654 files changed, 7526 insertions, 3430 deletions

diff --git a/Documentation/acpi/acpi-lid.txt b/Documentation/acpi/acpi-lid.txt
index 22cb3091f297..effe7af3a5af 100644
--- a/Documentation/acpi/acpi-lid.txt
+++ b/Documentation/acpi/acpi-lid.txt
@@ -59,20 +59,28 @@ button driver uses the following 3 modes in order not to trigger issues.
 If the userspace hasn't been prepared to ignore the unreliable "opened"
 events and the unreliable initial state notification, Linux users can use
 the following kernel parameters to handle the possible issues:
-A. button.lid_init_state=open:
+A. button.lid_init_state=method:
+   When this option is specified, the ACPI button driver reports the
+   initial lid state using the returning value of the _LID control method
+   and whether the "opened"/"closed" events are paired fully relies on the
+   firmware implementation.
+   This option can be used to fix some platforms where the returning value
+   of the _LID control method is reliable but the initial lid state
+   notification is missing.
+   This option is the default behavior during the period the userspace
+   isn't ready to handle the buggy AML tables.
+B. button.lid_init_state=open:
    When this option is specified, the ACPI button driver always reports the
    initial lid state as "opened" and whether the "opened"/"closed" events
    are paired fully relies on the firmware implementation.
    This may fix some platforms where the returning value of the _LID
    control method is not reliable and the initial lid state notification is
    missing.
-   This option is the default behavior during the period the userspace
-   isn't ready to handle the buggy AML tables.
 
 If the userspace has been prepared to ignore the unreliable "opened" events
 and the unreliable initial state notification, Linux users should always
 use the following kernel parameter:
-B. button.lid_init_state=ignore:
+C. button.lid_init_state=ignore:
    When this option is specified, the ACPI button driver never reports the
    initial lid state and there is a compensation mechanism implemented to
    ensure that the reliable "closed" notifications can always be delievered
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index 289c80f7760e..09aa2e949787 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -1,4 +1,5 @@
 .. |struct cpufreq_policy| replace:: :c:type:`struct cpufreq_policy <cpufreq_policy>`
+.. |intel_pstate| replace:: :doc:`intel_pstate <intel_pstate>`
 
 =======================
 CPU Performance Scaling
@@ -75,7 +76,7 @@ feedback registers, as that information is typically specific to the hardware
 interface it comes from and may not be easily represented in an abstract,
 platform-independent way.  For this reason, ``CPUFreq`` allows scaling drivers
 to bypass the governor layer and implement their own performance scaling
-algorithms.  That is done by the ``intel_pstate`` scaling driver.
+algorithms.  That is done by the |intel_pstate| scaling driver.
 
 
 ``CPUFreq`` Policy Objects
@@ -174,13 +175,13 @@ necessary to restart the scaling governor so that it can take the new online CPU
 into account.  That is achieved by invoking the governor's ``->stop`` and
 ``->start()`` callbacks, in this order, for the entire policy.
 
-As mentioned before, the ``intel_pstate`` scaling driver bypasses the scaling
+As mentioned before, the |intel_pstate| scaling driver bypasses the scaling
 governor layer of ``CPUFreq`` and provides its own P-state selection algorithms.
-Consequently, if ``intel_pstate`` is used, scaling governors are not attached to
+Consequently, if |intel_pstate| is used, scaling governors are not attached to
 new policy objects.  Instead, the driver's ``->setpolicy()`` callback is invoked
 to register per-CPU utilization update callbacks for each policy.  These
 callbacks are invoked by the CPU scheduler in the same way as for scaling
-governors, but in the ``intel_pstate`` case they both determine the P-state to
+governors, but in the |intel_pstate| case they both determine the P-state to
 use and change the hardware configuration accordingly in one go from scheduler
 context.
 
@@ -257,7 +258,7 @@ are the following:
 
 ``scaling_available_governors``
         List of ``CPUFreq`` scaling governors present in the kernel that can
-        be attached to this policy or (if the ``intel_pstate`` scaling driver is
+        be attached to this policy or (if the |intel_pstate| scaling driver is
         in use) list of scaling algorithms provided by the driver that can be
         applied to this policy.
 
@@ -274,7 +275,7 @@ are the following:
         the CPU is actually running at (due to hardware design and other
         limitations).
 
-        Some scaling drivers (e.g. ``intel_pstate``) attempt to provide
+        Some scaling drivers (e.g. |intel_pstate|) attempt to provide
         information more precisely reflecting the current CPU frequency through
         this attribute, but that still may not be the exact current CPU
         frequency as seen by the hardware at the moment.
@@ -284,13 +285,13 @@ are the following:
 
 ``scaling_governor``
         The scaling governor currently attached to this policy or (if the
-        ``intel_pstate`` scaling driver is in use) the scaling algorithm
+        |intel_pstate| scaling driver is in use) the scaling algorithm
         provided by the driver that is currently applied to this policy.
 
         This attribute is read-write and writing to it will cause a new scaling
         governor to be attached to this policy or a new scaling algorithm
         provided by the scaling driver to be applied to it (in the
-        ``intel_pstate`` case), as indicated by the string written to this
+        |intel_pstate| case), as indicated by the string written to this
         attribute (which must be one of the names listed by the
         ``scaling_available_governors`` attribute described above).
 
@@ -619,7 +620,7 @@ This file is located under :file:`/sys/devices/system/cpu/cpufreq/` and controls
 the "boost" setting for the whole system.  It is not present if the underlying
 scaling driver does not support the frequency boost mechanism (or supports it,
 but provides a driver-specific interface for controlling it, like
-``intel_pstate``).
+|intel_pstate|).
 
 If the value in this file is 1, the frequency boost mechanism is enabled.  This
 means that either the hardware can be put into states in which it is able to
diff --git a/Documentation/admin-guide/pm/index.rst b/Documentation/admin-guide/pm/index.rst
index c80f087321fc..7f148f76f432 100644
--- a/Documentation/admin-guide/pm/index.rst
+++ b/Documentation/admin-guide/pm/index.rst
@@ -6,6 +6,7 @@ Power Management
    :maxdepth: 2
 
    cpufreq
+   intel_pstate
 
 .. only::  subproject and html
 
diff --git a/Documentation/admin-guide/pm/intel_pstate.rst b/Documentation/admin-guide/pm/intel_pstate.rst
new file mode 100644
index 000000000000..33d703989ea8
--- /dev/null
+++ b/Documentation/admin-guide/pm/intel_pstate.rst
@@ -0,0 +1,755 @@
+===============================================
+``intel_pstate`` CPU Performance Scaling Driver
+===============================================
+
+::
+
+ Copyright (c) 2017 Intel Corp., Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+
+General Information
+===================
+
+``intel_pstate`` is a part of the
+:doc:`CPU performance scaling subsystem <cpufreq>` in the Linux kernel
+(``CPUFreq``).  It is a scaling driver for the Sandy Bridge and later
+generations of Intel processors.  Note, however, that some of those processors
+may not be supported.  [To understand ``intel_pstate`` it is necessary to know
+how ``CPUFreq`` works in general, so this is the time to read :doc:`cpufreq` if
+you have not done that yet.]
+
+For the processors supported by ``intel_pstate``, the P-state concept is broader
+than just an operating frequency or an operating performance point (see the
+`LinuxCon Europe 2015 presentation by Kristen Accardi <LCEU2015_>`_ for more
+information about that).  For this reason, the representation of P-states used
+by ``intel_pstate`` internally follows the hardware specification (for details
+refer to `Intel® 64 and IA-32 Architectures Software Developer’s Manual
+Volume 3: System Programming Guide <SDM_>`_).  However, the ``CPUFreq`` core
+uses frequencies for identifying operating performance points of CPUs and
+frequencies are involved in the user space interface exposed by it, so
+``intel_pstate`` maps its internal representation of P-states to frequencies too
+(fortunately, that mapping is unambiguous).  At the same time, it would not be
+practical for ``intel_pstate`` to supply the ``CPUFreq`` core with a table of
+available frequencies due to the possible size of it, so the driver does not do
+that.  Some functionality of the core is limited by that.
+
+Since the hardware P-state selection interface used by ``intel_pstate`` is
+available at the logical CPU level, the driver always works with individual
+CPUs.  Consequently, if ``intel_pstate`` is in use, every ``CPUFreq`` policy
+object corresponds to one logical CPU and ``CPUFreq`` policies are effectively
+equivalent to CPUs.  In particular, this means that they become "inactive" every
+time the corresponding CPU is taken offline and need to be re-initialized when
+it goes back online.
+
+``intel_pstate`` is not modular, so it cannot be unloaded, which means that the
+only way to pass early-configuration-time parameters to it is via the kernel
+command line.  However, its configuration can be adjusted via ``sysfs`` to a
+great extent.  In some configurations it even is possible to unregister it via
+``sysfs`` which allows another ``CPUFreq`` scaling driver to be loaded and
+registered (see `below <status_attr_>`_).
+
+
+Operation Modes
+===============
+
+``intel_pstate`` can operate in three different modes: in the active mode with
+or without hardware-managed P-states support and in the passive mode.  Which of
+them will be in effect depends on what kernel command line options are used and
+on the capabilities of the processor.
+
+Active Mode
+-----------
+
+This is the default operation mode of ``intel_pstate``.  If it works in this
+mode, the ``scaling_driver`` policy attribute in ``sysfs`` for all ``CPUFreq``
+policies contains the string "intel_pstate".
+
+In this mode the driver bypasses the scaling governors layer of ``CPUFreq`` and
+provides its own scaling algorithms for P-state selection.  Those algorithms
+can be applied to ``CPUFreq`` policies in the same way as generic scaling
+governors (that is, through the ``scaling_governor`` policy attribute in
+``sysfs``).  [Note that different P-state selection algorithms may be chosen for
+different policies, but that is not recommended.]
+
+They are not generic scaling governors, but their names are the same as the
+names of some of those governors.  Moreover, confusingly enough, they generally
+do not work in the same way as the generic governors they share the names with.
+For example, the ``powersave`` P-state selection algorithm provided by
+``intel_pstate`` is not a counterpart of the generic ``powersave`` governor
+(roughly, it corresponds to the ``schedutil`` and ``ondemand`` governors).
+
+There are two P-state selection algorithms provided by ``intel_pstate`` in the
+active mode: ``powersave`` and ``performance``.  The way they both operate
+depends on whether or not the hardware-managed P-states (HWP) feature has been
+enabled in the processor and possibly on the processor model.
+
+Which of the P-state selection algorithms is used by default depends on the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option.
+Namely, if that option is set, the ``performance`` algorithm will be used by
+default, and the other one will be used by default if it is not set.
+
+Active Mode With HWP
+~~~~~~~~~~~~~~~~~~~~
+
+If the processor supports the HWP feature, it will be enabled during the
+processor initialization and cannot be disabled after that.  It is possible
+to avoid enabling it by passing the ``intel_pstate=no_hwp`` argument to the
+kernel in the command line.
+
+If the HWP feature has been enabled, ``intel_pstate`` relies on the processor to
+select P-states by itself, but still it can give hints to the processor's
+internal P-state selection logic.  What those hints are depends on which P-state
+selection algorithm has been applied to the given policy (or to the CPU it
+corresponds to).
+
+Even though the P-state selection is carried out by the processor automatically,
+``intel_pstate`` registers utilization update callbacks with the CPU scheduler
+in this mode.  However, they are not used for running a P-state selection
+algorithm, but for periodic updates of the current CPU frequency information to
+be made available from the ``scaling_cur_freq`` policy attribute in ``sysfs``.
+
+HWP + ``performance``
+.....................
+
+In this configuration ``intel_pstate`` will write 0 to the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob (otherwise), which means that the processor's
+internal P-state selection logic is expected to focus entirely on performance.
+
+This will override the EPP/EPB setting coming from the ``sysfs`` interface
+(see `Energy vs Performance Hints`_ below).
+
+Also, in this configuration the range of P-states available to the processor's
+internal P-state selection logic is always restricted to the upper boundary
+(that is, the maximum P-state that the driver is allowed to use).
+
+HWP + ``powersave``
+...................
+
+In this configuration ``intel_pstate`` will set the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob (otherwise) to whatever value it was
+previously set to via ``sysfs`` (or whatever default value it was
+set to by the platform firmware).  This usually causes the processor's
+internal P-state selection logic to be less performance-focused.
+
+Active Mode Without HWP
+~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default operation mode for processors that do not support the HWP
+feature.  It also is used by default with the ``intel_pstate=no_hwp`` argument
+in the kernel command line.  However, in this mode ``intel_pstate`` may refuse
+to work with the given processor if it does not recognize it.  [Note that
+``intel_pstate`` will never refuse to work with any processor with the HWP
+feature enabled.]
+
+In this mode ``intel_pstate`` registers utilization update callbacks with the
+CPU scheduler in order to run a P-state selection algorithm, either
+``powersave`` or ``performance``, depending on the ``scaling_cur_freq`` policy
+setting in ``sysfs``.  The current CPU frequency information to be made
+available from the ``scaling_cur_freq`` policy attribute in ``sysfs`` is
+periodically updated by those utilization update callbacks too.
+
+``performance``
+...............
+
+Without HWP, this P-state selection algorithm is always the same regardless of
+the processor model and platform configuration.
+
+It selects the maximum P-state it is allowed to use, subject to limits set via
+``sysfs``, every time the P-state selection computations are carried out by the
+driver's utilization update callback for the given CPU (that does not happen
+more often than every 10 ms), but the hardware configuration will not be changed
+if the new P-state is the same as the current one.
+
+This is the default P-state selection algorithm if the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option
+is set.
+
+``powersave``
+.............
+
+Without HWP, this P-state selection algorithm generally depends on the
+processor model and/or the system profile setting in the ACPI tables and there
+are two variants of it.
+
+One of them is used with processors from the Atom line and (regardless of the
+processor model) on platforms with the system profile in the ACPI tables set to
+"mobile" (laptops mostly), "tablet", "appliance PC", "desktop", or
+"workstation".  It is also used with processors supporting the HWP feature if
+that feature has not been enabled (that is, with the ``intel_pstate=no_hwp``
+argument in the kernel command line).  It is similar to the algorithm
+implemented by the generic ``schedutil`` scaling governor except that the
+utilization metric used by it is based on numbers coming from feedback
+registers of the CPU.  It generally selects P-states proportional to the
+current CPU utilization, so it is referred to as the "proportional" algorithm.
+
+The second variant of the ``powersave`` P-state selection algorithm, used in all
+of the other cases (generally, on processors from the Core line, so it is
+referred to as the "Core" algorithm), is based on the values read from the APERF
+and MPERF feedback registers and the previously requested target P-state.
+It does not really take CPU utilization into account explicitly, but as a rule
+it causes the CPU P-state to ramp up very quickly in response to increased
+utilization which is generally desirable in server environments.
+
+Regardless of the variant, this algorithm is run by the driver's utilization
+update callback for the given CPU when it is invoked by the CPU scheduler, but
+not more often than every 10 ms (that can be tweaked via ``debugfs`` in `this
+particular case <Tuning Interface in debugfs_>`_).  Like in the ``performance``
+case, the hardware configuration is not touched if the new P-state turns out to
+be the same as the current one.
+
+This is the default P-state selection algorithm if the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option
+is not set.
+
+Passive Mode
+------------
+
+This mode is used if the ``intel_pstate=passive`` argument is passed to the
+kernel in the command line (it implies the ``intel_pstate=no_hwp`` setting too).
+Like in the active mode without HWP support, in this mode ``intel_pstate`` may
+refuse to work with the given processor if it does not recognize it.
+
+If the driver works in this mode, the ``scaling_driver`` policy attribute in
+``sysfs`` for all ``CPUFreq`` policies contains the string "intel_cpufreq".
+Then, the driver behaves like a regular ``CPUFreq`` scaling driver.  That is,
+it is invoked by generic scaling governors when necessary to talk to the
+hardware in order to change the P-state of a CPU (in particular, the
+``schedutil`` governor can invoke it directly from scheduler context).
+
+While in this mode, ``intel_pstate`` can be used with all of the (generic)
+scaling governors listed by the ``scaling_available_governors`` policy attribute
+in ``sysfs`` (and the P-state selection algorithms described above are not
+used).  Then, it is responsible for the configuration of policy objects
+corresponding to CPUs and provides the ``CPUFreq`` core (and the scaling
+governors attached to the policy objects) with accurate information on the
+maximum and minimum operating frequencies supported by the hardware (including
+the so-called "turbo" frequency ranges).  In other words, in the passive mode
+the entire range of available P-states is exposed by ``intel_pstate`` to the
+``CPUFreq`` core.  However, in this mode the driver does not register
+utilization update callbacks with the CPU scheduler and the ``scaling_cur_freq``
+information comes from the ``CPUFreq`` core (and is the last frequency selected
+by the current scaling governor for the given policy).
+
+
+.. _turbo:
+
+Turbo P-states Support
+======================
+
+In the majority of cases, the entire range of P-states available to
+``intel_pstate`` can be divided into two sub-ranges that correspond to
+different types of processor behavior, above and below a boundary that
+will be referred to as the "turbo threshold" in what follows.
+
+The P-states above the turbo threshold are referred to as "turbo P-states" and
+the whole sub-range of P-states they belong to is referred to as the "turbo
+range".  These names are related to the Turbo Boost technology allowing a
+multicore processor to opportunistically increase the P-state of one or more
+cores if there is enough power to do that and if that is not going to cause the
+thermal envelope of the processor package to be exceeded.
+
+Specifically, if software sets the P-state of a CPU core within the turbo range
+(that is, above the turbo threshold), the processor is permitted to take over
+performance scaling control for that core and put it into turbo P-states of its
+choice going forward.  However, that permission is interpreted differently by
+different processor generations.  Namely, the Sandy Bridge generation of
+processors will never use any P-states above the last one set by software for
+the given core, even if it is within the turbo range, whereas all of the later
+processor generations will take it as a license to use any P-states from the
+turbo range, even above the one set by software.  In other words, on those
+processors setting any P-state from the turbo range will enable the processor
+to put the given core into all turbo P-states up to and including the maximum
+supported one as it sees fit.
+
+One important property of turbo P-states is that they are not sustainable.  More
+precisely, there is no guarantee that any CPUs will be able to stay in any of
+those states indefinitely, because the power distribution within the processor
+package may change over time  or the thermal envelope it was designed for might
+be exceeded if a turbo P-state was used for too long.
+
+In turn, the P-states below the turbo threshold generally are sustainable.  In
+fact, if one of them is set by software, the processor is not expected to change
+it to a lower one unless in a thermal stress or a power limit violation
+situation (a higher P-state may still be used if it is set for another CPU in
+the same package at the same time, for example).
+
+Some processors allow multiple cores to be in turbo P-states at the same time,
+but the maximum P-state that can be set for them generally depends on the number
+of cores running concurrently.  The maximum turbo P-state that can be set for 3
+cores at the same time usually is lower than the analogous maximum P-state for
+2 cores, which in turn usually is lower than the maximum turbo P-state that can
+be set for 1 core.  The one-core maximum turbo P-state is thus the maximum
+supported one overall.
+
+The maximum supported turbo P-state, the turbo threshold (the maximum supported
+non-turbo P-state) and the minimum supported P-state are specific to the
+processor model and can be determined by reading the processor's model-specific
+registers (MSRs).  Moreover, some processors support the Configurable TDP
+(Thermal Design Power) feature and, when that feature is enabled, the turbo
+threshold effectively becomes a configurable value that can be set by the
+platform firmware.
+
+Unlike ``_PSS`` objects in the ACPI tables, ``intel_pstate`` always exposes
+the entire range of available P-states, including the whole turbo range, to the
+``CPUFreq`` core and (in the passive mode) to generic scaling governors.  This
+generally causes turbo P-states to be set more often when ``intel_pstate`` is
+used relative to ACPI-based CPU performance scaling (see `below <acpi-cpufreq_>`_
+for more information).
+
+Moreover, since ``intel_pstate`` always knows what the real turbo threshold is
+(even if the Configurable TDP feature is enabled in the processor), its
+``no_turbo`` attribute in ``sysfs`` (described `below <no_turbo_attr_>`_) should
+work as expected in all cases (that is, if set to disable turbo P-states, it
+always should prevent ``intel_pstate`` from using them).
+
+
+Processor Support
+=================
+
+To handle a given processor ``intel_pstate`` requires a number of different
+pieces of information on it to be known, including:
+
+ * The minimum supported P-state.
+
+ * The maximum supported `non-turbo P-state <turbo_>`_.
+
+ * Whether or not turbo P-states are supported at all.
+
+ * The maximum supported `one-core turbo P-state <turbo_>`_ (if turbo P-states
+   are supported).
+
+ * The scaling formula to translate the driver's internal representation
+   of P-states into frequencies and the other way around.
+
+Generally, ways to obtain that information are specific to the processor model
+or family.  Although it often is possible to obtain all of it from the processor
+itself (using model-specific registers), there are cases in which hardware
+manuals need to be consulted to get to it too.
+
+For this reason, there is a list of supported processors in ``intel_pstate`` and
+the driver initialization will fail if the detected processor is not in that
+list, unless it supports the `HWP feature <Active Mode_>`_.  [The interface to
+obtain all of the information listed above is the same for all of the processors
+supporting the HWP feature, which is why they all are supported by
+``intel_pstate``.]
+
+
+User Space Interface in ``sysfs``
+=================================
+
+Global Attributes
+-----------------
+
+``intel_pstate`` exposes several global attributes (files) in ``sysfs`` to
+control its functionality at the system level.  They are located in the
+``/sys/devices/system/cpu/cpufreq/intel_pstate/`` directory and affect all
+CPUs.
+
+Some of them are not present if the ``intel_pstate=per_cpu_perf_limits``
+argument is passed to the kernel in the command line.
+
+``max_perf_pct``
+        Maximum P-state the driver is allowed to set in percent of the
+        maximum supported performance level (the highest supported `turbo
+        P-state <turbo_>`_).
+
+        This attribute will not be exposed if the
+        ``intel_pstate=per_cpu_perf_limits`` argument is present in the kernel
+        command line.
+
+``min_perf_pct``
+        Minimum P-state the driver is allowed to set in percent of the
+        maximum supported performance level (the highest supported `turbo
+        P-state <turbo_>`_).
+
+        This attribute will not be exposed if the
+        ``intel_pstate=per_cpu_perf_limits`` argument is present in the kernel
+        command line.
+
+``num_pstates``
+        Number of P-states supported by the processor (between 0 and 255
+        inclusive) including both turbo and non-turbo P-states (see
+        `Turbo P-states Support`_).
+
+        The value of this attribute is not affected by the ``no_turbo``
+        setting described `below <no_turbo_attr_>`_.
+
+        This attribute is read-only.
+
+``turbo_pct``
+        Ratio of the `turbo range <turbo_>`_ size to the size of the entire
+        range of supported P-states, in percent.
+
+        This attribute is read-only.
+
+.. _no_turbo_attr:
+
+``no_turbo``
+        If set (equal to 1), the driver is not allowed to set any turbo P-states
+        (see `Turbo P-states Support`_).  If unset (equalt to 0, which is the
+        default), turbo P-states can be set by the driver.
+        [Note that ``intel_pstate`` does not support the general ``boost``
+        attribute (supported by some other scaling drivers) which is replaced
+        by this one.]
+
+        This attrubute does not affect the maximum supported frequency value
+        supplied to the ``CPUFreq`` core and exposed via the policy interface,
+        but it affects the maximum possible value of per-policy P-state limits
+        (see `Interpretation of Policy Attributes`_ below for details).
+
+.. _status_attr:
+
+``status``
+        Operation mode of the driver: "active", "passive" or "off".
+
+        "active"
+                The driver is functional and in the `active mode
+                <Active Mode_>`_.
+
+        "passive"
+                The driver is functional and in the `passive mode
+                <Passive Mode_>`_.
+
+        "off"
+                The driver is not functional (it is not registered as a scaling
+                driver with the ``CPUFreq`` core).
+
+        This attribute can be written to in order to change the driver's
+        operation mode or to unregister it.  The string written to it must be
+        one of the possible values of it and, if successful, the write will
+        cause the driver to switch over to the operation mode represented by
+        that string - or to be unregistered in the "off" case.  [Actually,
+        switching over from the active mode to the passive mode or the other
+        way around causes the driver to be unregistered and registered again
+        with a different set of callbacks, so all of its settings (the global
+        as well as the per-policy ones) are then reset to their default
+        values, possibly depending on the target operation mode.]
+
+        That only is supported in some configurations, though (for example, if
+        the `HWP feature is enabled in the processor <Active Mode With HWP_>`_,
+        the operation mode of the driver cannot be changed), and if it is not
+        supported in the current configuration, writes to this attribute with
+        fail with an appropriate error.
+
+Interpretation of Policy Attributes
+-----------------------------------
+
+The interpretation of some ``CPUFreq`` policy attributes described in
+:doc:`cpufreq` is special with ``intel_pstate`` as the current scaling driver
+and it generally depends on the driver's `operation mode <Operation Modes_>`_.
+
+First of all, the values of the ``cpuinfo_max_freq``, ``cpuinfo_min_freq`` and
+``scaling_cur_freq`` attributes are produced by applying a processor-specific
+multiplier to the internal P-state representation used by ``intel_pstate``.
+Also, the values of the ``scaling_max_freq`` and ``scaling_min_freq``
+attributes are capped by the frequency corresponding to the maximum P-state that
+the driver is allowed to set.
+
+If the ``no_turbo`` `global attribute <no_turbo_attr_>`_ is set, the driver is
+not allowed to use turbo P-states, so the maximum value of ``scaling_max_freq``
+and ``scaling_min_freq`` is limited to the maximum non-turbo P-state frequency.
+Accordingly, setting ``no_turbo`` causes ``scaling_max_freq`` and
+``scaling_min_freq`` to go down to that value if they were above it before.
+However, the old values of ``scaling_max_freq`` and ``scaling_min_freq`` will be
+restored after unsetting ``no_turbo``, unless these attributes have been written
+to after ``no_turbo`` was set.
+
+If ``no_turbo`` is not set, the maximum possible value of ``scaling_max_freq``
+and ``scaling_min_freq`` corresponds to the maximum supported turbo P-state,
+which also is the value of ``cpuinfo_max_freq`` in either case.
+
+Next, the following policy attributes have special meaning if
+``intel_pstate`` works in the `active mode <Active Mode_>`_:
+
+``scaling_available_governors``
+        List of P-state selection algorithms provided by ``intel_pstate``.
+
+``scaling_governor``
+        P-state selection algorithm provided by ``intel_pstate`` currently in
+        use with the given policy.
+
+``scaling_cur_freq``
+        Frequency of the average P-state of the CPU represented by the given
+        policy for the time interval between the last two invocations of the
+        driver's utilization update callback by the CPU scheduler for that CPU.
+
+The meaning of these attributes in the `passive mode <Passive Mode_>`_ is the
+same as for other scaling drivers.
+
+Additionally, the value of the ``scaling_driver`` attribute for ``intel_pstate``
+depends on the operation mode of the driver.  Namely, it is either
+"intel_pstate" (in the `active mode <Active Mode_>`_) or "intel_cpufreq" (in the
+`passive mode <Passive Mode_>`_).
+
+Coordination of P-State Limits
+------------------------------
+
+``intel_pstate`` allows P-state limits to be set in two ways: with the help of
+the ``max_perf_pct`` and ``min_perf_pct`` `global attributes
+<Global Attributes_>`_ or via the ``scaling_max_freq`` and ``scaling_min_freq``
+``CPUFreq`` policy attributes.  The coordination between those limits is based
+on the following rules, regardless of the current operation mode of the driver:
+
+ 1. All CPUs are affected by the global limits (that is, none of them can be
+    requested to run faster than the global maximum and none of them can be
+    requested to run slower than the global minimum).
+
+ 2. Each individual CPU is affected by its own per-policy limits (that is, it
+    cannot be requested to run faster than its own per-policy maximum and it
+    cannot be requested to run slower than its own per-policy minimum).
+
+ 3. The global and per-policy limits can be set independently.
+
+If the `HWP feature is enabled in the processor <Active Mode With HWP_>`_, the
+resulting effective values are written into its registers whenever the limits
+change in order to request its internal P-state selection logic to always set
+P-states within these limits.  Otherwise, the limits are taken into account by
+scaling governors (in the `passive mode <Passive Mode_>`_) and by the driver
+every time before setting a new P-state for a CPU.
+
+Additionally, if the ``intel_pstate=per_cpu_perf_limits`` command line argument
+is passed to the kernel, ``max_perf_pct`` and ``min_perf_pct`` are not exposed
+at all and the only way to set the limits is by using the policy attributes.
+
+
+Energy vs Performance Hints
+---------------------------
+
+If ``intel_pstate`` works in the `active mode with the HWP feature enabled
+<Active Mode With HWP_>`_ in the processor, additional attributes are present
+in every ``CPUFreq`` policy directory in ``sysfs``.  They are intended to allow
+user space to help ``intel_pstate`` to adjust the processor's internal P-state
+selection logic by focusing it on performance or on energy-efficiency, or
+somewhere between the two extremes:
+
+``energy_performance_preference``
+        Current value of the energy vs performance hint for the given policy
+        (or the CPU represented by it).
+
+        The hint can be changed by writing to this attribute.
+
+``energy_performance_available_preferences``
+        List of strings that can be written to the
+        ``energy_performance_preference`` attribute.
+
+        They represent different energy vs performance hints and should be
+        self-explanatory, except that ``default`` represents whatever hint
+        value was set by the platform firmware.
+
+Strings written to the ``energy_performance_preference`` attribute are
+internally translated to integer values written to the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob.
+
+[Note that tasks may by migrated from one CPU to another by the scheduler's
+load-balancing algorithm and if different energy vs performance hints are
+set for those CPUs, that may lead to undesirable outcomes.  To avoid such
+issues it is better to set the same energy vs performance hint for all CPUs
+or to pin every task potentially sensitive to them to a specific CPU.]
+
+.. _acpi-cpufreq:
+
+``intel_pstate`` vs ``acpi-cpufreq``
+====================================
+
+On the majority of systems supported by ``intel_pstate``, the ACPI tables
+provided by the platform firmware contain ``_PSS`` objects returning information
+that can be used for CPU performance scaling (refer to the `ACPI specification`_
+for details on the ``_PSS`` objects and the format of the information returned
+by them).
+
+The information returned by the ACPI ``_PSS`` objects is used by the
+``acpi-cpufreq`` scaling driver.  On systems supported by ``intel_pstate``
+the ``acpi-cpufreq`` driver uses the same hardware CPU performance scaling
+interface, but the set of P-states it can use is limited by the ``_PSS``
+output.
+
+On those systems each ``_PSS`` object returns a list of P-states supported by
+the corresponding CPU which basically is a subset of the P-states range that can
+be used by ``intel_pstate`` on the same system, with one exception: the whole
+`turbo range <turbo_>`_ is represented by one item in it (the topmost one).  By
+convention, the frequency returned by ``_PSS`` for that item is greater by 1 MHz
+than the frequency of the highest non-turbo P-state listed by it, but the
+corresponding P-state representation (following the hardware specification)
+returned for it matches the maximum supported turbo P-state (or is the
+special value 255 meaning essentially "go as high as you can get").
+
+The list of P-states returned by ``_PSS`` is reflected by the table of
+available frequencies supplied by ``acpi-cpufreq`` to the ``CPUFreq`` core and
+scaling governors and the minimum and maximum supported frequencies reported by
+it come from that list as well.  In particular, given the special representation
+of the turbo range described above, this means that the maximum supported
+frequency reported by ``acpi-cpufreq`` is higher by 1 MHz than the frequency
+of the highest supported non-turbo P-state listed by ``_PSS`` which, of course,
+affects decisions made by the scaling governors, except for ``powersave`` and
+``performance``.
+
+For example, if a given governor attempts to select a frequency proportional to
+estimated CPU load and maps the load of 100% to the maximum supported frequency
+(possibly multiplied by a constant), then it will tend to choose P-states below
+the turbo threshold if ``acpi-cpufreq`` is used as the scaling driver, because
+in that case the turbo range corresponds to a small fraction of the frequency
+band it can use (1 MHz vs 1 GHz or more).  In consequence, it will only go to
+the turbo range for the highest loads and the other loads above 50% that might
+benefit from running at turbo frequencies will be given non-turbo P-states
+instead.
+
+One more issue related to that may appear on systems supporting the
+`Configurable TDP feature <turbo_>`_ allowing the platform firmware to set the
+turbo threshold.  Namely, if that is not coordinated with the lists of P-states
+returned by ``_PSS`` properly, there may be more than one item corresponding to
+a turbo P-state in those lists and there may be a problem with avoiding the
+turbo range (if desirable or necessary).  Usually, to avoid using turbo
+P-states overall, ``acpi-cpufreq`` simply avoids using the topmost state listed
+by ``_PSS``, but that is not sufficient when there are other turbo P-states in
+the list returned by it.
+
+Apart from the above, ``acpi-cpufreq`` works like ``intel_pstate`` in the
+`passive mode <Passive Mode_>`_, except that the number of P-states it can set
+is limited to the ones listed by the ACPI ``_PSS`` objects.
+
+
+Kernel Command Line Options for ``intel_pstate``
+================================================
+
+Several kernel command line options can be used to pass early-configuration-time
+parameters to ``intel_pstate`` in order to enforce specific behavior of it.  All
+of them have to be prepended with the ``intel_pstate=`` prefix.
+
+``disable``
+        Do not register ``intel_pstate`` as the scaling driver even if the
+        processor is supported by it.
+
+``passive``
+        Register ``intel_pstate`` in the `passive mode <Passive Mode_>`_ to
+        start with.
+
+        This option implies the ``no_hwp`` one described below.
+
+``force``
+        Register ``intel_pstate`` as the scaling driver instead of
+        ``acpi-cpufreq`` even if the latter is preferred on the given system.
+
+        This may prevent some platform features (such as thermal controls and
+        power capping) that rely on the availability of ACPI P-states
+        information from functioning as expected, so it should be used with
+        caution.
+
+        This option does not work with processors that are not supported by
+        ``intel_pstate`` and on platforms where the ``pcc-cpufreq`` scaling
+        driver is used instead of ``acpi-cpufreq``.
+
+``no_hwp``
+        Do not enable the `hardware-managed P-states (HWP) feature
+        <Active Mode With HWP_>`_ even if it is supported by the processor.
+
+``hwp_only``
+        Register ``intel_pstate`` as the scaling driver only if the
+        `hardware-managed P-states (HWP) feature <Active Mode With HWP_>`_ is
+        supported by the processor.
+
+``support_acpi_ppc``
+        Take ACPI ``_PPC`` performance limits into account.
+
+        If the preferred power management profile in the FADT (Fixed ACPI
+        Description Table) is set to "Enterprise Server" or "Performance
+        Server", the ACPI ``_PPC`` limits are taken into account by default
+        and this option has no effect.
+
+``per_cpu_perf_limits``
+        Use per-logical-CPU P-State limits (see `Coordination of P-state
+        Limits`_ for details).
+
+
+Diagnostics and Tuning
+======================
+
+Trace Events
+------------
+
+There are two static trace events that can be used for ``intel_pstate``
+diagnostics.  One of them is the ``cpu_frequency`` trace event generally used
+by ``CPUFreq``, and the other one is the ``pstate_sample`` trace event specific
+to ``intel_pstate``.  Both of them are triggered by ``intel_pstate`` only if
+it works in the `active mode <Active Mode_>`_.
+
+The following sequence of shell commands can be used to enable them and see
+their output (if the kernel is generally configured to support event tracing)::
+
+ # cd /sys/kernel/debug/tracing/
+ # echo 1 > events/power/pstate_sample/enable
+ # echo 1 > events/power/cpu_frequency/enable
+ # cat trace
+ gnome-terminal--4510  [001] ..s.  1177.680733: pstate_sample: core_busy=107 scaled=94 from=26 to=26 mperf=1143818 aperf=1230607 tsc=29838618 freq=2474476
+ cat-5235  [002] ..s.  1177.681723: cpu_frequency: state=2900000 cpu_id=2
+
+If ``intel_pstate`` works in the `passive mode <Passive Mode_>`_, the
+``cpu_frequency`` trace event will be triggered either by the ``schedutil``
+scaling governor (for the policies it is attached to), or by the ``CPUFreq``
+core (for the policies with other scaling governors).
+
+``ftrace``
+----------
+
+The ``ftrace`` interface can be used for low-level diagnostics of
+``intel_pstate``.  For example, to check how often the function to set a
+P-state is called, the ``ftrace`` filter can be set to to
+:c:func:`intel_pstate_set_pstate`::
+
+ # cd /sys/kernel/debug/tracing/
+ # cat available_filter_functions | grep -i pstate
+ intel_pstate_set_pstate
+ intel_pstate_cpu_init
+ ...
+ # echo intel_pstate_set_pstate > set_ftrace_filter
+ # echo function > current_tracer
+ # cat trace | head -15
+ # tracer: function
+ #
+ # entries-in-buffer/entries-written: 80/80   #P:4
+ #
+ #                              _-----=> irqs-off
+ #                             / _----=> need-resched
+ #                            | / _---=> hardirq/softirq
+ #                            || / _--=> preempt-depth
+ #                            ||| /     delay
+ #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
+ #              | |       |   ||||       |         |
+             Xorg-3129  [000] ..s.  2537.644844: intel_pstate_set_pstate <-intel_pstate_timer_func
+  gnome-terminal--4510  [002] ..s.  2537.649844: intel_pstate_set_pstate <-intel_pstate_timer_func
+      gnome-shell-3409  [001] ..s.  2537.650850: intel_pstate_set_pstate <-intel_pstate_timer_func
+           <idle>-0     [000] ..s.  2537.654843: intel_pstate_set_pstate <-intel_pstate_timer_func
+
+Tuning Interface in ``debugfs``
+-------------------------------
+
+The ``powersave`` algorithm provided by ``intel_pstate`` for `the Core line of
+processors in the active mode <powersave_>`_ is based on a `PID controller`_
+whose parameters were chosen to address a number of different use cases at the
+same time.  However, it still is possible to fine-tune it to a specific workload
+and the ``debugfs`` interface under ``/sys/kernel/debug/pstate_snb/`` is
+provided for this purpose.  [Note that the ``pstate_snb`` directory will be
+present only if the specific P-state selection algorithm matching the interface
+in it actually is in use.]
+
+The following files present in that directory can be used to modify the PID
+controller parameters at run time:
+
+| ``deadband``
+| ``d_gain_pct``
+| ``i_gain_pct``
+| ``p_gain_pct``
+| ``sample_rate_ms``
+| ``setpoint``
+
+Note, however, that achieving desirable results this way generally requires
+expert-level understanding of the power vs performance tradeoff, so extra care
+is recommended when attempting to do that.
+
+
+.. _LCEU2015: http://events.linuxfoundation.org/sites/events/files/slides/LinuxConEurope_2015.pdf
+.. _SDM: http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-system-programming-manual-325384.html
+.. _ACPI specification: http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
+.. _PID controller: https://en.wikipedia.org/wiki/PID_controller
diff --git a/Documentation/cpu-freq/intel-pstate.txt b/Documentation/cpu-freq/intel-pstate.txt
deleted file mode 100644
index 3fdcdfd968ba..000000000000
--- a/Documentation/cpu-freq/intel-pstate.txt
+++ /dev/null
@@ -1,281 +0,0 @@
-Intel P-State driver
---------------------
-
-This driver provides an interface to control the P-State selection for the
-SandyBridge+ Intel processors.
-
-The following document explains P-States:
-http://events.linuxfoundation.org/sites/events/files/slides/LinuxConEurope_2015.pdf
-As stated in the document, P-State doesn’t exactly mean a frequency. However, for
-the sake of the relationship with cpufreq, P-State and frequency are used
-interchangeably.
-
-Understanding the cpufreq core governors and policies are important before
-discussing more details about the Intel P-State driver. Based on what callbacks
-a cpufreq driver provides to the cpufreq core, it can support two types of
-drivers:
-- with target_index() callback: In this mode, the drivers using cpufreq core
-simply provide the minimum and maximum frequency limits and an additional
-interface target_index() to set the current frequency. The cpufreq subsystem
-has a number of scaling governors ("performance", "powersave", "ondemand",
-etc.). Depending on which governor is in use, cpufreq core will call for
-transitions to a specific frequency using target_index() callback.
-- setpolicy() callback: In this mode, drivers do not provide target_index()
-callback, so cpufreq core can't request a transition to a specific frequency.
-The driver provides minimum and maximum frequency limits and callbacks to set a
-policy. The policy in cpufreq sysfs is referred to as the "scaling governor".
-The cpufreq core can request the driver to operate in any of the two policies:
-"performance" and "powersave". The driver decides which frequency to use based
-on the above policy selection considering minimum and maximum frequency limits.
-
-The Intel P-State driver falls under the latter category, which implements the
-setpolicy() callback. This driver decides what P-State to use based on the
-requested policy from the cpufreq core. If the processor is capable of
-selecting its next P-State internally, then the driver will offload this
-responsibility to the processor (aka HWP: Hardware P-States). If not, the
-driver implements algorithms to select the next P-State.
-
-Since these policies are implemented in the driver, they are not same as the
-cpufreq scaling governors implementation, even if they have the same name in
-the cpufreq sysfs (scaling_governors). For example the "performance" policy is
-similar to cpufreq’s "performance" governor, but "powersave" is completely
-different than the cpufreq "powersave" governor. The strategy here is similar
-to cpufreq "ondemand", where the requested P-State is related to the system load.
-
-Sysfs Interface
-
-In addition to the frequency-controlling interfaces provided by the cpufreq
-core, the driver provides its own sysfs files to control the P-State selection.
-These files have been added to /sys/devices/system/cpu/intel_pstate/.
-Any changes made to these files are applicable to all CPUs (even in a
-multi-package system, Refer to later section on placing "Per-CPU limits").
-
-      max_perf_pct: Limits the maximum P-State that will be requested by
-      the driver. It states it as a percentage of the available performance. The
-      available (P-State) performance may be reduced by the no_turbo
-      setting described below.
-
-      min_perf_pct: Limits the minimum P-State that will be requested by
-      the driver. It states it as a percentage of the max (non-turbo)
-      performance level.
-
-      no_turbo: Limits the driver to selecting P-State below the turbo
-      frequency range.
-
-      turbo_pct: Displays the percentage of the total performance that
-      is supported by hardware that is in the turbo range. This number
-      is independent of whether turbo has been disabled or not.
-
-      num_pstates: Displays the number of P-States that are supported
-      by hardware. This number is independent of whether turbo has
-      been disabled or not.
-
-For example, if a system has these parameters:
-        Max 1 core turbo ratio: 0x21 (Max 1 core ratio is the maximum P-State)
-        Max non turbo ratio: 0x17
-        Minimum ratio : 0x08 (Here the ratio is called max efficiency ratio)
-
-Sysfs will show :
-        max_perf_pct:100, which corresponds to 1 core ratio
-        min_perf_pct:24, max_efficiency_ratio / max 1 Core ratio
-        no_turbo:0, turbo is not disabled
-        num_pstates:26 = (max 1 Core ratio - Max Efficiency Ratio + 1)
-        turbo_pct:39 = (max 1 core ratio - max non turbo ratio) / num_pstates
-
-Refer to "Intel® 64 and IA-32 Architectures Software Developer’s Manual
-Volume 3: System Programming Guide" to understand ratios.
-
-There is one more sysfs attribute in /sys/devices/system/cpu/intel_pstate/
-that can be used for controlling the operation mode of the driver:
-
-      status: Three settings are possible:
-      "off"     - The driver is not in use at this time.
-      "active"  - The driver works as a P-state governor (default).
-      "passive" - The driver works as a regular cpufreq one and collaborates
-                  with the generic cpufreq governors (it sets P-states as
-                  requested by those governors).
-      The current setting is returned by reads from this attribute.  Writing one
-      of the above strings to it changes the operation mode as indicated by that
-      string, if possible.  If HW-managed P-states (HWP) are enabled, it is not
-      possible to change the driver's operation mode and attempts to write to
-      this attribute will fail.
-
-cpufreq sysfs for Intel P-State
-
-Since this driver registers with cpufreq, cpufreq sysfs is also presented.
-There are some important differences, which need to be considered.
-
-scaling_cur_freq: This displays the real frequency which was used during
-the last sample period instead of what is requested. Some other cpufreq driver,
-like acpi-cpufreq, displays what is requested (Some changes are on the
-way to fix this for acpi-cpufreq driver). The same is true for frequencies
-displayed at /proc/cpuinfo.
-
-scaling_governor: This displays current active policy. Since each CPU has a
-cpufreq sysfs, it is possible to set a scaling governor to each CPU. But this
-is not possible with Intel P-States, as there is one common policy for all
-CPUs. Here, the last requested policy will be applicable to all CPUs. It is
-suggested that one use the cpupower utility to change policy to all CPUs at the
-same time.
-
-scaling_setspeed: This attribute can never be used with Intel P-State.
-
-scaling_max_freq/scaling_min_freq: This interface can be used similarly to
-the max_perf_pct/min_perf_pct of Intel P-State sysfs. However since frequencies
-are converted to nearest possible P-State, this is prone to rounding errors.
-This method is not preferred to limit performance.
-
-affected_cpus: Not used
-related_cpus: Not used
-
-For contemporary Intel processors, the frequency is controlled by the
-processor itself and the P-State exposed to software is related to
-performance levels.  The idea that frequency can be set to a single
-frequency is fictional for Intel Core processors. Even if the scaling
-driver selects a single P-State, the actual frequency the processor
-will run at is selected by the processor itself.
-
-Per-CPU limits
-
-The kernel command line option "intel_pstate=per_cpu_perf_limits" forces
-the intel_pstate driver to use per-CPU performance limits.  When it is set,
-the sysfs control interface described above is subject to limitations.
-- The following controls are not available for both read and write
-        /sys/devices/system/cpu/intel_pstate/max_perf_pct
-        /sys/devices/system/cpu/intel_pstate/min_perf_pct
-- The following controls can be used to set performance limits, as far as the
-architecture of the processor permits:
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_max_freq
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_min_freq
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
-- User can still observe turbo percent and number of P-States from
-        /sys/devices/system/cpu/intel_pstate/turbo_pct
-        /sys/devices/system/cpu/intel_pstate/num_pstates
-- User can read write system wide turbo status
-        /sys/devices/system/cpu/no_turbo
-
-Support of energy performance hints
-It is possible to provide hints to the HWP algorithms in the processor
-to be more performance centric to more energy centric. When the driver
-is using HWP, two additional cpufreq sysfs attributes are presented for
-each logical CPU.
-These attributes are:
-        - energy_performance_available_preferences
-        - energy_performance_preference
-
-To get list of supported hints:
-$ cat energy_performance_available_preferences
-    default performance balance_performance balance_power power
-
-The current preference can be read or changed via cpufreq sysfs
-attribute "energy_performance_preference". Reading from this attribute
-will display current effective setting. User can write any of the valid
-preference string to this attribute. User can always restore to power-on
-default by writing "default".
-
-Since threads can migrate to different CPUs, this is possible that the
-new CPU may have different energy performance preference than the previous
-one. To avoid such issues, either threads can be pinned to specific CPUs
-or set the same energy performance preference value to all CPUs.
-
-Tuning Intel P-State driver
-
-When the performance can be tuned using PID (Proportional Integral
-Derivative) controller, debugfs files are provided for adjusting performance.
-They are presented under:
-/sys/kernel/debug/pstate_snb/
-
-The PID tunable parameters are:
-      deadband
-      d_gain_pct
-      i_gain_pct
-      p_gain_pct
-      sample_rate_ms
-      setpoint
-
-To adjust these parameters, some understanding of driver implementation is
-necessary. There are some tweeks described here, but be very careful. Adjusting
-them requires expert level understanding of power and performance relationship.
-These limits are only useful when the "powersave" policy is active.
-
--To make the system more responsive to load changes, sample_rate_ms can
-be adjusted  (current default is 10ms).
--To make the system use higher performance, even if the load is lower, setpoint
-can be adjusted to a lower number. This will also lead to faster ramp up time
-to reach the maximum P-State.
-If there are no derivative and integral coefficients, The next P-State will be
-equal to:
-        current P-State - ((setpoint - current cpu load) * p_gain_pct)
-
-For example, if the current PID parameters are (Which are defaults for the core
-processors like SandyBridge):
-      deadband = 0
-      d_gain_pct = 0
-      i_gain_pct = 0
-      p_gain_pct = 20
-      sample_rate_ms = 10
-      setpoint = 97
-
-If the current P-State = 0x08 and current load = 100, this will result in the
-next P-State = 0x08 - ((97 - 100) * 0.2) = 8.6 (rounded to 9). Here the P-State
-goes up by only 1. If during next sample interval the current load doesn't
-change and still 100, then P-State goes up by one again. This process will
-continue as long as the load is more than the setpoint until the maximum P-State
-is reached.
-
-For the same load at setpoint = 60, this will result in the next P-State
-= 0x08 - ((60 - 100) * 0.2) = 16
-So by changing the setpoint from 97 to 60, there is an increase of the
-next P-State from 9 to 16. So this will make processor execute at higher
-P-State for the same CPU load. If the load continues to be more than the
-setpoint during next sample intervals, then P-State will go up again till the
-maximum P-State is reached. But the ramp up time to reach the maximum P-State
-will be much faster when the setpoint is 60 compared to 97.
-
-Debugging Intel P-State driver
-
-Event tracing
-To debug P-State transition, the Linux event tracing interface can be used.
-There are two specific events, which can be enabled (Provided the kernel
-configs related to event tracing are enabled).
-
-# cd /sys/kernel/debug/tracing/
-# echo 1 > events/power/pstate_sample/enable
-# echo 1 > events/power/cpu_frequency/enable
-# cat trace
-gnome-terminal--4510  [001] ..s.  1177.680733: pstate_sample: core_busy=107
-        scaled=94 from=26 to=26 mperf=1143818 aperf=1230607 tsc=29838618
-                freq=2474476
-cat-5235  [002] ..s.  1177.681723: cpu_frequency: state=2900000 cpu_id=2
-
-
-Using ftrace
-
-If function level tracing is required, the Linux ftrace interface can be used.
-For example if we want to check how often a function to set a P-State is
-called, we can set ftrace filter to intel_pstate_set_pstate.
-
-# cd /sys/kernel/debug/tracing/
-# cat available_filter_functions | grep -i pstate
-intel_pstate_set_pstate
-intel_pstate_cpu_init
-...
-
-# echo intel_pstate_set_pstate > set_ftrace_filter
-# echo function > current_tracer
-# cat trace | head -15
-# tracer: function
-#
-# entries-in-buffer/entries-written: 80/80   #P:4
-#
-#                              _-----=> irqs-off
-#                             / _----=> need-resched
-#                            | / _---=> hardirq/softirq
-#                            || / _--=> preempt-depth
-#                            ||| /     delay
-#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
-#              | |       |   ||||       |         |
-            Xorg-3129  [000] ..s.  2537.644844: intel_pstate_set_pstate <-intel_pstate_timer_func
- gnome-terminal--4510  [002] ..s.  2537.649844: intel_pstate_set_pstate <-intel_pstate_timer_func
-     gnome-shell-3409  [001] ..s.  2537.650850: intel_pstate_set_pstate <-intel_pstate_timer_func
-          <idle>-0     [000] ..s.  2537.654843: intel_pstate_set_pstate <-intel_pstate_timer_func
diff --git a/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt b/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
index 6db22103e2dd..025cf8c9324a 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
+++ b/Documentation/devicetree/bindings/input/touchscreen/edt-ft5x06.txt
@@ -36,7 +36,7 @@ Optional properties:
                 control gpios
 
  - threshold:   allows setting the "click"-threshold in the range
-                from 20 to 80.
+                from 0 to 80.
 
  - gain:        allows setting the sensitivity in the range from 0 to
                 31. Note that lower values indicate higher
diff --git a/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt b/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
index 05485699d70e..9630ac0e4b56 100644
--- a/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
+++ b/Documentation/devicetree/bindings/mfd/hisilicon,hi655x.txt
@@ -16,6 +16,11 @@ Required properties:
 - reg:                  Base address of PMIC on Hi6220 SoC.
 - interrupt-controller: Hi655x has internal IRQs (has own IRQ domain).
 - pmic-gpios:           The GPIO used by PMIC IRQ.
+- #clock-cells:         From common clock binding; shall be set to 0
+
+Optional properties:
+- clock-output-names: From common clock binding to override the
+  default output clock name
 
 Example:
         pmic: pmic@f8000000 {
@@ -24,4 +29,5 @@ Example:
                 interrupt-controller;
                 #interrupt-cells = <2>;
                 pmic-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+                #clock-cells = <0>;
         }
diff --git a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
index e25436861867..9029b45b8a22 100644
--- a/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
+++ b/Documentation/devicetree/bindings/mmc/mmc-pwrseq-simple.txt
@@ -18,6 +18,8 @@ Optional properties:
   "ext_clock" (External clock provided to the card).
 - post-power-on-delay-ms : Delay in ms after powering the card and
         de-asserting the reset-gpios (if any)
+- power-off-delay-us : Delay in us after asserting the reset-gpios (if any)
+        during power off of the card.
 
 Example:
 
diff --git a/Documentation/devicetree/bindings/net/fsl-fec.txt b/Documentation/devicetree/bindings/net/fsl-fec.txt
index a1e3693cca16..6f55bdd52f8a 100644
--- a/Documentation/devicetree/bindings/net/fsl-fec.txt
+++ b/Documentation/devicetree/bindings/net/fsl-fec.txt
@@ -15,6 +15,10 @@ Optional properties:
 - phy-reset-active-high : If present then the reset sequence using the GPIO
   specified in the "phy-reset-gpios" property is reversed (H=reset state,
   L=operation state).
+- phy-reset-post-delay : Post reset delay in milliseconds. If present then
+  a delay of phy-reset-post-delay milliseconds will be observed after the
+  phy-reset-gpios has been toggled. Can be omitted thus no delay is
+  observed. Delay is in range of 1ms to 1000ms. Other delays are invalid.
 - phy-supply : regulator that powers the Ethernet PHY.
 - phy-handle : phandle to the PHY device connected to this device.
 - fixed-link : Assume a fixed link. See fixed-link.txt in the same directory.
diff --git a/Documentation/devicetree/bindings/staging/ion/hi6220-ion.txt b/Documentation/devicetree/bindings/staging/ion/hi6220-ion.txt
deleted file mode 100644
index c59e27c632c1..000000000000
--- a/Documentation/devicetree/bindings/staging/ion/hi6220-ion.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-Hi6220 SoC ION
-===================================================================
-Required properties:
-- compatible : "hisilicon,hi6220-ion"
-- list of the ION heaps
-        - heap name : maybe heap_sys_user@0
-        - heap id   : id should be unique in the system.
-        - heap base : base ddr address of the heap,0 means that
-        it is dynamic.
-        - heap size : memory size and 0 means it is dynamic.
-        - heap type : the heap type of the heap, please also
-        see the define in ion.h(drivers/staging/android/uapi/ion.h)
--------------------------------------------------------------------
-Example:
-        hi6220-ion {
-                compatible = "hisilicon,hi6220-ion";
-                heap_sys_user@0 {
-                        heap-name = "sys_user";
-                        heap-id   = <0x0>;
-                        heap-base = <0x0>;
-                        heap-size = <0x0>;
-                        heap-type = "ion_system";
-                };
-                heap_sys_contig@0 {
-                        heap-name = "sys_contig";
-                        heap-id   = <0x1>;
-                        heap-base = <0x0>;
-                        heap-size = <0x0>;
-                        heap-type = "ion_system_contig";
-                };
-        };
diff --git a/Documentation/input/devices/edt-ft5x06.rst b/Documentation/input/devices/edt-ft5x06.rst
index 2032f0b7a8fa..1ccc94b192b7 100644
--- a/Documentation/input/devices/edt-ft5x06.rst
+++ b/Documentation/input/devices/edt-ft5x06.rst
@@ -15,7 +15,7 @@ It has been tested with the following devices:
 The driver allows configuration of the touch screen via a set of sysfs files:
 
 /sys/class/input/eventX/device/device/threshold:
-    allows setting the "click"-threshold in the range from 20 to 80.
+    allows setting the "click"-threshold in the range from 0 to 80.
 
 /sys/class/input/eventX/device/device/gain:
     allows setting the sensitivity in the range from 0 to 31. Note that
diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst
index 5338673c88d9..773d2bfacc6c 100644
--- a/Documentation/sound/hd-audio/models.rst
+++ b/Documentation/sound/hd-audio/models.rst
@@ -16,6 +16,8 @@ ALC880
     6-jack in back, 2-jack in front
 6stack-digout
     6-jack with a SPDIF out
+6stack-automute
+    6-jack with headphone jack detection
 
 ALC260
 ======
@@ -62,6 +64,8 @@ lenovo-dock
     Enables docking station I/O for some Lenovos
 hp-gpio-led
     GPIO LED support on HP laptops
+hp-dock-gpio-mic1-led
+    HP dock with mic LED support
 dell-headset-multi
     Headset jack, which can also be used as mic-in
 dell-headset-dock
@@ -72,6 +76,12 @@ alc283-sense-combo
     Combo jack sensing on ALC283
 tpt440-dock
     Pin configs for Lenovo Thinkpad Dock support
+tpt440
+    Lenovo Thinkpad T440s setup
+tpt460
+    Lenovo Thinkpad T460/560 setup
+dual-codecs
+    Lenovo laptops with dual codecs
 
 ALC66x/67x/892
 ==============
@@ -97,6 +107,8 @@ inv-dmic
     Inverted internal mic workaround
 dell-headset-multi
     Headset jack, which can also be used as mic-in
+dual-codecs
+    Lenovo laptops with dual codecs
 
 ALC680
 ======
@@ -114,6 +126,8 @@ inv-dmic
     Inverted internal mic workaround
 no-primary-hp
     VAIO Z/VGC-LN51JGB workaround (for fixed speaker DAC)
+dual-codecs
+    ALC1220 dual codecs for Gaming mobos
 
 ALC861/660
 ==========
@@ -206,65 +220,47 @@ auto
 
 Conexant 5045
 =============
-laptop-hpsense
-    Laptop with HP sense (old model laptop)
-laptop-micsense
-    Laptop with Mic sense (old model fujitsu)
-laptop-hpmicsense
-    Laptop with HP and Mic senses
-benq
-    Benq R55E
-laptop-hp530
-    HP 530 laptop
-test
-    for testing/debugging purpose, almost all controls can be
-    adjusted.  Appearing only when compiled with $CONFIG_SND_DEBUG=y
+cap-mix-amp
+    Fix max input level on mixer widget
+toshiba-p105
+    Toshiba P105 quirk
+hp-530
+    HP 530 quirk
 
 Conexant 5047
 =============
-laptop
-    Basic Laptop config 
-laptop-hp
-    Laptop config for some HP models (subdevice 30A5)
-laptop-eapd
-    Laptop config with EAPD support
-test
-    for testing/debugging purpose, almost all controls can be
-    adjusted.  Appearing only when compiled with $CONFIG_SND_DEBUG=y
+cap-mix-amp
+    Fix max input level on mixer widget
 
 Conexant 5051
 =============
-laptop
-    Basic Laptop config (default)
-hp
-    HP Spartan laptop
-hp-dv6736
-    HP dv6736
-hp-f700
-    HP Compaq Presario F700
-ideapad
-    Lenovo IdeaPad laptop
-toshiba
-    Toshiba Satellite M300
+lenovo-x200
+    Lenovo X200 quirk
 
 Conexant 5066
 =============
-laptop
-    Basic Laptop config (default)
-hp-laptop
-    HP laptops, e g G60
-asus
-    Asus K52JU, Lenovo G560
-dell-laptop
-    Dell laptops
-dell-vostro
-    Dell Vostro
-olpc-xo-1_5
-    OLPC XO 1.5
-ideapad
-    Lenovo IdeaPad U150
+stereo-dmic
+    Workaround for inverted stereo digital mic
+gpio1
+    Enable GPIO1 pin
+headphone-mic-pin
+    Enable headphone mic NID 0x18 without detection
+tp410
+    Thinkpad T400 & co quirks
 thinkpad
-    Lenovo Thinkpad
+    Thinkpad mute/mic LED quirk
+lemote-a1004
+    Lemote A1004 quirk
+lemote-a1205
+    Lemote A1205 quirk
+olpc-xo
+    OLPC XO quirk
+mute-led-eapd
+    Mute LED control via EAPD
+hp-dock
+    HP dock support
+mute-led-gpio
+    Mute LED control via GPIO
 
 STAC9200
 ========
@@ -444,6 +440,8 @@ dell-eq
     Dell desktops/laptops
 alienware
     Alienware M17x
+asus-mobo
+    Pin configs for ASUS mobo with 5.1/SPDIF out
 auto
     BIOS setup (default)
 
@@ -477,6 +475,8 @@ hp-envy-ts-bass
     Pin fixup for HP Envy TS bass speaker (NID 0x10)
 hp-bnb13-eq
     Hardware equalizer setup for HP laptops
+hp-envy-ts-bass
+    HP Envy TS bass support
 auto
     BIOS setup (default)
 
@@ -496,10 +496,22 @@ auto
 
 Cirrus Logic CS4206/4207
 ========================
+mbp53
+    MacBook Pro 5,3
 mbp55
     MacBook Pro 5,5
 imac27
     IMac 27 Inch
+imac27_122
+    iMac 12,2
+apple
+    Generic Apple quirk
+mbp101
+    MacBookPro 10,1
+mbp81
+    MacBookPro 8,1
+mba42
+    MacBookAir 4,2
 auto
     BIOS setup (default)
 
@@ -509,6 +521,10 @@ mba6
     MacBook Air 6,1 and 6,2
 gpio0
     Enable GPIO 0 amp
+mbp11
+    MacBookPro 11,2
+macmini
+    MacMini 7,1
 auto
     BIOS setup (default)
 
diff --git a/Documentation/usb/typec.rst b/Documentation/usb/typec.rst
index b67a46779de9..8a7249f2ff04 100644
--- a/Documentation/usb/typec.rst
+++ b/Documentation/usb/typec.rst
@@ -114,8 +114,7 @@ the details during registration. The class offers the following API for
 registering/unregistering cables and their plugs:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_register_cable typec_unregister_cable typec_register_plug
-   typec_unregister_plug
+   :functions: typec_register_cable typec_unregister_cable typec_register_plug typec_unregister_plug
 
 The class will provide a handle to struct typec_cable and struct typec_plug if
 the registration is successful, or NULL if it isn't.
@@ -137,8 +136,7 @@ during connection of a partner or cable, the port driver must use the following
 APIs to report it to the class:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role
-   typec_set_pwr_opmode
+   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role typec_set_pwr_opmode
 
 Alternate Modes
 ~~~~~~~~~~~~~~~
diff --git a/Documentation/watchdog/watchdog-parameters.txt b/Documentation/watchdog/watchdog-parameters.txt
index 4f7d86dd0a5d..914518aeb972 100644
--- a/Documentation/watchdog/watchdog-parameters.txt
+++ b/Documentation/watchdog/watchdog-parameters.txt
@@ -117,7 +117,7 @@ nowayout: Watchdog cannot be stopped once started
 -------------------------------------------------
 iTCO_wdt:
 heartbeat: Watchdog heartbeat in seconds.
-        (2<heartbeat<39 (TCO v1) or 613 (TCO v2), default=30)
+        (5<=heartbeat<=74 (TCO v1) or 1226 (TCO v2), default=30)
 nowayout: Watchdog cannot be stopped once started
         (default=kernel config parameter)
 -------------------------------------------------
diff --git a/MAINTAINERS b/MAINTAINERS
index f7d568b8f133..053c3bdd1fe5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -846,7 +846,6 @@ M:	Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
 S:      Supported
-F:      Documentation/devicetree/bindings/staging/ion/
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
 F:      drivers/staging/android/uapi/ion_test.h
@@ -3116,6 +3115,14 @@ F:	drivers/net/ieee802154/cc2520.c
 F:      include/linux/spi/cc2520.h
 F:      Documentation/devicetree/bindings/net/ieee802154/cc2520.txt
 
+CCREE ARM TRUSTZONE CRYPTOCELL 700 REE DRIVER
+M:      Gilad Ben-Yossef <gilad@benyossef.com>
+L:      linux-crypto@vger.kernel.org
+L:      driverdev-devel@linuxdriverproject.org
+S:      Supported
+F:      drivers/staging/ccree/
+W:      https://developer.arm.com/products/system-ip/trustzone-cryptocell/cryptocell-700-family
+
 CEC FRAMEWORK
 M:      Hans Verkuil <hans.verkuil@cisco.com>
 L:      linux-media@vger.kernel.org
@@ -5695,7 +5702,7 @@ M:	Alex Elder <elder@kernel.org>
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 S:      Maintained
 F:      drivers/staging/greybus/
-L:      greybus-dev@lists.linaro.org
+L:      greybus-dev@lists.linaro.org (moderated for non-subscribers)
 
 GREYBUS AUDIO PROTOCOLS DRIVERS
 M:      Vaibhav Agarwal <vaibhav.sr@gmail.com>
@@ -7136,7 +7143,7 @@ S:	Maintained
 F:      drivers/media/platform/rcar_jpu.c
 
 JSM Neo PCI based serial card
-M:      Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+M:      Guilherme G. Piccoli <gpiccoli@linux.vnet.ibm.com>
 L:      linux-serial@vger.kernel.org
 S:      Maintained
 F:      drivers/tty/serial/jsm/
@@ -9553,10 +9560,6 @@ F:	drivers/net/wireless/intersil/orinoco/
 
 OSD LIBRARY and FILESYSTEM
 M:      Boaz Harrosh <ooo@electrozaur.com>
-M:      Benny Halevy <bhalevy@primarydata.com>
-L:      osd-dev@open-osd.org
-W:      http://open-osd.org
-T:      git git://git.open-osd.org/open-osd.git
 S:      Maintained
 F:      drivers/scsi/osd/
 F:      include/scsi/osd_*
diff --git a/Makefile b/Makefile
index b400c0604fac..470bd4d9513a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
@@ -1172,7 +1172,7 @@ headers_check_all: headers_install_all
 PHONY += headers_check
 headers_check: headers_install
         $(Q)$(MAKE) $(hdr-inst)=include/uapi HDRCHECK=1
-        $(Q)$(MAKE) $(hdr-inst)=arch/$(hdr-arch)/include/uapi/ $(hdr-dst) HDRCHECK=1
+        $(Q)$(MAKE) $(hdr-inst)=arch/$(hdr-arch)/include/uapi $(hdr-dst) HDRCHECK=1
 
 # ---------------------------------------------------------------------------
 # Kernel selftest
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 9ec56dc97374..ce93124a850b 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1201,8 +1201,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
         if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
                 return -EFAULT;
 
-        err = 0;
-        err |= put_user(status, ustatus);
+        err = put_user(status, ustatus);
+        if (ret < 0)
+                return err ? err : ret;
+
         err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
         err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
         err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
diff --git a/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi b/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
index 12c981e51134..9a0599f711ff 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
@@ -1,6 +1,6 @@
 / {
         aliases {
-                ethernet = &ethernet;
+                ethernet0 = &ethernet;
         };
 };
 
diff --git a/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi b/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
index 3f0a56ebcf1f..dc7ae776db5f 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
@@ -1,6 +1,6 @@
 / {
         aliases {
-                ethernet = &ethernet;
+                ethernet0 = &ethernet;
         };
 };
 
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 35cea3fcaf5c..561f27d8d922 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -198,8 +198,8 @@
                                 brcm,pins = <0 1>;
                                 brcm,function = <BCM2835_FSEL_ALT0>;
                         };
-                        i2c0_gpio32: i2c0_gpio32 {
-                                brcm,pins = <32 34>;
+                        i2c0_gpio28: i2c0_gpio28 {
+                                brcm,pins = <28 29>;
                                 brcm,function = <BCM2835_FSEL_ALT0>;
                         };
                         i2c0_gpio44: i2c0_gpio44 {
@@ -295,20 +295,28 @@
                         /* Separate from the uart0_gpio14 group
                          * because it conflicts with spi1_gpio16, and
                          * people often run uart0 on the two pins
-                         * without flow contrl.
+                         * without flow control.
                          */
                         uart0_ctsrts_gpio16: uart0_ctsrts_gpio16 {
                                 brcm,pins = <16 17>;
                                 brcm,function = <BCM2835_FSEL_ALT3>;
                         };
-                        uart0_gpio30: uart0_gpio30 {
+                        uart0_ctsrts_gpio30: uart0_ctsrts_gpio30 {
                                 brcm,pins = <30 31>;
                                 brcm,function = <BCM2835_FSEL_ALT3>;
                         };
-                        uart0_ctsrts_gpio32: uart0_ctsrts_gpio32 {
+                        uart0_gpio32: uart0_gpio32 {
                                 brcm,pins = <32 33>;
                                 brcm,function = <BCM2835_FSEL_ALT3>;
                         };
+                        uart0_gpio36: uart0_gpio36 {
+                                brcm,pins = <36 37>;
+                                brcm,function = <BCM2835_FSEL_ALT2>;
+                        };
+                        uart0_ctsrts_gpio38: uart0_ctsrts_gpio38 {
+                                brcm,pins = <38 39>;
+                                brcm,function = <BCM2835_FSEL_ALT2>;
+                        };
 
                         uart1_gpio14: uart1_gpio14 {
                                 brcm,pins = <14 15>;
@@ -326,10 +334,6 @@
                                 brcm,pins = <30 31>;
                                 brcm,function = <BCM2835_FSEL_ALT5>;
                         };
-                        uart1_gpio36: uart1_gpio36 {
-                                brcm,pins = <36 37 38 39>;
-                                brcm,function = <BCM2835_FSEL_ALT2>;
-                        };
                         uart1_gpio40: uart1_gpio40 {
                                 brcm,pins = <40 41>;
                                 brcm,function = <BCM2835_FSEL_ALT5>;
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 4bc4b575c99b..31a9e061ddd0 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -204,6 +204,8 @@
         tps659038: tps659038@58 {
                 compatible = "ti,tps659038";
                 reg = <0x58>;
+                ti,palmas-override-powerhold;
+                ti,system-power-controller;
 
                 tps659038_pmic {
                         compatible = "ti,tps659038-pmic";
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 57892f264cea..e7144662af45 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -2017,4 +2017,8 @@
         coefficients = <0 2000>;
 };
 
+&cpu_crit {
+        temperature = <120000>; /* milli Celsius */
+};
+
 /include/ "dra7xx-clocks.dtsi"
diff --git a/arch/arm/boot/dts/imx53-qsrb.dts b/arch/arm/boot/dts/imx53-qsrb.dts
index de2215832372..4e103a905dc9 100644
--- a/arch/arm/boot/dts/imx53-qsrb.dts
+++ b/arch/arm/boot/dts/imx53-qsrb.dts
@@ -23,7 +23,7 @@
         imx53-qsrb {
                 pinctrl_pmic: pmicgrp {
                         fsl,pins = <
-                                MX53_PAD_CSI0_DAT5__GPIO5_23    0x1e4 /* IRQ */
+                                MX53_PAD_CSI0_DAT5__GPIO5_23    0x1c4 /* IRQ */
                         >;
                 };
         };
diff --git a/arch/arm/boot/dts/imx6sx-sdb.dts b/arch/arm/boot/dts/imx6sx-sdb.dts
index 5bb8fd57e7f5..d71da30c9cff 100644
--- a/arch/arm/boot/dts/imx6sx-sdb.dts
+++ b/arch/arm/boot/dts/imx6sx-sdb.dts
@@ -12,23 +12,6 @@
         model = "Freescale i.MX6 SoloX SDB RevB Board";
 };
 
-&cpu0 {
-        operating-points = <
-                /* kHz    uV */
-                996000  1250000
-                792000  1175000
-                396000  1175000
-                198000  1175000
-                >;
-        fsl,soc-operating-points = <
-                /* ARM kHz      SOC uV */
-                996000  1250000
-                792000  1175000
-                396000  1175000
-                198000  1175000
-        >;
-};
-
 &i2c1 {
         clock-frequency = <100000>;
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/include/arm b/arch/arm/boot/dts/include/arm
deleted file mode 120000
index a96aa0ea9d8c..000000000000
--- a/arch/arm/boot/dts/include/arm
+++ /dev/null
@@ -1 +0,0 @@
-..
\ No newline at end of file
diff --git a/arch/arm/boot/dts/include/arm64 b/arch/arm/boot/dts/include/arm64
deleted file mode 120000
index 074a835fca3e..000000000000
--- a/arch/arm/boot/dts/include/arm64
+++ /dev/null
@@ -1 +0,0 @@
-../../../../arm64/boot/dts
\ No newline at end of file
diff --git a/arch/arm/boot/dts/include/dt-bindings b/arch/arm/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/arm/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
index 08cce17a25a0..43e9364083de 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
@@ -249,9 +249,9 @@
                         OMAP3_CORE1_IOPAD(0x2110, PIN_INPUT | MUX_MODE0)   /* cam_xclka.cam_xclka */
                         OMAP3_CORE1_IOPAD(0x2112, PIN_INPUT | MUX_MODE0)   /* cam_pclk.cam_pclk */
 
-                        OMAP3_CORE1_IOPAD(0x2114, PIN_INPUT | MUX_MODE0)   /* cam_d0.cam_d0 */
-                        OMAP3_CORE1_IOPAD(0x2116, PIN_INPUT | MUX_MODE0)   /* cam_d1.cam_d1 */
-                        OMAP3_CORE1_IOPAD(0x2118, PIN_INPUT | MUX_MODE0)   /* cam_d2.cam_d2 */
+                        OMAP3_CORE1_IOPAD(0x2116, PIN_INPUT | MUX_MODE0)   /* cam_d0.cam_d0 */
+                        OMAP3_CORE1_IOPAD(0x2118, PIN_INPUT | MUX_MODE0)   /* cam_d1.cam_d1 */
+                        OMAP3_CORE1_IOPAD(0x211a, PIN_INPUT | MUX_MODE0)   /* cam_d2.cam_d2 */
                         OMAP3_CORE1_IOPAD(0x211c, PIN_INPUT | MUX_MODE0)   /* cam_d3.cam_d3 */
                         OMAP3_CORE1_IOPAD(0x211e, PIN_INPUT | MUX_MODE0)   /* cam_d4.cam_d4 */
                         OMAP3_CORE1_IOPAD(0x2120, PIN_INPUT | MUX_MODE0)   /* cam_d5.cam_d5 */
diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi
index 402579ab70d2..3a9e9b6aea68 100644
--- a/arch/arm/boot/dts/mt7623.dtsi
+++ b/arch/arm/boot/dts/mt7623.dtsi
@@ -72,6 +72,8 @@
                              <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>,
                              <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>,
                              <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+                clock-frequency = <13000000>;
+                arm,cpu-registers-not-fw-configured;
         };
 
         watchdog: watchdog@10007000 {
diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index b3a8b1f24499..9ec737069369 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -55,7 +55,8 @@
                 simple-audio-card,bitclock-master = <&telephony_link_master>;
                 simple-audio-card,frame-master = <&telephony_link_master>;
                 simple-audio-card,format = "i2s";
-
+                simple-audio-card,bitclock-inversion;
+                simple-audio-card,frame-inversion;
                 simple-audio-card,cpu {
                         sound-dai = <&mcbsp4>;
                 };
diff --git a/arch/arm/boot/dts/omap4-panda-a4.dts b/arch/arm/boot/dts/omap4-panda-a4.dts
index 78d363177762..f1a6476af371 100644
--- a/arch/arm/boot/dts/omap4-panda-a4.dts
+++ b/arch/arm/boot/dts/omap4-panda-a4.dts
@@ -13,7 +13,7 @@
 /* Pandaboard Rev A4+ have external pullups on SCL & SDA */
 &dss_hdmi_pins {
         pinctrl-single,pins = <
-                OMAP4_IOPAD(0x09a, PIN_INPUT_PULLUP | MUX_MODE0)        /* hdmi_cec.hdmi_cec */
+                OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0)               /* hdmi_cec.hdmi_cec */
                 OMAP4_IOPAD(0x09c, PIN_INPUT | MUX_MODE0)               /* hdmi_scl.hdmi_scl */
                 OMAP4_IOPAD(0x09e, PIN_INPUT | MUX_MODE0)               /* hdmi_sda.hdmi_sda */
                 >;
diff --git a/arch/arm/boot/dts/omap4-panda-es.dts b/arch/arm/boot/dts/omap4-panda-es.dts
index 119f8e657edc..940fe4f7c5f6 100644
--- a/arch/arm/boot/dts/omap4-panda-es.dts
+++ b/arch/arm/boot/dts/omap4-panda-es.dts
@@ -34,7 +34,7 @@
 /* PandaboardES has external pullups on SCL & SDA */
 &dss_hdmi_pins {
         pinctrl-single,pins = <
-                OMAP4_IOPAD(0x09a, PIN_INPUT_PULLUP | MUX_MODE0)        /* hdmi_cec.hdmi_cec */
+                OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0)               /* hdmi_cec.hdmi_cec */
                 OMAP4_IOPAD(0x09c, PIN_INPUT | MUX_MODE0)               /* hdmi_scl.hdmi_scl */
                 OMAP4_IOPAD(0x09e, PIN_INPUT | MUX_MODE0)               /* hdmi_sda.hdmi_sda */
                 >;
diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig
new file mode 100644
index 000000000000..d2d75fa664a6
--- /dev/null
+++ b/arch/arm/configs/gemini_defconfig
@@ -0,0 +1,68 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_USER_NS=y
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_ARCH_MULTI_V4=y
+# CONFIG_ARCH_MULTI_V7 is not set
+CONFIG_ARCH_GEMINI=y
+CONFIG_PCI=y
+CONFIG_PREEMPT=y
+CONFIG_AEABI=y
+CONFIG_CMDLINE="console=ttyS0,115200n8"
+CONFIG_KEXEC=y
+CONFIG_BINFMT_MISC=y
+CONFIG_PM=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_MTD=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=16384
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+# CONFIG_SCSI_LOWLEVEL is not set
+CONFIG_ATA=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_GPIO=y
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=1
+CONFIG_SERIAL_OF_PLATFORM=y
+# CONFIG_HW_RANDOM is not set
+# CONFIG_HWMON is not set
+CONFIG_WATCHDOG=y
+CONFIG_GEMINI_WATCHDOG=y
+CONFIG_USB=y
+CONFIG_USB_MON=y
+CONFIG_USB_FOTG210_HCD=y
+CONFIG_USB_STORAGE=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_GEMINI=y
+CONFIG_DMADEVICES=y
+# CONFIG_DNOTIFY is not set
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ROMFS_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_DEBUG_FS=y
diff --git a/arch/arm/include/asm/kvm_coproc.h b/arch/arm/include/asm/kvm_coproc.h
index 4917c2f7e459..e74ab0fbab79 100644
--- a/arch/arm/include/asm/kvm_coproc.h
+++ b/arch/arm/include/asm/kvm_coproc.h
@@ -31,7 +31,8 @@ void kvm_register_target_coproc_table(struct kvm_coproc_target_table *table);
 int kvm_handle_cp10_id(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp_0_13_access(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp14_load_store(struct kvm_vcpu *vcpu, struct kvm_run *run);
-int kvm_handle_cp14_access(struct kvm_vcpu *vcpu, struct kvm_run *run);
+int kvm_handle_cp14_32(struct kvm_vcpu *vcpu, struct kvm_run *run);
+int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run);
 
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 2c14b69511e9..6d1d2e26dfe5 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -32,6 +32,7 @@
 #include <asm/vfp.h>
 #include "../vfp/vfpinstr.h"
 
+#define CREATE_TRACE_POINTS
 #include "trace.h"
 #include "coproc.h"
 
@@ -111,12 +112,6 @@ int kvm_handle_cp14_load_store(struct kvm_vcpu *vcpu, struct kvm_run *run)
         return 1;
 }
 
-int kvm_handle_cp14_access(struct kvm_vcpu *vcpu, struct kvm_run *run)
-{
-        kvm_inject_undefined(vcpu);
-        return 1;
-}
-
 static void reset_mpidr(struct kvm_vcpu *vcpu, const struct coproc_reg *r)
 {
         /*
@@ -284,7 +279,7 @@ static bool access_gic_sre(struct kvm_vcpu *vcpu,
  * must always support PMCCNTR (the cycle counter): we just RAZ/WI for
  * all PM registers, which doesn't crash the guest kernel at least.
  */
-static bool pm_fake(struct kvm_vcpu *vcpu,
+static bool trap_raz_wi(struct kvm_vcpu *vcpu,
                     const struct coproc_params *p,
                     const struct coproc_reg *r)
 {
@@ -294,19 +289,19 @@ static bool pm_fake(struct kvm_vcpu *vcpu,
                 return read_zero(vcpu, p);
 }
 
-#define access_pmcr pm_fake
-#define access_pmcntenset pm_fake
-#define access_pmcntenclr pm_fake
-#define access_pmovsr pm_fake
-#define access_pmselr pm_fake
-#define access_pmceid0 pm_fake
-#define access_pmceid1 pm_fake
-#define access_pmccntr pm_fake
-#define access_pmxevtyper pm_fake
-#define access_pmxevcntr pm_fake
-#define access_pmuserenr pm_fake
-#define access_pmintenset pm_fake
-#define access_pmintenclr pm_fake
+#define access_pmcr trap_raz_wi
+#define access_pmcntenset trap_raz_wi
+#define access_pmcntenclr trap_raz_wi
+#define access_pmovsr trap_raz_wi
+#define access_pmselr trap_raz_wi
+#define access_pmceid0 trap_raz_wi
+#define access_pmceid1 trap_raz_wi
+#define access_pmccntr trap_raz_wi
+#define access_pmxevtyper trap_raz_wi
+#define access_pmxevcntr trap_raz_wi
+#define access_pmuserenr trap_raz_wi
+#define access_pmintenset trap_raz_wi
+#define access_pmintenclr trap_raz_wi
 
 /* Architected CP15 registers.
  * CRn denotes the primary register number, but is copied to the CRm in the
@@ -532,12 +527,7 @@ static int emulate_cp15(struct kvm_vcpu *vcpu,
         return 1;
 }
 
-/**
- * kvm_handle_cp15_64 -- handles a mrrc/mcrr trap on a guest CP15 access
- * @vcpu: The VCPU pointer
- * @run:  The kvm_run struct
- */
-int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+static struct coproc_params decode_64bit_hsr(struct kvm_vcpu *vcpu)
 {
         struct coproc_params params;
 
@@ -551,9 +541,38 @@ int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
         params.Rt2 = (kvm_vcpu_get_hsr(vcpu) >> 10) & 0xf;
         params.CRm = 0;
 
+        return params;
+}
+
+/**
+ * kvm_handle_cp15_64 -- handles a mrrc/mcrr trap on a guest CP15 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_64bit_hsr(vcpu);
+
         return emulate_cp15(vcpu, &params);
 }
 
+/**
+ * kvm_handle_cp14_64 -- handles a mrrc/mcrr trap on a guest CP14 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_64bit_hsr(vcpu);
+
+        /* raz_wi cp14 */
+        trap_raz_wi(vcpu, &params, NULL);
+
+        /* handled */
+        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+        return 1;
+}
+
 static void reset_coproc_regs(struct kvm_vcpu *vcpu,
                               const struct coproc_reg *table, size_t num)
 {
@@ -564,12 +583,7 @@ static void reset_coproc_regs(struct kvm_vcpu *vcpu,
                         table[i].reset(vcpu, &table[i]);
 }
 
-/**
- * kvm_handle_cp15_32 -- handles a mrc/mcr trap on a guest CP15 access
- * @vcpu: The VCPU pointer
- * @run:  The kvm_run struct
- */
-int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
+static struct coproc_params decode_32bit_hsr(struct kvm_vcpu *vcpu)
 {
         struct coproc_params params;
 
@@ -583,9 +597,37 @@ int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
         params.Op2 = (kvm_vcpu_get_hsr(vcpu) >> 17) & 0x7;
         params.Rt2 = 0;
 
+        return params;
+}
+
+/**
+ * kvm_handle_cp15_32 -- handles a mrc/mcr trap on a guest CP15 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_32bit_hsr(vcpu);
         return emulate_cp15(vcpu, &params);
 }
 
+/**
+ * kvm_handle_cp14_32 -- handles a mrc/mcr trap on a guest CP14 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp14_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_32bit_hsr(vcpu);
+
+        /* raz_wi cp14 */
+        trap_raz_wi(vcpu, &params, NULL);
+
+        /* handled */
+        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+        return 1;
+}
+
 /******************************************************************************
  * Userspace API
  *****************************************************************************/
diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c
index 5fd7968cdae9..f86a9aaef462 100644
--- a/arch/arm/kvm/handle_exit.c
+++ b/arch/arm/kvm/handle_exit.c
@@ -95,9 +95,9 @@ static exit_handle_fn arm_exit_handlers[] = {
         [HSR_EC_WFI]            = kvm_handle_wfx,
         [HSR_EC_CP15_32]        = kvm_handle_cp15_32,
         [HSR_EC_CP15_64]        = kvm_handle_cp15_64,
-        [HSR_EC_CP14_MR]        = kvm_handle_cp14_access,
+        [HSR_EC_CP14_MR]        = kvm_handle_cp14_32,
         [HSR_EC_CP14_LS]        = kvm_handle_cp14_load_store,
-        [HSR_EC_CP14_64]        = kvm_handle_cp14_access,
+        [HSR_EC_CP14_64]        = kvm_handle_cp14_64,
         [HSR_EC_CP_0_13]        = kvm_handle_cp_0_13_access,
         [HSR_EC_CP10_ID]        = kvm_handle_cp10_id,
         [HSR_EC_HVC]            = handle_hvc,
diff --git a/arch/arm/kvm/hyp/Makefile b/arch/arm/kvm/hyp/Makefile
index 3023bb530edf..8679405b0b2b 100644
--- a/arch/arm/kvm/hyp/Makefile
+++ b/arch/arm/kvm/hyp/Makefile
@@ -2,6 +2,8 @@
 # Makefile for Kernel-based Virtual Machine module, HYP part
 #
 
+ccflags-y += -fno-stack-protector
+
 KVM=../../../../virt/kvm
 
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
diff --git a/arch/arm/kvm/hyp/switch.c b/arch/arm/kvm/hyp/switch.c
index 92678b7bd046..624a510d31df 100644
--- a/arch/arm/kvm/hyp/switch.c
+++ b/arch/arm/kvm/hyp/switch.c
@@ -48,7 +48,9 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu, u32 *fpexc_host)
         write_sysreg(HSTR_T(15), HSTR);
         write_sysreg(HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11), HCPTR);
         val = read_sysreg(HDCR);
-        write_sysreg(val | HDCR_TPM | HDCR_TPMCR, HDCR);
+        val |= HDCR_TPM | HDCR_TPMCR; /* trap performance monitors */
+        val |= HDCR_TDRA | HDCR_TDOSA | HDCR_TDA; /* trap debug regs */
+        write_sysreg(val, HDCR);
 }
 
 static void __hyp_text __deactivate_traps(struct kvm_vcpu *vcpu)
diff --git a/arch/arm/kvm/trace.h b/arch/arm/kvm/trace.h
index fc0943776db2..b0d10648c486 100644
--- a/arch/arm/kvm/trace.h
+++ b/arch/arm/kvm/trace.h
@@ -1,5 +1,5 @@
-#if !defined(_TRACE_KVM_H) || defined(TRACE_HEADER_MULTI_READ)
-#define _TRACE_KVM_H
+#if !defined(_TRACE_ARM_KVM_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_ARM_KVM_H
 
 #include <linux/tracepoint.h>
 
@@ -74,10 +74,10 @@ TRACE_EVENT(kvm_hvc,
                   __entry->vcpu_pc, __entry->r0, __entry->imm)
 );
 
-#endif /* _TRACE_KVM_H */
+#endif /* _TRACE_ARM_KVM_H */
 
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH arch/arm/kvm
+#define TRACE_INCLUDE_PATH .
 #undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE trace
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 2cd27c830ab6..283e79ab587d 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -335,7 +335,7 @@ static const struct ramc_info ramc_infos[] __initconst = {
         { .idle = sama5d3_ddr_standby, .memctrl = AT91_MEMCTRL_DDRSDR},
 };
 
-static const struct of_device_id const ramc_ids[] __initconst = {
+static const struct of_device_id ramc_ids[] __initconst = {
         { .compatible = "atmel,at91rm9200-sdramc", .data = &ramc_infos[0] },
         { .compatible = "atmel,at91sam9260-sdramc", .data = &ramc_infos[1] },
         { .compatible = "atmel,at91sam9g45-ddramc", .data = &ramc_infos[2] },
diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c
index cf3f8658f0e5..a55a7ecf146a 100644
--- a/arch/arm/mach-bcm/bcm_kona_smc.c
+++ b/arch/arm/mach-bcm/bcm_kona_smc.c
@@ -33,7 +33,7 @@ struct bcm_kona_smc_data {
         unsigned result;
 };
 
-static const struct of_device_id const bcm_kona_smc_ids[] __initconst = {
+static const struct of_device_id bcm_kona_smc_ids[] __initconst = {
         {.compatible = "brcm,kona-smc"},
         {.compatible = "bcm,kona-smc"}, /* deprecated name */
         {},
diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c
index 03da3813f1ab..7d5a44a06648 100644
--- a/arch/arm/mach-cns3xxx/core.c
+++ b/arch/arm/mach-cns3xxx/core.c
@@ -346,7 +346,7 @@ static struct usb_ohci_pdata cns3xxx_usb_ohci_pdata = {
         .power_off      = csn3xxx_usb_power_off,
 };
 
-static const struct of_dev_auxdata const cns3xxx_auxdata[] __initconst = {
+static const struct of_dev_auxdata cns3xxx_auxdata[] __initconst = {
         { "intel,usb-ehci", CNS3XXX_USB_BASE, "ehci-platform", &cns3xxx_usb_ehci_pdata },
         { "intel,usb-ohci", CNS3XXX_USB_OHCI_BASE, "ohci-platform", &cns3xxx_usb_ohci_pdata },
         { "cavium,cns3420-ahci", CNS3XXX_SATA2_BASE, "ahci", NULL },
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index 3089d3bfa19b..8cc6338fcb12 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -266,11 +266,12 @@ extern int omap4_cpu_kill(unsigned int cpu);
 extern const struct smp_operations omap4_smp_ops;
 #endif
 
+extern u32 omap4_get_cpu1_ns_pa_addr(void);
+
 #if defined(CONFIG_SMP) && defined(CONFIG_PM)
 extern int omap4_mpuss_init(void);
 extern int omap4_enter_lowpower(unsigned int cpu, unsigned int power_state);
 extern int omap4_hotplug_cpu(unsigned int cpu, unsigned int power_state);
-extern u32 omap4_get_cpu1_ns_pa_addr(void);
 #else
 static inline int omap4_enter_lowpower(unsigned int cpu,
                                         unsigned int power_state)
diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
index 03ec6d307c82..4cfc4f9b2c69 100644
--- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
@@ -213,11 +213,6 @@ static void __init save_l2x0_context(void)
 {}
 #endif
 
-u32 omap4_get_cpu1_ns_pa_addr(void)
-{
-        return old_cpu1_ns_pa_addr;
-}
-
 /**
  * omap4_enter_lowpower: OMAP4 MPUSS Low Power Entry Function
  * The purpose of this function is to manage low power programming
@@ -457,6 +452,11 @@ int __init omap4_mpuss_init(void)
 
 #endif
 
+u32 omap4_get_cpu1_ns_pa_addr(void)
+{
+        return old_cpu1_ns_pa_addr;
+}
+
 /*
  * For kexec, we must set CPU1_WAKEUP_NS_PA_ADDR to point to
  * current kernel's secondary_startup() early before
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index 3faf454ba487..33e4953c61a8 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -306,7 +306,6 @@ static void __init omap4_smp_maybe_reset_cpu1(struct omap_smp_config *c)
 
         cpu1_startup_pa = readl_relaxed(cfg.wakeupgen_base +
                                         OMAP_AUX_CORE_BOOT_1);
-        cpu1_ns_pa_addr = omap4_get_cpu1_ns_pa_addr();
 
         /* Did the configured secondary_startup() get overwritten? */
         if (!omap4_smp_cpu1_startup_valid(cpu1_startup_pa))
@@ -316,9 +315,13 @@ static void __init omap4_smp_maybe_reset_cpu1(struct omap_smp_config *c)
          * If omap4 or 5 has NS_PA_ADDR configured, CPU1 may be in a
          * deeper idle state in WFI and will wake to an invalid address.
          */
-        if ((soc_is_omap44xx() || soc_is_omap54xx()) &&
-            !omap4_smp_cpu1_startup_valid(cpu1_ns_pa_addr))
-                needs_reset = true;
+        if ((soc_is_omap44xx() || soc_is_omap54xx())) {
+                cpu1_ns_pa_addr = omap4_get_cpu1_ns_pa_addr();
+                if (!omap4_smp_cpu1_startup_valid(cpu1_ns_pa_addr))
+                        needs_reset = true;
+        } else {
+                cpu1_ns_pa_addr = 0;
+        }
 
         if (!needs_reset || !c->cpu1_rstctrl_va)
                 return;
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 2b138b65129a..dc11841ca334 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -711,7 +711,7 @@ static struct omap_prcm_init_data scrm_data __initdata = {
 };
 #endif
 
-static const struct of_device_id const omap_prcm_dt_match_table[] __initconst = {
+static const struct of_device_id omap_prcm_dt_match_table[] __initconst = {
 #ifdef CONFIG_SOC_AM33XX
         { .compatible = "ti,am3-prcm", .data = &am3_prm_data },
 #endif
diff --git a/arch/arm/mach-omap2/vc.c b/arch/arm/mach-omap2/vc.c
index 2028167fff31..d76b1e5eb8ba 100644
--- a/arch/arm/mach-omap2/vc.c
+++ b/arch/arm/mach-omap2/vc.c
@@ -559,7 +559,7 @@ struct i2c_init_data {
         u8 hsscll_12;
 };
 
-static const struct i2c_init_data const omap4_i2c_timing_data[] __initconst = {
+static const struct i2c_init_data omap4_i2c_timing_data[] __initconst = {
         {
                 .load = 50,
                 .loadbits = 0x3,
diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c
index 4878ba90026d..289e036c9c30 100644
--- a/arch/arm/mach-spear/time.c
+++ b/arch/arm/mach-spear/time.c
@@ -204,7 +204,7 @@ static void __init spear_clockevent_init(int irq)
         setup_irq(irq, &spear_timer_irq);
 }
 
-static const struct of_device_id const timer_of_match[] __initconst = {
+static const struct of_device_id timer_of_match[] __initconst = {
         { .compatible = "st,spear-timer", },
         { },
 };
diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index 4afcffcb46cb..73272f43ca01 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -106,8 +106,13 @@ config ARCH_MVEBU
         select ARMADA_AP806_SYSCON
         select ARMADA_CP110_SYSCON
         select ARMADA_37XX_CLK
+        select GPIOLIB
+        select GPIOLIB_IRQCHIP
         select MVEBU_ODMI
         select MVEBU_PIC
+        select OF_GPIO
+        select PINCTRL
+        select PINCTRL_ARMADA_37XX
         help
           This enables support for Marvell EBU familly, including:
            - Armada 3700 SoC Family
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
index 75bce2d0b1a8..49f6a6242cf9 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
+++ b/arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
@@ -81,6 +81,45 @@
                 };
         };
 
+        reg_sys_5v: regulator@0 {
+                compatible = "regulator-fixed";
+                regulator-name = "SYS_5V";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                regulator-boot-on;
+                regulator-always-on;
+        };
+
+        reg_vdd_3v3: regulator@1 {
+                compatible = "regulator-fixed";
+                regulator-name = "VDD_3V3";
+                regulator-min-microvolt = <3300000>;
+                regulator-max-microvolt = <3300000>;
+                regulator-boot-on;
+                regulator-always-on;
+                vin-supply = <&reg_sys_5v>;
+        };
+
+        reg_5v_hub: regulator@2 {
+                compatible = "regulator-fixed";
+                regulator-name = "5V_HUB";
+                regulator-min-microvolt = <5000000>;
+                regulator-max-microvolt = <5000000>;
+                regulator-boot-on;
+                gpio = <&gpio0 7 0>;
+                regulator-always-on;
+                vin-supply = <&reg_sys_5v>;
+        };
+
+        wl1835_pwrseq: wl1835-pwrseq {
+                compatible = "mmc-pwrseq-simple";
+                /* WLAN_EN GPIO */
+                reset-gpios = <&gpio0 5 GPIO_ACTIVE_LOW>;
+                clocks = <&pmic>;
+                clock-names = "ext_clock";
+                power-off-delay-us = <10>;
+        };
+
         soc {
                 spi0: spi@f7106000 {
                         status = "ok";
@@ -256,11 +295,31 @@
 
                 /* GPIO blocks 16 thru 19 do not appear to be routed to pins */
 
+                dwmmc_0: dwmmc0@f723d000 {
+                        cap-mmc-highspeed;
+                        non-removable;
+                        bus-width = <0x8>;
+                        vmmc-supply = <&ldo19>;
+                };
+
+                dwmmc_1: dwmmc1@f723e000 {
+                        card-detect-delay = <200>;
+                        cap-sd-highspeed;
+                        sd-uhs-sdr12;
+                        sd-uhs-sdr25;
+                        sd-uhs-sdr50;
+                        vqmmc-supply = <&ldo7>;
+                        vmmc-supply = <&ldo10>;
+                        bus-width = <0x4>;
+                        disable-wp;
+                        cd-gpios = <&gpio1 0 1>;
+                };
+
                 dwmmc_2: dwmmc2@f723f000 {
-                        ti,non-removable;
+                        bus-width = <0x4>;
                         non-removable;
-                        /* WL_EN */
-                        vmmc-supply = <&wlan_en_reg>;
+                        vmmc-supply = <&reg_vdd_3v3>;
+                        mmc-pwrseq = <&wl1835_pwrseq>;
 
                         #address-cells = <0x1>;
                         #size-cells = <0x0>;
@@ -272,18 +331,6 @@
                                 interrupts = <3 IRQ_TYPE_EDGE_RISING>;
                         };
                 };
-
-                wlan_en_reg: regulator@1 {
-                        compatible = "regulator-fixed";
-                        regulator-name = "wlan-en-regulator";
-                        regulator-min-microvolt = <1800000>;
-                        regulator-max-microvolt = <1800000>;
-                        /* WLAN_EN GPIO */
-                        gpio = <&gpio0 5 0>;
-                        /* WLAN card specific delay */
-                        startup-delay-us = <70000>;
-                        enable-active-high;
-                };
         };
 
         leds {
@@ -330,6 +377,7 @@
         pmic: pmic@f8000000 {
                 compatible = "hisilicon,hi655x-pmic";
                 reg = <0x0 0xf8000000 0x0 0x1000>;
+                #clock-cells = <0>;
                 interrupt-controller;
                 #interrupt-cells = <2>;
                 pmic-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
index 1e5129b19280..5013e4b2ea71 100644
--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
+++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi
@@ -725,20 +725,10 @@
                         status = "disabled";
                 };
 
-                fixed_5v_hub: regulator@0 {
-                        compatible = "regulator-fixed";
-                        regulator-name = "fixed_5v_hub";
-                        regulator-min-microvolt = <5000000>;
-                        regulator-max-microvolt = <5000000>;
-                        regulator-boot-on;
-                        gpio = <&gpio0 7 0>;
-                        regulator-always-on;
-                };
-
                 usb_phy: usbphy {
                         compatible = "hisilicon,hi6220-usb-phy";
                         #phy-cells = <0>;
-                        phy-supply = <&fixed_5v_hub>;
+                        phy-supply = <&reg_5v_hub>;
                         hisilicon,peripheral-syscon = <&sys_ctrl>;
                 };
 
@@ -766,17 +756,12 @@
 
                 dwmmc_0: dwmmc0@f723d000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
-                        cap-mmc-highspeed;
-                        non-removable;
                         reg = <0x0 0xf723d000 0x0 0x1000>;
                         interrupts = <0x0 0x48 0x4>;
                         clocks = <&sys_ctrl 2>, <&sys_ctrl 1>;
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC0>;
                         reset-names = "reset";
-                        bus-width = <0x8>;
-                        vmmc-supply = <&ldo19>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&emmc_pmx_func &emmc_clk_cfg_func
                                      &emmc_cfg_func &emmc_rst_cfg_func>;
@@ -784,13 +769,7 @@
 
                 dwmmc_1: dwmmc1@f723e000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
-                        card-detect-delay = <200>;
                         hisilicon,peripheral-syscon = <&ao_ctrl>;
-                        cap-sd-highspeed;
-                        sd-uhs-sdr12;
-                        sd-uhs-sdr25;
-                        sd-uhs-sdr50;
                         reg = <0x0 0xf723e000 0x0 0x1000>;
                         interrupts = <0x0 0x49 0x4>;
                         #address-cells = <0x1>;
@@ -799,11 +778,6 @@
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC1>;
                         reset-names = "reset";
-                        vqmmc-supply = <&ldo7>;
-                        vmmc-supply = <&ldo10>;
-                        bus-width = <0x4>;
-                        disable-wp;
-                        cd-gpios = <&gpio1 0 1>;
                         pinctrl-names = "default", "idle";
                         pinctrl-0 = <&sd_pmx_func &sd_clk_cfg_func &sd_cfg_func>;
                         pinctrl-1 = <&sd_pmx_idle &sd_clk_cfg_idle &sd_cfg_idle>;
@@ -811,15 +785,12 @@
 
                 dwmmc_2: dwmmc2@f723f000 {
                         compatible = "hisilicon,hi6220-dw-mshc";
-                        num-slots = <0x1>;
                         reg = <0x0 0xf723f000 0x0 0x1000>;
                         interrupts = <0x0 0x4a 0x4>;
                         clocks = <&sys_ctrl HI6220_MMC2_CIUCLK>, <&sys_ctrl HI6220_MMC2_CLK>;
                         clock-names = "ciu", "biu";
                         resets = <&sys_ctrl PERIPH_RSTDIS0_MMC2>;
                         reset-names = "reset";
-                        bus-width = <0x4>;
-                        broken-cd;
                         pinctrl-names = "default", "idle";
                         pinctrl-0 = <&sdio_pmx_func &sdio_clk_cfg_func &sdio_cfg_func>;
                         pinctrl-1 = <&sdio_pmx_idle &sdio_clk_cfg_idle &sdio_cfg_idle>;
diff --git a/arch/arm64/boot/dts/include/arm b/arch/arm64/boot/dts/include/arm
deleted file mode 120000
index cf63d80e2b93..000000000000
--- a/arch/arm64/boot/dts/include/arm
+++ /dev/null
@@ -1 +0,0 @@
-../../../../arm/boot/dts
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/include/arm64 b/arch/arm64/boot/dts/include/arm64
deleted file mode 120000
index a96aa0ea9d8c..000000000000
--- a/arch/arm64/boot/dts/include/arm64
+++ /dev/null
@@ -1 +0,0 @@
-..
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/include/dt-bindings b/arch/arm64/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/arm64/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/marvell/armada-3720-db.dts b/arch/arm64/boot/dts/marvell/armada-3720-db.dts
index cef5f976bc0f..a89855f57091 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-db.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-db.dts
@@ -79,6 +79,8 @@
 };
 
 &i2c0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c1_pins>;
         status = "okay";
 
         gpio_exp: pca9555@22 {
@@ -113,6 +115,8 @@
 
 &spi0 {
         status = "okay";
+        pinctrl-names = "default";
+        pinctrl-0 = <&spi_quad_pins>;
 
         m25p80@0 {
                 compatible = "jedec,spi-nor";
@@ -143,6 +147,8 @@
 
 /* Exported on the micro USB connector CON32 through an FTDI */
 &uart0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&uart1_pins>;
         status = "okay";
 };
 
@@ -184,6 +190,8 @@
 };
 
 &eth0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&rgmii_pins>;
         phy-mode = "rgmii-id";
         phy = <&phy0>;
         status = "okay";
diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
index 58ae9e095af2..4d495ec39202 100644
--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
@@ -161,16 +161,83 @@
                                 #clock-cells = <1>;
                         };
 
-                        gpio1: gpio@13800 {
-                                compatible = "marvell,mvebu-gpio-3700",
+                        pinctrl_nb: pinctrl@13800 {
+                                compatible = "marvell,armada3710-nb-pinctrl",
                                 "syscon", "simple-mfd";
-                                reg = <0x13800 0x500>;
+                                reg = <0x13800 0x100>, <0x13C00 0x20>;
+                                gpionb: gpio {
+                                        #gpio-cells = <2>;
+                                        gpio-ranges = <&pinctrl_nb 0 0 36>;
+                                        gpio-controller;
+                                        interrupts =
+                                        <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 152 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 153 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 155 IRQ_TYPE_LEVEL_HIGH>;
+
+                                };
 
                                 xtalclk: xtal-clk {
                                         compatible = "marvell,armada-3700-xtal-clock";
                                         clock-output-names = "xtal";
                                         #clock-cells = <0>;
                                 };
+
+                                spi_quad_pins: spi-quad-pins {
+                                        groups = "spi_quad";
+                                        function = "spi";
+                                };
+
+                                i2c1_pins: i2c1-pins {
+                                        groups = "i2c1";
+                                        function = "i2c";
+                                };
+
+                                i2c2_pins: i2c2-pins {
+                                        groups = "i2c2";
+                                        function = "i2c";
+                                };
+
+                                uart1_pins: uart1-pins {
+                                        groups = "uart1";
+                                        function = "uart";
+                                };
+
+                                uart2_pins: uart2-pins {
+                                        groups = "uart2";
+                                        function = "uart";
+                                };
+                        };
+
+                        pinctrl_sb: pinctrl@18800 {
+                                compatible = "marvell,armada3710-sb-pinctrl",
+                                "syscon", "simple-mfd";
+                                reg = <0x18800 0x100>, <0x18C00 0x20>;
+                                gpiosb: gpio {
+                                        #gpio-cells = <2>;
+                                        gpio-ranges = <&pinctrl_sb 0 0 29>;
+                                        gpio-controller;
+                                        interrupts =
+                                        <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 159 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 158 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 156 IRQ_TYPE_LEVEL_HIGH>;
+                                };
+
+                                rgmii_pins: mii-pins {
+                                        groups = "rgmii";
+                                        function = "mii";
+                                };
+
                         };
 
                         eth0: ethernet@30000 {
diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
index 0ecaad4333a7..1c3634fa94bf 100644
--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
@@ -134,6 +134,9 @@
         bus-width = <8>;
         max-frequency = <50000000>;
         cap-mmc-highspeed;
+        mediatek,hs200-cmd-int-delay=<26>;
+        mediatek,hs400-cmd-int-delay=<14>;
+        mediatek,hs400-cmd-resp-sel-rising;
         vmmc-supply = <&mt6397_vemc_3v3_reg>;
         vqmmc-supply = <&mt6397_vio18_reg>;
         non-removable;
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
index 658bb9dc9dfd..7bd31066399b 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
@@ -44,7 +44,7 @@
 
 /dts-v1/;
 #include "rk3399-gru.dtsi"
-#include <include/dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/input/linux-event-codes.h>
 
 /*
  * Kevin-specific things
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index ce072859e3b2..65cdd878cfbd 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -30,7 +30,6 @@ CONFIG_PROFILING=y
 CONFIG_JUMP_LABEL=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
-# CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 CONFIG_ARCH_SUNXI=y
 CONFIG_ARCH_ALPINE=y
@@ -62,16 +61,15 @@ CONFIG_ARCH_XGENE=y
 CONFIG_ARCH_ZX=y
 CONFIG_ARCH_ZYNQMP=y
 CONFIG_PCI=y
-CONFIG_PCI_MSI=y
 CONFIG_PCI_IOV=y
-CONFIG_PCI_AARDVARK=y
-CONFIG_PCIE_RCAR=y
-CONFIG_PCI_HOST_GENERIC=y
-CONFIG_PCI_XGENE=y
 CONFIG_PCI_LAYERSCAPE=y
 CONFIG_PCI_HISI=y
 CONFIG_PCIE_QCOM=y
 CONFIG_PCIE_ARMADA_8K=y
+CONFIG_PCI_AARDVARK=y
+CONFIG_PCIE_RCAR=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCI_XGENE=y
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_SCHED_MC=y
 CONFIG_NUMA=y
@@ -80,12 +78,11 @@ CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
 CONFIG_SECCOMP=y
-CONFIG_XEN=y
 CONFIG_KEXEC=y
 CONFIG_CRASH_DUMP=y
+CONFIG_XEN=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_COMPAT=y
-CONFIG_CPU_IDLE=y
 CONFIG_HIBERNATION=y
 CONFIG_ARM_CPUIDLE=y
 CONFIG_CPU_FREQ=y
@@ -155,8 +152,8 @@ CONFIG_MTD_SPI_NOR=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_NBD=m
 CONFIG_VIRTIO_BLK=y
-CONFIG_EEPROM_AT25=m
 CONFIG_SRAM=y
+CONFIG_EEPROM_AT25=m
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_ATA=y
@@ -168,8 +165,8 @@ CONFIG_AHCI_CEVA=y
 CONFIG_AHCI_MVEBU=y
 CONFIG_AHCI_XGENE=y
 CONFIG_AHCI_QORIQ=y
-CONFIG_SATA_RCAR=y
 CONFIG_SATA_SIL24=y
+CONFIG_SATA_RCAR=y
 CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_NETDEVICES=y
@@ -186,18 +183,17 @@ CONFIG_HNS_ENET=y
 CONFIG_E1000E=y
 CONFIG_IGB=y
 CONFIG_IGBVF=y
-CONFIG_MVPP2=y
 CONFIG_MVNETA=y
+CONFIG_MVPP2=y
 CONFIG_SKY2=y
 CONFIG_RAVB=y
 CONFIG_SMC91X=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=m
-CONFIG_REALTEK_PHY=m
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
 CONFIG_MESON_GXL_PHY=m
 CONFIG_MICREL_PHY=y
-CONFIG_MDIO_BUS_MUX=y
-CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_REALTEK_PHY=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=m
@@ -230,14 +226,14 @@ CONFIG_SERIAL_8250_UNIPHIER=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_MESON=y
+CONFIG_SERIAL_MESON_CONSOLE=y
 CONFIG_SERIAL_SAMSUNG=y
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
 CONFIG_SERIAL_TEGRA=y
 CONFIG_SERIAL_SH_SCI=y
 CONFIG_SERIAL_SH_SCI_NR_UARTS=11
 CONFIG_SERIAL_SH_SCI_CONSOLE=y
-CONFIG_SERIAL_MESON=y
-CONFIG_SERIAL_MESON_CONSOLE=y
 CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SERIAL_XILINX_PS_UART=y
@@ -261,14 +257,14 @@ CONFIG_I2C_UNIPHIER_F=y
 CONFIG_I2C_RCAR=y
 CONFIG_I2C_CROS_EC_TUNNEL=y
 CONFIG_SPI=y
-CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_BCM2835=m
 CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_QUP=y
-CONFIG_SPI_SPIDEV=m
 CONFIG_SPI_S3C64XX=y
+CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
 CONFIG_PINCTRL_SINGLE=y
 CONFIG_PINCTRL_MAX77620=y
@@ -286,33 +282,30 @@ CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
 CONFIG_GPIO_MAX77620=y
 CONFIG_POWER_RESET_MSM=y
-CONFIG_BATTERY_BQ27XXX=y
 CONFIG_POWER_RESET_XGENE=y
 CONFIG_POWER_RESET_SYSCON=y
+CONFIG_BATTERY_BQ27XXX=y
+CONFIG_SENSORS_ARM_SCPI=y
 CONFIG_SENSORS_LM90=m
 CONFIG_SENSORS_INA2XX=m
-CONFIG_SENSORS_ARM_SCPI=y
-CONFIG_THERMAL=y
-CONFIG_THERMAL_EMULATION=y
 CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
-CONFIG_BCM2835_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
 CONFIG_EXYNOS_THERMAL=y
 CONFIG_WATCHDOG=y
-CONFIG_BCM2835_WDT=y
-CONFIG_RENESAS_WDT=y
 CONFIG_S3C2410_WATCHDOG=y
 CONFIG_MESON_GXBB_WATCHDOG=m
 CONFIG_MESON_WATCHDOG=m
+CONFIG_RENESAS_WDT=y
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_CROS_EC=y
+CONFIG_MFD_CROS_EC_I2C=y
 CONFIG_MFD_EXYNOS_LPASS=m
+CONFIG_MFD_HI655X_PMIC=y
 CONFIG_MFD_MAX77620=y
-CONFIG_MFD_RK808=y
 CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_RK808=y
 CONFIG_MFD_SEC_CORE=y
-CONFIG_MFD_HI655X_PMIC=y
-CONFIG_REGULATOR=y
-CONFIG_MFD_CROS_EC=y
-CONFIG_MFD_CROS_EC_I2C=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_HI655X=y
@@ -345,13 +338,12 @@ CONFIG_DRM_EXYNOS_DSI=y
 CONFIG_DRM_EXYNOS_HDMI=y
 CONFIG_DRM_EXYNOS_MIC=y
 CONFIG_DRM_RCAR_DU=m
-CONFIG_DRM_RCAR_HDMI=y
 CONFIG_DRM_RCAR_LVDS=y
 CONFIG_DRM_RCAR_VSP=y
 CONFIG_DRM_TEGRA=m
-CONFIG_DRM_VC4=m
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_I2C_ADV7511=m
+CONFIG_DRM_VC4=m
 CONFIG_DRM_HISI_KIRIN=m
 CONFIG_DRM_MESON=m
 CONFIG_FB=y
@@ -366,39 +358,37 @@ CONFIG_SOUND=y
 CONFIG_SND=y
 CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=m
-CONFIG_SND_SOC_RCAR=y
 CONFIG_SND_SOC_SAMSUNG=y
+CONFIG_SND_SOC_RCAR=y
 CONFIG_SND_SOC_AK4613=y
 CONFIG_USB=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_PLATFORM=y
-CONFIG_USB_XHCI_RCAR=y
-CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_XHCI_TEGRA=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_MSM=y
+CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
-CONFIG_USB_OHCI_EXYNOS=y
 CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_EXYNOS=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
 CONFIG_USB_RENESAS_USBHS=m
 CONFIG_USB_STORAGE=y
-CONFIG_USB_DWC2=y
 CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
 CONFIG_USB_CHIPIDEA=y
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=y
 CONFIG_USB_MSM_OTG=y
+CONFIG_USB_QCOM_8X16_PHY=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_RENESAS_USBHS_UDC=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_ARMMMCI=y
-CONFIG_MMC_MESON_GX=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_ACPI=y
 CONFIG_MMC_SDHCI_PLTFM=y
@@ -406,6 +396,7 @@ CONFIG_MMC_SDHCI_OF_ARASAN=y
 CONFIG_MMC_SDHCI_OF_ESDHC=y
 CONFIG_MMC_SDHCI_CADENCE=y
 CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_MMC_MESON_GX=y
 CONFIG_MMC_SDHCI_MSM=y
 CONFIG_MMC_SPI=y
 CONFIG_MMC_SDHI=y
@@ -414,32 +405,31 @@ CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_K3=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_MMC_SUNXI=y
-CONFIG_MMC_SDHCI_XENON=y
 CONFIG_MMC_BCM2835=y
+CONFIG_MMC_SDHCI_XENON=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PWM=y
 CONFIG_LEDS_SYSCON=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
+CONFIG_RTC_DRV_RK808=m
 CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_S3C=y
 CONFIG_RTC_DRV_PL031=y
 CONFIG_RTC_DRV_SUN6I=y
-CONFIG_RTC_DRV_RK808=m
 CONFIG_RTC_DRV_TEGRA=y
 CONFIG_RTC_DRV_XGENE=y
-CONFIG_RTC_DRV_S3C=y
 CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=m
 CONFIG_MV_XOR_V2=y
 CONFIG_PL330_DMA=y
-CONFIG_DMA_BCM2835=m
 CONFIG_TEGRA20_APB_DMA=y
 CONFIG_QCOM_BAM_DMA=y
 CONFIG_QCOM_HIDMA_MGMT=y
@@ -452,52 +442,53 @@ CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_XEN_GNTDEV=y
 CONFIG_XEN_GRANT_DEV_ALLOC=y
+CONFIG_COMMON_CLK_RK808=y
 CONFIG_COMMON_CLK_SCPI=y
 CONFIG_COMMON_CLK_CS2000_CP=y
 CONFIG_COMMON_CLK_S2MPS11=y
-CONFIG_COMMON_CLK_PWM=y
-CONFIG_COMMON_CLK_RK808=y
 CONFIG_CLK_QORIQ=y
+CONFIG_COMMON_CLK_PWM=y
 CONFIG_COMMON_CLK_QCOM=y
+CONFIG_QCOM_CLK_SMD_RPM=y
 CONFIG_MSM_GCC_8916=y
 CONFIG_MSM_GCC_8994=y
 CONFIG_MSM_MMCC_8996=y
 CONFIG_HWSPINLOCK_QCOM=y
-CONFIG_MAILBOX=y
 CONFIG_ARM_MHU=y
 CONFIG_PLATFORM_MHU=y
 CONFIG_BCM2835_MBOX=y
 CONFIG_HI6220_MBOX=y
 CONFIG_ARM_SMMU=y
 CONFIG_ARM_SMMU_V3=y
+CONFIG_RPMSG_QCOM_SMD=y
 CONFIG_RASPBERRYPI_POWER=y
 CONFIG_QCOM_SMEM=y
-CONFIG_QCOM_SMD=y
 CONFIG_QCOM_SMD_RPM=y
+CONFIG_QCOM_SMP2P=y
+CONFIG_QCOM_SMSM=y
 CONFIG_ROCKCHIP_PM_DOMAINS=y
 CONFIG_ARCH_TEGRA_132_SOC=y
 CONFIG_ARCH_TEGRA_210_SOC=y
 CONFIG_ARCH_TEGRA_186_SOC=y
 CONFIG_EXTCON_USB_GPIO=y
+CONFIG_IIO=y
+CONFIG_EXYNOS_ADC=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=m
+CONFIG_PWM_MESON=m
 CONFIG_PWM_ROCKCHIP=y
+CONFIG_PWM_SAMSUNG=y
 CONFIG_PWM_TEGRA=m
-CONFIG_PWM_MESON=m
-CONFIG_COMMON_RESET_HI6220=y
 CONFIG_PHY_RCAR_GEN3_USB2=y
 CONFIG_PHY_HI6220_USB=y
+CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_EMMC=y
-CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_XGENE=y
 CONFIG_PHY_TEGRA_XUSB=y
 CONFIG_ARM_SCPI_PROTOCOL=y
-CONFIG_ACPI=y
-CONFIG_IIO=y
-CONFIG_EXYNOS_ADC=y
-CONFIG_PWM_SAMSUNG=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_ACPI=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -511,7 +502,6 @@ CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
 CONFIG_VFAT_FS=y
-CONFIG_TMPFS=y
 CONFIG_HUGETLBFS=y
 CONFIG_CONFIGFS_FS=y
 CONFIG_EFIVAR_FS=y
@@ -539,11 +529,9 @@ CONFIG_MEMTEST=y
 CONFIG_SECURITY=y
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
-CONFIG_CRYPTO_DEV_SAFEXCEL=m
 CONFIG_ARM64_CRYPTO=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
-# CONFIG_CRYPTO_AES_ARM64_NEON_BLK is not set
diff --git a/arch/arm64/include/asm/atomic_ll_sc.h b/arch/arm64/include/asm/atomic_ll_sc.h
index f819fdcff1ac..f5a2d09afb38 100644
--- a/arch/arm64/include/asm/atomic_ll_sc.h
+++ b/arch/arm64/include/asm/atomic_ll_sc.h
@@ -264,7 +264,6 @@ __LL_SC_PREFIX(__cmpxchg_case_##name(volatile void *ptr,		\
         "       st" #rel "xr" #sz "\t%w[tmp], %" #w "[new], %[v]\n"     \
         "       cbnz    %w[tmp], 1b\n"                                  \
         "       " #mb "\n"                                              \
-        "       mov     %" #w "[oldval], %" #w "[old]\n"                \
         "2:"                                                            \
         : [tmp] "=&r" (tmp), [oldval] "=&r" (oldval),                   \
           [v] "+Q" (*(unsigned long *)ptr)                              \
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index e7f84a7b4465..428ee1f2468c 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -115,6 +115,7 @@ struct arm64_cpu_capabilities {
 
 extern DECLARE_BITMAP(cpu_hwcaps, ARM64_NCAPS);
 extern struct static_key_false cpu_hwcap_keys[ARM64_NCAPS];
+extern struct static_key_false arm64_const_caps_ready;
 
 bool this_cpu_has_cap(unsigned int cap);
 
@@ -124,7 +125,7 @@ static inline bool cpu_have_feature(unsigned int num)
 }
 
 /* System capability check for constant caps */
-static inline bool cpus_have_const_cap(int num)
+static inline bool __cpus_have_const_cap(int num)
 {
         if (num >= ARM64_NCAPS)
                 return false;
@@ -138,6 +139,14 @@ static inline bool cpus_have_cap(unsigned int num)
         return test_bit(num, cpu_hwcaps);
 }
 
+static inline bool cpus_have_const_cap(int num)
+{
+        if (static_branch_likely(&arm64_const_caps_ready))
+                return __cpus_have_const_cap(num);
+        else
+                return cpus_have_cap(num);
+}
+
 static inline void cpus_set_cap(unsigned int num)
 {
         if (num >= ARM64_NCAPS) {
@@ -145,7 +154,6 @@ static inline void cpus_set_cap(unsigned int num)
                         num, ARM64_NCAPS);
         } else {
                 __set_bit(num, cpu_hwcaps);
-                static_branch_enable(&cpu_hwcap_keys[num]);
         }
 }
 
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 5e19165c5fa8..1f252a95bc02 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -24,6 +24,7 @@
 
 #include <linux/types.h>
 #include <linux/kvm_types.h>
+#include <asm/cpufeature.h>
 #include <asm/kvm.h>
 #include <asm/kvm_asm.h>
 #include <asm/kvm_mmio.h>
@@ -355,9 +356,12 @@ static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr,
                                        unsigned long vector_ptr)
 {
         /*
-         * Call initialization code, and switch to the full blown
-         * HYP code.
+         * Call initialization code, and switch to the full blown HYP code.
+         * If the cpucaps haven't been finalized yet, something has gone very
+         * wrong, and hyp will crash and burn when it uses any
+         * cpus_have_const_cap() wrapper.
          */
+        BUG_ON(!static_branch_likely(&arm64_const_caps_ready));
         __kvm_call_hyp((void *)pgd_ptr, hyp_stack_ptr, vector_ptr);
 }
 
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 94b8f7fc3310..817ce3365e20 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -985,8 +985,16 @@ void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
  */
 void __init enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
 {
-        for (; caps->matches; caps++)
-                if (caps->enable && cpus_have_cap(caps->capability))
+        for (; caps->matches; caps++) {
+                unsigned int num = caps->capability;
+
+                if (!cpus_have_cap(num))
+                        continue;
+
+                /* Ensure cpus_have_const_cap(num) works */
+                static_branch_enable(&cpu_hwcap_keys[num]);
+
+                if (caps->enable) {
                         /*
                          * Use stop_machine() as it schedules the work allowing
                          * us to modify PSTATE, instead of on_each_cpu() which
@@ -994,6 +1002,8 @@ void __init enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
                          * we return.
                          */
                         stop_machine(caps->enable, NULL, cpu_online_mask);
+                }
+        }
 }
 
 /*
@@ -1096,6 +1106,14 @@ static void __init setup_feature_capabilities(void)
         enable_cpu_capabilities(arm64_features);
 }
 
+DEFINE_STATIC_KEY_FALSE(arm64_const_caps_ready);
+EXPORT_SYMBOL(arm64_const_caps_ready);
+
+static void __init mark_const_caps_ready(void)
+{
+        static_branch_enable(&arm64_const_caps_ready);
+}
+
 /*
  * Check if the current CPU has a given feature capability.
  * Should be called from non-preemptible context.
@@ -1131,6 +1149,7 @@ void __init setup_cpu_features(void)
         /* Set the CPU feature capabilies */
         setup_feature_capabilities();
         enable_errata_workarounds();
+        mark_const_caps_ready();
         setup_elf_hwcaps(arm64_elf_hwcaps);
 
         if (system_supports_32bit_el0())
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index bcc79471b38e..83a1b1ad189f 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -877,15 +877,24 @@ static int armv8pmu_set_event_filter(struct hw_perf_event *event,
 
         if (attr->exclude_idle)
                 return -EPERM;
-        if (is_kernel_in_hyp_mode() &&
-            attr->exclude_kernel != attr->exclude_hv)
-                return -EINVAL;
+
+        /*
+         * If we're running in hyp mode, then we *are* the hypervisor.
+         * Therefore we ignore exclude_hv in this configuration, since
+         * there's no hypervisor to sample anyway. This is consistent
+         * with other architectures (x86 and Power).
+         */
+        if (is_kernel_in_hyp_mode()) {
+                if (!attr->exclude_kernel)
+                        config_base |= ARMV8_PMU_INCLUDE_EL2;
+        } else {
+                if (attr->exclude_kernel)
+                        config_base |= ARMV8_PMU_EXCLUDE_EL1;
+                if (!attr->exclude_hv)
+                        config_base |= ARMV8_PMU_INCLUDE_EL2;
+        }
         if (attr->exclude_user)
                 config_base |= ARMV8_PMU_EXCLUDE_EL0;
-        if (!is_kernel_in_hyp_mode() && attr->exclude_kernel)
-                config_base |= ARMV8_PMU_EXCLUDE_EL1;
-        if (!attr->exclude_hv)
-                config_base |= ARMV8_PMU_INCLUDE_EL2;
 
         /*
          * Install the filter into config_base as this is used to
diff --git a/arch/arm64/kvm/hyp/Makefile b/arch/arm64/kvm/hyp/Makefile
index aaf42ae8d8c3..14c4e3b14bcb 100644
--- a/arch/arm64/kvm/hyp/Makefile
+++ b/arch/arm64/kvm/hyp/Makefile
@@ -2,6 +2,8 @@
 # Makefile for Kernel-based Virtual Machine module, HYP part
 #
 
+ccflags-y += -fno-stack-protector
+
 KVM=../../../../virt/kvm
 
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index c6e53580aefe..71f930501ade 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -253,8 +253,9 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx)
          */
         off = offsetof(struct bpf_array, ptrs);
         emit_a64_mov_i64(tmp, off, ctx);
-        emit(A64_LDR64(tmp, r2, tmp), ctx);
-        emit(A64_LDR64(prg, tmp, r3), ctx);
+        emit(A64_ADD(1, tmp, r2, tmp), ctx);
+        emit(A64_LSL(1, prg, r3, 3), ctx);
+        emit(A64_LDR64(prg, tmp, prg), ctx);
         emit(A64_CBZ(1, prg, jmp_offset), ctx);
 
         /* goto *(prog->bpf_func + prologue_size); */
diff --git a/arch/cris/boot/dts/include/dt-bindings b/arch/cris/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/cris/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/metag/boot/dts/include/dt-bindings b/arch/metag/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/metag/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/mips/boot/dts/include/dt-bindings b/arch/mips/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/mips/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/powerpc/boot/dts/include/dt-bindings b/arch/powerpc/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/powerpc/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
index 53885512b8d3..6c0132c7212f 100644
--- a/arch/powerpc/include/asm/module.h
+++ b/arch/powerpc/include/asm/module.h
@@ -14,6 +14,10 @@
 #include <asm-generic/module.h>
 
 
+#ifdef CC_USING_MPROFILE_KERNEL
+#define MODULE_ARCH_VERMAGIC    "mprofile-kernel"
+#endif
+
 #ifndef __powerpc64__
 /*
  * Thanks to Paul M for explaining this.
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 2a32483c7b6c..8da5d4c1cab2 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -132,7 +132,19 @@ extern long long virt_phys_offset;
 #define virt_to_pfn(kaddr)      (__pa(kaddr) >> PAGE_SHIFT)
 #define virt_to_page(kaddr)     pfn_to_page(virt_to_pfn(kaddr))
 #define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
+
+#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * On hash the vmalloc and other regions alias to the kernel region when passed
+ * through __pa(), which virt_to_pfn() uses. That means virt_addr_valid() can
+ * return true for some vmalloc addresses, which is incorrect. So explicitly
+ * check that the address is in the kernel region.
+ */
+#define virt_addr_valid(kaddr) (REGION_ID(kaddr) == KERNEL_REGION_ID && \
+                                pfn_valid(virt_to_pfn(kaddr)))
+#else
 #define virt_addr_valid(kaddr)  pfn_valid(virt_to_pfn(kaddr))
+#endif
 
 /*
  * On Book-E parts we need __va to parse the device tree and we can't
diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h
index 3e7ce86d5c13..4d877144f377 100644
--- a/arch/powerpc/include/uapi/asm/cputable.h
+++ b/arch/powerpc/include/uapi/asm/cputable.h
@@ -46,6 +46,8 @@
 #define PPC_FEATURE2_HTM_NOSC           0x01000000
 #define PPC_FEATURE2_ARCH_3_00          0x00800000 /* ISA 3.00 */
 #define PPC_FEATURE2_HAS_IEEE128        0x00400000 /* VSX IEEE Binary Float 128-bit */
+#define PPC_FEATURE2_DARN               0x00200000 /* darn random number insn */
+#define PPC_FEATURE2_SCV                0x00100000 /* scv syscall */
 
 /*
  * IMPORTANT!
diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
index 9b3e88b1a9c8..6f849832a669 100644
--- a/arch/powerpc/kernel/cputable.c
+++ b/arch/powerpc/kernel/cputable.c
@@ -124,7 +124,8 @@ extern void __restore_cpu_e6500(void);
 #define COMMON_USER_POWER9      COMMON_USER_POWER8
 #define COMMON_USER2_POWER9     (COMMON_USER2_POWER8 | \
                                  PPC_FEATURE2_ARCH_3_00 | \
-                                 PPC_FEATURE2_HAS_IEEE128)
+                                 PPC_FEATURE2_HAS_IEEE128 | \
+                                 PPC_FEATURE2_DARN )
 
 #ifdef CONFIG_PPC_BOOK3E_64
 #define COMMON_USER_BOOKE       (COMMON_USER_PPC64 | PPC_FEATURE_BOOKE)
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 07d4e0ad60db..4898d676dcae 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -416,7 +416,7 @@ power9_dd1_recover_paca:
          * which needs to be restored from the stack.
          */
         li      r3, 1
-        stb     r0,PACA_NAPSTATELOST(r13)
+        stb     r3,PACA_NAPSTATELOST(r13)
         blr
 
 /*
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 160ae0fa7d0d..fc4343514bed 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -305,16 +305,17 @@ int kprobe_handler(struct pt_regs *regs)
                         save_previous_kprobe(kcb);
                         set_current_kprobe(p, regs, kcb);
                         kprobes_inc_nmissed_count(p);
-                        prepare_singlestep(p, regs);
                         kcb->kprobe_status = KPROBE_REENTER;
                         if (p->ainsn.boostable >= 0) {
                                 ret = try_to_emulate(p, regs);
 
                                 if (ret > 0) {
                                         restore_previous_kprobe(kcb);
+                                        preempt_enable_no_resched();
                                         return 1;
                                 }
                         }
+                        prepare_singlestep(p, regs);
                         return 1;
                 } else {
                         if (*addr != BREAKPOINT_INSTRUCTION) {
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index d645da302bf2..baae104b16c7 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -864,6 +864,25 @@ static void tm_reclaim_thread(struct thread_struct *thr,
         if (!MSR_TM_SUSPENDED(mfmsr()))
                 return;
 
+        /*
+         * If we are in a transaction and FP is off then we can't have
+         * used FP inside that transaction. Hence the checkpointed
+         * state is the same as the live state. We need to copy the
+         * live state to the checkpointed state so that when the
+         * transaction is restored, the checkpointed state is correct
+         * and the aborted transaction sees the correct state. We use
+         * ckpt_regs.msr here as that's what tm_reclaim will use to
+         * determine if it's going to write the checkpointed state or
+         * not. So either this will write the checkpointed registers,
+         * or reclaim will. Similarly for VMX.
+         */
+        if ((thr->ckpt_regs.msr & MSR_FP) == 0)
+                memcpy(&thr->ckfp_state, &thr->fp_state,
+                       sizeof(struct thread_fp_state));
+        if ((thr->ckpt_regs.msr & MSR_VEC) == 0)
+                memcpy(&thr->ckvr_state, &thr->vr_state,
+                       sizeof(struct thread_vr_state));
+
         giveup_all(container_of(thr, struct task_struct, thread));
 
         tm_reclaim(thr, thr->ckpt_regs.msr, cause);
diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
index 40c4887c27b6..f83056297441 100644
--- a/arch/powerpc/kernel/prom.c
+++ b/arch/powerpc/kernel/prom.c
@@ -161,7 +161,9 @@ static struct ibm_pa_feature {
         { .pabyte = 0,  .pabit = 3, .cpu_features  = CPU_FTR_CTRL },
         { .pabyte = 0,  .pabit = 6, .cpu_features  = CPU_FTR_NOEXECUTE },
         { .pabyte = 1,  .pabit = 2, .mmu_features  = MMU_FTR_CI_LARGE_PAGE },
+#ifdef CONFIG_PPC_RADIX_MMU
         { .pabyte = 40, .pabit = 0, .mmu_features  = MMU_FTR_TYPE_RADIX },
+#endif
         { .pabyte = 1,  .pabit = 1, .invert = 1, .cpu_features = CPU_FTR_NODSISRALIGN },
         { .pabyte = 5,  .pabit = 0, .cpu_features  = CPU_FTR_REAL_LE,
                                     .cpu_user_ftrs = PPC_FEATURE_TRUE_LE },
diff --git a/arch/powerpc/kvm/Kconfig b/arch/powerpc/kvm/Kconfig
index 24de532c1736..0c52cb5d43f5 100644
--- a/arch/powerpc/kvm/Kconfig
+++ b/arch/powerpc/kvm/Kconfig
@@ -67,7 +67,7 @@ config KVM_BOOK3S_64
         select KVM_BOOK3S_64_HANDLER
         select KVM
         select KVM_BOOK3S_PR_POSSIBLE if !KVM_BOOK3S_HV_POSSIBLE
-        select SPAPR_TCE_IOMMU if IOMMU_SUPPORT
+        select SPAPR_TCE_IOMMU if IOMMU_SUPPORT && (PPC_SERIES || PPC_POWERNV)
         ---help---
           Support running unmodified book3s_64 and book3s_32 guest kernels
           in virtual machines on book3s_64 host processors.
diff --git a/arch/powerpc/kvm/Makefile b/arch/powerpc/kvm/Makefile
index d91a2604c496..381a6ec0ff3b 100644
--- a/arch/powerpc/kvm/Makefile
+++ b/arch/powerpc/kvm/Makefile
@@ -46,7 +46,7 @@ kvm-e500mc-objs := \
         e500_emulate.o
 kvm-objs-$(CONFIG_KVM_E500MC) := $(kvm-e500mc-objs)
 
-kvm-book3s_64-builtin-objs-$(CONFIG_KVM_BOOK3S_64_HANDLER) := \
+kvm-book3s_64-builtin-objs-$(CONFIG_SPAPR_TCE_IOMMU) := \
         book3s_64_vio_hv.o
 
 kvm-pr-y := \
@@ -90,11 +90,11 @@ kvm-book3s_64-objs-$(CONFIG_KVM_XICS) += \
         book3s_xics.o
 
 kvm-book3s_64-objs-$(CONFIG_KVM_XIVE) += book3s_xive.o
+kvm-book3s_64-objs-$(CONFIG_SPAPR_TCE_IOMMU) += book3s_64_vio.o
 
 kvm-book3s_64-module-objs := \
         $(common-objs-y) \
         book3s.o \
-        book3s_64_vio.o \
         book3s_rtas.o \
         $(kvm-book3s_64-objs-y)
 
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index eda0a8f6fae8..3adfd2f5301c 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -301,6 +301,10 @@ long kvmppc_rm_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
         /* udbg_printf("H_PUT_TCE(): liobn=0x%lx ioba=0x%lx, tce=0x%lx\n", */
         /*          liobn, ioba, tce); */
 
+        /* For radix, we might be in virtual mode, so punt */
+        if (kvm_is_radix(vcpu->kvm))
+                return H_TOO_HARD;
+
         stt = kvmppc_find_table(vcpu->kvm, liobn);
         if (!stt)
                 return H_TOO_HARD;
@@ -381,6 +385,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
         bool prereg = false;
         struct kvmppc_spapr_tce_iommu_table *stit;
 
+        /* For radix, we might be in virtual mode, so punt */
+        if (kvm_is_radix(vcpu->kvm))
+                return H_TOO_HARD;
+
         stt = kvmppc_find_table(vcpu->kvm, liobn);
         if (!stt)
                 return H_TOO_HARD;
@@ -491,6 +499,10 @@ long kvmppc_rm_h_stuff_tce(struct kvm_vcpu *vcpu,
         long i, ret;
         struct kvmppc_spapr_tce_iommu_table *stit;
 
+        /* For radix, we might be in virtual mode, so punt */
+        if (kvm_is_radix(vcpu->kvm))
+                return H_TOO_HARD;
+
         stt = kvmppc_find_table(vcpu->kvm, liobn);
         if (!stt)
                 return H_TOO_HARD;
@@ -527,6 +539,7 @@ long kvmppc_rm_h_stuff_tce(struct kvm_vcpu *vcpu,
         return H_SUCCESS;
 }
 
+/* This can be called in either virtual mode or real mode */
 long kvmppc_h_get_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
                       unsigned long ioba)
 {
diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
index 88a65923c649..ee4c2558c305 100644
--- a/arch/powerpc/kvm/book3s_hv_builtin.c
+++ b/arch/powerpc/kvm/book3s_hv_builtin.c
@@ -207,7 +207,14 @@ EXPORT_SYMBOL_GPL(kvmppc_hwrng_present);
 
 long kvmppc_h_random(struct kvm_vcpu *vcpu)
 {
-        if (powernv_get_random_real_mode(&vcpu->arch.gpr[4]))
+        int r;
+
+        /* Only need to do the expensive mfmsr() on radix */
+        if (kvm_is_radix(vcpu->kvm) && (mfmsr() & MSR_IR))
+                r = powernv_get_random_long(&vcpu->arch.gpr[4]);
+        else
+                r = powernv_get_random_real_mode(&vcpu->arch.gpr[4]);
+        if (r)
                 return H_SUCCESS;
 
         return H_HARDWARE;
diff --git a/arch/powerpc/kvm/book3s_pr_papr.c b/arch/powerpc/kvm/book3s_pr_papr.c
index bcbeeb62dd13..8a4205fa774f 100644
--- a/arch/powerpc/kvm/book3s_pr_papr.c
+++ b/arch/powerpc/kvm/book3s_pr_papr.c
@@ -50,7 +50,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu)
         pteg_addr = get_pteg_addr(vcpu, pte_index);
 
         mutex_lock(&vcpu->kvm->arch.hpt_mutex);
-        copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg));
+        ret = H_FUNCTION;
+        if (copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)))
+                goto done;
         hpte = pteg;
 
         ret = H_PTEG_FULL;
@@ -71,7 +73,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu)
         hpte[0] = cpu_to_be64(kvmppc_get_gpr(vcpu, 6));
         hpte[1] = cpu_to_be64(kvmppc_get_gpr(vcpu, 7));
         pteg_addr += i * HPTE_SIZE;
-        copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE);
+        ret = H_FUNCTION;
+        if (copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE))
+                goto done;
         kvmppc_set_gpr(vcpu, 4, pte_index | i);
         ret = H_SUCCESS;
 
@@ -93,7 +97,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu)
 
         pteg = get_pteg_addr(vcpu, pte_index);
         mutex_lock(&vcpu->kvm->arch.hpt_mutex);
-        copy_from_user(pte, (void __user *)pteg, sizeof(pte));
+        ret = H_FUNCTION;
+        if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
+                goto done;
         pte[0] = be64_to_cpu((__force __be64)pte[0]);
         pte[1] = be64_to_cpu((__force __be64)pte[1]);
 
@@ -103,7 +109,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu)
             ((flags & H_ANDCOND) && (pte[0] & avpn) != 0))
                 goto done;
 
-        copy_to_user((void __user *)pteg, &v, sizeof(v));
+        ret = H_FUNCTION;
+        if (copy_to_user((void __user *)pteg, &v, sizeof(v)))
+                goto done;
 
         rb = compute_tlbie_rb(pte[0], pte[1], pte_index);
         vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
@@ -171,7 +179,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu)
                 }
 
                 pteg = get_pteg_addr(vcpu, tsh & H_BULK_REMOVE_PTEX);
-                copy_from_user(pte, (void __user *)pteg, sizeof(pte));
+                if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) {
+                        ret = H_FUNCTION;
+                        break;
+                }
                 pte[0] = be64_to_cpu((__force __be64)pte[0]);
                 pte[1] = be64_to_cpu((__force __be64)pte[1]);
 
@@ -184,7 +195,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu)
                         tsh |= H_BULK_REMOVE_NOT_FOUND;
                 } else {
                         /* Splat the pteg in (userland) hpt */
-                        copy_to_user((void __user *)pteg, &v, sizeof(v));
+                        if (copy_to_user((void __user *)pteg, &v, sizeof(v))) {
+                                ret = H_FUNCTION;
+                                break;
+                        }
 
                         rb = compute_tlbie_rb(pte[0], pte[1],
                                               tsh & H_BULK_REMOVE_PTEX);
@@ -211,7 +225,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
 
         pteg = get_pteg_addr(vcpu, pte_index);
         mutex_lock(&vcpu->kvm->arch.hpt_mutex);
-        copy_from_user(pte, (void __user *)pteg, sizeof(pte));
+        ret = H_FUNCTION;
+        if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
+                goto done;
         pte[0] = be64_to_cpu((__force __be64)pte[0]);
         pte[1] = be64_to_cpu((__force __be64)pte[1]);
 
@@ -234,7 +250,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
         vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
         pte[0] = (__force u64)cpu_to_be64(pte[0]);
         pte[1] = (__force u64)cpu_to_be64(pte[1]);
-        copy_to_user((void __user *)pteg, pte, sizeof(pte));
+        ret = H_FUNCTION;
+        if (copy_to_user((void __user *)pteg, pte, sizeof(pte)))
+                goto done;
         ret = H_SUCCESS;
 
  done:
@@ -244,36 +262,37 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
         return EMULATE_DONE;
 }
 
-static int kvmppc_h_pr_put_tce(struct kvm_vcpu *vcpu)
+static int kvmppc_h_pr_logical_ci_load(struct kvm_vcpu *vcpu)
 {
-        unsigned long liobn = kvmppc_get_gpr(vcpu, 4);
-        unsigned long ioba = kvmppc_get_gpr(vcpu, 5);
-        unsigned long tce = kvmppc_get_gpr(vcpu, 6);
         long rc;
 
-        rc = kvmppc_h_put_tce(vcpu, liobn, ioba, tce);
+        rc = kvmppc_h_logical_ci_load(vcpu);
         if (rc == H_TOO_HARD)
                 return EMULATE_FAIL;
         kvmppc_set_gpr(vcpu, 3, rc);
         return EMULATE_DONE;
 }
 
-static int kvmppc_h_pr_logical_ci_load(struct kvm_vcpu *vcpu)
+static int kvmppc_h_pr_logical_ci_store(struct kvm_vcpu *vcpu)
 {
         long rc;
 
-        rc = kvmppc_h_logical_ci_load(vcpu);
+        rc = kvmppc_h_logical_ci_store(vcpu);
         if (rc == H_TOO_HARD)
                 return EMULATE_FAIL;
         kvmppc_set_gpr(vcpu, 3, rc);
         return EMULATE_DONE;
 }
 
-static int kvmppc_h_pr_logical_ci_store(struct kvm_vcpu *vcpu)
+#ifdef CONFIG_SPAPR_TCE_IOMMU
+static int kvmppc_h_pr_put_tce(struct kvm_vcpu *vcpu)
 {
+        unsigned long liobn = kvmppc_get_gpr(vcpu, 4);
+        unsigned long ioba = kvmppc_get_gpr(vcpu, 5);
+        unsigned long tce = kvmppc_get_gpr(vcpu, 6);
         long rc;
 
-        rc = kvmppc_h_logical_ci_store(vcpu);
+        rc = kvmppc_h_put_tce(vcpu, liobn, ioba, tce);
         if (rc == H_TOO_HARD)
                 return EMULATE_FAIL;
         kvmppc_set_gpr(vcpu, 3, rc);
@@ -311,6 +330,23 @@ static int kvmppc_h_pr_stuff_tce(struct kvm_vcpu *vcpu)
         return EMULATE_DONE;
 }
 
+#else /* CONFIG_SPAPR_TCE_IOMMU */
+static int kvmppc_h_pr_put_tce(struct kvm_vcpu *vcpu)
+{
+        return EMULATE_FAIL;
+}
+
+static int kvmppc_h_pr_put_tce_indirect(struct kvm_vcpu *vcpu)
+{
+        return EMULATE_FAIL;
+}
+
+static int kvmppc_h_pr_stuff_tce(struct kvm_vcpu *vcpu)
+{
+        return EMULATE_FAIL;
+}
+#endif /* CONFIG_SPAPR_TCE_IOMMU */
+
 static int kvmppc_h_pr_xics_hcall(struct kvm_vcpu *vcpu, u32 cmd)
 {
         long rc = kvmppc_xics_hcall(vcpu, cmd);
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index f7cf2cd564ef..7f71ab5fcad1 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -1749,7 +1749,7 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 r = kvm_vm_ioctl_enable_cap(kvm, &cap);
                 break;
         }
-#ifdef CONFIG_PPC_BOOK3S_64
+#ifdef CONFIG_SPAPR_TCE_IOMMU
         case KVM_CREATE_SPAPR_TCE_64: {
                 struct kvm_create_spapr_tce_64 create_tce_64;
 
@@ -1780,6 +1780,8 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 r = kvm_vm_ioctl_create_spapr_tce(kvm, &create_tce_64);
                 goto out;
         }
+#endif
+#ifdef CONFIG_PPC_BOOK3S_64
         case KVM_PPC_GET_SMMU_INFO: {
                 struct kvm_ppc_smmu_info info;
                 struct kvm *kvm = filp->private_data;
diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
index d659345a98d6..44fe4833910f 100644
--- a/arch/powerpc/mm/dump_linuxpagetables.c
+++ b/arch/powerpc/mm/dump_linuxpagetables.c
@@ -16,6 +16,7 @@
  */
 #include <linux/debugfs.h>
 #include <linux/fs.h>
+#include <linux/hugetlb.h>
 #include <linux/io.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
@@ -391,7 +392,7 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
 
         for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
                 addr = start + i * PMD_SIZE;
-                if (!pmd_none(*pmd))
+                if (!pmd_none(*pmd) && !pmd_huge(*pmd))
                         /* pmd exists */
                         walk_pte(st, pmd, addr);
                 else
@@ -407,7 +408,7 @@ static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 
         for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
                 addr = start + i * PUD_SIZE;
-                if (!pud_none(*pud))
+                if (!pud_none(*pud) && !pud_huge(*pud))
                         /* pud exists */
                         walk_pmd(st, pud, addr);
                 else
@@ -427,7 +428,7 @@ static void walk_pagetables(struct pg_state *st)
          */
         for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
                 addr = KERN_VIRT_START + i * PGDIR_SIZE;
-                if (!pgd_none(*pgd))
+                if (!pgd_none(*pgd) && !pgd_huge(*pgd))
                         /* pgd exists */
                         walk_pud(st, pgd, addr);
                 else
diff --git a/arch/powerpc/platforms/cell/spu_base.c b/arch/powerpc/platforms/cell/spu_base.c
index 96c2b8a40630..0c45cdbac4cf 100644
--- a/arch/powerpc/platforms/cell/spu_base.c
+++ b/arch/powerpc/platforms/cell/spu_base.c
@@ -197,7 +197,9 @@ static int __spu_trap_data_map(struct spu *spu, unsigned long ea, u64 dsisr)
             (REGION_ID(ea) != USER_REGION_ID)) {
 
                 spin_unlock(&spu->register_lock);
-                ret = hash_page(ea, _PAGE_PRESENT | _PAGE_READ, 0x300, dsisr);
+                ret = hash_page(ea,
+                                _PAGE_PRESENT | _PAGE_READ | _PAGE_PRIVILEGED,
+                                0x300, dsisr);
                 spin_lock(&spu->register_lock);
 
                 if (!ret) {
diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c
index 067defeea691..78fa9395b8c5 100644
--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -714,7 +714,7 @@ static void pnv_npu2_release_context(struct kref *kref)
 void pnv_npu2_destroy_context(struct npu_context *npu_context,
                         struct pci_dev *gpdev)
 {
-        struct pnv_phb *nphb, *phb;
+        struct pnv_phb *nphb;
         struct npu *npu;
         struct pci_dev *npdev = pnv_pci_get_npu_dev(gpdev, 0);
         struct device_node *nvlink_dn;
@@ -728,13 +728,12 @@ void pnv_npu2_destroy_context(struct npu_context *npu_context,
 
         nphb = pci_bus_to_host(npdev->bus)->private_data;
         npu = &nphb->npu;
-        phb = pci_bus_to_host(gpdev->bus)->private_data;
         nvlink_dn = of_parse_phandle(npdev->dev.of_node, "ibm,nvlink", 0);
         if (WARN_ON(of_property_read_u32(nvlink_dn, "ibm,npu-link-index",
                                                         &nvlink_index)))
                 return;
         npu_context->npdev[npu->index][nvlink_index] = NULL;
-        opal_npu_destroy_context(phb->opal_id, npu_context->mm->context.id,
+        opal_npu_destroy_context(nphb->opal_id, npu_context->mm->context.id,
                                 PCI_DEVID(gpdev->bus->number, gpdev->devfn));
         kref_put(&npu_context->kref, pnv_npu2_release_context);
 }
diff --git a/arch/s390/include/asm/debug.h b/arch/s390/include/asm/debug.h
index 0206c8052328..df7b54ea956d 100644
--- a/arch/s390/include/asm/debug.h
+++ b/arch/s390/include/asm/debug.h
@@ -10,6 +10,7 @@
 #include <linux/spinlock.h>
 #include <linux/kernel.h>
 #include <linux/time.h>
+#include <linux/refcount.h>
 #include <uapi/asm/debug.h>
 
 #define DEBUG_MAX_LEVEL            6  /* debug levels range from 0 to 6 */
@@ -31,7 +32,7 @@ struct debug_view;
 typedef struct debug_info {     
         struct debug_info* next;
         struct debug_info* prev;
-        atomic_t ref_count;
+        refcount_t ref_count;
         spinlock_t lock;                        
         int level;
         int nr_areas;
diff --git a/arch/s390/include/asm/dis.h b/arch/s390/include/asm/dis.h
index 60323c21938b..37f617dfbede 100644
--- a/arch/s390/include/asm/dis.h
+++ b/arch/s390/include/asm/dis.h
@@ -40,6 +40,8 @@ static inline int insn_length(unsigned char code)
         return ((((int) code + 64) >> 7) + 1) << 1;
 }
 
+struct pt_regs;
+
 void show_code(struct pt_regs *regs);
 void print_fn_code(unsigned char *code, unsigned long len);
 int insn_to_mnemonic(unsigned char *instruction, char *buf, unsigned int len);
diff --git a/arch/s390/include/asm/kprobes.h b/arch/s390/include/asm/kprobes.h
index 1293c4066cfc..28792ef82c83 100644
--- a/arch/s390/include/asm/kprobes.h
+++ b/arch/s390/include/asm/kprobes.h
@@ -27,12 +27,21 @@
  * 2005-Dec     Used as a template for s390 by Mike Grundy
  *              <grundym@us.ibm.com>
  */
+#include <linux/types.h>
 #include <asm-generic/kprobes.h>
 
 #define BREAKPOINT_INSTRUCTION  0x0002
 
+#define FIXUP_PSW_NORMAL        0x08
+#define FIXUP_BRANCH_NOT_TAKEN  0x04
+#define FIXUP_RETURN_REGISTER   0x02
+#define FIXUP_NOT_REQUIRED      0x01
+
+int probe_is_prohibited_opcode(u16 *insn);
+int probe_get_fixup_type(u16 *insn);
+int probe_is_insn_relative_long(u16 *insn);
+
 #ifdef CONFIG_KPROBES
-#include <linux/types.h>
 #include <linux/ptrace.h>
 #include <linux/percpu.h>
 #include <linux/sched/task_stack.h>
@@ -56,11 +65,6 @@ typedef u16 kprobe_opcode_t;
 
 #define KPROBE_SWAP_INST        0x10
 
-#define FIXUP_PSW_NORMAL        0x08
-#define FIXUP_BRANCH_NOT_TAKEN  0x04
-#define FIXUP_RETURN_REGISTER   0x02
-#define FIXUP_NOT_REQUIRED      0x01
-
 /* Architecture specific copy of original instruction */
 struct arch_specific_insn {
         /* copy of original instruction */
@@ -90,10 +94,6 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr);
 int kprobe_exceptions_notify(struct notifier_block *self,
         unsigned long val, void *data);
 
-int probe_is_prohibited_opcode(u16 *insn);
-int probe_get_fixup_type(u16 *insn);
-int probe_is_insn_relative_long(u16 *insn);
-
 #define flush_insn_slot(p)      do { } while (0)
 
 #endif /* CONFIG_KPROBES */
diff --git a/arch/s390/include/asm/sysinfo.h b/arch/s390/include/asm/sysinfo.h
index 73bff45ced55..e784bed6ed7f 100644
--- a/arch/s390/include/asm/sysinfo.h
+++ b/arch/s390/include/asm/sysinfo.h
@@ -146,7 +146,7 @@ extern int topology_max_mnest;
  * Returns the maximum nesting level supported by the cpu topology code.
  * The current maximum level is 4 which is the drawer level.
  */
-static inline int topology_mnest_limit(void)
+static inline unsigned char topology_mnest_limit(void)
 {
         return min(topology_max_mnest, 4);
 }
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index 530226b6cb19..86b3e74f569e 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -277,7 +277,7 @@ debug_info_alloc(const char *name, int pages_per_area, int nr_areas,
         memset(rc->views, 0, DEBUG_MAX_VIEWS * sizeof(struct debug_view *));
         memset(rc->debugfs_entries, 0 ,DEBUG_MAX_VIEWS *
                 sizeof(struct dentry*));
-        atomic_set(&(rc->ref_count), 0);
+        refcount_set(&(rc->ref_count), 0);
 
         return rc;
 
@@ -361,7 +361,7 @@ debug_info_create(const char *name, int pages_per_area, int nr_areas,
         debug_area_last = rc;
         rc->next = NULL;
 
-        debug_info_get(rc);
+        refcount_set(&rc->ref_count, 1);
 out:
         return rc;
 }
@@ -416,7 +416,7 @@ static void
 debug_info_get(debug_info_t * db_info)
 {
         if (db_info)
-                atomic_inc(&db_info->ref_count);
+                refcount_inc(&db_info->ref_count);
 }
 
 /*
@@ -431,7 +431,7 @@ debug_info_put(debug_info_t *db_info)
 
         if (!db_info)
                 return;
-        if (atomic_dec_and_test(&db_info->ref_count)) {
+        if (refcount_dec_and_test(&db_info->ref_count)) {
                 for (i = 0; i < DEBUG_MAX_VIEWS; i++) {
                         if (!db_info->views[i])
                                 continue;
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index a5f5d3bb3dbc..e408d9cc5b96 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -312,6 +312,7 @@ ENTRY(system_call)
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
+.Lsysc_exit_timer:
         stpt    __LC_EXIT_TIMER
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
@@ -623,6 +624,7 @@ ENTRY(io_int_handler)
         lg      %r14,__LC_VDSO_PER_CPU
         lmg     %r0,%r10,__PT_R0(%r11)
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r11)
+.Lio_exit_timer:
         stpt    __LC_EXIT_TIMER
         mvc     __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER
         lmg     %r11,%r15,__PT_R11(%r11)
@@ -1174,15 +1176,23 @@ cleanup_critical:
         br      %r14
 
 .Lcleanup_sysc_restore:
+        # check if stpt has been executed
         clg     %r9,BASED(.Lcleanup_sysc_restore_insn)
+        jh      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_ASYNC_ENTER_TIMER
+        cghi    %r11,__LC_SAVE_AREA_ASYNC
         je      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER
+0:      clg     %r9,BASED(.Lcleanup_sysc_restore_insn+8)
+        je      1f
         lg      %r9,24(%r11)            # get saved pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
         mvc     0(64,%r11),__PT_R8(%r9)
         lmg     %r0,%r7,__PT_R0(%r9)
-0:      lmg     %r8,%r9,__LC_RETURN_PSW
+1:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
 .Lcleanup_sysc_restore_insn:
+        .quad   .Lsysc_exit_timer
         .quad   .Lsysc_done - 4
 
 .Lcleanup_io_tif:
@@ -1190,15 +1200,20 @@ cleanup_critical:
         br      %r14
 
 .Lcleanup_io_restore:
+        # check if stpt has been executed
         clg     %r9,BASED(.Lcleanup_io_restore_insn)
-        je      0f
+        jh      0f
+        mvc     __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER
+0:      clg     %r9,BASED(.Lcleanup_io_restore_insn+8)
+        je      1f
         lg      %r9,24(%r11)            # get saved r11 pointer to pt_regs
         mvc     __LC_RETURN_PSW(16),__PT_PSW(%r9)
         mvc     0(64,%r11),__PT_R8(%r9)
         lmg     %r0,%r7,__PT_R0(%r9)
-0:      lmg     %r8,%r9,__LC_RETURN_PSW
+1:      lmg     %r8,%r9,__LC_RETURN_PSW
         br      %r14
 .Lcleanup_io_restore_insn:
+        .quad   .Lio_exit_timer
         .quad   .Lio_done - 4
 
 .Lcleanup_idle:
diff --git a/arch/s390/kernel/ftrace.c b/arch/s390/kernel/ftrace.c
index 27477f34cc0a..d03a6d12c4bd 100644
--- a/arch/s390/kernel/ftrace.c
+++ b/arch/s390/kernel/ftrace.c
@@ -173,6 +173,8 @@ int __init ftrace_dyn_arch_init(void)
         return 0;
 }
 
+#ifdef CONFIG_MODULES
+
 static int __init ftrace_plt_init(void)
 {
         unsigned int *ip;
@@ -191,6 +193,8 @@ static int __init ftrace_plt_init(void)
 }
 device_initcall(ftrace_plt_init);
 
+#endif /* CONFIG_MODULES */
+
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 /*
  * Hook the return address and push it in the stack of return addresses
diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
index 72307f108c40..6e2c42bd1c3b 100644
--- a/arch/s390/kernel/vmlinux.lds.S
+++ b/arch/s390/kernel/vmlinux.lds.S
@@ -31,8 +31,14 @@ SECTIONS
 {
         . = 0x00000000;
         .text : {
-        _text = .;              /* Text and read-only data */
+                /* Text and read-only data */
                 HEAD_TEXT
+                /*
+                 * E.g. perf doesn't like symbols starting at address zero,
+                 * therefore skip the initial PSW and channel program located
+                 * at address zero and let _text start at 0x200.
+                 */
+        _text = 0x200;
                 TEXT_TEXT
                 SCHED_TEXT
                 CPUIDLE_TEXT
diff --git a/arch/s390/lib/probes.c b/arch/s390/lib/probes.c
index ae90e1ae3607..1963ddbf4ab3 100644
--- a/arch/s390/lib/probes.c
+++ b/arch/s390/lib/probes.c
@@ -4,6 +4,7 @@
  *    Copyright IBM Corp. 2014
  */
 
+#include <linux/errno.h>
 #include <asm/kprobes.h>
 #include <asm/dis.h>
 
diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c
index 1e5bb2b86c42..b3bd3f23b8e8 100644
--- a/arch/s390/lib/uaccess.c
+++ b/arch/s390/lib/uaccess.c
@@ -337,8 +337,8 @@ long __strncpy_from_user(char *dst, const char __user *src, long size)
                 return 0;
         done = 0;
         do {
-                offset = (size_t)src & ~PAGE_MASK;
-                len = min(size - done, PAGE_SIZE - offset);
+                offset = (size_t)src & (L1_CACHE_BYTES - 1);
+                len = min(size - done, L1_CACHE_BYTES - offset);
                 if (copy_from_user(dst, src, len))
                         return -EFAULT;
                 len_str = strnlen(dst, len);
diff --git a/arch/sparc/include/asm/hugetlb.h b/arch/sparc/include/asm/hugetlb.h
index dcbf985ab243..d1f837dc77a4 100644
--- a/arch/sparc/include/asm/hugetlb.h
+++ b/arch/sparc/include/asm/hugetlb.h
@@ -24,9 +24,11 @@ static inline int is_hugepage_only_range(struct mm_struct *mm,
 static inline int prepare_hugepage_range(struct file *file,
                         unsigned long addr, unsigned long len)
 {
-        if (len & ~HPAGE_MASK)
+        struct hstate *h = hstate_file(file);
+
+        if (len & ~huge_page_mask(h))
                 return -EINVAL;
-        if (addr & ~HPAGE_MASK)
+        if (addr & ~huge_page_mask(h))
                 return -EINVAL;
         return 0;
 }
diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
index ce6f56980aef..cf190728360b 100644
--- a/arch/sparc/include/asm/pgtable_32.h
+++ b/arch/sparc/include/asm/pgtable_32.h
@@ -91,9 +91,9 @@ extern unsigned long pfn_base;
  * ZERO_PAGE is a global shared page that is always zero: used
  * for zero-mapped memory areas etc..
  */
-extern unsigned long empty_zero_page;
+extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 
-#define ZERO_PAGE(vaddr) (virt_to_page(&empty_zero_page))
+#define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page))
 
 /*
  * In general all page table modifications should use the V8 atomic
diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h
index 478bf6bb4598..3fae200dd251 100644
--- a/arch/sparc/include/asm/setup.h
+++ b/arch/sparc/include/asm/setup.h
@@ -16,7 +16,7 @@ extern char reboot_command[];
  */
 extern unsigned char boot_cpu_id;
 
-extern unsigned long empty_zero_page;
+extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 
 extern int serial_console;
 static inline int con_is_present(void)
diff --git a/arch/sparc/kernel/ftrace.c b/arch/sparc/kernel/ftrace.c
index 6bcff698069b..cec54dc4ab81 100644
--- a/arch/sparc/kernel/ftrace.c
+++ b/arch/sparc/kernel/ftrace.c
@@ -130,17 +130,16 @@ unsigned long prepare_ftrace_return(unsigned long parent,
         if (unlikely(atomic_read(&current->tracing_graph_pause)))
                 return parent + 8UL;
 
-        if (ftrace_push_return_trace(parent, self_addr, &trace.depth,
-                                     frame_pointer, NULL) == -EBUSY)
-                return parent + 8UL;
-
         trace.func = self_addr;
+        trace.depth = current->curr_ret_stack + 1;
 
         /* Only trace if the calling function expects to */
-        if (!ftrace_graph_entry(&trace)) {
-                current->curr_ret_stack--;
+        if (!ftrace_graph_entry(&trace))
+                return parent + 8UL;
+
+        if (ftrace_push_return_trace(parent, self_addr, &trace.depth,
+                                     frame_pointer, NULL) == -EBUSY)
                 return parent + 8UL;
-        }
 
         return return_hooker;
 }
diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c
index c6afe98de4d9..3bd0d513bddb 100644
--- a/arch/sparc/mm/init_32.c
+++ b/arch/sparc/mm/init_32.c
@@ -290,7 +290,7 @@ void __init mem_init(void)
 
 
         /* Saves us work later. */
-        memset((void *)&empty_zero_page, 0, PAGE_SIZE);
+        memset((void *)empty_zero_page, 0, PAGE_SIZE);
 
         i = last_valid_pfn >> ((20 - PAGE_SHIFT) + 5);
         i += 1;
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index cd18994a9555..4ccfacc7232a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -360,7 +360,7 @@ config SMP
           Management" code will be disabled if you say Y here.
 
           See also <file:Documentation/x86/i386/IO-APIC.txt>,
-          <file:Documentation/nmi_watchdog.txt> and the SMP-HOWTO available at
+          <file:Documentation/lockup-watchdogs.txt> and the SMP-HOWTO available at
           <http://www.tldp.org/docs.html#howto>.
 
           If you don't know what to do here, say N.
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 5851411e60fb..bf240b920473 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -159,7 +159,7 @@ ifdef CONFIG_FUNCTION_GRAPH_TRACER
         # If '-Os' is enabled, disable it and print a warning.
         ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
           undefine CONFIG_CC_OPTIMIZE_FOR_SIZE
-          $(warning Disabling CONFIG_CC_OPTIMIZE_FOR_SIZE.  Your compiler does not have -mfentry so you cannot optimize for size with CONFIG_FUNCTION_GRAPH_TRACER.)
+          $(warning Disabling CONFIG_CC_OPTIMIZE_FOR_SIZE.  Your compiler does not have -mfentry so you cannot optimize for size with CONFIG_FUNCTION_GRAPH_TRACER.)
         endif
 
     endif
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index 44163e8c3868..2c860ad4fe06 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -94,7 +94,7 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o
 quiet_cmd_check_data_rel = DATAREL $@
 define cmd_check_data_rel
         for obj in $(filter %.o,$^); do \
-                readelf -S $$obj | grep -qF .rel.local && { \
+                ${CROSS_COMPILE}readelf -S $$obj | grep -qF .rel.local && { \
                         echo "error: $$obj has data relocations!" >&2; \
                         exit 1; \
                 } || true; \
diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S
index 50bc26949e9e..48ef7bb32c42 100644
--- a/arch/x86/entry/entry_32.S
+++ b/arch/x86/entry/entry_32.S
@@ -252,6 +252,23 @@ ENTRY(__switch_to_asm)
 END(__switch_to_asm)
 
 /*
+ * The unwinder expects the last frame on the stack to always be at the same
+ * offset from the end of the page, which allows it to validate the stack.
+ * Calling schedule_tail() directly would break that convention because its an
+ * asmlinkage function so its argument has to be pushed on the stack.  This
+ * wrapper creates a proper "end of stack" frame header before the call.
+ */
+ENTRY(schedule_tail_wrapper)
+        FRAME_BEGIN
+
+        pushl   %eax
+        call    schedule_tail
+        popl    %eax
+
+        FRAME_END
+        ret
+ENDPROC(schedule_tail_wrapper)
+/*
  * A newly forked process directly context switches into this address.
  *
  * eax: prev task we switched from
@@ -259,24 +276,15 @@ END(__switch_to_asm)
  * edi: kernel thread arg
  */
 ENTRY(ret_from_fork)
-        FRAME_BEGIN             /* help unwinder find end of stack */
-
-        /*
-         * schedule_tail() is asmlinkage so we have to put its 'prev' argument
-         * on the stack.
-         */
-        pushl   %eax
-        call    schedule_tail
-        popl    %eax
+        call    schedule_tail_wrapper
 
         testl   %ebx, %ebx
         jnz     1f              /* kernel threads are uncommon */
 
 2:
         /* When we fork, we trace the syscall return in the child, too. */
-        leal    FRAME_OFFSET(%esp), %eax
+        movl    %esp, %eax
         call    syscall_return_slowpath
-        FRAME_END
         jmp     restore_all
 
         /* kernel thread */
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index 607d72c4a485..4a4c0834f965 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -36,7 +36,6 @@
 #include <asm/smap.h>
 #include <asm/pgtable_types.h>
 #include <asm/export.h>
-#include <asm/frame.h>
 #include <linux/err.h>
 
 .code64
@@ -406,19 +405,17 @@ END(__switch_to_asm)
  * r12: kernel thread arg
  */
 ENTRY(ret_from_fork)
-        FRAME_BEGIN                     /* help unwinder find end of stack */
         movq    %rax, %rdi
-        call    schedule_tail           /* rdi: 'prev' task parameter */
+        call    schedule_tail                   /* rdi: 'prev' task parameter */
 
-        testq   %rbx, %rbx              /* from kernel_thread? */
-        jnz     1f                      /* kernel threads are uncommon */
+        testq   %rbx, %rbx                      /* from kernel_thread? */
+        jnz     1f                              /* kernel threads are uncommon */
 
 2:
-        leaq    FRAME_OFFSET(%rsp),%rdi /* pt_regs pointer */
+        movq    %rsp, %rdi
         call    syscall_return_slowpath /* returns with IRQs disabled */
         TRACE_IRQS_ON                   /* user mode is traced as IRQS on */
         SWAPGS
-        FRAME_END
         jmp     restore_regs_and_iret
 
 1:
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 9c761fea0c98..695605eb1dfb 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -43,7 +43,7 @@
 #define KVM_PRIVATE_MEM_SLOTS 3
 #define KVM_MEM_SLOTS_NUM (KVM_USER_MEM_SLOTS + KVM_PRIVATE_MEM_SLOTS)
 
-#define KVM_HALT_POLL_NS_DEFAULT 400000
+#define KVM_HALT_POLL_NS_DEFAULT 200000
 
 #define KVM_IRQCHIP_NUM_PINS  KVM_IOAPIC_NUM_PINS
 
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 4fd5195deed0..3f9a3d2a5209 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -266,6 +266,7 @@ static inline int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *s
 #endif
 
 int mce_available(struct cpuinfo_x86 *c);
+bool mce_is_memory_error(struct mce *m);
 
 DECLARE_PER_CPU(unsigned, mce_exception_count);
 DECLARE_PER_CPU(unsigned, mce_poll_count);
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 68766b276d9e..a059aac9e937 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -319,10 +319,10 @@ do {									\
 #define __get_user_asm_u64(x, ptr, retval, errret)                      \
 ({                                                                      \
         __typeof__(ptr) __ptr = (ptr);                                  \
-        asm volatile(ASM_STAC "\n"                                      \
+        asm volatile("\n"                                       \
                      "1:        movl %2,%%eax\n"                        \
                      "2:        movl %3,%%edx\n"                        \
-                     "3: " ASM_CLAC "\n"                                \
+                     "3:\n"                             \
                      ".section .fixup,\"ax\"\n"                         \
                      "4:        mov %4,%0\n"                            \
                      "  xorl %%eax,%%eax\n"                             \
@@ -331,7 +331,7 @@ do {									\
                      ".previous\n"                                      \
                      _ASM_EXTABLE(1b, 4b)                               \
                      _ASM_EXTABLE(2b, 4b)                               \
-                     : "=r" (retval), "=A"(x)                           \
+                     : "=r" (retval), "=&A"(x)                          \
                      : "m" (__m(__ptr)), "m" __m(((u32 *)(__ptr)) + 1), \
                        "i" (errret), "0" (retval));                     \
 })
@@ -703,14 +703,15 @@ extern struct movsl_mask {
 #define unsafe_put_user(x, ptr, err_label)                                      \
 do {                                                                            \
         int __pu_err;                                                           \
-        __put_user_size((x), (ptr), sizeof(*(ptr)), __pu_err, -EFAULT);         \
+        __typeof__(*(ptr)) __pu_val = (x);                                      \
+        __put_user_size(__pu_val, (ptr), sizeof(*(ptr)), __pu_err, -EFAULT);    \
         if (unlikely(__pu_err)) goto err_label;                                 \
 } while (0)
 
 #define unsafe_get_user(x, ptr, err_label)                                      \
 do {                                                                            \
         int __gu_err;                                                           \
-        unsigned long __gu_val;                                                 \
+        __inttype(*(ptr)) __gu_val;                                             \
         __get_user_size(__gu_val, (ptr), sizeof(*(ptr)), __gu_err, -EFAULT);    \
         (x) = (__force __typeof__(*(ptr)))__gu_val;                             \
         if (unlikely(__gu_err)) goto err_label;                                 \
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index c5b8f760473c..32e14d137416 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -409,8 +409,13 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
                 memcpy(insnbuf, replacement, a->replacementlen);
                 insnbuf_sz = a->replacementlen;
 
-                /* 0xe8 is a relative jump; fix the offset. */
-                if (*insnbuf == 0xe8 && a->replacementlen == 5) {
+                /*
+                 * 0xe8 is a relative jump; fix the offset.
+                 *
+                 * Instruction length is checked before the opcode to avoid
+                 * accessing uninitialized bytes for zero-length replacements.
+                 */
+                if (a->replacementlen == 5 && *insnbuf == 0xe8) {
                         *(s32 *)(insnbuf + 1) += replacement - instr;
                         DPRINTK("Fix CALL offset: 0x%x, CALL 0x%lx",
                                 *(s32 *)(insnbuf + 1),
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 5abd4bf73d6e..5cfbaeb6529a 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -499,16 +499,14 @@ static int mce_usable_address(struct mce *m)
         return 1;
 }
 
-static bool memory_error(struct mce *m)
+bool mce_is_memory_error(struct mce *m)
 {
-        struct cpuinfo_x86 *c = &boot_cpu_data;
-
-        if (c->x86_vendor == X86_VENDOR_AMD) {
+        if (m->cpuvendor == X86_VENDOR_AMD) {
                 /* ErrCodeExt[20:16] */
                 u8 xec = (m->status >> 16) & 0x1f;
 
                 return (xec == 0x0 || xec == 0x8);
-        } else if (c->x86_vendor == X86_VENDOR_INTEL) {
+        } else if (m->cpuvendor == X86_VENDOR_INTEL) {
                 /*
                  * Intel SDM Volume 3B - 15.9.2 Compound Error Codes
                  *
@@ -529,6 +527,7 @@ static bool memory_error(struct mce *m)
 
         return false;
 }
+EXPORT_SYMBOL_GPL(mce_is_memory_error);
 
 static bool cec_add_mce(struct mce *m)
 {
@@ -536,7 +535,7 @@ static bool cec_add_mce(struct mce *m)
                 return false;
 
         /* We eat only correctable DRAM errors with usable addresses. */
-        if (memory_error(m) &&
+        if (mce_is_memory_error(m) &&
             !(m->status & MCI_STATUS_UC) &&
             mce_usable_address(m))
                 if (!cec_add_elem(m->addr >> PAGE_SHIFT))
@@ -713,7 +712,7 @@ bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
 
                 severity = mce_severity(&m, mca_cfg.tolerant, NULL, false);
 
-                if (severity == MCE_DEFERRED_SEVERITY && memory_error(&m))
+                if (severity == MCE_DEFERRED_SEVERITY && mce_is_memory_error(&m))
                         if (m.status & MCI_STATUS_ADDRV)
                                 m.severity = severity;
 
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index c2f8dde3255c..d5d44c452624 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -90,6 +90,7 @@ static void fpu__init_system_early_generic(struct cpuinfo_x86 *c)
  * Boot time FPU feature detection code:
  */
 unsigned int mxcsr_feature_mask __read_mostly = 0xffffffffu;
+EXPORT_SYMBOL_GPL(mxcsr_feature_mask);
 
 static void __init fpu__init_system_mxcsr(void)
 {
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 0651e974dcb3..9bef1bbeba63 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -689,8 +689,12 @@ static inline void *alloc_tramp(unsigned long size)
 {
         return module_alloc(size);
 }
-static inline void tramp_free(void *tramp)
+static inline void tramp_free(void *tramp, int size)
 {
+        int npages = PAGE_ALIGN(size) >> PAGE_SHIFT;
+
+        set_memory_nx((unsigned long)tramp, npages);
+        set_memory_rw((unsigned long)tramp, npages);
         module_memfree(tramp);
 }
 #else
@@ -699,7 +703,7 @@ static inline void *alloc_tramp(unsigned long size)
 {
         return NULL;
 }
-static inline void tramp_free(void *tramp) { }
+static inline void tramp_free(void *tramp, int size) { }
 #endif
 
 /* Defined as markers to the end of the ftrace default trampolines */
@@ -771,7 +775,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
         /* Copy ftrace_caller onto the trampoline memory */
         ret = probe_kernel_read(trampoline, (void *)start_offset, size);
         if (WARN_ON(ret < 0)) {
-                tramp_free(trampoline);
+                tramp_free(trampoline, *tramp_size);
                 return 0;
         }
 
@@ -797,7 +801,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
 
         /* Are we pointing to the reference? */
         if (WARN_ON(memcmp(op_ptr.op, op_ref, 3) != 0)) {
-                tramp_free(trampoline);
+                tramp_free(trampoline, *tramp_size);
                 return 0;
         }
 
@@ -839,7 +843,7 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
         unsigned long offset;
         unsigned long ip;
         unsigned int size;
-        int ret;
+        int ret, npages;
 
         if (ops->trampoline) {
                 /*
@@ -848,11 +852,14 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
                  */
                 if (!(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
                         return;
+                npages = PAGE_ALIGN(ops->trampoline_size) >> PAGE_SHIFT;
+                set_memory_rw(ops->trampoline, npages);
         } else {
                 ops->trampoline = create_trampoline(ops, &size);
                 if (!ops->trampoline)
                         return;
                 ops->trampoline_size = size;
+                npages = PAGE_ALIGN(size) >> PAGE_SHIFT;
         }
 
         offset = calc_trampoline_call_offset(ops->flags & FTRACE_OPS_FL_SAVE_REGS);
@@ -863,6 +870,7 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
         /* Do a safe modify in case the trampoline is executing */
         new = ftrace_call_replace(ip, (unsigned long)func);
         ret = update_ftrace_func(ip, new);
+        set_memory_ro(ops->trampoline, npages);
 
         /* The update should never fail */
         WARN_ON(ret);
@@ -939,7 +947,7 @@ void arch_ftrace_trampoline_free(struct ftrace_ops *ops)
         if (!ops || !(ops->flags & FTRACE_OPS_FL_ALLOC_TRAMP))
                 return;
 
-        tramp_free((void *)ops->trampoline);
+        tramp_free((void *)ops->trampoline, ops->trampoline_size);
         ops->trampoline = 0;
 }
 
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 5b2bbfbb3712..6b877807598b 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -52,6 +52,7 @@
 #include <linux/ftrace.h>
 #include <linux/frame.h>
 #include <linux/kasan.h>
+#include <linux/moduleloader.h>
 
 #include <asm/text-patching.h>
 #include <asm/cacheflush.h>
@@ -417,6 +418,14 @@ static void prepare_boost(struct kprobe *p, struct insn *insn)
         }
 }
 
+/* Recover page to RW mode before releasing it */
+void free_insn_page(void *page)
+{
+        set_memory_nx((unsigned long)page & PAGE_MASK, 1);
+        set_memory_rw((unsigned long)page & PAGE_MASK, 1);
+        module_memfree(page);
+}
+
 static int arch_copy_kprobe(struct kprobe *p)
 {
         struct insn insn;
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 0b4d3c686b1e..f81823695014 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -980,8 +980,6 @@ void __init setup_arch(char **cmdline_p)
          */
         x86_configure_nx();
 
-        simple_udelay_calibration();
-
         parse_early_param();
 
 #ifdef CONFIG_MEMORY_HOTPLUG
@@ -1041,6 +1039,8 @@ void __init setup_arch(char **cmdline_p)
          */
         init_hypervisor_platform();
 
+        simple_udelay_calibration();
+
         x86_init.resources.probe_roms();
 
         /* after parse_early_param, so could debug it */
diff --git a/arch/x86/kernel/unwind_frame.c b/arch/x86/kernel/unwind_frame.c
index 82c6d7f1fd73..b9389d72b2f7 100644
--- a/arch/x86/kernel/unwind_frame.c
+++ b/arch/x86/kernel/unwind_frame.c
@@ -104,6 +104,11 @@ static inline unsigned long *last_frame(struct unwind_state *state)
         return (unsigned long *)task_pt_regs(state->task) - 2;
 }
 
+static bool is_last_frame(struct unwind_state *state)
+{
+        return state->bp == last_frame(state);
+}
+
 #ifdef CONFIG_X86_32
 #define GCC_REALIGN_WORDS 3
 #else
@@ -115,16 +120,15 @@ static inline unsigned long *last_aligned_frame(struct unwind_state *state)
         return last_frame(state) - GCC_REALIGN_WORDS;
 }
 
-static bool is_last_task_frame(struct unwind_state *state)
+static bool is_last_aligned_frame(struct unwind_state *state)
 {
         unsigned long *last_bp = last_frame(state);
         unsigned long *aligned_bp = last_aligned_frame(state);
 
         /*
-         * We have to check for the last task frame at two different locations
-         * because gcc can occasionally decide to realign the stack pointer and
-         * change the offset of the stack frame in the prologue of a function
-         * called by head/entry code.  Examples:
+         * GCC can occasionally decide to realign the stack pointer and change
+         * the offset of the stack frame in the prologue of a function called
+         * by head/entry code.  Examples:
          *
          * <start_secondary>:
          *      push   %edi
@@ -141,11 +145,38 @@ static bool is_last_task_frame(struct unwind_state *state)
          *      push   %rbp
          *      mov    %rsp,%rbp
          *
-         * Note that after aligning the stack, it pushes a duplicate copy of
-         * the return address before pushing the frame pointer.
+         * After aligning the stack, it pushes a duplicate copy of the return
+         * address before pushing the frame pointer.
+         */
+        return (state->bp == aligned_bp && *(aligned_bp + 1) == *(last_bp + 1));
+}
+
+static bool is_last_ftrace_frame(struct unwind_state *state)
+{
+        unsigned long *last_bp = last_frame(state);
+        unsigned long *last_ftrace_bp = last_bp - 3;
+
+        /*
+         * When unwinding from an ftrace handler of a function called by entry
+         * code, the stack layout of the last frame is:
+         *
+         *   bp
+         *   parent ret addr
+         *   bp
+         *   function ret addr
+         *   parent ret addr
+         *   pt_regs
+         *   -----------------
          */
-        return (state->bp == last_bp ||
-                (state->bp == aligned_bp && *(aligned_bp+1) == *(last_bp+1)));
+        return (state->bp == last_ftrace_bp &&
+                *state->bp == *(state->bp + 2) &&
+                *(state->bp + 1) == *(state->bp + 4));
+}
+
+static bool is_last_task_frame(struct unwind_state *state)
+{
+        return is_last_frame(state) || is_last_aligned_frame(state) ||
+               is_last_ftrace_frame(state);
 }
 
 /*
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index c25cfaf584e7..0816ab2e8adc 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4173,7 +4173,7 @@ static int check_dr_write(struct x86_emulate_ctxt *ctxt)
 
 static int check_svme(struct x86_emulate_ctxt *ctxt)
 {
-        u64 efer;
+        u64 efer = 0;
 
         ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
 
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 56241746abbd..b0454c7e4cff 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -283,11 +283,13 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
         pt_element_t pte;
         pt_element_t __user *uninitialized_var(ptep_user);
         gfn_t table_gfn;
-        unsigned index, pt_access, pte_access, accessed_dirty, pte_pkey;
+        u64 pt_access, pte_access;
+        unsigned index, accessed_dirty, pte_pkey;
         unsigned nested_access;
         gpa_t pte_gpa;
         bool have_ad;
         int offset;
+        u64 walk_nx_mask = 0;
         const int write_fault = access & PFERR_WRITE_MASK;
         const int user_fault  = access & PFERR_USER_MASK;
         const int fetch_fault = access & PFERR_FETCH_MASK;
@@ -302,6 +304,7 @@ retry_walk:
         have_ad       = PT_HAVE_ACCESSED_DIRTY(mmu);
 
 #if PTTYPE == 64
+        walk_nx_mask = 1ULL << PT64_NX_SHIFT;
         if (walker->level == PT32E_ROOT_LEVEL) {
                 pte = mmu->get_pdptr(vcpu, (addr >> 30) & 3);
                 trace_kvm_mmu_paging_element(pte, walker->level);
@@ -313,8 +316,6 @@ retry_walk:
         walker->max_level = walker->level;
         ASSERT(!(is_long_mode(vcpu) && !is_pae(vcpu)));
 
-        accessed_dirty = have_ad ? PT_GUEST_ACCESSED_MASK : 0;
-
         /*
          * FIXME: on Intel processors, loads of the PDPTE registers for PAE paging
          * by the MOV to CR instruction are treated as reads and do not cause the
@@ -322,14 +323,14 @@ retry_walk:
          */
         nested_access = (have_ad ? PFERR_WRITE_MASK : 0) | PFERR_USER_MASK;
 
-        pt_access = pte_access = ACC_ALL;
+        pte_access = ~0;
         ++walker->level;
 
         do {
                 gfn_t real_gfn;
                 unsigned long host_addr;
 
-                pt_access &= pte_access;
+                pt_access = pte_access;
                 --walker->level;
 
                 index = PT_INDEX(addr, walker->level);
@@ -371,6 +372,12 @@ retry_walk:
 
                 trace_kvm_mmu_paging_element(pte, walker->level);
 
+                /*
+                 * Inverting the NX it lets us AND it like other
+                 * permission bits.
+                 */
+                pte_access = pt_access & (pte ^ walk_nx_mask);
+
                 if (unlikely(!FNAME(is_present_gpte)(pte)))
                         goto error;
 
@@ -379,14 +386,16 @@ retry_walk:
                         goto error;
                 }
 
-                accessed_dirty &= pte;
-                pte_access = pt_access & FNAME(gpte_access)(vcpu, pte);
-
                 walker->ptes[walker->level - 1] = pte;
         } while (!is_last_gpte(mmu, walker->level, pte));
 
         pte_pkey = FNAME(gpte_pkeys)(vcpu, pte);
-        errcode = permission_fault(vcpu, mmu, pte_access, pte_pkey, access);
+        accessed_dirty = have_ad ? pte_access & PT_GUEST_ACCESSED_MASK : 0;
+
+        /* Convert to ACC_*_MASK flags for struct guest_walker.  */
+        walker->pt_access = FNAME(gpte_access)(vcpu, pt_access ^ walk_nx_mask);
+        walker->pte_access = FNAME(gpte_access)(vcpu, pte_access ^ walk_nx_mask);
+        errcode = permission_fault(vcpu, mmu, walker->pte_access, pte_pkey, access);
         if (unlikely(errcode))
                 goto error;
 
@@ -403,7 +412,7 @@ retry_walk:
         walker->gfn = real_gpa >> PAGE_SHIFT;
 
         if (!write_fault)
-                FNAME(protect_clean_gpte)(mmu, &pte_access, pte);
+                FNAME(protect_clean_gpte)(mmu, &walker->pte_access, pte);
         else
                 /*
                  * On a write fault, fold the dirty bit into accessed_dirty.
@@ -421,10 +430,8 @@ retry_walk:
                         goto retry_walk;
         }
 
-        walker->pt_access = pt_access;
-        walker->pte_access = pte_access;
         pgprintk("%s: pte %llx pte_access %x pt_access %x\n",
-                 __func__, (u64)pte, pte_access, pt_access);
+                 __func__, (u64)pte, walker->pte_access, walker->pt_access);
         return 1;
 
 error:
@@ -452,7 +459,7 @@ error:
          */
         if (!(errcode & PFERR_RSVD_MASK)) {
                 vcpu->arch.exit_qualification &= 0x187;
-                vcpu->arch.exit_qualification |= ((pt_access & pte) & 0x7) << 3;
+                vcpu->arch.exit_qualification |= (pte_access & 0x7) << 3;
         }
 #endif
         walker->fault.address = addr;
diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
index 9d4a8504a95a..5ab4a364348e 100644
--- a/arch/x86/kvm/pmu_intel.c
+++ b/arch/x86/kvm/pmu_intel.c
@@ -294,7 +294,7 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
                         ((u64)1 << edx.split.bit_width_fixed) - 1;
         }
 
-        pmu->global_ctrl = ((1 << pmu->nr_arch_gp_counters) - 1) |
+        pmu->global_ctrl = ((1ull << pmu->nr_arch_gp_counters) - 1) |
                 (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED);
         pmu->global_ctrl_mask = ~pmu->global_ctrl;
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index c27ac6923a18..183ddb235fb4 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1272,7 +1272,8 @@ static void init_vmcb(struct vcpu_svm *svm)
 
 }
 
-static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu, int index)
+static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu,
+                                       unsigned int index)
 {
         u64 *avic_physical_id_table;
         struct kvm_arch *vm_data = &vcpu->kvm->arch;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c6f4ad44aa95..72f78396bc09 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6504,7 +6504,7 @@ static __init int hardware_setup(void)
                 enable_ept_ad_bits = 0;
         }
 
-        if (!cpu_has_vmx_ept_ad_bits())
+        if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
                 enable_ept_ad_bits = 0;
 
         if (!cpu_has_vmx_unrestricted_guest())
@@ -11213,7 +11213,7 @@ static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu)
                 if (!nested_cpu_has_pml(vmcs12))
                         return 0;
 
-                if (vmcs12->guest_pml_index > PML_ENTITY_NUM) {
+                if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) {
                         vmx->nested.pml_full = true;
                         return 1;
                 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 464da936c53d..02363e37d4a6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1763,6 +1763,7 @@ u64 get_kvmclock_ns(struct kvm *kvm)
 {
         struct kvm_arch *ka = &kvm->arch;
         struct pvclock_vcpu_time_info hv_clock;
+        u64 ret;
 
         spin_lock(&ka->pvclock_gtod_sync_lock);
         if (!ka->use_master_clock) {
@@ -1774,10 +1775,17 @@ u64 get_kvmclock_ns(struct kvm *kvm)
         hv_clock.system_time = ka->master_kernel_ns + ka->kvmclock_offset;
         spin_unlock(&ka->pvclock_gtod_sync_lock);
 
+        /* both __this_cpu_read() and rdtsc() should be on the same cpu */
+        get_cpu();
+
         kvm_get_time_scale(NSEC_PER_SEC, __this_cpu_read(cpu_tsc_khz) * 1000LL,
                            &hv_clock.tsc_shift,
                            &hv_clock.tsc_to_system_mul);
-        return __pvclock_read_cycles(&hv_clock, rdtsc());
+        ret = __pvclock_read_cycles(&hv_clock, rdtsc());
+
+        put_cpu();
+
+        return ret;
 }
 
 static void kvm_setup_pvclock_page(struct kvm_vcpu *v)
@@ -3288,11 +3296,14 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
         }
 }
 
+#define XSAVE_MXCSR_OFFSET 24
+
 static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
                                         struct kvm_xsave *guest_xsave)
 {
         u64 xstate_bv =
                 *(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)];
+        u32 mxcsr = *(u32 *)&guest_xsave->region[XSAVE_MXCSR_OFFSET / sizeof(u32)];
 
         if (boot_cpu_has(X86_FEATURE_XSAVE)) {
                 /*
@@ -3300,11 +3311,13 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
                  * CPUID leaf 0xD, index 0, EDX:EAX.  This is for compatibility
                  * with old userspace.
                  */
-                if (xstate_bv & ~kvm_supported_xcr0())
+                if (xstate_bv & ~kvm_supported_xcr0() ||
+                        mxcsr & ~mxcsr_feature_mask)
                         return -EINVAL;
                 load_xsave(vcpu, (u8 *)guest_xsave->region);
         } else {
-                if (xstate_bv & ~XFEATURE_MASK_FPSSE)
+                if (xstate_bv & ~XFEATURE_MASK_FPSSE ||
+                        mxcsr & ~mxcsr_feature_mask)
                         return -EINVAL;
                 memcpy(&vcpu->arch.guest_fpu.state.fxsave,
                         guest_xsave->region, sizeof(struct fxregs_state));
@@ -4818,16 +4831,20 @@ emul_write:
 
 static int kernel_pio(struct kvm_vcpu *vcpu, void *pd)
 {
-        /* TODO: String I/O for in kernel device */
-        int r;
+        int r = 0, i;
 
-        if (vcpu->arch.pio.in)
-                r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port,
-                                    vcpu->arch.pio.size, pd);
-        else
-                r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
-                                     vcpu->arch.pio.port, vcpu->arch.pio.size,
-                                     pd);
+        for (i = 0; i < vcpu->arch.pio.count; i++) {
+                if (vcpu->arch.pio.in)
+                        r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port,
+                                            vcpu->arch.pio.size, pd);
+                else
+                        r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
+                                             vcpu->arch.pio.port, vcpu->arch.pio.size,
+                                             pd);
+                if (r)
+                        break;
+                pd += vcpu->arch.pio.size;
+        }
         return r;
 }
 
@@ -4865,6 +4882,8 @@ static int emulator_pio_in_emulated(struct x86_emulate_ctxt *ctxt,
         if (vcpu->arch.pio.count)
                 goto data_avail;
 
+        memset(vcpu->arch.pio_data, 0, size * count);
+
         ret = emulator_pio_in_out(vcpu, size, port, val, count, true);
         if (ret) {
 data_avail:
@@ -5048,6 +5067,8 @@ static bool emulator_get_segment(struct x86_emulate_ctxt *ctxt, u16 *selector,
 
         if (var.unusable) {
                 memset(desc, 0, sizeof(*desc));
+                if (base3)
+                        *base3 = 0;
                 return false;
         }
 
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 1dcd2be4cce4..c8520b2c62d2 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -186,7 +186,7 @@ static void cpa_flush_range(unsigned long start, int numpages, int cache)
         unsigned int i, level;
         unsigned long addr;
 
-        BUG_ON(irqs_disabled());
+        BUG_ON(irqs_disabled() && !early_boot_irqs_disabled);
         WARN_ON(PAGE_ALIGN(start) != start);
 
         on_each_cpu(__cpa_flush_range, NULL, 1);
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 9b78685b66e6..83a59a67757a 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -65,9 +65,11 @@ static int __init nopat(char *str)
 }
 early_param("nopat", nopat);
 
+static bool __read_mostly __pat_initialized = false;
+
 bool pat_enabled(void)
 {
-        return !!__pat_enabled;
+        return __pat_initialized;
 }
 EXPORT_SYMBOL_GPL(pat_enabled);
 
@@ -225,13 +227,14 @@ static void pat_bsp_init(u64 pat)
         }
 
         wrmsrl(MSR_IA32_CR_PAT, pat);
+        __pat_initialized = true;
 
         __init_cache_modes(pat);
 }
 
 static void pat_ap_init(u64 pat)
 {
-        if (!boot_cpu_has(X86_FEATURE_PAT)) {
+        if (!this_cpu_has(X86_FEATURE_PAT)) {
                 /*
                  * If this happens we are on a secondary CPU, but switched to
                  * PAT on the boot CPU. We have no way to undo PAT.
@@ -306,7 +309,7 @@ void pat_init(void)
         u64 pat;
         struct cpuinfo_x86 *c = &boot_cpu_data;
 
-        if (!pat_enabled()) {
+        if (!__pat_enabled) {
                 init_cache_modes();
                 return;
         }
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 7cd442690f9d..f33eef4ebd12 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -142,9 +142,7 @@ static void __init xen_banner(void)
         struct xen_extraversion extra;
         HYPERVISOR_xen_version(XENVER_extraversion, &extra);
 
-        pr_info("Booting paravirtualized kernel %son %s\n",
-                xen_feature(XENFEAT_auto_translated_physmap) ?
-                        "with PVH extensions " : "", pv_info.name);
+        pr_info("Booting paravirtualized kernel on %s\n", pv_info.name);
         printk(KERN_INFO "Xen version: %d.%d%s%s\n",
                version >> 16, version & 0xffff, extra.extraversion,
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
@@ -957,15 +955,10 @@ static void xen_write_msr(unsigned int msr, unsigned low, unsigned high)
 
 void xen_setup_shared_info(void)
 {
-        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                set_fixmap(FIX_PARAVIRT_BOOTMAP,
-                           xen_start_info->shared_info);
+        set_fixmap(FIX_PARAVIRT_BOOTMAP, xen_start_info->shared_info);
 
-                HYPERVISOR_shared_info =
-                        (struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
-        } else
-                HYPERVISOR_shared_info =
-                        (struct shared_info *)__va(xen_start_info->shared_info);
+        HYPERVISOR_shared_info =
+                (struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
 
 #ifndef CONFIG_SMP
         /* In UP this is as good a place as any to set up shared info */
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 5e375a5e815f..3be06f3caf3c 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -42,7 +42,7 @@ xmaddr_t arbitrary_virt_to_machine(void *vaddr)
 }
 EXPORT_SYMBOL_GPL(arbitrary_virt_to_machine);
 
-void xen_flush_tlb_all(void)
+static void xen_flush_tlb_all(void)
 {
         struct mmuext_op *op;
         struct multicall_space mcs;
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 7397d8b8459d..1f386d7fdf70 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -355,10 +355,8 @@ static pteval_t pte_pfn_to_mfn(pteval_t val)
                 pteval_t flags = val & PTE_FLAGS_MASK;
                 unsigned long mfn;
 
-                if (!xen_feature(XENFEAT_auto_translated_physmap))
-                        mfn = __pfn_to_mfn(pfn);
-                else
-                        mfn = pfn;
+                mfn = __pfn_to_mfn(pfn);
+
                 /*
                  * If there's no mfn for the pfn, then just create an
                  * empty non-present pte.  Unfortunately this loses
@@ -647,9 +645,6 @@ static int __xen_pgd_walk(struct mm_struct *mm, pgd_t *pgd,
         limit--;
         BUG_ON(limit >= FIXADDR_TOP);
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return 0;
-
         /*
          * 64-bit has a great big hole in the middle of the address
          * space, which contains the Xen mappings.  On 32-bit these
@@ -1289,9 +1284,6 @@ static void __init xen_pagetable_cleanhighmap(void)
 
 static void __init xen_pagetable_p2m_setup(void)
 {
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         xen_vmalloc_p2m_tree();
 
 #ifdef CONFIG_X86_64
@@ -1314,8 +1306,7 @@ static void __init xen_pagetable_init(void)
         xen_build_mfn_list_list();
 
         /* Remap memory freed due to conflicts with E820 map */
-        if (!xen_feature(XENFEAT_auto_translated_physmap))
-                xen_remap_memory();
+        xen_remap_memory();
 
         xen_setup_shared_info();
 }
@@ -1925,21 +1916,20 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
         /* Zap identity mapping */
         init_level4_pgt[0] = __pgd(0);
 
-        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                /* Pre-constructed entries are in pfn, so convert to mfn */
-                /* L4[272] -> level3_ident_pgt
-                 * L4[511] -> level3_kernel_pgt */
-                convert_pfn_mfn(init_level4_pgt);
+        /* Pre-constructed entries are in pfn, so convert to mfn */
+        /* L4[272] -> level3_ident_pgt  */
+        /* L4[511] -> level3_kernel_pgt */
+        convert_pfn_mfn(init_level4_pgt);
 
-                /* L3_i[0] -> level2_ident_pgt */
-                convert_pfn_mfn(level3_ident_pgt);
-                /* L3_k[510] -> level2_kernel_pgt
-                 * L3_k[511] -> level2_fixmap_pgt */
-                convert_pfn_mfn(level3_kernel_pgt);
+        /* L3_i[0] -> level2_ident_pgt */
+        convert_pfn_mfn(level3_ident_pgt);
+        /* L3_k[510] -> level2_kernel_pgt */
+        /* L3_k[511] -> level2_fixmap_pgt */
+        convert_pfn_mfn(level3_kernel_pgt);
+
+        /* L3_k[511][506] -> level1_fixmap_pgt */
+        convert_pfn_mfn(level2_fixmap_pgt);
 
-                /* L3_k[511][506] -> level1_fixmap_pgt */
-                convert_pfn_mfn(level2_fixmap_pgt);
-        }
         /* We get [511][511] and have Xen's version of level2_kernel_pgt */
         l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
         l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
@@ -1962,34 +1952,30 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
         if (i && i < pgd_index(__START_KERNEL_map))
                 init_level4_pgt[i] = ((pgd_t *)xen_start_info->pt_base)[i];
 
-        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                /* Make pagetable pieces RO */
-                set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-                set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO);
-
-                /* Pin down new L4 */
-                pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
-                                  PFN_DOWN(__pa_symbol(init_level4_pgt)));
-
-                /* Unpin Xen-provided one */
-                pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+        /* Make pagetable pieces RO */
+        set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
+        set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO);
+
+        /* Pin down new L4 */
+        pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
+                          PFN_DOWN(__pa_symbol(init_level4_pgt)));
+
+        /* Unpin Xen-provided one */
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
 
-                /*
-                 * At this stage there can be no user pgd, and no page
-                 * structure to attach it to, so make sure we just set kernel
-                 * pgd.
-                 */
-                xen_mc_batch();
-                __xen_write_cr3(true, __pa(init_level4_pgt));
-                xen_mc_issue(PARAVIRT_LAZY_CPU);
-        } else
-                native_write_cr3(__pa(init_level4_pgt));
+        /*
+         * At this stage there can be no user pgd, and no page structure to
+         * attach it to, so make sure we just set kernel pgd.
+         */
+        xen_mc_batch();
+        __xen_write_cr3(true, __pa(init_level4_pgt));
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
 
         /* We can't that easily rip out L3 and L2, as the Xen pagetables are
          * set out this way: [L4], [L1], [L2], [L3], [L1], [L1] ...  for
@@ -2403,9 +2389,6 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 
 static void __init xen_post_allocator_init(void)
 {
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         pv_mmu_ops.set_pte = xen_set_pte;
         pv_mmu_ops.set_pmd = xen_set_pmd;
         pv_mmu_ops.set_pud = xen_set_pud;
@@ -2511,9 +2494,6 @@ void __init xen_init_mmu_ops(void)
 {
         x86_init.paging.pagetable_init = xen_pagetable_init;
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         pv_mmu_ops = xen_mmu_ops;
 
         memset(dummy_mapping, 0xff, PAGE_SIZE);
@@ -2650,9 +2630,6 @@ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
          * this function are redundant and can be ignored.
          */
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return 0;
-
         if (unlikely(order > MAX_CONTIG_ORDER))
                 return -ENOMEM;
 
@@ -2689,9 +2666,6 @@ void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order)
         int success;
         unsigned long vstart;
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         if (unlikely(order > MAX_CONTIG_ORDER))
                 return;
 
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a69ad122ed66..f2224ffd225d 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -628,25 +628,6 @@ void blk_mq_delay_kick_requeue_list(struct request_queue *q,
 }
 EXPORT_SYMBOL(blk_mq_delay_kick_requeue_list);
 
-void blk_mq_abort_requeue_list(struct request_queue *q)
-{
-        unsigned long flags;
-        LIST_HEAD(rq_list);
-
-        spin_lock_irqsave(&q->requeue_lock, flags);
-        list_splice_init(&q->requeue_list, &rq_list);
-        spin_unlock_irqrestore(&q->requeue_lock, flags);
-
-        while (!list_empty(&rq_list)) {
-                struct request *rq;
-
-                rq = list_first_entry(&rq_list, struct request, queuelist);
-                list_del_init(&rq->queuelist);
-                blk_mq_end_request(rq, -EIO);
-        }
-}
-EXPORT_SYMBOL(blk_mq_abort_requeue_list);
-
 struct request *blk_mq_tag_to_rq(struct blk_mq_tags *tags, unsigned int tag)
 {
         if (tag < tags->nr_tags) {
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 504fee940052..712b018e9f54 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -887,10 +887,10 @@ int blk_register_queue(struct gendisk *disk)
                 goto unlock;
         }
 
-        if (q->mq_ops)
+        if (q->mq_ops) {
                 __blk_mq_register_dev(dev, q);
-
-        blk_mq_debugfs_register(q);
+                blk_mq_debugfs_register(q);
+        }
 
         kobject_uevent(&q->kobj, KOBJ_ADD);
 
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index b78db2e5fdff..fc13dd0c6e39 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -22,11 +22,11 @@ static int throtl_quantum = 32;
 #define DFL_THROTL_SLICE_HD (HZ / 10)
 #define DFL_THROTL_SLICE_SSD (HZ / 50)
 #define MAX_THROTL_SLICE (HZ)
-#define DFL_IDLE_THRESHOLD_SSD (1000L) /* 1 ms */
-#define DFL_IDLE_THRESHOLD_HD (100L * 1000) /* 100 ms */
 #define MAX_IDLE_TIME (5L * 1000 * 1000) /* 5 s */
-/* default latency target is 0, eg, guarantee IO latency by default */
-#define DFL_LATENCY_TARGET (0)
+#define MIN_THROTL_BPS (320 * 1024)
+#define MIN_THROTL_IOPS (10)
+#define DFL_LATENCY_TARGET (-1L)
+#define DFL_IDLE_THRESHOLD (0)
 
 #define SKIP_LATENCY (((u64)1) << BLK_STAT_RES_SHIFT)
 
@@ -157,6 +157,7 @@ struct throtl_grp {
         unsigned long last_check_time;
 
         unsigned long latency_target; /* us */
+        unsigned long latency_target_conf; /* us */
         /* When did we start a new slice */
         unsigned long slice_start[2];
         unsigned long slice_end[2];
@@ -165,6 +166,7 @@ struct throtl_grp {
         unsigned long checked_last_finish_time; /* ns / 1024 */
         unsigned long avg_idletime; /* ns / 1024 */
         unsigned long idletime_threshold; /* us */
+        unsigned long idletime_threshold_conf; /* us */
 
         unsigned int bio_cnt; /* total bios */
         unsigned int bad_bio_cnt; /* bios exceeding latency threshold */
@@ -201,8 +203,6 @@ struct throtl_data
         unsigned int limit_index;
         bool limit_valid[LIMIT_CNT];
 
-        unsigned long dft_idletime_threshold; /* us */
-
         unsigned long low_upgrade_time;
         unsigned long low_downgrade_time;
 
@@ -294,8 +294,14 @@ static uint64_t tg_bps_limit(struct throtl_grp *tg, int rw)
 
         td = tg->td;
         ret = tg->bps[rw][td->limit_index];
-        if (ret == 0 && td->limit_index == LIMIT_LOW)
-                return tg->bps[rw][LIMIT_MAX];
+        if (ret == 0 && td->limit_index == LIMIT_LOW) {
+                /* intermediate node or iops isn't 0 */
+                if (!list_empty(&blkg->blkcg->css.children) ||
+                    tg->iops[rw][td->limit_index])
+                        return U64_MAX;
+                else
+                        return MIN_THROTL_BPS;
+        }
 
         if (td->limit_index == LIMIT_MAX && tg->bps[rw][LIMIT_LOW] &&
             tg->bps[rw][LIMIT_LOW] != tg->bps[rw][LIMIT_MAX]) {
@@ -315,10 +321,17 @@ static unsigned int tg_iops_limit(struct throtl_grp *tg, int rw)
 
         if (cgroup_subsys_on_dfl(io_cgrp_subsys) && !blkg->parent)
                 return UINT_MAX;
+
         td = tg->td;
         ret = tg->iops[rw][td->limit_index];
-        if (ret == 0 && tg->td->limit_index == LIMIT_LOW)
-                return tg->iops[rw][LIMIT_MAX];
+        if (ret == 0 && tg->td->limit_index == LIMIT_LOW) {
+                /* intermediate node or bps isn't 0 */
+                if (!list_empty(&blkg->blkcg->css.children) ||
+                    tg->bps[rw][td->limit_index])
+                        return UINT_MAX;
+                else
+                        return MIN_THROTL_IOPS;
+        }
 
         if (td->limit_index == LIMIT_MAX && tg->iops[rw][LIMIT_LOW] &&
             tg->iops[rw][LIMIT_LOW] != tg->iops[rw][LIMIT_MAX]) {
@@ -482,6 +495,9 @@ static struct blkg_policy_data *throtl_pd_alloc(gfp_t gfp, int node)
         /* LIMIT_LOW will have default value 0 */
 
         tg->latency_target = DFL_LATENCY_TARGET;
+        tg->latency_target_conf = DFL_LATENCY_TARGET;
+        tg->idletime_threshold = DFL_IDLE_THRESHOLD;
+        tg->idletime_threshold_conf = DFL_IDLE_THRESHOLD;
 
         return &tg->pd;
 }
@@ -510,8 +526,6 @@ static void throtl_pd_init(struct blkg_policy_data *pd)
         if (cgroup_subsys_on_dfl(io_cgrp_subsys) && blkg->parent)
                 sq->parent_sq = &blkg_to_tg(blkg->parent)->service_queue;
         tg->td = td;
-
-        tg->idletime_threshold = td->dft_idletime_threshold;
 }
 
 /*
@@ -1349,7 +1363,7 @@ static int tg_print_conf_uint(struct seq_file *sf, void *v)
         return 0;
 }
 
-static void tg_conf_updated(struct throtl_grp *tg)
+static void tg_conf_updated(struct throtl_grp *tg, bool global)
 {
         struct throtl_service_queue *sq = &tg->service_queue;
         struct cgroup_subsys_state *pos_css;
@@ -1367,8 +1381,26 @@ static void tg_conf_updated(struct throtl_grp *tg)
          * restrictions in the whole hierarchy and allows them to bypass
          * blk-throttle.
          */
-        blkg_for_each_descendant_pre(blkg, pos_css, tg_to_blkg(tg))
-                tg_update_has_rules(blkg_to_tg(blkg));
+        blkg_for_each_descendant_pre(blkg, pos_css,
+                        global ? tg->td->queue->root_blkg : tg_to_blkg(tg)) {
+                struct throtl_grp *this_tg = blkg_to_tg(blkg);
+                struct throtl_grp *parent_tg;
+
+                tg_update_has_rules(this_tg);
+                /* ignore root/second level */
+                if (!cgroup_subsys_on_dfl(io_cgrp_subsys) || !blkg->parent ||
+                    !blkg->parent->parent)
+                        continue;
+                parent_tg = blkg_to_tg(blkg->parent);
+                /*
+                 * make sure all children has lower idle time threshold and
+                 * higher latency target
+                 */
+                this_tg->idletime_threshold = min(this_tg->idletime_threshold,
+                                parent_tg->idletime_threshold);
+                this_tg->latency_target = max(this_tg->latency_target,
+                                parent_tg->latency_target);
+        }
 
         /*
          * We're already holding queue_lock and know @tg is valid.  Let's
@@ -1413,7 +1445,7 @@ static ssize_t tg_set_conf(struct kernfs_open_file *of,
         else
                 *(unsigned int *)((void *)tg + of_cft(of)->private) = v;
 
-        tg_conf_updated(tg);
+        tg_conf_updated(tg, false);
         ret = 0;
 out_finish:
         blkg_conf_finish(&ctx);
@@ -1497,34 +1529,34 @@ static u64 tg_prfill_limit(struct seq_file *sf, struct blkg_policy_data *pd,
             tg->iops_conf[READ][off] == iops_dft &&
             tg->iops_conf[WRITE][off] == iops_dft &&
             (off != LIMIT_LOW ||
-             (tg->idletime_threshold == tg->td->dft_idletime_threshold &&
-              tg->latency_target == DFL_LATENCY_TARGET)))
+             (tg->idletime_threshold_conf == DFL_IDLE_THRESHOLD &&
+              tg->latency_target_conf == DFL_LATENCY_TARGET)))
                 return 0;
 
-        if (tg->bps_conf[READ][off] != bps_dft)
+        if (tg->bps_conf[READ][off] != U64_MAX)
                 snprintf(bufs[0], sizeof(bufs[0]), "%llu",
                         tg->bps_conf[READ][off]);
-        if (tg->bps_conf[WRITE][off] != bps_dft)
+        if (tg->bps_conf[WRITE][off] != U64_MAX)
                 snprintf(bufs[1], sizeof(bufs[1]), "%llu",
                         tg->bps_conf[WRITE][off]);
-        if (tg->iops_conf[READ][off] != iops_dft)
+        if (tg->iops_conf[READ][off] != UINT_MAX)
                 snprintf(bufs[2], sizeof(bufs[2]), "%u",
                         tg->iops_conf[READ][off]);
-        if (tg->iops_conf[WRITE][off] != iops_dft)
+        if (tg->iops_conf[WRITE][off] != UINT_MAX)
                 snprintf(bufs[3], sizeof(bufs[3]), "%u",
                         tg->iops_conf[WRITE][off]);
         if (off == LIMIT_LOW) {
-                if (tg->idletime_threshold == ULONG_MAX)
+                if (tg->idletime_threshold_conf == ULONG_MAX)
                         strcpy(idle_time, " idle=max");
                 else
                         snprintf(idle_time, sizeof(idle_time), " idle=%lu",
-                                tg->idletime_threshold);
+                                tg->idletime_threshold_conf);
 
-                if (tg->latency_target == ULONG_MAX)
+                if (tg->latency_target_conf == ULONG_MAX)
                         strcpy(latency_time, " latency=max");
                 else
                         snprintf(latency_time, sizeof(latency_time),
-                                " latency=%lu", tg->latency_target);
+                                " latency=%lu", tg->latency_target_conf);
         }
 
         seq_printf(sf, "%s rbps=%s wbps=%s riops=%s wiops=%s%s%s\n",
@@ -1563,8 +1595,8 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of,
         v[2] = tg->iops_conf[READ][index];
         v[3] = tg->iops_conf[WRITE][index];
 
-        idle_time = tg->idletime_threshold;
-        latency_time = tg->latency_target;
+        idle_time = tg->idletime_threshold_conf;
+        latency_time = tg->latency_target_conf;
         while (true) {
                 char tok[27];   /* wiops=18446744073709551616 */
                 char *p;
@@ -1623,17 +1655,33 @@ static ssize_t tg_set_limit(struct kernfs_open_file *of,
                 tg->iops_conf[READ][LIMIT_MAX]);
         tg->iops[WRITE][LIMIT_LOW] = min(tg->iops_conf[WRITE][LIMIT_LOW],
                 tg->iops_conf[WRITE][LIMIT_MAX]);
+        tg->idletime_threshold_conf = idle_time;
+        tg->latency_target_conf = latency_time;
+
+        /* force user to configure all settings for low limit  */
+        if (!(tg->bps[READ][LIMIT_LOW] || tg->iops[READ][LIMIT_LOW] ||
+              tg->bps[WRITE][LIMIT_LOW] || tg->iops[WRITE][LIMIT_LOW]) ||
+            tg->idletime_threshold_conf == DFL_IDLE_THRESHOLD ||
+            tg->latency_target_conf == DFL_LATENCY_TARGET) {
+                tg->bps[READ][LIMIT_LOW] = 0;
+                tg->bps[WRITE][LIMIT_LOW] = 0;
+                tg->iops[READ][LIMIT_LOW] = 0;
+                tg->iops[WRITE][LIMIT_LOW] = 0;
+                tg->idletime_threshold = DFL_IDLE_THRESHOLD;
+                tg->latency_target = DFL_LATENCY_TARGET;
+        } else if (index == LIMIT_LOW) {
+                tg->idletime_threshold = tg->idletime_threshold_conf;
+                tg->latency_target = tg->latency_target_conf;
+        }
 
-        if (index == LIMIT_LOW) {
-                blk_throtl_update_limit_valid(tg->td);
-                if (tg->td->limit_valid[LIMIT_LOW])
+        blk_throtl_update_limit_valid(tg->td);
+        if (tg->td->limit_valid[LIMIT_LOW]) {
+                if (index == LIMIT_LOW)
                         tg->td->limit_index = LIMIT_LOW;
-                tg->idletime_threshold = (idle_time == ULONG_MAX) ?
-                        ULONG_MAX : idle_time;
-                tg->latency_target = (latency_time == ULONG_MAX) ?
-                        ULONG_MAX : latency_time;
-        }
-        tg_conf_updated(tg);
+        } else
+                tg->td->limit_index = LIMIT_MAX;
+        tg_conf_updated(tg, index == LIMIT_LOW &&
+                tg->td->limit_valid[LIMIT_LOW]);
         ret = 0;
 out_finish:
         blkg_conf_finish(&ctx);
@@ -1722,17 +1770,25 @@ static bool throtl_tg_is_idle(struct throtl_grp *tg)
         /*
          * cgroup is idle if:
          * - single idle is too long, longer than a fixed value (in case user
-         *   configure a too big threshold) or 4 times of slice
+         *   configure a too big threshold) or 4 times of idletime threshold
          * - average think time is more than threshold
          * - IO latency is largely below threshold
          */
-        unsigned long time = jiffies_to_usecs(4 * tg->td->throtl_slice);
-
-        time = min_t(unsigned long, MAX_IDLE_TIME, time);
-        return (ktime_get_ns() >> 10) - tg->last_finish_time > time ||
-               tg->avg_idletime > tg->idletime_threshold ||
-               (tg->latency_target && tg->bio_cnt &&
+        unsigned long time;
+        bool ret;
+
+        time = min_t(unsigned long, MAX_IDLE_TIME, 4 * tg->idletime_threshold);
+        ret = tg->latency_target == DFL_LATENCY_TARGET ||
+              tg->idletime_threshold == DFL_IDLE_THRESHOLD ||
+              (ktime_get_ns() >> 10) - tg->last_finish_time > time ||
+              tg->avg_idletime > tg->idletime_threshold ||
+              (tg->latency_target && tg->bio_cnt &&
                 tg->bad_bio_cnt * 5 < tg->bio_cnt);
+        throtl_log(&tg->service_queue,
+                "avg_idle=%ld, idle_threshold=%ld, bad_bio=%d, total_bio=%d, is_idle=%d, scale=%d",
+                tg->avg_idletime, tg->idletime_threshold, tg->bad_bio_cnt,
+                tg->bio_cnt, ret, tg->td->scale);
+        return ret;
 }
 
 static bool throtl_tg_can_upgrade(struct throtl_grp *tg)
@@ -1828,6 +1884,7 @@ static void throtl_upgrade_state(struct throtl_data *td)
         struct cgroup_subsys_state *pos_css;
         struct blkcg_gq *blkg;
 
+        throtl_log(&td->service_queue, "upgrade to max");
         td->limit_index = LIMIT_MAX;
         td->low_upgrade_time = jiffies;
         td->scale = 0;
@@ -1850,6 +1907,7 @@ static void throtl_downgrade_state(struct throtl_data *td, int new)
 {
         td->scale /= 2;
 
+        throtl_log(&td->service_queue, "downgrade, scale %d", td->scale);
         if (td->scale) {
                 td->low_upgrade_time = jiffies - td->scale * td->throtl_slice;
                 return;
@@ -2023,6 +2081,11 @@ static void throtl_update_latency_buckets(struct throtl_data *td)
                 td->avg_buckets[i].valid = true;
                 last_latency = td->avg_buckets[i].latency;
         }
+
+        for (i = 0; i < LATENCY_BUCKET_SIZE; i++)
+                throtl_log(&td->service_queue,
+                        "Latency bucket %d: latency=%ld, valid=%d", i,
+                        td->avg_buckets[i].latency, td->avg_buckets[i].valid);
 }
 #else
 static inline void throtl_update_latency_buckets(struct throtl_data *td)
@@ -2354,19 +2417,14 @@ void blk_throtl_exit(struct request_queue *q)
 void blk_throtl_register_queue(struct request_queue *q)
 {
         struct throtl_data *td;
-        struct cgroup_subsys_state *pos_css;
-        struct blkcg_gq *blkg;
 
         td = q->td;
         BUG_ON(!td);
 
-        if (blk_queue_nonrot(q)) {
+        if (blk_queue_nonrot(q))
                 td->throtl_slice = DFL_THROTL_SLICE_SSD;
-                td->dft_idletime_threshold = DFL_IDLE_THRESHOLD_SSD;
-        } else {
+        else
                 td->throtl_slice = DFL_THROTL_SLICE_HD;
-                td->dft_idletime_threshold = DFL_IDLE_THRESHOLD_HD;
-        }
 #ifndef CONFIG_BLK_DEV_THROTTLING_LOW
         /* if no low limit, use previous default */
         td->throtl_slice = DFL_THROTL_SLICE_HD;
@@ -2375,18 +2433,6 @@ void blk_throtl_register_queue(struct request_queue *q)
         td->track_bio_latency = !q->mq_ops && !q->request_fn;
         if (!td->track_bio_latency)
                 blk_stat_enable_accounting(q);
-
-        /*
-         * some tg are created before queue is fully initialized, eg, nonrot
-         * isn't initialized yet
-         */
-        rcu_read_lock();
-        blkg_for_each_descendant_post(blkg, pos_css, q->root_blkg) {
-                struct throtl_grp *tg = blkg_to_tg(blkg);
-
-                tg->idletime_threshold = td->dft_idletime_threshold;
-        }
-        rcu_read_unlock();
 }
 
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
diff --git a/block/partition-generic.c b/block/partition-generic.c
index ff07b9143ca4..c5ec8246e25e 100644
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -320,8 +320,10 @@ struct hd_struct *add_partition(struct gendisk *disk, int partno,
 
         if (info) {
                 struct partition_meta_info *pinfo = alloc_part_info(disk);
-                if (!pinfo)
+                if (!pinfo) {
+                        err = -ENOMEM;
                         goto out_free_stats;
+                }
                 memcpy(pinfo, info, sizeof(*info));
                 p->info = pinfo;
         }
diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c
index 93e7c1b32edd..5610cd537da7 100644
--- a/block/partitions/msdos.c
+++ b/block/partitions/msdos.c
@@ -300,6 +300,8 @@ static void parse_bsd(struct parsed_partitions *state,
                         continue;
                 bsd_start = le32_to_cpu(p->p_offset);
                 bsd_size = le32_to_cpu(p->p_size);
+                if (memcmp(flavour, "bsd\0", 4) == 0)
+                        bsd_start += offset;
                 if (offset == bsd_start && size == bsd_size)
                         /* full parent partition, we have it already */
                         continue;
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index 014af741fc6a..4faa0fd53b0c 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -764,6 +764,44 @@ static int crypto_init_skcipher_ops_ablkcipher(struct crypto_tfm *tfm)
         return 0;
 }
 
+static int skcipher_setkey_unaligned(struct crypto_skcipher *tfm,
+                                     const u8 *key, unsigned int keylen)
+{
+        unsigned long alignmask = crypto_skcipher_alignmask(tfm);
+        struct skcipher_alg *cipher = crypto_skcipher_alg(tfm);
+        u8 *buffer, *alignbuffer;
+        unsigned long absize;
+        int ret;
+
+        absize = keylen + alignmask;
+        buffer = kmalloc(absize, GFP_ATOMIC);
+        if (!buffer)
+                return -ENOMEM;
+
+        alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
+        memcpy(alignbuffer, key, keylen);
+        ret = cipher->setkey(tfm, alignbuffer, keylen);
+        kzfree(buffer);
+        return ret;
+}
+
+static int skcipher_setkey(struct crypto_skcipher *tfm, const u8 *key,
+                           unsigned int keylen)
+{
+        struct skcipher_alg *cipher = crypto_skcipher_alg(tfm);
+        unsigned long alignmask = crypto_skcipher_alignmask(tfm);
+
+        if (keylen < cipher->min_keysize || keylen > cipher->max_keysize) {
+                crypto_skcipher_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN);
+                return -EINVAL;
+        }
+
+        if ((unsigned long)key & alignmask)
+                return skcipher_setkey_unaligned(tfm, key, keylen);
+
+        return cipher->setkey(tfm, key, keylen);
+}
+
 static void crypto_skcipher_exit_tfm(struct crypto_tfm *tfm)
 {
         struct crypto_skcipher *skcipher = __crypto_skcipher_cast(tfm);
@@ -784,7 +822,7 @@ static int crypto_skcipher_init_tfm(struct crypto_tfm *tfm)
             tfm->__crt_alg->cra_type == &crypto_givcipher_type)
                 return crypto_init_skcipher_ops_ablkcipher(tfm);
 
-        skcipher->setkey = alg->setkey;
+        skcipher->setkey = skcipher_setkey;
         skcipher->encrypt = alg->encrypt;
         skcipher->decrypt = alg->decrypt;
         skcipher->ivsize = alg->ivsize;
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index b7c2a06963d6..25aba9b107dd 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -57,6 +57,7 @@
 
 #define ACPI_BUTTON_LID_INIT_IGNORE     0x00
 #define ACPI_BUTTON_LID_INIT_OPEN       0x01
+#define ACPI_BUTTON_LID_INIT_METHOD     0x02
 
 #define _COMPONENT              ACPI_BUTTON_COMPONENT
 ACPI_MODULE_NAME("button");
@@ -376,6 +377,9 @@ static void acpi_lid_initialize_state(struct acpi_device *device)
         case ACPI_BUTTON_LID_INIT_OPEN:
                 (void)acpi_lid_notify_state(device, 1);
                 break;
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                (void)acpi_lid_update_state(device);
+                break;
         case ACPI_BUTTON_LID_INIT_IGNORE:
         default:
                 break;
@@ -560,6 +564,9 @@ static int param_set_lid_init_state(const char *val, struct kernel_param *kp)
         if (!strncmp(val, "open", sizeof("open") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_OPEN;
                 pr_info("Notify initial lid state as open\n");
+        } else if (!strncmp(val, "method", sizeof("method") - 1)) {
+                lid_init_state = ACPI_BUTTON_LID_INIT_METHOD;
+                pr_info("Notify initial lid state with _LID return value\n");
         } else if (!strncmp(val, "ignore", sizeof("ignore") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_IGNORE;
                 pr_info("Do not notify initial lid state\n");
@@ -573,6 +580,8 @@ static int param_get_lid_init_state(char *buffer, struct kernel_param *kp)
         switch (lid_init_state) {
         case ACPI_BUTTON_LID_INIT_OPEN:
                 return sprintf(buffer, "open");
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                return sprintf(buffer, "method");
         case ACPI_BUTTON_LID_INIT_IGNORE:
                 return sprintf(buffer, "ignore");
         default:
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 3ba1c3472cf9..fd86bec98dea 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -26,7 +26,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
         struct nfit_spa *nfit_spa;
 
         /* We only care about memory errors */
-        if (!(mce->status & MCACOD))
+        if (!mce_is_memory_error(mce))
                 return NOTIFY_DONE;
 
         /*
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index f62082fdd670..9c36b27996fc 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -512,13 +512,12 @@ static bool wakeup_source_not_registered(struct wakeup_source *ws)
 /**
  * wakup_source_activate - Mark given wakeup source as active.
  * @ws: Wakeup source to handle.
- * @hard: If set, abort suspends in progress and wake up from suspend-to-idle.
  *
  * Update the @ws' statistics and, if @ws has just been activated, notify the PM
  * core of the event by incrementing the counter of of wakeup events being
  * processed.
  */
-static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
+static void wakeup_source_activate(struct wakeup_source *ws)
 {
         unsigned int cec;
 
@@ -526,9 +525,6 @@ static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
                         "unregistered wakeup source\n"))
                 return;
 
-        if (hard)
-                pm_system_wakeup();
-
         ws->active = true;
         ws->active_count++;
         ws->last_time = ktime_get();
@@ -554,7 +550,10 @@ static void wakeup_source_report_event(struct wakeup_source *ws, bool hard)
                 ws->wakeup_count++;
 
         if (!ws->active)
-                wakeup_source_activate(ws, hard);
+                wakeup_source_activate(ws);
+
+        if (hard)
+                pm_system_wakeup();
 }
 
 /**
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index b5730e17b455..656624314f0d 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -315,24 +315,32 @@ void drbd_req_complete(struct drbd_request *req, struct bio_and_error *m)
 }
 
 /* still holds resource->req_lock */
-static int drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
+static void drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
 {
         struct drbd_device *device = req->device;
         D_ASSERT(device, m || (req->rq_state & RQ_POSTPONED));
 
+        if (!put)
+                return;
+
         if (!atomic_sub_and_test(put, &req->completion_ref))
-                return 0;
+                return;
 
         drbd_req_complete(req, m);
 
+        /* local completion may still come in later,
+         * we need to keep the req object around. */
+        if (req->rq_state & RQ_LOCAL_ABORTED)
+                return;
+
         if (req->rq_state & RQ_POSTPONED) {
                 /* don't destroy the req object just yet,
                  * but queue it for retry */
                 drbd_restart_request(req);
-                return 0;
+                return;
         }
 
-        return 1;
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void set_if_null_req_next(struct drbd_peer_device *peer_device, struct drbd_request *req)
@@ -519,12 +527,8 @@ static void mod_rq_state(struct drbd_request *req, struct bio_and_error *m,
         if (req->i.waiting)
                 wake_up(&device->misc_wait);
 
-        if (c_put) {
-                if (drbd_req_put_completion_ref(req, m, c_put))
-                        kref_put(&req->kref, drbd_req_destroy);
-        } else {
-                kref_put(&req->kref, drbd_req_destroy);
-        }
+        drbd_req_put_completion_ref(req, m, c_put);
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void drbd_report_io_error(struct drbd_device *device, struct drbd_request *req)
@@ -1366,8 +1370,7 @@ nodata:
         }
 
 out:
-        if (drbd_req_put_completion_ref(req, &m, 1))
-                kref_put(&req->kref, drbd_req_destroy);
+        drbd_req_put_completion_ref(req, &m, 1);
         spin_unlock_irq(&resource->req_lock);
 
         /* Even though above is a kref_put(), this is safe.
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 8fe61b5dc5a6..1f3dfaa54d87 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -504,11 +504,13 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
 
         dev_set_drvdata(&dev->dev, NULL);
 
-        if (be->blkif)
+        if (be->blkif) {
                 xen_blkif_disconnect(be->blkif);
 
-        /* Put the reference we set in xen_blkif_alloc(). */
-        xen_blkif_put(be->blkif);
+                /* Put the reference we set in xen_blkif_alloc(). */
+                xen_blkif_put(be->blkif);
+        }
+
         kfree(be->mode);
         kfree(be);
         return 0;
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 565e4cf04a02..8249762192d5 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str)
         } else if (!strcmp(str, "auto")) {
                 parport_nr[0] = LP_PARPORT_AUTO;
         } else if (!strcmp(str, "none")) {
-                parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+                if (parport_ptr < LP_NO)
+                        parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+                else
+                        printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+                               str);
         } else if (!strcmp(str, "reset")) {
                 reset = 1;
         }
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 7e4a9d1296bb..6e0cbe092220 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -340,6 +340,11 @@ static const struct vm_operations_struct mmap_mem_ops = {
 static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 {
         size_t size = vma->vm_end - vma->vm_start;
+        phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+        /* It's illegal to wrap around the end of the physical address space. */
+        if (offset + (phys_addr_t)size < offset)
+                return -EINVAL;
 
         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
                 return -EINVAL;
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 74ed7e9a7f27..2011fec2d6ad 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,6 +71,15 @@ config ARM_HIGHBANK_CPUFREQ
 
           If in doubt, say N.
 
+config ARM_DB8500_CPUFREQ
+        tristate "ST-Ericsson DB8500 cpufreq" if COMPILE_TEST && !ARCH_U8500
+        default ARCH_U8500
+        depends on HAS_IOMEM
+        depends on !CPU_THERMAL || THERMAL
+        help
+          This adds the CPUFreq driver for ST-Ericsson Ux500 (DB8500) SoC
+          series.
+
 config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6 cpufreq support"
         depends on ARCH_MXC
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index b7e78f063c4f..ab3a42cd29ef 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -53,7 +53,7 @@ obj-$(CONFIG_ARM_DT_BL_CPUFREQ)		+= arm_big_little_dt.o
 
 obj-$(CONFIG_ARM_BRCMSTB_AVS_CPUFREQ)   += brcmstb-avs-cpufreq.o
 obj-$(CONFIG_ARCH_DAVINCI)              += davinci-cpufreq.o
-obj-$(CONFIG_UX500_SOC_DB8500)          += dbx500-cpufreq.o
+obj-$(CONFIG_ARM_DB8500_CPUFREQ)        += dbx500-cpufreq.o
 obj-$(CONFIG_ARM_EXYNOS5440_CPUFREQ)    += exynos5440-cpufreq.o
 obj-$(CONFIG_ARM_HIGHBANK_CPUFREQ)      += highbank-cpufreq.o
 obj-$(CONFIG_ARM_IMX6Q_CPUFREQ)         += imx6q-cpufreq.o
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index ebf43f531ada..6ed32aac8bbe 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -44,6 +44,7 @@ void dax_read_unlock(int id)
 }
 EXPORT_SYMBOL_GPL(dax_read_unlock);
 
+#ifdef CONFIG_BLOCK
 int bdev_dax_pgoff(struct block_device *bdev, sector_t sector, size_t size,
                 pgoff_t *pgoff)
 {
@@ -112,6 +113,7 @@ int __bdev_dax_supported(struct super_block *sb, int blocksize)
         return 0;
 }
 EXPORT_SYMBOL_GPL(__bdev_dax_supported);
+#endif
 
 /**
  * struct dax_device - anchor object for dax services
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 82dab1692264..3aea55698165 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -782,24 +782,26 @@ static void debug_dump_dramcfg_low(struct amd64_pvt *pvt, u32 dclr, int chan)
 
 static void debug_display_dimm_sizes_df(struct amd64_pvt *pvt, u8 ctrl)
 {
-        u32 *dcsb = ctrl ? pvt->csels[1].csbases : pvt->csels[0].csbases;
-        int dimm, size0, size1;
+        int dimm, size0, size1, cs0, cs1;
 
         edac_printk(KERN_DEBUG, EDAC_MC, "UMC%d chip selects:\n", ctrl);
 
         for (dimm = 0; dimm < 4; dimm++) {
                 size0 = 0;
+                cs0 = dimm * 2;
 
-                if (dcsb[dimm*2] & DCSB_CS_ENABLE)
-                        size0 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, dimm);
+                if (csrow_enabled(cs0, ctrl, pvt))
+                        size0 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, cs0);
 
                 size1 = 0;
-                if (dcsb[dimm*2 + 1] & DCSB_CS_ENABLE)
-                        size1 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, dimm);
+                cs1 = dimm * 2 + 1;
+
+                if (csrow_enabled(cs1, ctrl, pvt))
+                        size1 = pvt->ops->dbam_to_cs(pvt, ctrl, 0, cs1);
 
                 amd64_info(EDAC_MC ": %d: %5dMB %d: %5dMB\n",
-                                dimm * 2,     size0,
-                                dimm * 2 + 1, size1);
+                                cs0,    size0,
+                                cs1,    size1);
         }
 }
 
@@ -2756,26 +2758,22 @@ skip:
  *      encompasses
  *
  */
-static u32 get_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr)
+static u32 get_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr_orig)
 {
-        u32 cs_mode, nr_pages;
         u32 dbam = dct ? pvt->dbam1 : pvt->dbam0;
+        int csrow_nr = csrow_nr_orig;
+        u32 cs_mode, nr_pages;
 
+        if (!pvt->umc)
+                csrow_nr >>= 1;
 
-        /*
-         * The math on this doesn't look right on the surface because x/2*4 can
-         * be simplified to x*2 but this expression makes use of the fact that
-         * it is integral math where 1/2=0. This intermediate value becomes the
-         * number of bits to shift the DBAM register to extract the proper CSROW
-         * field.
-         */
-        cs_mode = DBAM_DIMM(csrow_nr / 2, dbam);
+        cs_mode = DBAM_DIMM(csrow_nr, dbam);
 
-        nr_pages = pvt->ops->dbam_to_cs(pvt, dct, cs_mode, (csrow_nr / 2))
-                                                           << (20 - PAGE_SHIFT);
+        nr_pages   = pvt->ops->dbam_to_cs(pvt, dct, cs_mode, csrow_nr);
+        nr_pages <<= 20 - PAGE_SHIFT;
 
         edac_dbg(0, "csrow: %d, channel: %d, DBAM idx: %d\n",
-                    csrow_nr, dct,  cs_mode);
+                    csrow_nr_orig, dct,  cs_mode);
         edac_dbg(0, "nr_pages/channel: %u\n", nr_pages);
 
         return nr_pages;
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index ed3137c1ceb0..ef1fafdad400 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -53,6 +53,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         if (sscanf(name, "dump-type%u-%u-%d-%lu-%c",
                    &record->type, &part, &cnt, &time, &data_type) == 5) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -64,6 +65,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         } else if (sscanf(name, "dump-type%u-%u-%d-%lu",
                    &record->type, &part, &cnt, &time) == 4) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -77,6 +79,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
                  * multiple logs, remains.
                  */
                 record->id = generic_id(time, part, 0);
+                record->part = part;
                 record->count = 0;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -155,19 +158,14 @@ static int efi_pstore_scan_sysfs_exit(struct efivar_entry *pos,
  * efi_pstore_sysfs_entry_iter
  *
  * @record: pstore record to pass to callback
- * @pos: entry to begin iterating from
  *
  * You MUST call efivar_enter_iter_begin() before this function, and
  * efivar_entry_iter_end() afterwards.
  *
- * It is possible to begin iteration from an arbitrary entry within
- * the list by passing @pos. @pos is updated on return to point to
- * the next entry of the last one passed to efi_pstore_read_func().
- * To begin iterating from the beginning of the list @pos must be %NULL.
  */
-static int efi_pstore_sysfs_entry_iter(struct pstore_record *record,
-                                       struct efivar_entry **pos)
+static int efi_pstore_sysfs_entry_iter(struct pstore_record *record)
 {
+        struct efivar_entry **pos = (struct efivar_entry **)&record->psi->data;
         struct efivar_entry *entry, *n;
         struct list_head *head = &efivar_sysfs_list;
         int size = 0;
@@ -218,7 +216,6 @@ static int efi_pstore_sysfs_entry_iter(struct pstore_record *record,
  */
 static ssize_t efi_pstore_read(struct pstore_record *record)
 {
-        struct efivar_entry *entry = (struct efivar_entry *)record->psi->data;
         ssize_t size;
 
         record->buf = kzalloc(EFIVARS_DATA_SIZE_MAX, GFP_KERNEL);
@@ -229,7 +226,7 @@ static ssize_t efi_pstore_read(struct pstore_record *record)
                 size = -EINTR;
                 goto out;
         }
-        size = efi_pstore_sysfs_entry_iter(record, &entry);
+        size = efi_pstore_sysfs_entry_iter(record);
         efivar_entry_iter_end();
 
 out:
@@ -247,9 +244,15 @@ static int efi_pstore_write(struct pstore_record *record)
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
         int i, ret = 0;
 
+        record->time.tv_sec = get_seconds();
+        record->time.tv_nsec = 0;
+
+        record->id = generic_id(record->time.tv_sec, record->part,
+                                record->count);
+
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu-%c",
                  record->type, record->part, record->count,
-                 get_seconds(), record->compressed ? 'C' : 'D');
+                 record->time.tv_sec, record->compressed ? 'C' : 'D');
 
         for (i = 0; i < DUMP_NAME_LEN; i++)
                 efi_name[i] = name[i];
@@ -261,7 +264,6 @@ static int efi_pstore_write(struct pstore_record *record)
         if (record->reason == KMSG_DUMP_OOPS)
                 efivar_run_worker();
 
-        record->id = record->part;
         return ret;
 };
 
@@ -293,7 +295,7 @@ static int efi_pstore_erase_func(struct efivar_entry *entry, void *data)
                  * holding multiple logs, remains.
                  */
                 snprintf(name_old, sizeof(name_old), "dump-type%u-%u-%lu",
-                        ed->record->type, (unsigned int)ed->record->id,
+                        ed->record->type, ed->record->part,
                         ed->record->time.tv_sec);
 
                 for (i = 0; i < DUMP_NAME_LEN; i++)
@@ -326,10 +328,7 @@ static int efi_pstore_erase(struct pstore_record *record)
         char name[DUMP_NAME_LEN];
         efi_char16_t efi_name[DUMP_NAME_LEN];
         int found, i;
-        unsigned int part;
 
-        do_div(record->id, 1000);
-        part = do_div(record->id, 100);
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu",
                  record->type, record->part, record->count,
                  record->time.tv_sec);
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 3ce813110d5e..1e7860f02f4f 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -116,9 +116,13 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
                 return VPD_OK;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
-        info->key = kzalloc(key_len + 1, GFP_KERNEL);
-        if (!info->key)
+        if (!info)
                 return -ENOMEM;
+        info->key = kzalloc(key_len + 1, GFP_KERNEL);
+        if (!info->key) {
+                ret = -ENOMEM;
+                goto free_info;
+        }
 
         memcpy(info->key, key, key_len);
 
@@ -135,12 +139,17 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
         list_add_tail(&info->list, &sec->attribs);
 
         ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
-        if (ret) {
-                kfree(info->key);
-                return ret;
-        }
+        if (ret)
+                goto free_info_key;
 
         return 0;
+
+free_info_key:
+        kfree(info->key);
+free_info:
+        kfree(info);
+
+        return ret;
 }
 
 static void vpd_section_attrib_destroy(struct vpd_section *sec)
diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index 874ff32db366..00cfed3c3e1a 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -202,7 +202,8 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
         info->debug_buffer[info->debug_region_size] = 0;
 
         info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
-                                              sizeof(debug_name)),
+                                              sizeof(debug_name) -
+                                              sizeof("ti_sci_debug@")),
                                       0444, NULL, info, &ti_sci_debug_fops);
         if (IS_ERR(info->d))
                 return PTR_ERR(info->d);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
index 236d9950221b..c0d8c6ff6380 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c
@@ -425,10 +425,15 @@ bool amdgpu_fbdev_robj_is_fb(struct amdgpu_device *adev, struct amdgpu_bo *robj)
 
 void amdgpu_fbdev_restore_mode(struct amdgpu_device *adev)
 {
-        struct amdgpu_fbdev *afbdev = adev->mode_info.rfbdev;
+        struct amdgpu_fbdev *afbdev;
         struct drm_fb_helper *fb_helper;
         int ret;
 
+        if (!adev)
+                return;
+
+        afbdev = adev->mode_info.rfbdev;
+
         if (!afbdev)
                 return;
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 07ff3b1514f1..8ecf82c5fe74 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -634,7 +634,7 @@ int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job)
                 mutex_unlock(&id_mgr->lock);
         }
 
-        if (gds_switch_needed) {
+        if (ring->funcs->emit_gds_switch && gds_switch_needed) {
                 id->gds_base = job->gds_base;
                 id->gds_size = job->gds_size;
                 id->gws_base = job->gws_base;
@@ -672,6 +672,7 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
         struct amdgpu_vm_id_manager *id_mgr = &adev->vm_manager.id_mgr[vmhub];
         struct amdgpu_vm_id *id = &id_mgr->ids[vmid];
 
+        atomic64_set(&id->owner, 0);
         id->gds_base = 0;
         id->gds_size = 0;
         id->gws_base = 0;
@@ -681,6 +682,26 @@ void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
 }
 
 /**
+ * amdgpu_vm_reset_all_id - reset VMID to zero
+ *
+ * @adev: amdgpu device structure
+ *
+ * Reset VMID to force flush on next use
+ */
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev)
+{
+        unsigned i, j;
+
+        for (i = 0; i < AMDGPU_MAX_VMHUBS; ++i) {
+                struct amdgpu_vm_id_manager *id_mgr =
+                        &adev->vm_manager.id_mgr[i];
+
+                for (j = 1; j < id_mgr->num_ids; ++j)
+                        amdgpu_vm_reset_id(adev, i, j);
+        }
+}
+
+/**
  * amdgpu_vm_bo_find - find the bo_va for a specific vm & bo
  *
  * @vm: requested vm
@@ -2270,7 +2291,6 @@ void amdgpu_vm_manager_init(struct amdgpu_device *adev)
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i)
                 adev->vm_manager.seqno[i] = 0;
 
-
         atomic_set(&adev->vm_manager.vm_pte_next_ring, 0);
         atomic64_set(&adev->vm_manager.client_counter, 0);
         spin_lock_init(&adev->vm_manager.prt_lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
index d97e28b4bdc4..e1d951ece433 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -204,6 +204,7 @@ int amdgpu_vm_grab_id(struct amdgpu_vm *vm, struct amdgpu_ring *ring,
 int amdgpu_vm_flush(struct amdgpu_ring *ring, struct amdgpu_job *job);
 void amdgpu_vm_reset_id(struct amdgpu_device *adev, unsigned vmhub,
                         unsigned vmid);
+void amdgpu_vm_reset_all_ids(struct amdgpu_device *adev);
 int amdgpu_vm_update_directories(struct amdgpu_device *adev,
                                  struct amdgpu_vm *vm);
 int amdgpu_vm_clear_freed(struct amdgpu_device *adev,
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 6dc1410b380f..ec93714e4524 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -906,6 +906,12 @@ static bool ci_dpm_vblank_too_short(struct amdgpu_device *adev)
         u32 vblank_time = amdgpu_dpm_get_vblank_time(adev);
         u32 switch_limit = adev->mc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+         * blanking period would allow it
+         */
+        if (amdgpu_dpm_get_vrefresh(adev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
index a572979f186c..d860939152df 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c
@@ -950,10 +950,6 @@ static int gmc_v6_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v6_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v6_0_hw_fini(adev);
 
         return 0;
@@ -968,16 +964,9 @@ static int gmc_v6_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v6_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v6_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index a9083a16a250..2750e5c23813 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -1117,10 +1117,6 @@ static int gmc_v7_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v7_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v7_0_hw_fini(adev);
 
         return 0;
@@ -1135,16 +1131,9 @@ static int gmc_v7_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v7_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v7_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 4ac99784160a..f56b4089ee9f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -1209,10 +1209,6 @@ static int gmc_v8_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v8_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v8_0_hw_fini(adev);
 
         return 0;
@@ -1227,16 +1223,9 @@ static int gmc_v8_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v8_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev, "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v8_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
index dc1e1c1d6b24..f936332a069d 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c
@@ -791,10 +791,6 @@ static int gmc_v9_0_suspend(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
-        if (adev->vm_manager.enabled) {
-                gmc_v9_0_vm_fini(adev);
-                adev->vm_manager.enabled = false;
-        }
         gmc_v9_0_hw_fini(adev);
 
         return 0;
@@ -809,17 +805,9 @@ static int gmc_v9_0_resume(void *handle)
         if (r)
                 return r;
 
-        if (!adev->vm_manager.enabled) {
-                r = gmc_v9_0_vm_init(adev);
-                if (r) {
-                        dev_err(adev->dev,
-                                "vm manager initialization failed (%d).\n", r);
-                        return r;
-                }
-                adev->vm_manager.enabled = true;
-        }
+        amdgpu_vm_reset_all_ids(adev);
 
-        return r;
+        return 0;
 }
 
 static bool gmc_v9_0_is_idle(void *handle)
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
index a74a3db3056c..102eb6d029fa 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c
@@ -2655,6 +2655,28 @@ static int smu7_get_power_state_size(struct pp_hwmgr *hwmgr)
         return sizeof(struct smu7_power_state);
 }
 
+static int smu7_vblank_too_short(struct pp_hwmgr *hwmgr,
+                                 uint32_t vblank_time_us)
+{
+        struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
+        uint32_t switch_limit_us;
+
+        switch (hwmgr->chip_id) {
+        case CHIP_POLARIS10:
+        case CHIP_POLARIS11:
+        case CHIP_POLARIS12:
+                switch_limit_us = data->is_memory_gddr5 ? 190 : 150;
+                break;
+        default:
+                switch_limit_us = data->is_memory_gddr5 ? 450 : 150;
+                break;
+        }
+
+        if (vblank_time_us < switch_limit_us)
+                return true;
+        else
+                return false;
+}
 
 static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                 struct pp_power_state *request_ps,
@@ -2669,6 +2691,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         bool disable_mclk_switching;
         bool disable_mclk_switching_for_frame_lock;
         struct cgs_display_info info = {0};
+        struct cgs_mode_info mode_info = {0};
         const struct phm_clock_and_voltage_limits *max_limits;
         uint32_t i;
         struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend);
@@ -2677,6 +2700,7 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
         int32_t count;
         int32_t stable_pstate_sclk = 0, stable_pstate_mclk = 0;
 
+        info.mode_info = &mode_info;
         data->battery_state = (PP_StateUILabel_Battery ==
                         request_ps->classification.ui_label);
 
@@ -2703,8 +2727,6 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
 
         cgs_get_active_displays_info(hwmgr->device, &info);
 
-        /*TO DO result = PHM_CheckVBlankTime(hwmgr, &vblankTooShort);*/
-
         minimum_clocks.engineClock = hwmgr->display_config.min_core_set_clock;
         minimum_clocks.memoryClock = hwmgr->display_config.min_mem_set_clock;
 
@@ -2769,8 +2791,10 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr,
                                     PHM_PlatformCaps_DisableMclkSwitchingForFrameLock);
 
 
-        disable_mclk_switching = (1 < info.display_count) ||
-                                    disable_mclk_switching_for_frame_lock;
+        disable_mclk_switching = ((1 < info.display_count) ||
+                                  disable_mclk_switching_for_frame_lock ||
+                                  smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) ||
+                                  (mode_info.refresh_rate > 120));
 
         sclk = smu7_ps->performance_levels[0].engine_clock;
         mclk = smu7_ps->performance_levels[0].memory_clock;
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
index ad30f5d3a10d..2614af2f553f 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c
@@ -4186,7 +4186,7 @@ static int vega10_force_clock_level(struct pp_hwmgr *hwmgr,
                 enum pp_clock_type type, uint32_t mask)
 {
         struct vega10_hwmgr *data = (struct vega10_hwmgr *)(hwmgr->backend);
-        uint32_t i;
+        int i;
 
         if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_MANUAL)
                 return -EINVAL;
diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
index 798a3cc480a2..1a3359c0f6cd 100644
--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
+++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
@@ -10,6 +10,7 @@
  */
 
 #include <drm/drmP.h>
+#include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_crtc.h>
 #include <drm/drm_crtc_helper.h>
@@ -226,16 +227,33 @@ static const struct drm_crtc_helper_funcs hdlcd_crtc_helper_funcs = {
 static int hdlcd_plane_atomic_check(struct drm_plane *plane,
                                     struct drm_plane_state *state)
 {
-        u32 src_w, src_h;
+        struct drm_rect clip = { 0 };
+        struct drm_crtc_state *crtc_state;
+        u32 src_h = state->src_h >> 16;
 
-        src_w = state->src_w >> 16;
-        src_h = state->src_h >> 16;
+        /* only the HDLCD_REG_FB_LINE_COUNT register has a limit */
+        if (src_h >= HDLCD_MAX_YRES) {
+                DRM_DEBUG_KMS("Invalid source width: %d\n", src_h);
+                return -EINVAL;
+        }
+
+        if (!state->fb || !state->crtc)
+                return 0;
 
-        /* we can't do any scaling of the plane source */
-        if ((src_w != state->crtc_w) || (src_h != state->crtc_h))
+        crtc_state = drm_atomic_get_existing_crtc_state(state->state,
+                                                        state->crtc);
+        if (!crtc_state) {
+                DRM_DEBUG_KMS("Invalid crtc state\n");
                 return -EINVAL;
+        }
 
-        return 0;
+        clip.x2 = crtc_state->adjusted_mode.hdisplay;
+        clip.y2 = crtc_state->adjusted_mode.vdisplay;
+
+        return drm_plane_helper_check_state(state, &clip,
+                                            DRM_PLANE_HELPER_NO_SCALING,
+                                            DRM_PLANE_HELPER_NO_SCALING,
+                                            false, true);
 }
 
 static void hdlcd_plane_atomic_update(struct drm_plane *plane,
@@ -244,21 +262,20 @@ static void hdlcd_plane_atomic_update(struct drm_plane *plane,
         struct drm_framebuffer *fb = plane->state->fb;
         struct hdlcd_drm_private *hdlcd;
         struct drm_gem_cma_object *gem;
-        u32 src_w, src_h, dest_w, dest_h;
+        u32 src_x, src_y, dest_h;
         dma_addr_t scanout_start;
 
         if (!fb)
                 return;
 
-        src_w = plane->state->src_w >> 16;
-        src_h = plane->state->src_h >> 16;
-        dest_w = plane->state->crtc_w;
-        dest_h = plane->state->crtc_h;
+        src_x = plane->state->src.x1 >> 16;
+        src_y = plane->state->src.y1 >> 16;
+        dest_h = drm_rect_height(&plane->state->dst);
         gem = drm_fb_cma_get_gem_obj(fb, 0);
+
         scanout_start = gem->paddr + fb->offsets[0] +
-                plane->state->crtc_y * fb->pitches[0] +
-                plane->state->crtc_x *
-                fb->format->cpp[0];
+                        src_y * fb->pitches[0] +
+                        src_x * fb->format->cpp[0];
 
         hdlcd = plane->dev->dev_private;
         hdlcd_write(hdlcd, HDLCD_REG_FB_LINE_LENGTH, fb->pitches[0]);
@@ -305,7 +322,6 @@ static struct drm_plane *hdlcd_plane_init(struct drm_device *drm)
                                        formats, ARRAY_SIZE(formats),
                                        DRM_PLANE_TYPE_PRIMARY, NULL);
         if (ret) {
-                devm_kfree(drm->dev, plane);
                 return ERR_PTR(ret);
         }
 
@@ -329,7 +345,6 @@ int hdlcd_setup_crtc(struct drm_device *drm)
                                         &hdlcd_crtc_funcs, NULL);
         if (ret) {
                 hdlcd_plane_destroy(primary);
-                devm_kfree(drm->dev, primary);
                 return ret;
         }
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
index 65a3bd7a0c00..423dda2785d4 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
@@ -152,8 +152,7 @@ static const struct drm_connector_funcs atmel_hlcdc_panel_connector_funcs = {
         .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
 };
 
-static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
-                                       const struct device_node *np)
+static int atmel_hlcdc_attach_endpoint(struct drm_device *dev, int endpoint)
 {
         struct atmel_hlcdc_dc *dc = dev->dev_private;
         struct atmel_hlcdc_rgb_output *output;
@@ -161,6 +160,11 @@ static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
         struct drm_bridge *bridge;
         int ret;
 
+        ret = drm_of_find_panel_or_bridge(dev->dev->of_node, 0, endpoint,
+                                          &panel, &bridge);
+        if (ret)
+                return ret;
+
         output = devm_kzalloc(dev->dev, sizeof(*output), GFP_KERNEL);
         if (!output)
                 return -EINVAL;
@@ -177,10 +181,6 @@ static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
 
         output->encoder.possible_crtcs = 0x1;
 
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, &panel, &bridge);
-        if (ret)
-                return ret;
-
         if (panel) {
                 output->connector.dpms = DRM_MODE_DPMS_OFF;
                 output->connector.polled = DRM_CONNECTOR_POLL_CONNECT;
@@ -220,22 +220,14 @@ err_encoder_cleanup:
 
 int atmel_hlcdc_create_outputs(struct drm_device *dev)
 {
-        struct device_node *remote;
-        int ret = -ENODEV;
-        int endpoint = 0;
-
-        while (true) {
-                /* Loop thru possible multiple connections to the output */
-                remote = of_graph_get_remote_node(dev->dev->of_node, 0,
-                                                  endpoint++);
-                if (!remote)
-                        break;
-
-                ret = atmel_hlcdc_attach_endpoint(dev, remote);
-                of_node_put(remote);
-                if (ret)
-                        return ret;
-        }
+        int endpoint, ret = 0;
+
+        for (endpoint = 0; !ret; endpoint++)
+                ret = atmel_hlcdc_attach_endpoint(dev, endpoint);
+
+        /* At least one device was successfully attached.*/
+        if (ret == -ENODEV && endpoint)
+                return 0;
 
         return ret;
 }
diff --git a/drivers/gpu/drm/drm_plane.c b/drivers/gpu/drm/drm_plane.c
index fedd4d60d9cd..5dc8c4350602 100644
--- a/drivers/gpu/drm/drm_plane.c
+++ b/drivers/gpu/drm/drm_plane.c
@@ -948,8 +948,6 @@ retry:
         }
 
 out:
-        if (ret && crtc->funcs->page_flip_target)
-                drm_crtc_vblank_put(crtc);
         if (fb)
                 drm_framebuffer_put(fb);
         if (crtc->primary->old_fb)
@@ -964,5 +962,8 @@ out:
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
 
+        if (ret && crtc->funcs->page_flip_target)
+                drm_crtc_vblank_put(crtc);
+
         return ret;
 }
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index e1909429837e..de80ee1b71df 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -44,6 +44,7 @@ static struct etnaviv_gem_submit *submit_create(struct drm_device *dev,
 
                 /* initially, until copy_from_user() and bo lookup succeeds: */
                 submit->nr_bos = 0;
+                submit->fence = NULL;
 
                 ww_acquire_init(&submit->ticket, &reservation_ww_class);
         }
@@ -294,7 +295,8 @@ static void submit_cleanup(struct etnaviv_gem_submit *submit)
         }
 
         ww_acquire_fini(&submit->ticket);
-        dma_fence_put(submit->fence);
+        if (submit->fence)
+                dma_fence_put(submit->fence);
         kfree(submit);
 }
 
diff --git a/drivers/gpu/drm/gma500/psb_intel_lvds.c b/drivers/gpu/drm/gma500/psb_intel_lvds.c
index 0066fe7e622e..be3eefec5152 100644
--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
+++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
@@ -759,20 +759,23 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (scan->type & DRM_MODE_TYPE_PREFERRED) {
                         mode_dev->panel_fixed_mode =
                             drm_mode_duplicate(dev, scan);
+                        DRM_DEBUG_KMS("Using mode from DDC\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
 
         /* Failed to get EDID, what about VBT? do we need this? */
-        if (mode_dev->vbt_mode)
+        if (dev_priv->lfp_lvds_vbt_mode) {
                 mode_dev->panel_fixed_mode =
-                    drm_mode_duplicate(dev, mode_dev->vbt_mode);
+                        drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
 
-        if (!mode_dev->panel_fixed_mode)
-                if (dev_priv->lfp_lvds_vbt_mode)
-                        mode_dev->panel_fixed_mode =
-                                drm_mode_duplicate(dev,
-                                        dev_priv->lfp_lvds_vbt_mode);
+                if (mode_dev->panel_fixed_mode) {
+                        mode_dev->panel_fixed_mode->type |=
+                                DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using mode from VBT\n");
+                        goto out;
+                }
+        }
 
         /*
          * If we didn't get EDID, try checking if the panel is already turned
@@ -789,6 +792,7 @@ void psb_intel_lvds_init(struct drm_device *dev,
                 if (mode_dev->panel_fixed_mode) {
                         mode_dev->panel_fixed_mode->type |=
                             DRM_MODE_TYPE_PREFERRED;
+                        DRM_DEBUG_KMS("Using pre-programmed mode\n");
                         goto out;       /* FIXME: check for quirks */
                 }
         }
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 0ad1a508e2af..c995e540ff96 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1244,7 +1244,7 @@ static int dma_ctrl_write(struct intel_vgpu *vgpu, unsigned int offset,
         mode = vgpu_vreg(vgpu, offset);
 
         if (GFX_MODE_BIT_SET_IN_MASK(mode, START_DMA)) {
-                WARN_ONCE(1, "VM(%d): iGVT-g doesn't supporte GuC\n",
+                WARN_ONCE(1, "VM(%d): iGVT-g doesn't support GuC\n",
                                 vgpu->id);
                 return 0;
         }
diff --git a/drivers/gpu/drm/i915/gvt/render.c b/drivers/gpu/drm/i915/gvt/render.c
index c6e7972ac21d..a5e11d89df2f 100644
--- a/drivers/gpu/drm/i915/gvt/render.c
+++ b/drivers/gpu/drm/i915/gvt/render.c
@@ -340,6 +340,9 @@ void intel_gvt_restore_render_mmio(struct intel_vgpu *vgpu, int ring_id)
                 } else
                         v = mmio->value;
 
+                if (mmio->in_context)
+                        continue;
+
                 I915_WRITE(mmio->reg, v);
                 POSTING_READ(mmio->reg);
 
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 79ba4b3440aa..f25ff133865f 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -129,9 +129,13 @@ static void try_to_schedule_next_vgpu(struct intel_gvt *gvt)
         struct vgpu_sched_data *vgpu_data;
         ktime_t cur_time;
 
-        /* no target to schedule */
-        if (!scheduler->next_vgpu)
+        /* no need to schedule if next_vgpu is the same with current_vgpu,
+         * let scheduler chose next_vgpu again by setting it to NULL.
+         */
+        if (scheduler->next_vgpu == scheduler->current_vgpu) {
+                scheduler->next_vgpu = NULL;
                 return;
+        }
 
         /*
          * after the flag is set, workload dispatch thread will
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2aa6b97fd22f..a0563e18d753 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -195,9 +195,12 @@ static int ppgtt_bind_vma(struct i915_vma *vma,
         u32 pte_flags;
         int ret;
 
-        ret = vma->vm->allocate_va_range(vma->vm, vma->node.start, vma->size);
-        if (ret)
-                return ret;
+        if (!(vma->flags & I915_VMA_LOCAL_BIND)) {
+                ret = vma->vm->allocate_va_range(vma->vm, vma->node.start,
+                                                 vma->size);
+                if (ret)
+                        return ret;
+        }
 
         vma->pages = vma->obj->mm.pages;
 
@@ -2306,7 +2309,8 @@ static int aliasing_gtt_bind_vma(struct i915_vma *vma,
         if (flags & I915_VMA_LOCAL_BIND) {
                 struct i915_hw_ppgtt *appgtt = i915->mm.aliasing_ppgtt;
 
-                if (appgtt->base.allocate_va_range) {
+                if (!(vma->flags & I915_VMA_LOCAL_BIND) &&
+                    appgtt->base.allocate_va_range) {
                         ret = appgtt->base.allocate_va_range(&appgtt->base,
                                                              vma->node.start,
                                                              vma->node.size);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 11b12f412492..5a7c63e64381 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3051,10 +3051,14 @@ enum skl_disp_power_wells {
 #define CLKCFG_FSB_667                                  (3 << 0)        /* hrawclk 166 */
 #define CLKCFG_FSB_800                                  (2 << 0)        /* hrawclk 200 */
 #define CLKCFG_FSB_1067                                 (6 << 0)        /* hrawclk 266 */
+#define CLKCFG_FSB_1067_ALT                             (0 << 0)        /* hrawclk 266 */
 #define CLKCFG_FSB_1333                                 (7 << 0)        /* hrawclk 333 */
-/* Note, below two are guess */
-#define CLKCFG_FSB_1600                                 (4 << 0)        /* hrawclk 400 */
-#define CLKCFG_FSB_1600_ALT                             (0 << 0)        /* hrawclk 400 */
+/*
+ * Note that on at least on ELK the below value is reported for both
+ * 333 and 400 MHz BIOS FSB setting, but given that the gmch datasheet
+ * lists only 200/266/333 MHz FSB as supported let's decode it as 333 MHz.
+ */
+#define CLKCFG_FSB_1333_ALT                             (4 << 0)        /* hrawclk 333 */
 #define CLKCFG_FSB_MASK                                 (7 << 0)
 #define CLKCFG_MEM_533                                  (1 << 4)
 #define CLKCFG_MEM_667                                  (2 << 4)
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index dd3ad52b7dfe..f29a226e24d8 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -1798,13 +1798,11 @@ static int g4x_hrawclk(struct drm_i915_private *dev_priv)
         case CLKCFG_FSB_800:
                 return 200000;
         case CLKCFG_FSB_1067:
+        case CLKCFG_FSB_1067_ALT:
                 return 266667;
         case CLKCFG_FSB_1333:
+        case CLKCFG_FSB_1333_ALT:
                 return 333333;
-        /* these two are just a guess; one of them might be right */
-        case CLKCFG_FSB_1600:
-        case CLKCFG_FSB_1600_ALT:
-                return 400000;
         default:
                 return 133333;
         }
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index 3ffe8b1f1d48..fc0ef492252a 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -410,11 +410,10 @@ static void glk_dsi_device_ready(struct intel_encoder *encoder)
                 val |= (ULPS_STATE_ENTER | DEVICE_READY);
                 I915_WRITE(MIPI_DEVICE_READY(port), val);
 
-                /* Wait for ULPS Not active */
+                /* Wait for ULPS active */
                 if (intel_wait_for_register(dev_priv,
-                                MIPI_CTRL(port), GLK_ULPS_NOT_ACTIVE,
-                                GLK_ULPS_NOT_ACTIVE, 20))
-                        DRM_ERROR("ULPS is still active\n");
+                                MIPI_CTRL(port), GLK_ULPS_NOT_ACTIVE, 0, 20))
+                        DRM_ERROR("ULPS not active\n");
 
                 /* Exit ULPS */
                 val = I915_READ(MIPI_DEVICE_READY(port));
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 25d8e76489e4..668f00480d97 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -63,6 +63,7 @@
 #include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/pci.h>
+#include <linux/pm_runtime.h>
 
 #include "i915_drv.h"
 #include <linux/delay.h>
@@ -121,6 +122,10 @@ lpe_audio_platdev_create(struct drm_i915_private *dev_priv)
 
         kfree(rsc);
 
+        pm_runtime_forbid(&platdev->dev);
+        pm_runtime_set_active(&platdev->dev);
+        pm_runtime_enable(&platdev->dev);
+
         return platdev;
 
 err:
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 21b10f9840c9..549763f5e17d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -360,6 +360,8 @@ nouveau_display_hpd_work(struct work_struct *work)
         pm_runtime_get_sync(drm->dev->dev);
 
         drm_helper_hpd_irq_event(drm->dev);
+        /* enable polling for external displays */
+        drm_kms_helper_poll_enable(drm->dev);
 
         pm_runtime_mark_last_busy(drm->dev->dev);
         pm_runtime_put_sync(drm->dev->dev);
@@ -413,10 +415,6 @@ nouveau_display_init(struct drm_device *dev)
         if (ret)
                 return ret;
 
-        /* enable polling for external displays */
-        if (!dev->mode_config.poll_enabled)
-                drm_kms_helper_poll_enable(dev);
-
         /* enable hotplug interrupts */
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 struct nouveau_connector *conn = nouveau_connector(connector);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 2b6ac24ce690..36268e1802b5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -502,6 +502,9 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
                 pm_runtime_allow(dev->dev);
                 pm_runtime_mark_last_busy(dev->dev);
                 pm_runtime_put(dev->dev);
+        } else {
+                /* enable polling for external displays */
+                drm_kms_helper_poll_enable(dev);
         }
         return 0;
 
@@ -774,9 +777,6 @@ nouveau_pmops_runtime_resume(struct device *dev)
 
         ret = nouveau_do_resume(drm_dev, true);
 
-        if (!drm_dev->mode_config.poll_enabled)
-                drm_kms_helper_poll_enable(drm_dev);
-
         /* do magic */
         nvif_mask(&device->object, 0x088488, (1 << 25), (1 << 25));
         vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
index 3a24788c3185..a7e55c422501 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -148,7 +148,7 @@ gk104_fifo_runlist_commit(struct gk104_fifo *fifo, int runl)
         case NVKM_MEM_TARGET_NCOH: target = 3; break;
         default:
                 WARN_ON(1);
-                return;
+                goto unlock;
         }
 
         nvkm_wr32(device, 0x002270, (nvkm_memory_addr(mem) >> 12) |
@@ -160,6 +160,7 @@ gk104_fifo_runlist_commit(struct gk104_fifo *fifo, int runl)
                                        & 0x00100000),
                                msecs_to_jiffies(2000)) == 0)
                 nvkm_error(subdev, "runlist %d update timeout\n", runl);
+unlock:
         mutex_unlock(&subdev->mutex);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
index d1cf02d22db1..1b0c793c0192 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
@@ -116,6 +116,7 @@ ls_ucode_img_load_gr(const struct nvkm_subdev *subdev, struct ls_ucode_img *img,
         ret = nvkm_firmware_get(subdev->device, f, &sig);
         if (ret)
                 goto free_data;
+
         img->sig = kmemdup(sig->data, sig->size, GFP_KERNEL);
         if (!img->sig) {
                 ret = -ENOMEM;
@@ -126,8 +127,9 @@ ls_ucode_img_load_gr(const struct nvkm_subdev *subdev, struct ls_ucode_img *img,
         img->ucode_data = ls_ucode_img_build(bl, code, data,
                                              &img->ucode_desc);
         if (IS_ERR(img->ucode_data)) {
+                kfree(img->sig);
                 ret = PTR_ERR(img->ucode_data);
-                goto free_data;
+                goto free_sig;
         }
         img->ucode_size = img->ucode_desc.image_size;
 
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 058340a002c2..4a340efd8ba6 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -575,8 +575,6 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
         if (ret)
                 return;
 
-        cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
-
         if (fb != old_state->fb) {
                 obj = to_qxl_framebuffer(fb)->obj;
                 user_bo = gem_to_qxl_bo(obj);
@@ -614,6 +612,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 qxl_bo_kunmap(cursor_bo);
                 qxl_bo_kunmap(user_bo);
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->u.set.visible = 1;
                 cmd->u.set.shape = qxl_bo_physical_address(qdev,
                                                            cursor_bo, 0);
@@ -624,6 +623,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane,
                 if (ret)
                         goto out_free_release;
 
+                cmd = (struct qxl_cursor_cmd *) qxl_release_map(qdev, release);
                 cmd->type = QXL_CURSOR_MOVE;
         }
 
diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
index 7ba450832e6b..ea36dc4dd5d2 100644
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -776,6 +776,12 @@ bool ci_dpm_vblank_too_short(struct radeon_device *rdev)
         u32 vblank_time = r600_dpm_get_vblank_time(rdev);
         u32 switch_limit = pi->mem_gddr5 ? 450 : 300;
 
+        /* disable mclk switching if the refresh is >120Hz, even if the
+        * blanking period would allow it
+        */
+        if (r600_dpm_get_vrefresh(rdev) > 120)
+                return true;
+
         if (vblank_time < switch_limit)
                 return true;
         else
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index ccebe0f8d2e1..008c145b7f29 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -7401,7 +7401,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -7431,7 +7431,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index f130ec41ee4b..0bf103536404 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -4927,7 +4927,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -4958,7 +4958,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 0a085176e79b..e06e2d8feab3 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3988,7 +3988,7 @@ static void r600_irq_ack(struct radeon_device *rdev)
                         WREG32(DC_HPD5_INT_CONTROL, tmp);
                 }
                 if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
-                        tmp = RREG32(DC_HPD5_INT_CONTROL);
+                        tmp = RREG32(DC_HPD6_INT_CONTROL);
                         tmp |= DC_HPDx_INT_ACK;
                         WREG32(DC_HPD6_INT_CONTROL, tmp);
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index e3e7cb1d10a2..4761f27f2ca2 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -116,7 +116,7 @@ int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags)
         if ((radeon_runtime_pm != 0) &&
             radeon_has_atpx() &&
             ((flags & RADEON_IS_IGP) == 0) &&
-            !pci_is_thunderbolt_attached(rdev->pdev))
+            !pci_is_thunderbolt_attached(dev->pdev))
                 flags |= RADEON_IS_PX;
 
         /* radeon_device_init should report only fatal error
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index ceee87f029d9..76d1888528e6 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6317,7 +6317,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
@@ -6348,7 +6348,7 @@ static inline void si_irq_ack(struct radeon_device *rdev)
                 WREG32(DC_HPD5_INT_CONTROL, tmp);
         }
         if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-                tmp = RREG32(DC_HPD5_INT_CONTROL);
+                tmp = RREG32(DC_HPD6_INT_CONTROL);
                 tmp |= DC_HPDx_RX_INT_ACK;
                 WREG32(DC_HPD6_INT_CONTROL, tmp);
         }
diff --git a/drivers/gpu/host1x/Kconfig b/drivers/gpu/host1x/Kconfig
index b2fd029d67b3..91916326957f 100644
--- a/drivers/gpu/host1x/Kconfig
+++ b/drivers/gpu/host1x/Kconfig
@@ -1,6 +1,7 @@
 config TEGRA_HOST1X
         tristate "NVIDIA Tegra host1x driver"
         depends on ARCH_TEGRA || (ARM && COMPILE_TEST)
+        select IOMMU_IOVA if IOMMU_SUPPORT
         help
           Driver for the NVIDIA Tegra host1x hardware.
 
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 3ac4c03ba77b..c13a4fd86b3c 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -605,6 +605,13 @@ static int coretemp_cpu_online(unsigned int cpu)
         struct platform_data *pdata;
 
         /*
+         * Don't execute this on resume as the offline callback did
+         * not get executed on suspend.
+         */
+        if (cpuhp_tasks_frozen)
+                return 0;
+
+        /*
          * CPUID.06H.EAX[0] indicates whether the CPU has thermal
          * sensors. We check this bit only, all the early CPUs
          * without thermal sensors will be filtered out.
@@ -654,6 +661,13 @@ static int coretemp_cpu_offline(unsigned int cpu)
         struct temp_data *tdata;
         int indx, target;
 
+        /*
+         * Don't execute this on suspend as the device remove locks
+         * up the machine.
+         */
+        if (cpuhp_tasks_frozen)
+                return 0;
+
         /* If the physical CPU device does not exist, just return */
         if (!pdev)
                 return 0;
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index f2acd4b6bf01..d1263b82d646 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -94,6 +94,7 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
 static int dw_i2c_acpi_configure(struct platform_device *pdev)
 {
         struct dw_i2c_dev *dev = platform_get_drvdata(pdev);
+        u32 ss_ht = 0, fp_ht = 0, hs_ht = 0, fs_ht = 0;
         acpi_handle handle = ACPI_HANDLE(&pdev->dev);
         const struct acpi_device_id *id;
         struct acpi_device *adev;
@@ -107,23 +108,24 @@ static int dw_i2c_acpi_configure(struct platform_device *pdev)
          * Try to get SDA hold time and *CNT values from an ACPI method for
          * selected speed modes.
          */
+        dw_i2c_acpi_params(pdev, "SSCN", &dev->ss_hcnt, &dev->ss_lcnt, &ss_ht);
+        dw_i2c_acpi_params(pdev, "FPCN", &dev->fp_hcnt, &dev->fp_lcnt, &fp_ht);
+        dw_i2c_acpi_params(pdev, "HSCN", &dev->hs_hcnt, &dev->hs_lcnt, &hs_ht);
+        dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt, &fs_ht);
+
         switch (dev->clk_freq) {
         case 100000:
-                dw_i2c_acpi_params(pdev, "SSCN", &dev->ss_hcnt, &dev->ss_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = ss_ht;
                 break;
         case 1000000:
-                dw_i2c_acpi_params(pdev, "FPCN", &dev->fp_hcnt, &dev->fp_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = fp_ht;
                 break;
         case 3400000:
-                dw_i2c_acpi_params(pdev, "HSCN", &dev->hs_hcnt, &dev->hs_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = hs_ht;
                 break;
         case 400000:
         default:
-                dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = fs_ht;
                 break;
         }
 
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index cf737ec8563b..5c4db65c5019 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -819,7 +819,6 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data,
                 rc = -EINVAL;
                 goto out;
         }
-        drv_data->irq = irq_of_parse_and_map(np, 0);
 
         drv_data->rstc = devm_reset_control_get_optional(dev, NULL);
         if (IS_ERR(drv_data->rstc)) {
@@ -902,10 +901,11 @@ mv64xxx_i2c_probe(struct platform_device *pd)
         if (!IS_ERR(drv_data->clk))
                 clk_prepare_enable(drv_data->clk);
 
+        drv_data->irq = platform_get_irq(pd, 0);
+
         if (pdata) {
                 drv_data->freq_m = pdata->freq_m;
                 drv_data->freq_n = pdata->freq_n;
-                drv_data->irq = platform_get_irq(pd, 0);
                 drv_data->adapter.timeout = msecs_to_jiffies(pdata->timeout);
                 drv_data->offload_enabled = false;
                 memcpy(&drv_data->reg_offsets, &mv64xxx_i2c_regs_mv64xxx, sizeof(drv_data->reg_offsets));
@@ -915,7 +915,7 @@ mv64xxx_i2c_probe(struct platform_device *pd)
                         goto exit_clk;
         }
         if (drv_data->irq < 0) {
-                rc = -ENXIO;
+                rc = drv_data->irq;
                 goto exit_reset;
         }
 
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index 0ed77eeff31e..a2e3dd715380 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -178,22 +178,39 @@ static int usb_read(struct i2c_adapter *adapter, int cmd,
                     int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmalloc(len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
-                               USB_DIR_IN, value, index, data, len, 2000);
+                               USB_DIR_IN, value, index, dmadata, len, 2000);
+
+        memcpy(data, dmadata, len);
+        kfree(dmadata);
+        return ret;
 }
 
 static int usb_write(struct i2c_adapter *adapter, int cmd,
                      int value, int index, void *data, int len)
 {
         struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+        void *dmadata = kmemdup(data, len, GFP_KERNEL);
+        int ret;
+
+        if (!dmadata)
+                return -ENOMEM;
 
         /* do control transfer */
-        return usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
+        ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
                                cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
-                               value, index, data, len, 2000);
+                               value, index, dmadata, len, 2000);
+
+        kfree(dmadata);
+        return ret;
 }
 
 static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
index dbe7e44c9321..6ba6c83ca8f1 100644
--- a/drivers/i2c/busses/i2c-xgene-slimpro.c
+++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
@@ -416,6 +416,7 @@ static int xgene_slimpro_i2c_probe(struct platform_device *pdev)
         adapter->class = I2C_CLASS_HWMON;
         adapter->dev.parent = &pdev->dev;
         adapter->dev.of_node = pdev->dev.of_node;
+        ACPI_COMPANION_SET(&adapter->dev, ACPI_COMPANION(&pdev->dev));
         i2c_set_adapdata(adapter, ctx);
         rc = i2c_add_adapter(adapter);
         if (rc) {
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 26f7237558ba..9669ca4937b8 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -395,18 +395,20 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
         if (force_nr) {
                 priv->adap.nr = force_nr;
                 ret = i2c_add_numbered_adapter(&priv->adap);
-                dev_err(&parent->dev,
-                        "failed to add mux-adapter %u as bus %u (error=%d)\n",
-                        chan_id, force_nr, ret);
+                if (ret < 0) {
+                        dev_err(&parent->dev,
+                                "failed to add mux-adapter %u as bus %u (error=%d)\n",
+                                chan_id, force_nr, ret);
+                        goto err_free_priv;
+                }
         } else {
                 ret = i2c_add_adapter(&priv->adap);
-                dev_err(&parent->dev,
-                        "failed to add mux-adapter %u (error=%d)\n",
-                        chan_id, ret);
-        }
-        if (ret < 0) {
-                kfree(priv);
-                return ret;
+                if (ret < 0) {
+                        dev_err(&parent->dev,
+                                "failed to add mux-adapter %u (error=%d)\n",
+                                chan_id, ret);
+                        goto err_free_priv;
+                }
         }
 
         WARN(sysfs_create_link(&priv->adap.dev.kobj, &muxc->dev->kobj,
@@ -422,6 +424,10 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
 
         muxc->adapter[muxc->num_adapters++] = &priv->adap;
         return 0;
+
+err_free_priv:
+        kfree(priv);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(i2c_mux_add_adapter);
 
diff --git a/drivers/i2c/muxes/i2c-mux-reg.c b/drivers/i2c/muxes/i2c-mux-reg.c
index 406d5059072c..d97031804de8 100644
--- a/drivers/i2c/muxes/i2c-mux-reg.c
+++ b/drivers/i2c/muxes/i2c-mux-reg.c
@@ -196,20 +196,25 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
                 res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
                 mux->data.reg_size = resource_size(res);
                 mux->data.reg = devm_ioremap_resource(&pdev->dev, res);
-                if (IS_ERR(mux->data.reg))
-                        return PTR_ERR(mux->data.reg);
+                if (IS_ERR(mux->data.reg)) {
+                        ret = PTR_ERR(mux->data.reg);
+                        goto err_put_parent;
+                }
         }
 
         if (mux->data.reg_size != 4 && mux->data.reg_size != 2 &&
             mux->data.reg_size != 1) {
                 dev_err(&pdev->dev, "Invalid register size\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_put_parent;
         }
 
         muxc = i2c_mux_alloc(parent, &pdev->dev, mux->data.n_values, 0, 0,
                              i2c_mux_reg_select, NULL);
-        if (!muxc)
-                return -ENOMEM;
+        if (!muxc) {
+                ret = -ENOMEM;
+                goto err_put_parent;
+        }
         muxc->priv = mux;
 
         platform_set_drvdata(pdev, muxc);
@@ -223,7 +228,7 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
 
                 ret = i2c_mux_add_adapter(muxc, nr, mux->data.values[i], class);
                 if (ret)
-                        goto add_adapter_failed;
+                        goto err_del_mux_adapters;
         }
 
         dev_dbg(&pdev->dev, "%d port mux on %s adapter\n",
@@ -231,8 +236,10 @@ static int i2c_mux_reg_probe(struct platform_device *pdev)
 
         return 0;
 
-add_adapter_failed:
+err_del_mux_adapters:
         i2c_mux_del_adapters(muxc);
+err_put_parent:
+        i2c_put_adapter(parent);
 
         return ret;
 }
diff --git a/drivers/input/mouse/elan_i2c_i2c.c b/drivers/input/mouse/elan_i2c_i2c.c
index a679e56c44cd..f431da07f861 100644
--- a/drivers/input/mouse/elan_i2c_i2c.c
+++ b/drivers/input/mouse/elan_i2c_i2c.c
@@ -554,32 +554,34 @@ static int elan_i2c_finish_fw_update(struct i2c_client *client,
                                      struct completion *completion)
 {
         struct device *dev = &client->dev;
-        long ret;
         int error;
         int len;
-        u8 buffer[ETP_I2C_INF_LENGTH];
+        u8 buffer[ETP_I2C_REPORT_LEN];
+
+        len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN);
+        if (len != ETP_I2C_REPORT_LEN) {
+                error = len < 0 ? len : -EIO;
+                dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n",
+                        error, len);
+        }
 
         reinit_completion(completion);
         enable_irq(client->irq);
 
         error = elan_i2c_write_cmd(client, ETP_I2C_STAND_CMD, ETP_I2C_RESET);
-        if (!error)
-                ret = wait_for_completion_interruptible_timeout(completion,
-                                                        msecs_to_jiffies(300));
-        disable_irq(client->irq);
-
         if (error) {
                 dev_err(dev, "device reset failed: %d\n", error);
-                return error;
-        } else if (ret == 0) {
+        } else if (!wait_for_completion_timeout(completion,
+                                                msecs_to_jiffies(300))) {
                 dev_err(dev, "timeout waiting for device reset\n");
-                return -ETIMEDOUT;
-        } else if (ret < 0) {
-                error = ret;
-                dev_err(dev, "error waiting for device reset: %d\n", error);
-                return error;
+                error = -ETIMEDOUT;
         }
 
+        disable_irq(client->irq);
+
+        if (error)
+                return error;
+
         len = i2c_master_recv(client, buffer, ETP_I2C_INF_LENGTH);
         if (len != ETP_I2C_INF_LENGTH) {
                 error = len < 0 ? len : -EIO;
diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
index 2302aef2b2d4..dd042a9b0aaa 100644
--- a/drivers/input/touchscreen/atmel_mxt_ts.c
+++ b/drivers/input/touchscreen/atmel_mxt_ts.c
@@ -350,6 +350,7 @@ static bool mxt_object_readable(unsigned int type)
         case MXT_TOUCH_KEYARRAY_T15:
         case MXT_TOUCH_PROXIMITY_T23:
         case MXT_TOUCH_PROXKEY_T52:
+        case MXT_TOUCH_MULTITOUCHSCREEN_T100:
         case MXT_PROCI_GRIPFACE_T20:
         case MXT_PROCG_NOISE_T22:
         case MXT_PROCI_ONETOUCH_T24:
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 8cf8d8d5d4ef..f872817e81e4 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -471,7 +471,7 @@ static EDT_ATTR(gain, S_IWUSR | S_IRUGO, WORK_REGISTER_GAIN,
 static EDT_ATTR(offset, S_IWUSR | S_IRUGO, WORK_REGISTER_OFFSET,
                 M09_REGISTER_OFFSET, 0, 31);
 static EDT_ATTR(threshold, S_IWUSR | S_IRUGO, WORK_REGISTER_THRESHOLD,
-                M09_REGISTER_THRESHOLD, 20, 80);
+                M09_REGISTER_THRESHOLD, 0, 80);
 static EDT_ATTR(report_rate, S_IWUSR | S_IRUGO, WORK_REGISTER_REPORT_RATE,
                 NO_REGISTER, 3, 14);
 
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 8348f366ddd1..62618e77bedc 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -396,13 +396,13 @@ static void iommu_dma_free_iova(struct iommu_dma_cookie *cookie,
                 dma_addr_t iova, size_t size)
 {
         struct iova_domain *iovad = &cookie->iovad;
-        unsigned long shift = iova_shift(iovad);
 
         /* The MSI case is only ever cleaning up its most recent allocation */
         if (cookie->type == IOMMU_DMA_MSI_COOKIE)
                 cookie->msi_iova -= size;
         else
-                free_iova_fast(iovad, iova >> shift, size >> shift);
+                free_iova_fast(iovad, iova_pfn(iovad, iova),
+                                size >> iova_shift(iovad));
 }
 
 static void __iommu_dma_unmap(struct iommu_domain *domain, dma_addr_t dma_addr,
@@ -617,11 +617,14 @@ static dma_addr_t __iommu_dma_map(struct device *dev, phys_addr_t phys,
 {
         struct iommu_domain *domain = iommu_get_domain_for_dev(dev);
         struct iommu_dma_cookie *cookie = domain->iova_cookie;
-        struct iova_domain *iovad = &cookie->iovad;
-        size_t iova_off = iova_offset(iovad, phys);
+        size_t iova_off = 0;
         dma_addr_t iova;
 
-        size = iova_align(iovad, size + iova_off);
+        if (cookie->type == IOMMU_DMA_IOVA_COOKIE) {
+                iova_off = iova_offset(&cookie->iovad, phys);
+                size = iova_align(&cookie->iovad, size + iova_off);
+        }
+
         iova = iommu_dma_alloc_iova(domain, size, dma_get_mask(dev), dev);
         if (!iova)
                 return DMA_ERROR_CODE;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 90ab0115d78e..fc2765ccdb57 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2055,11 +2055,14 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
         if (context_copied(context)) {
                 u16 did_old = context_domain_id(context);
 
-                if (did_old >= 0 && did_old < cap_ndoms(iommu->cap))
+                if (did_old >= 0 && did_old < cap_ndoms(iommu->cap)) {
                         iommu->flush.flush_context(iommu, did_old,
                                                    (((u16)bus) << 8) | devfn,
                                                    DMA_CCMD_MASK_NOBIT,
                                                    DMA_CCMD_DEVICE_INVL);
+                        iommu->flush.flush_iotlb(iommu, did_old, 0, 0,
+                                                 DMA_TLB_DSI_FLUSH);
+                }
         }
 
         pgd = domain->pgd;
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index a27ef570c328..bc1efbfb9ddf 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -18,6 +18,7 @@
 #include <linux/clk.h>
 #include <linux/component.h>
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/dma-iommu.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
index d2306c821ebb..31d6b5a582d2 100644
--- a/drivers/irqchip/irq-mbigen.c
+++ b/drivers/irqchip/irq-mbigen.c
@@ -106,10 +106,7 @@ static inline void get_mbigen_type_reg(irq_hw_number_t hwirq,
 static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq,
                                         u32 *mask, u32 *addr)
 {
-        unsigned int ofst;
-
-        hwirq -= RESERVED_IRQ_PER_MBIGEN_CHIP;
-        ofst = hwirq / 32 * 4;
+        unsigned int ofst = (hwirq / 32) * 4;
 
         *mask = 1 << (hwirq % 32);
         *addr = ofst + REG_MBIGEN_CLEAR_OFFSET;
@@ -337,9 +334,15 @@ static int mbigen_device_probe(struct platform_device *pdev)
         mgn_chip->pdev = pdev;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mgn_chip->base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(mgn_chip->base))
-                return PTR_ERR(mgn_chip->base);
+        if (!res)
+                return -EINVAL;
+
+        mgn_chip->base = devm_ioremap(&pdev->dev, res->start,
+                                      resource_size(res));
+        if (!mgn_chip->base) {
+                dev_err(&pdev->dev, "failed to ioremap %pR\n", res);
+                return -ENOMEM;
+        }
 
         if (IS_ENABLED(CONFIG_OF) && pdev->dev.of_node)
                 err = mbigen_of_create_domain(pdev, mgn_chip);
diff --git a/drivers/leds/leds-pca955x.c b/drivers/leds/leds-pca955x.c
index 78a7ce816a47..9a873118ea5f 100644
--- a/drivers/leds/leds-pca955x.c
+++ b/drivers/leds/leds-pca955x.c
@@ -285,7 +285,7 @@ static int pca955x_probe(struct i2c_client *client,
                         "slave address 0x%02x\n",
                         client->name, chip->bits, client->addr);
 
-        if (!i2c_check_functionality(adapter, I2C_FUNC_I2C))
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
                 return -EIO;
 
         if (pdata) {
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 5db11a405129..cd8139593ccd 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -218,7 +218,7 @@ static DEFINE_SPINLOCK(param_spinlock);
  * Buffers are freed after this timeout
  */
 static unsigned dm_bufio_max_age = DM_BUFIO_DEFAULT_AGE_SECS;
-static unsigned dm_bufio_retain_bytes = DM_BUFIO_DEFAULT_RETAIN_BYTES;
+static unsigned long dm_bufio_retain_bytes = DM_BUFIO_DEFAULT_RETAIN_BYTES;
 
 static unsigned long dm_bufio_peak_allocated;
 static unsigned long dm_bufio_allocated_kmem_cache;
@@ -1558,10 +1558,10 @@ static bool __try_evict_buffer(struct dm_buffer *b, gfp_t gfp)
         return true;
 }
 
-static unsigned get_retain_buffers(struct dm_bufio_client *c)
+static unsigned long get_retain_buffers(struct dm_bufio_client *c)
 {
-        unsigned retain_bytes = ACCESS_ONCE(dm_bufio_retain_bytes);
-        return retain_bytes / c->block_size;
+        unsigned long retain_bytes = ACCESS_ONCE(dm_bufio_retain_bytes);
+        return retain_bytes >> (c->sectors_per_block_bits + SECTOR_SHIFT);
 }
 
 static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
@@ -1571,7 +1571,7 @@ static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan,
         struct dm_buffer *b, *tmp;
         unsigned long freed = 0;
         unsigned long count = nr_to_scan;
-        unsigned retain_target = get_retain_buffers(c);
+        unsigned long retain_target = get_retain_buffers(c);
 
         for (l = 0; l < LIST_SIZE; l++) {
                 list_for_each_entry_safe_reverse(b, tmp, &c->lru[l], lru_list) {
@@ -1794,8 +1794,8 @@ static bool older_than(struct dm_buffer *b, unsigned long age_hz)
 static void __evict_old_buffers(struct dm_bufio_client *c, unsigned long age_hz)
 {
         struct dm_buffer *b, *tmp;
-        unsigned retain_target = get_retain_buffers(c);
-        unsigned count;
+        unsigned long retain_target = get_retain_buffers(c);
+        unsigned long count;
         LIST_HEAD(write_list);
 
         dm_bufio_lock(c);
@@ -1955,7 +1955,7 @@ MODULE_PARM_DESC(max_cache_size_bytes, "Size of metadata cache");
 module_param_named(max_age_seconds, dm_bufio_max_age, uint, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(max_age_seconds, "Max age of a buffer in seconds");
 
-module_param_named(retain_bytes, dm_bufio_retain_bytes, uint, S_IRUGO | S_IWUSR);
+module_param_named(retain_bytes, dm_bufio_retain_bytes, ulong, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(retain_bytes, "Try to keep at least this many bytes cached in memory");
 
 module_param_named(peak_allocated_bytes, dm_bufio_peak_allocated, ulong, S_IRUGO | S_IWUSR);
diff --git a/drivers/md/dm-cache-background-tracker.c b/drivers/md/dm-cache-background-tracker.c
index 9b1afdfb13f0..707233891291 100644
--- a/drivers/md/dm-cache-background-tracker.c
+++ b/drivers/md/dm-cache-background-tracker.c
@@ -33,6 +33,11 @@ struct background_tracker *btracker_create(unsigned max_work)
 {
         struct background_tracker *b = kmalloc(sizeof(*b), GFP_KERNEL);
 
+        if (!b) {
+                DMERR("couldn't create background_tracker");
+                return NULL;
+        }
+
         b->max_work = max_work;
         atomic_set(&b->pending_promotes, 0);
         atomic_set(&b->pending_writebacks, 0);
diff --git a/drivers/md/dm-cache-policy-smq.c b/drivers/md/dm-cache-policy-smq.c
index 72479bd61e11..e5eb9c9b4bc8 100644
--- a/drivers/md/dm-cache-policy-smq.c
+++ b/drivers/md/dm-cache-policy-smq.c
@@ -1120,8 +1120,6 @@ static bool clean_target_met(struct smq_policy *mq, bool idle)
          * Cache entries may not be populated.  So we cannot rely on the
          * size of the clean queue.
          */
-        unsigned nr_clean;
-
         if (idle) {
                 /*
                  * We'd like to clean everything.
@@ -1129,18 +1127,16 @@ static bool clean_target_met(struct smq_policy *mq, bool idle)
                 return q_size(&mq->dirty) == 0u;
         }
 
-        nr_clean = from_cblock(mq->cache_size) - q_size(&mq->dirty);
-        return (nr_clean + btracker_nr_writebacks_queued(mq->bg_work)) >=
-                percent_to_target(mq, CLEAN_TARGET);
+        /*
+         * If we're busy we don't worry about cleaning at all.
+         */
+        return true;
 }
 
-static bool free_target_met(struct smq_policy *mq, bool idle)
+static bool free_target_met(struct smq_policy *mq)
 {
         unsigned nr_free;
 
-        if (!idle)
-                return true;
-
         nr_free = from_cblock(mq->cache_size) - mq->cache_alloc.nr_allocated;
         return (nr_free + btracker_nr_demotions_queued(mq->bg_work)) >=
                 percent_to_target(mq, FREE_TARGET);
@@ -1190,9 +1186,9 @@ static void queue_demotion(struct smq_policy *mq)
         if (unlikely(WARN_ON_ONCE(!mq->migrations_allowed)))
                 return;
 
-        e = q_peek(&mq->clean, mq->clean.nr_levels, true);
+        e = q_peek(&mq->clean, mq->clean.nr_levels / 2, true);
         if (!e) {
-                if (!clean_target_met(mq, false))
+                if (!clean_target_met(mq, true))
                         queue_writeback(mq);
                 return;
         }
@@ -1220,7 +1216,7 @@ static void queue_promotion(struct smq_policy *mq, dm_oblock_t oblock,
                  * We always claim to be 'idle' to ensure some demotions happen
                  * with continuous loads.
                  */
-                if (!free_target_met(mq, true))
+                if (!free_target_met(mq))
                         queue_demotion(mq);
                 return;
         }
@@ -1421,14 +1417,10 @@ static int smq_get_background_work(struct dm_cache_policy *p, bool idle,
         spin_lock_irqsave(&mq->lock, flags);
         r = btracker_issue(mq->bg_work, result);
         if (r == -ENODATA) {
-                /* find some writeback work to do */
-                if (mq->migrations_allowed && !free_target_met(mq, idle))
-                        queue_demotion(mq);
-
-                else if (!clean_target_met(mq, idle))
+                if (!clean_target_met(mq, idle)) {
                         queue_writeback(mq);
-
-                r = btracker_issue(mq->bg_work, result);
+                        r = btracker_issue(mq->bg_work, result);
+                }
         }
         spin_unlock_irqrestore(&mq->lock, flags);
 
@@ -1452,6 +1444,7 @@ static void __complete_background_work(struct smq_policy *mq,
                 clear_pending(mq, e);
                 if (success) {
                         e->oblock = work->oblock;
+                        e->level = NR_CACHE_LEVELS - 1;
                         push(mq, e);
                         // h, q, a
                 } else {
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1db375f50a13..d682a0511381 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -94,6 +94,9 @@ static void iot_io_begin(struct io_tracker *iot, sector_t len)
 
 static void __iot_io_end(struct io_tracker *iot, sector_t len)
 {
+        if (!len)
+                return;
+
         iot->in_flight -= len;
         if (!iot->in_flight)
                 iot->idle_time = jiffies;
@@ -474,7 +477,7 @@ struct cache {
         spinlock_t invalidation_lock;
         struct list_head invalidation_requests;
 
-        struct io_tracker origin_tracker;
+        struct io_tracker tracker;
 
         struct work_struct commit_ws;
         struct batcher committer;
@@ -901,8 +904,7 @@ static dm_oblock_t get_bio_block(struct cache *cache, struct bio *bio)
 
 static bool accountable_bio(struct cache *cache, struct bio *bio)
 {
-        return ((bio->bi_bdev == cache->origin_dev->bdev) &&
-                bio_op(bio) != REQ_OP_DISCARD);
+        return bio_op(bio) != REQ_OP_DISCARD;
 }
 
 static void accounted_begin(struct cache *cache, struct bio *bio)
@@ -912,7 +914,7 @@ static void accounted_begin(struct cache *cache, struct bio *bio)
 
         if (accountable_bio(cache, bio)) {
                 pb->len = bio_sectors(bio);
-                iot_io_begin(&cache->origin_tracker, pb->len);
+                iot_io_begin(&cache->tracker, pb->len);
         }
 }
 
@@ -921,7 +923,7 @@ static void accounted_complete(struct cache *cache, struct bio *bio)
         size_t pb_data_size = get_per_bio_data_size(cache);
         struct per_bio_data *pb = get_per_bio_data(bio, pb_data_size);
 
-        iot_io_end(&cache->origin_tracker, pb->len);
+        iot_io_end(&cache->tracker, pb->len);
 }
 
 static void accounted_request(struct cache *cache, struct bio *bio)
@@ -1716,20 +1718,19 @@ static int invalidate_start(struct cache *cache, dm_cblock_t cblock,
 
 enum busy {
         IDLE,
-        MODERATE,
         BUSY
 };
 
 static enum busy spare_migration_bandwidth(struct cache *cache)
 {
-        bool idle = iot_idle_for(&cache->origin_tracker, HZ);
+        bool idle = iot_idle_for(&cache->tracker, HZ);
         sector_t current_volume = (atomic_read(&cache->nr_io_migrations) + 1) *
                 cache->sectors_per_block;
 
-        if (current_volume <= cache->migration_threshold)
-                return idle ? IDLE : MODERATE;
+        if (idle && current_volume <= cache->migration_threshold)
+                return IDLE;
         else
-                return idle ? MODERATE : BUSY;
+                return BUSY;
 }
 
 static void inc_hit_counter(struct cache *cache, struct bio *bio)
@@ -2045,8 +2046,6 @@ static void check_migrations(struct work_struct *ws)
 
         for (;;) {
                 b = spare_migration_bandwidth(cache);
-                if (b == BUSY)
-                        break;
 
                 r = policy_get_background_work(cache->policy, b == IDLE, &op);
                 if (r == -ENODATA)
@@ -2717,7 +2716,7 @@ static int cache_create(struct cache_args *ca, struct cache **result)
 
         batcher_init(&cache->committer, commit_op, cache,
                      issue_op, cache, cache->wq);
-        iot_init(&cache->origin_tracker);
+        iot_init(&cache->tracker);
 
         init_rwsem(&cache->background_work_lock);
         prevent_background_work(cache);
@@ -2941,7 +2940,7 @@ static void cache_postsuspend(struct dm_target *ti)
 
         cancel_delayed_work(&cache->waker);
         flush_workqueue(cache->wq);
-        WARN_ON(cache->origin_tracker.in_flight);
+        WARN_ON(cache->tracker.in_flight);
 
         /*
          * If it's a flush suspend there won't be any deferred bios, so this
diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
index 926a6bcb32c8..3df056b73b66 100644
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -447,7 +447,7 @@ failed:
  * it has been invoked.
  */
 #define dm_report_EIO(m)                                                \
-({                                                                      \
+do {                                                                    \
         struct mapped_device *md = dm_table_get_md((m)->ti->table);     \
                                                                         \
         pr_debug("%s: returning EIO; QIFNP = %d; SQIFNP = %d; DNFS = %d\n", \
@@ -455,8 +455,7 @@ failed:
                  test_bit(MPATHF_QUEUE_IF_NO_PATH, &(m)->flags),        \
                  test_bit(MPATHF_SAVED_QUEUE_IF_NO_PATH, &(m)->flags),  \
                  dm_noflush_suspending((m)->ti));                       \
-        -EIO;                                                           \
-})
+} while (0)
 
 /*
  * Map cloned requests (request-based multipath)
@@ -481,7 +480,8 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq,
         if (!pgpath) {
                 if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
                         return DM_MAPIO_DELAY_REQUEUE;
-                return dm_report_EIO(m);        /* Failed */
+                dm_report_EIO(m);       /* Failed */
+                return DM_MAPIO_KILL;
         } else if (test_bit(MPATHF_QUEUE_IO, &m->flags) ||
                    test_bit(MPATHF_PG_INIT_REQUIRED, &m->flags)) {
                 if (pg_init_all_paths(m))
@@ -558,7 +558,8 @@ static int __multipath_map_bio(struct multipath *m, struct bio *bio, struct dm_m
         if (!pgpath) {
                 if (test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
                         return DM_MAPIO_REQUEUE;
-                return dm_report_EIO(m);
+                dm_report_EIO(m);
+                return -EIO;
         }
 
         mpio->pgpath = pgpath;
@@ -1493,7 +1494,7 @@ static int multipath_end_io(struct dm_target *ti, struct request *clone,
                 if (atomic_read(&m->nr_valid_paths) == 0 &&
                     !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
                         if (error == -EIO)
-                                error = dm_report_EIO(m);
+                                dm_report_EIO(m);
                         /* complete with the original error */
                         r = DM_ENDIO_DONE;
                 }
@@ -1524,8 +1525,10 @@ static int do_end_io_bio(struct multipath *m, struct bio *clone,
                 fail_path(mpio->pgpath);
 
         if (atomic_read(&m->nr_valid_paths) == 0 &&
-            !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags))
-                return dm_report_EIO(m);
+            !test_bit(MPATHF_QUEUE_IF_NO_PATH, &m->flags)) {
+                dm_report_EIO(m);
+                return -EIO;
+        }
 
         /* Queue for the daemon to resubmit */
         dm_bio_restore(get_bio_details_from_bio(clone), clone);
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 2af27026aa2e..b639fa7246ee 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -507,6 +507,7 @@ static int map_request(struct dm_rq_target_io *tio)
         case DM_MAPIO_KILL:
                 /* The target wants to complete the I/O */
                 dm_kill_unmapped_request(rq, -EIO);
+                break;
         default:
                 DMWARN("unimplemented target map return value: %d", r);
                 BUG();
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 0f0251d0d337..d31d18d9727c 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -484,11 +484,11 @@ static int __write_initial_superblock(struct dm_pool_metadata *pmd)
         if (r < 0)
                 return r;
 
-        r = save_sm_roots(pmd);
+        r = dm_tm_pre_commit(pmd->tm);
         if (r < 0)
                 return r;
 
-        r = dm_tm_pre_commit(pmd->tm);
+        r = save_sm_roots(pmd);
         if (r < 0)
                 return r;
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 82f798be964f..10367ffe92e3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8022,18 +8022,15 @@ EXPORT_SYMBOL(md_write_end);
  * may proceed without blocking.  It is important to call this before
  * attempting a GFP_KERNEL allocation while holding the mddev lock.
  * Must be called with mddev_lock held.
- *
- * In the ->external case MD_SB_CHANGE_PENDING can not be cleared until mddev->lock
- * is dropped, so return -EAGAIN after notifying userspace.
  */
-int md_allow_write(struct mddev *mddev)
+void md_allow_write(struct mddev *mddev)
 {
         if (!mddev->pers)
-                return 0;
+                return;
         if (mddev->ro)
-                return 0;
+                return;
         if (!mddev->pers->sync_request)
-                return 0;
+                return;
 
         spin_lock(&mddev->lock);
         if (mddev->in_sync) {
@@ -8046,13 +8043,12 @@ int md_allow_write(struct mddev *mddev)
                 spin_unlock(&mddev->lock);
                 md_update_sb(mddev, 0);
                 sysfs_notify_dirent_safe(mddev->sysfs_state);
+                /* wait for the dirty state to be recorded in the metadata */
+                wait_event(mddev->sb_wait,
+                           !test_bit(MD_SB_CHANGE_CLEAN, &mddev->sb_flags) &&
+                           !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags));
         } else
                 spin_unlock(&mddev->lock);
-
-        if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags))
-                return -EAGAIN;
-        else
-                return 0;
 }
 EXPORT_SYMBOL_GPL(md_allow_write);
 
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 4e75d121bfcc..11f15146ce51 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -665,7 +665,7 @@ extern int sync_page_io(struct md_rdev *rdev, sector_t sector, int size,
                         bool metadata_op);
 extern void md_do_sync(struct md_thread *thread);
 extern void md_new_event(struct mddev *mddev);
-extern int md_allow_write(struct mddev *mddev);
+extern void md_allow_write(struct mddev *mddev);
 extern void md_wait_for_blocked_rdev(struct md_rdev *rdev, struct mddev *mddev);
 extern void md_set_array_sectors(struct mddev *mddev, sector_t array_sectors);
 extern int md_check_no_bitmap(struct mddev *mddev);
diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c
index ebb280a14325..32adf6b4a9c7 100644
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -142,10 +142,23 @@ static int sm_disk_inc_block(struct dm_space_map *sm, dm_block_t b)
 
 static int sm_disk_dec_block(struct dm_space_map *sm, dm_block_t b)
 {
+        int r;
+        uint32_t old_count;
         enum allocation_event ev;
         struct sm_disk *smd = container_of(sm, struct sm_disk, sm);
 
-        return sm_ll_dec(&smd->ll, b, &ev);
+        r = sm_ll_dec(&smd->ll, b, &ev);
+        if (!r && (ev == SM_FREE)) {
+                /*
+                 * It's only free if it's also free in the last
+                 * transaction.
+                 */
+                r = sm_ll_lookup(&smd->old_ll, b, &old_count);
+                if (!r && !old_count)
+                        smd->nr_allocated_this_transaction--;
+        }
+
+        return r;
 }
 
 static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 84e58596594d..d6c0bc76e837 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -385,7 +385,7 @@ static int raid0_run(struct mddev *mddev)
                 blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
                 blk_queue_max_write_same_sectors(mddev->queue, mddev->chunk_sectors);
                 blk_queue_max_write_zeroes_sectors(mddev->queue, mddev->chunk_sectors);
-                blk_queue_max_discard_sectors(mddev->queue, mddev->chunk_sectors);
+                blk_queue_max_discard_sectors(mddev->queue, UINT_MAX);
 
                 blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
                 blk_queue_io_opt(mddev->queue,
@@ -459,6 +459,95 @@ static inline int is_io_in_chunk_boundary(struct mddev *mddev,
         }
 }
 
+static void raid0_handle_discard(struct mddev *mddev, struct bio *bio)
+{
+        struct r0conf *conf = mddev->private;
+        struct strip_zone *zone;
+        sector_t start = bio->bi_iter.bi_sector;
+        sector_t end;
+        unsigned int stripe_size;
+        sector_t first_stripe_index, last_stripe_index;
+        sector_t start_disk_offset;
+        unsigned int start_disk_index;
+        sector_t end_disk_offset;
+        unsigned int end_disk_index;
+        unsigned int disk;
+
+        zone = find_zone(conf, &start);
+
+        if (bio_end_sector(bio) > zone->zone_end) {
+                struct bio *split = bio_split(bio,
+                        zone->zone_end - bio->bi_iter.bi_sector, GFP_NOIO,
+                        mddev->bio_set);
+                bio_chain(split, bio);
+                generic_make_request(bio);
+                bio = split;
+                end = zone->zone_end;
+        } else
+                end = bio_end_sector(bio);
+
+        if (zone != conf->strip_zone)
+                end = end - zone[-1].zone_end;
+
+        /* Now start and end is the offset in zone */
+        stripe_size = zone->nb_dev * mddev->chunk_sectors;
+
+        first_stripe_index = start;
+        sector_div(first_stripe_index, stripe_size);
+        last_stripe_index = end;
+        sector_div(last_stripe_index, stripe_size);
+
+        start_disk_index = (int)(start - first_stripe_index * stripe_size) /
+                mddev->chunk_sectors;
+        start_disk_offset = ((int)(start - first_stripe_index * stripe_size) %
+                mddev->chunk_sectors) +
+                first_stripe_index * mddev->chunk_sectors;
+        end_disk_index = (int)(end - last_stripe_index * stripe_size) /
+                mddev->chunk_sectors;
+        end_disk_offset = ((int)(end - last_stripe_index * stripe_size) %
+                mddev->chunk_sectors) +
+                last_stripe_index * mddev->chunk_sectors;
+
+        for (disk = 0; disk < zone->nb_dev; disk++) {
+                sector_t dev_start, dev_end;
+                struct bio *discard_bio = NULL;
+                struct md_rdev *rdev;
+
+                if (disk < start_disk_index)
+                        dev_start = (first_stripe_index + 1) *
+                                mddev->chunk_sectors;
+                else if (disk > start_disk_index)
+                        dev_start = first_stripe_index * mddev->chunk_sectors;
+                else
+                        dev_start = start_disk_offset;
+
+                if (disk < end_disk_index)
+                        dev_end = (last_stripe_index + 1) * mddev->chunk_sectors;
+                else if (disk > end_disk_index)
+                        dev_end = last_stripe_index * mddev->chunk_sectors;
+                else
+                        dev_end = end_disk_offset;
+
+                if (dev_end <= dev_start)
+                        continue;
+
+                rdev = conf->devlist[(zone - conf->strip_zone) *
+                        conf->strip_zone[0].nb_dev + disk];
+                if (__blkdev_issue_discard(rdev->bdev,
+                        dev_start + zone->dev_start + rdev->data_offset,
+                        dev_end - dev_start, GFP_NOIO, 0, &discard_bio) ||
+                    !discard_bio)
+                        continue;
+                bio_chain(discard_bio, bio);
+                if (mddev->gendisk)
+                        trace_block_bio_remap(bdev_get_queue(rdev->bdev),
+                                discard_bio, disk_devt(mddev->gendisk),
+                                bio->bi_iter.bi_sector);
+                generic_make_request(discard_bio);
+        }
+        bio_endio(bio);
+}
+
 static void raid0_make_request(struct mddev *mddev, struct bio *bio)
 {
         struct strip_zone *zone;
@@ -473,6 +562,11 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
                 return;
         }
 
+        if (unlikely((bio_op(bio) == REQ_OP_DISCARD))) {
+                raid0_handle_discard(mddev, bio);
+                return;
+        }
+
         bio_sector = bio->bi_iter.bi_sector;
         sector = bio_sector;
         chunk_sects = mddev->chunk_sectors;
@@ -498,19 +592,13 @@ static void raid0_make_request(struct mddev *mddev, struct bio *bio)
         bio->bi_iter.bi_sector = sector + zone->dev_start +
                 tmp_dev->data_offset;
 
-        if (unlikely((bio_op(bio) == REQ_OP_DISCARD) &&
-                     !blk_queue_discard(bdev_get_queue(bio->bi_bdev)))) {
-                /* Just ignore it */
-                bio_endio(bio);
-        } else {
-                if (mddev->gendisk)
-                        trace_block_bio_remap(bdev_get_queue(bio->bi_bdev),
-                                              bio, disk_devt(mddev->gendisk),
-                                              bio_sector);
-                mddev_check_writesame(mddev, bio);
-                mddev_check_write_zeroes(mddev, bio);
-                generic_make_request(bio);
-        }
+        if (mddev->gendisk)
+                trace_block_bio_remap(bdev_get_queue(bio->bi_bdev),
+                                      bio, disk_devt(mddev->gendisk),
+                                      bio_sector);
+        mddev_check_writesame(mddev, bio);
+        mddev_check_write_zeroes(mddev, bio);
+        generic_make_request(bio);
 }
 
 static void raid0_status(struct seq_file *seq, struct mddev *mddev)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 7ed59351fe97..af5056d56878 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -666,8 +666,11 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect
                                         break;
                         }
                         continue;
-                } else
+                } else {
+                        if ((sectors > best_good_sectors) && (best_disk >= 0))
+                                best_disk = -1;
                         best_good_sectors = sectors;
+                }
 
                 if (best_disk >= 0)
                         /* At least two disks to choose from so failfast is OK */
@@ -1529,17 +1532,16 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
                         plug = container_of(cb, struct raid1_plug_cb, cb);
                 else
                         plug = NULL;
-                spin_lock_irqsave(&conf->device_lock, flags);
                 if (plug) {
                         bio_list_add(&plug->pending, mbio);
                         plug->pending_cnt++;
                 } else {
+                        spin_lock_irqsave(&conf->device_lock, flags);
                         bio_list_add(&conf->pending_bio_list, mbio);
                         conf->pending_count++;
-                }
-                spin_unlock_irqrestore(&conf->device_lock, flags);
-                if (!plug)
+                        spin_unlock_irqrestore(&conf->device_lock, flags);
                         md_wakeup_thread(mddev->thread);
+                }
         }
 
         r1_bio_write_done(r1_bio);
@@ -3197,7 +3199,7 @@ static int raid1_reshape(struct mddev *mddev)
         struct r1conf *conf = mddev->private;
         int cnt, raid_disks;
         unsigned long flags;
-        int d, d2, err;
+        int d, d2;
 
         /* Cannot change chunk_size, layout, or level */
         if (mddev->chunk_sectors != mddev->new_chunk_sectors ||
@@ -3209,11 +3211,8 @@ static int raid1_reshape(struct mddev *mddev)
                 return -EINVAL;
         }
 
-        if (!mddev_is_clustered(mddev)) {
-                err = md_allow_write(mddev);
-                if (err)
-                        return err;
-        }
+        if (!mddev_is_clustered(mddev))
+                md_allow_write(mddev);
 
         raid_disks = mddev->raid_disks + mddev->delta_disks;
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6b86a0032cf8..4343d7ff9916 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1282,17 +1282,16 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio,
                 plug = container_of(cb, struct raid10_plug_cb, cb);
         else
                 plug = NULL;
-        spin_lock_irqsave(&conf->device_lock, flags);
         if (plug) {
                 bio_list_add(&plug->pending, mbio);
                 plug->pending_cnt++;
         } else {
+                spin_lock_irqsave(&conf->device_lock, flags);
                 bio_list_add(&conf->pending_bio_list, mbio);
                 conf->pending_count++;
-        }
-        spin_unlock_irqrestore(&conf->device_lock, flags);
-        if (!plug)
+                spin_unlock_irqrestore(&conf->device_lock, flags);
                 md_wakeup_thread(mddev->thread);
+        }
 }
 
 static void raid10_write_request(struct mddev *mddev, struct bio *bio,
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 26ba09282e7c..4c00bc248287 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -24,6 +24,7 @@
 #include "md.h"
 #include "raid5.h"
 #include "bitmap.h"
+#include "raid5-log.h"
 
 /*
  * metadata/data stored in disk with 4k size unit (a block) regardless
@@ -622,20 +623,30 @@ static void r5l_do_submit_io(struct r5l_log *log, struct r5l_io_unit *io)
         __r5l_set_io_unit_state(io, IO_UNIT_IO_START);
         spin_unlock_irqrestore(&log->io_list_lock, flags);
 
+        /*
+         * In case of journal device failures, submit_bio will get error
+         * and calls endio, then active stripes will continue write
+         * process. Therefore, it is not necessary to check Faulty bit
+         * of journal device here.
+         *
+         * We can't check split_bio after current_bio is submitted. If
+         * io->split_bio is null, after current_bio is submitted, current_bio
+         * might already be completed and the io_unit is freed. We submit
+         * split_bio first to avoid the issue.
+         */
+        if (io->split_bio) {
+                if (io->has_flush)
+                        io->split_bio->bi_opf |= REQ_PREFLUSH;
+                if (io->has_fua)
+                        io->split_bio->bi_opf |= REQ_FUA;
+                submit_bio(io->split_bio);
+        }
+
         if (io->has_flush)
                 io->current_bio->bi_opf |= REQ_PREFLUSH;
         if (io->has_fua)
                 io->current_bio->bi_opf |= REQ_FUA;
         submit_bio(io->current_bio);
-
-        if (!io->split_bio)
-                return;
-
-        if (io->has_flush)
-                io->split_bio->bi_opf |= REQ_PREFLUSH;
-        if (io->has_fua)
-                io->split_bio->bi_opf |= REQ_FUA;
-        submit_bio(io->split_bio);
 }
 
 /* deferred io_unit will be dispatched here */
@@ -670,6 +681,11 @@ static void r5c_disable_writeback_async(struct work_struct *work)
                 return;
         pr_info("md/raid:%s: Disabling writeback cache for degraded array.\n",
                 mdname(mddev));
+
+        /* wait superblock change before suspend */
+        wait_event(mddev->sb_wait,
+                   !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags));
+
         mddev_suspend(mddev);
         log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH;
         mddev_resume(mddev);
@@ -2621,8 +2637,11 @@ int r5c_try_caching_write(struct r5conf *conf,
          * When run in degraded mode, array is set to write-through mode.
          * This check helps drain pending write safely in the transition to
          * write-through mode.
+         *
+         * When a stripe is syncing, the write is also handled in write
+         * through mode.
          */
-        if (s->failed) {
+        if (s->failed || test_bit(STRIPE_SYNCING, &sh->state)) {
                 r5c_make_stripe_write_out(sh);
                 return -EAGAIN;
         }
@@ -2825,6 +2844,9 @@ void r5c_finish_stripe_write_out(struct r5conf *conf,
         }
 
         r5l_append_flush_payload(log, sh->sector);
+        /* stripe is flused to raid disks, we can do resync now */
+        if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
+                set_bit(STRIPE_HANDLE, &sh->state);
 }
 
 int r5c_cache_data(struct r5l_log *log, struct stripe_head *sh)
@@ -2973,7 +2995,7 @@ ioerr:
         return ret;
 }
 
-void r5c_update_on_rdev_error(struct mddev *mddev)
+void r5c_update_on_rdev_error(struct mddev *mddev, struct md_rdev *rdev)
 {
         struct r5conf *conf = mddev->private;
         struct r5l_log *log = conf->log;
@@ -2981,7 +3003,8 @@ void r5c_update_on_rdev_error(struct mddev *mddev)
         if (!log)
                 return;
 
-        if (raid5_calc_degraded(conf) > 0 &&
+        if ((raid5_calc_degraded(conf) > 0 ||
+             test_bit(Journal, &rdev->flags)) &&
             conf->log->r5c_journal_mode == R5C_JOURNAL_MODE_WRITE_BACK)
                 schedule_work(&log->disable_writeback_work);
 }
diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h
index 27097101ccca..328d67aedda4 100644
--- a/drivers/md/raid5-log.h
+++ b/drivers/md/raid5-log.h
@@ -28,7 +28,8 @@ extern void r5c_flush_cache(struct r5conf *conf, int num);
 extern void r5c_check_stripe_cache_usage(struct r5conf *conf);
 extern void r5c_check_cached_full_stripe(struct r5conf *conf);
 extern struct md_sysfs_entry r5c_journal_mode;
-extern void r5c_update_on_rdev_error(struct mddev *mddev);
+extern void r5c_update_on_rdev_error(struct mddev *mddev,
+                                     struct md_rdev *rdev);
 extern bool r5c_big_stripe_cached(struct r5conf *conf, sector_t sect);
 
 extern struct dma_async_tx_descriptor *
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2e38cfac5b1d..9c4f7659f8b1 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -103,8 +103,7 @@ static inline void unlock_device_hash_lock(struct r5conf *conf, int hash)
 static inline void lock_all_device_hash_locks_irq(struct r5conf *conf)
 {
         int i;
-        local_irq_disable();
-        spin_lock(conf->hash_locks);
+        spin_lock_irq(conf->hash_locks);
         for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++)
                 spin_lock_nest_lock(conf->hash_locks + i, conf->hash_locks);
         spin_lock(&conf->device_lock);
@@ -114,9 +113,9 @@ static inline void unlock_all_device_hash_locks_irq(struct r5conf *conf)
 {
         int i;
         spin_unlock(&conf->device_lock);
-        for (i = NR_STRIPE_HASH_LOCKS; i; i--)
-                spin_unlock(conf->hash_locks + i - 1);
-        local_irq_enable();
+        for (i = NR_STRIPE_HASH_LOCKS - 1; i; i--)
+                spin_unlock(conf->hash_locks + i);
+        spin_unlock_irq(conf->hash_locks);
 }
 
 /* Find first data disk in a raid6 stripe */
@@ -234,11 +233,15 @@ static void do_release_stripe(struct r5conf *conf, struct stripe_head *sh,
                         if (test_bit(R5_InJournal, &sh->dev[i].flags))
                                 injournal++;
         /*
-         * When quiesce in r5c write back, set STRIPE_HANDLE for stripes with
-         * data in journal, so they are not released to cached lists
+         * In the following cases, the stripe cannot be released to cached
+         * lists. Therefore, we make the stripe write out and set
+         * STRIPE_HANDLE:
+         *   1. when quiesce in r5c write back;
+         *   2. when resync is requested fot the stripe.
          */
-        if (conf->quiesce && r5c_is_writeback(conf->log) &&
-            !test_bit(STRIPE_HANDLE, &sh->state) && injournal != 0) {
+        if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state) ||
+            (conf->quiesce && r5c_is_writeback(conf->log) &&
+             !test_bit(STRIPE_HANDLE, &sh->state) && injournal != 0)) {
                 if (test_bit(STRIPE_R5C_CACHING, &sh->state))
                         r5c_make_stripe_write_out(sh);
                 set_bit(STRIPE_HANDLE, &sh->state);
@@ -714,12 +717,11 @@ static bool is_full_stripe_write(struct stripe_head *sh)
 
 static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
 {
-        local_irq_disable();
         if (sh1 > sh2) {
-                spin_lock(&sh2->stripe_lock);
+                spin_lock_irq(&sh2->stripe_lock);
                 spin_lock_nested(&sh1->stripe_lock, 1);
         } else {
-                spin_lock(&sh1->stripe_lock);
+                spin_lock_irq(&sh1->stripe_lock);
                 spin_lock_nested(&sh2->stripe_lock, 1);
         }
 }
@@ -727,8 +729,7 @@ static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
 static void unlock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2)
 {
         spin_unlock(&sh1->stripe_lock);
-        spin_unlock(&sh2->stripe_lock);
-        local_irq_enable();
+        spin_unlock_irq(&sh2->stripe_lock);
 }
 
 /* Only freshly new full stripe normal write stripe can be added to a batch list */
@@ -2312,14 +2313,12 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         struct stripe_head *osh, *nsh;
         LIST_HEAD(newstripes);
         struct disk_info *ndisks;
-        int err;
+        int err = 0;
         struct kmem_cache *sc;
         int i;
         int hash, cnt;
 
-        err = md_allow_write(conf->mddev);
-        if (err)
-                return err;
+        md_allow_write(conf->mddev);
 
         /* Step 1 */
         sc = kmem_cache_create(conf->cache_name[1-conf->active_name],
@@ -2694,7 +2693,7 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
                 bdevname(rdev->bdev, b),
                 mdname(mddev),
                 conf->raid_disks - mddev->degraded);
-        r5c_update_on_rdev_error(mddev);
+        r5c_update_on_rdev_error(mddev, rdev);
 }
 
 /*
@@ -3055,6 +3054,11 @@ sector_t raid5_compute_blocknr(struct stripe_head *sh, int i, int previous)
  *      When LOG_CRITICAL, stripes with injournal == 0 will be sent to
  *      no_space_stripes list.
  *
+ *   3. during journal failure
+ *      In journal failure, we try to flush all cached data to raid disks
+ *      based on data in stripe cache. The array is read-only to upper
+ *      layers, so we would skip all pending writes.
+ *
  */
 static inline bool delay_towrite(struct r5conf *conf,
                                  struct r5dev *dev,
@@ -3068,6 +3072,9 @@ static inline bool delay_towrite(struct r5conf *conf,
         if (test_bit(R5C_LOG_CRITICAL, &conf->cache_state) &&
             s->injournal > 0)
                 return true;
+        /* case 3 above */
+        if (s->log_failed && s->injournal)
+                return true;
         return false;
 }
 
@@ -4653,8 +4660,13 @@ static void handle_stripe(struct stripe_head *sh)
 
         if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state) && !sh->batch_head) {
                 spin_lock(&sh->stripe_lock);
-                /* Cannot process 'sync' concurrently with 'discard' */
-                if (!test_bit(STRIPE_DISCARD, &sh->state) &&
+                /*
+                 * Cannot process 'sync' concurrently with 'discard'.
+                 * Flush data in r5cache before 'sync'.
+                 */
+                if (!test_bit(STRIPE_R5C_PARTIAL_STRIPE, &sh->state) &&
+                    !test_bit(STRIPE_R5C_FULL_STRIPE, &sh->state) &&
+                    !test_bit(STRIPE_DISCARD, &sh->state) &&
                     test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
                         set_bit(STRIPE_SYNCING, &sh->state);
                         clear_bit(STRIPE_INSYNC, &sh->state);
@@ -4701,10 +4713,15 @@ static void handle_stripe(struct stripe_head *sh)
                " to_write=%d failed=%d failed_num=%d,%d\n",
                s.locked, s.uptodate, s.to_read, s.to_write, s.failed,
                s.failed_num[0], s.failed_num[1]);
-        /* check if the array has lost more than max_degraded devices and,
+        /*
+         * check if the array has lost more than max_degraded devices and,
          * if so, some requests might need to be failed.
+         *
+         * When journal device failed (log_failed), we will only process
+         * the stripe if there is data need write to raid disks
          */
-        if (s.failed > conf->max_degraded || s.log_failed) {
+        if (s.failed > conf->max_degraded ||
+            (s.log_failed && s.injournal == 0)) {
                 sh->check_state = 0;
                 sh->reconstruct_state = 0;
                 break_stripe_batch_list(sh, 0);
@@ -5277,8 +5294,10 @@ static struct stripe_head *__get_priority_stripe(struct r5conf *conf, int group)
         struct stripe_head *sh, *tmp;
         struct list_head *handle_list = NULL;
         struct r5worker_group *wg;
-        bool second_try = !r5c_is_writeback(conf->log);
-        bool try_loprio = test_bit(R5C_LOG_TIGHT, &conf->cache_state);
+        bool second_try = !r5c_is_writeback(conf->log) &&
+                !r5l_log_disk_error(conf);
+        bool try_loprio = test_bit(R5C_LOG_TIGHT, &conf->cache_state) ||
+                r5l_log_disk_error(conf);
 
 again:
         wg = NULL;
@@ -6313,7 +6332,6 @@ int
 raid5_set_cache_size(struct mddev *mddev, int size)
 {
         struct r5conf *conf = mddev->private;
-        int err;
 
         if (size <= 16 || size > 32768)
                 return -EINVAL;
@@ -6325,10 +6343,7 @@ raid5_set_cache_size(struct mddev *mddev, int size)
                 ;
         mutex_unlock(&conf->cache_size_mutex);
 
-
-        err = md_allow_write(mddev);
-        if (err)
-                return err;
+        md_allow_write(mddev);
 
         mutex_lock(&conf->cache_size_mutex);
         while (size > conf->max_nr_stripes)
@@ -7530,7 +7545,9 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
                  * neilb: there is no locking about new writes here,
                  * so this cannot be safe.
                  */
-                if (atomic_read(&conf->active_stripes)) {
+                if (atomic_read(&conf->active_stripes) ||
+                    atomic_read(&conf->r5c_cached_full_stripes) ||
+                    atomic_read(&conf->r5c_cached_partial_stripes)) {
                         return -EBUSY;
                 }
                 log_exit(conf);
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index bf0fe0137dfe..a80e17de906d 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -460,12 +460,12 @@ static int get_gpmc_timing_reg(
                 if (l)
                         time_ns_min = gpmc_clk_ticks_to_ns(l - 1, cs, cd) + 1;
                 time_ns = gpmc_clk_ticks_to_ns(l, cs, cd);
-                pr_info("gpmc,%s = <%u> /* %u ns - %u ns; %i ticks%s*/\n",
+                pr_info("gpmc,%s = <%u>; /* %u ns - %u ns; %i ticks%s*/\n",
                         name, time_ns, time_ns_min, time_ns, l,
                         invalid ? "; invalid " : " ");
         } else {
                 /* raw format */
-                pr_info("gpmc,%s = <%u>%s\n", name, l,
+                pr_info("gpmc,%s = <%u>;%s\n", name, l,
                         invalid ? " /* invalid */" : "");
         }
 
@@ -512,7 +512,7 @@ static void gpmc_cs_show_timings(int cs, const char *desc)
         pr_info("gpmc cs%i access configuration:\n", cs);
         GPMC_GET_RAW_BOOL(GPMC_CS_CONFIG1,  4,  4, "time-para-granularity");
         GPMC_GET_RAW(GPMC_CS_CONFIG1,  8,  9, "mux-add-data");
-        GPMC_GET_RAW_MAX(GPMC_CS_CONFIG1, 12, 13,
+        GPMC_GET_RAW_SHIFT_MAX(GPMC_CS_CONFIG1, 12, 13, 1,
                          GPMC_CONFIG1_DEVICESIZE_MAX, "device-width");
         GPMC_GET_RAW(GPMC_CS_CONFIG1, 16, 17, "wait-pin");
         GPMC_GET_RAW_BOOL(GPMC_CS_CONFIG1, 21, 21, "wait-on-write");
@@ -2083,8 +2083,11 @@ static int gpmc_probe_generic_child(struct platform_device *pdev,
         } else {
                 ret = of_property_read_u32(child, "bank-width",
                                            &gpmc_s.device_width);
-                if (ret < 0)
+                if (ret < 0) {
+                        dev_err(&pdev->dev, "%s has no 'bank-width' property\n",
+                                child->full_name);
                         goto err;
+                }
         }
 
         /* Reserve wait pin if it is required and valid */
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2cba76e6fa3c..07bbd4cc1852 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -492,6 +492,7 @@ config ASPEED_LPC_CTRL
 
 config PCI_ENDPOINT_TEST
         depends on PCI
+        select CRC32
         tristate "PCI Endpoint Test driver"
         ---help---
            Enable this configuration option to enable the host side test driver
diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c
index 1304160de168..13ef162cf066 100644
--- a/drivers/mmc/core/pwrseq_simple.c
+++ b/drivers/mmc/core/pwrseq_simple.c
@@ -27,6 +27,7 @@ struct mmc_pwrseq_simple {
         struct mmc_pwrseq pwrseq;
         bool clk_enabled;
         u32 post_power_on_delay_ms;
+        u32 power_off_delay_us;
         struct clk *ext_clk;
         struct gpio_descs *reset_gpios;
 };
@@ -78,6 +79,10 @@ static void mmc_pwrseq_simple_power_off(struct mmc_host *host)
 
         mmc_pwrseq_simple_set_gpios_value(pwrseq, 1);
 
+        if (pwrseq->power_off_delay_us)
+                usleep_range(pwrseq->power_off_delay_us,
+                        2 * pwrseq->power_off_delay_us);
+
         if (!IS_ERR(pwrseq->ext_clk) && pwrseq->clk_enabled) {
                 clk_disable_unprepare(pwrseq->ext_clk);
                 pwrseq->clk_enabled = false;
@@ -119,6 +124,8 @@ static int mmc_pwrseq_simple_probe(struct platform_device *pdev)
 
         device_property_read_u32(dev, "post-power-on-delay-ms",
                                  &pwrseq->post_power_on_delay_ms);
+        device_property_read_u32(dev, "power-off-delay-us",
+                                 &pwrseq->power_off_delay_us);
 
         pwrseq->pwrseq.dev = dev;
         pwrseq->pwrseq.ops = &mmc_pwrseq_simple_ops;
diff --git a/drivers/mmc/host/cavium-octeon.c b/drivers/mmc/host/cavium-octeon.c
index 772d0900026d..951d2cdd7888 100644
--- a/drivers/mmc/host/cavium-octeon.c
+++ b/drivers/mmc/host/cavium-octeon.c
@@ -108,7 +108,7 @@ static void octeon_mmc_release_bus(struct cvm_mmc_host *host)
 static void octeon_mmc_int_enable(struct cvm_mmc_host *host, u64 val)
 {
         writeq(val, host->base + MIO_EMM_INT(host));
-        if (!host->dma_active || (host->dma_active && !host->has_ciu3))
+        if (!host->has_ciu3)
                 writeq(val, host->base + MIO_EMM_INT_EN(host));
 }
 
@@ -267,7 +267,7 @@ static int octeon_mmc_probe(struct platform_device *pdev)
         }
 
         host->global_pwr_gpiod = devm_gpiod_get_optional(&pdev->dev,
-                                                         "power-gpios",
+                                                         "power",
                                                          GPIOD_OUT_HIGH);
         if (IS_ERR(host->global_pwr_gpiod)) {
                 dev_err(&pdev->dev, "Invalid power GPIO\n");
@@ -288,11 +288,20 @@ static int octeon_mmc_probe(struct platform_device *pdev)
                 if (ret) {
                         dev_err(&pdev->dev, "Error populating slots\n");
                         octeon_mmc_set_shared_power(host, 0);
-                        return ret;
+                        goto error;
                 }
                 i++;
         }
         return 0;
+
+error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
+        return ret;
 }
 
 static int octeon_mmc_remove(struct platform_device *pdev)
diff --git a/drivers/mmc/host/cavium-thunderx.c b/drivers/mmc/host/cavium-thunderx.c
index fe3d77267cd6..b9cc95998799 100644
--- a/drivers/mmc/host/cavium-thunderx.c
+++ b/drivers/mmc/host/cavium-thunderx.c
@@ -146,6 +146,12 @@ static int thunder_mmc_probe(struct pci_dev *pdev,
         return 0;
 
 error:
+        for (i = 0; i < CAVIUM_MAX_MMC; i++) {
+                if (host->slot[i])
+                        cvm_mmc_of_slot_remove(host->slot[i]);
+                if (host->slot_pdev[i])
+                        of_platform_device_destroy(&host->slot_pdev[i]->dev, NULL);
+        }
         clk_disable_unprepare(host->clk);
         return ret;
 }
diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
index 58b51ba6aabd..b8aaf0fdb77c 100644
--- a/drivers/mmc/host/cavium.c
+++ b/drivers/mmc/host/cavium.c
@@ -839,14 +839,14 @@ static void cvm_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                 cvm_mmc_reset_bus(slot);
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 0);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, 0);
                 break;
 
         case MMC_POWER_UP:
                 if (host->global_pwr_gpiod)
                         host->set_shared_power(host, 1);
-                else
+                else if (!IS_ERR(mmc->supply.vmmc))
                         mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, ios->vdd);
                 break;
         }
@@ -968,20 +968,15 @@ static int cvm_mmc_of_parse(struct device *dev, struct cvm_mmc_slot *slot)
                 return -EINVAL;
         }
 
-        mmc->supply.vmmc = devm_regulator_get_optional(dev, "vmmc");
-        if (IS_ERR(mmc->supply.vmmc)) {
-                if (PTR_ERR(mmc->supply.vmmc) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                /*
-                 * Legacy Octeon firmware has no regulator entry, fall-back to
-                 * a hard-coded voltage to get a sane OCR.
-                 */
+        ret = mmc_regulator_get_supply(mmc);
+        if (ret == -EPROBE_DEFER)
+                return ret;
+        /*
+         * Legacy Octeon firmware has no regulator entry, fall-back to
+         * a hard-coded voltage to get a sane OCR.
+         */
+        if (IS_ERR(mmc->supply.vmmc))
                 mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
-        } else {
-                ret = mmc_regulator_get_ocrmask(mmc->supply.vmmc);
-                if (ret > 0)
-                        mmc->ocr_avail = ret;
-        }
 
         /* Common MMC bindings */
         ret = mmc_of_parse(mmc);
diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c
index 3275d4995812..61666d269771 100644
--- a/drivers/mmc/host/sdhci-iproc.c
+++ b/drivers/mmc/host/sdhci-iproc.c
@@ -187,7 +187,8 @@ static const struct sdhci_iproc_data iproc_cygnus_data = {
 };
 
 static const struct sdhci_pltfm_data sdhci_iproc_pltfm_data = {
-        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK,
+        .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK |
+                  SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12,
         .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN,
         .ops = &sdhci_iproc_ops,
 };
diff --git a/drivers/mmc/host/sdhci-xenon-phy.c b/drivers/mmc/host/sdhci-xenon-phy.c
index 6356781f1cca..f7e26b031e76 100644
--- a/drivers/mmc/host/sdhci-xenon-phy.c
+++ b/drivers/mmc/host/sdhci-xenon-phy.c
@@ -787,14 +787,6 @@ int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios)
         return ret;
 }
 
-void xenon_clean_phy(struct sdhci_host *host)
-{
-        struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
-        struct xenon_priv *priv = sdhci_pltfm_priv(pltfm_host);
-
-        kfree(priv->phy_params);
-}
-
 static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
                          const char *phy_name)
 {
@@ -819,11 +811,7 @@ static int xenon_add_phy(struct device_node *np, struct sdhci_host *host,
         if (ret)
                 return ret;
 
-        ret = xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
-        if (ret)
-                xenon_clean_phy(host);
-
-        return ret;
+        return xenon_emmc_phy_parse_param_dt(host, np, priv->phy_params);
 }
 
 int xenon_phy_parse_dt(struct device_node *np, struct sdhci_host *host)
diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c
index 67246655315b..bc1781bb070b 100644
--- a/drivers/mmc/host/sdhci-xenon.c
+++ b/drivers/mmc/host/sdhci-xenon.c
@@ -486,7 +486,7 @@ static int xenon_probe(struct platform_device *pdev)
 
         err = xenon_sdhc_prepare(host);
         if (err)
-                goto clean_phy_param;
+                goto err_clk;
 
         err = sdhci_add_host(host);
         if (err)
@@ -496,8 +496,6 @@ static int xenon_probe(struct platform_device *pdev)
 
 remove_sdhc:
         xenon_sdhc_unprepare(host);
-clean_phy_param:
-        xenon_clean_phy(host);
 err_clk:
         clk_disable_unprepare(pltfm_host->clk);
 free_pltfm:
@@ -510,8 +508,6 @@ static int xenon_remove(struct platform_device *pdev)
         struct sdhci_host *host = platform_get_drvdata(pdev);
         struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 
-        xenon_clean_phy(host);
-
         sdhci_remove_host(host, 0);
 
         xenon_sdhc_unprepare(host);
diff --git a/drivers/mmc/host/sdhci-xenon.h b/drivers/mmc/host/sdhci-xenon.h
index 6e6523ea01ce..73debb42dc2f 100644
--- a/drivers/mmc/host/sdhci-xenon.h
+++ b/drivers/mmc/host/sdhci-xenon.h
@@ -93,7 +93,6 @@ struct xenon_priv {
 };
 
 int xenon_phy_adj(struct sdhci_host *host, struct mmc_ios *ios);
-void xenon_clean_phy(struct sdhci_host *host);
 int xenon_phy_parse_dt(struct device_node *np,
                        struct sdhci_host *host);
 void xenon_soc_pad_ctrl(struct sdhci_host *host,
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index c5fd4259da33..b44a6aeb346d 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2577,7 +2577,7 @@ int __bond_3ad_get_active_agg_info(struct bonding *bond,
                 return -1;
 
         ad_info->aggregator_id = aggregator->aggregator_identifier;
-        ad_info->ports = aggregator->num_of_ports;
+        ad_info->ports = __agg_active_ports(aggregator);
         ad_info->actor_key = aggregator->actor_oper_aggregator_key;
         ad_info->partner_key = aggregator->partner_oper_aggregator_key;
         ether_addr_copy(ad_info->partner_system,
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2be78807fd6e..2359478b977f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2612,11 +2612,13 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
         bond_for_each_slave_rcu(bond, slave, iter) {
                 unsigned long trans_start = dev_trans_start(slave->dev);
 
+                slave->new_link = BOND_LINK_NOCHANGE;
+
                 if (slave->link != BOND_LINK_UP) {
                         if (bond_time_in_interval(bond, trans_start, 1) &&
                             bond_time_in_interval(bond, slave->last_rx, 1)) {
 
-                                slave->link  = BOND_LINK_UP;
+                                slave->new_link = BOND_LINK_UP;
                                 slave_state_changed = 1;
 
                                 /* primary_slave has no meaning in round-robin
@@ -2643,7 +2645,7 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                         if (!bond_time_in_interval(bond, trans_start, 2) ||
                             !bond_time_in_interval(bond, slave->last_rx, 2)) {
 
-                                slave->link  = BOND_LINK_DOWN;
+                                slave->new_link = BOND_LINK_DOWN;
                                 slave_state_changed = 1;
 
                                 if (slave->link_failure_count < UINT_MAX)
@@ -2674,6 +2676,11 @@ static void bond_loadbalance_arp_mon(struct bonding *bond)
                 if (!rtnl_trylock())
                         goto re_arm;
 
+                bond_for_each_slave(bond, slave, iter) {
+                        if (slave->new_link != BOND_LINK_NOCHANGE)
+                                slave->link = slave->new_link;
+                }
+
                 if (slave_state_changed) {
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
@@ -4271,10 +4278,10 @@ static int bond_check_params(struct bond_params *params)
         int arp_validate_value, fail_over_mac_value, primary_reselect_value, i;
         struct bond_opt_value newval;
         const struct bond_opt_value *valptr;
-        int arp_all_targets_value;
+        int arp_all_targets_value = 0;
         u16 ad_actor_sys_prio = 0;
         u16 ad_user_port_key = 0;
-        __be32 arp_target[BOND_MAX_ARP_TARGETS];
+        __be32 arp_target[BOND_MAX_ARP_TARGETS] = { 0 };
         int arp_ip_count;
         int bond_mode   = BOND_MODE_ROUNDROBIN;
         int xmit_hashtype = BOND_XMIT_POLICY_LAYER2;
@@ -4501,7 +4508,6 @@ static int bond_check_params(struct bond_params *params)
                 arp_validate_value = 0;
         }
 
-        arp_all_targets_value = 0;
         if (arp_all_targets) {
                 bond_opt_initstr(&newval, arp_all_targets);
                 valptr = bond_opt_parse(bond_opt_get(BOND_OPT_ARP_ALL_TARGETS),
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 19581d783d8e..d034d8cd7d22 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -849,6 +849,9 @@ static uint64_t _mv88e6xxx_get_ethtool_stat(struct mv88e6xxx_chip *chip,
                 mv88e6xxx_g1_stats_read(chip, reg, &low);
                 if (s->sizeof_stat == 8)
                         mv88e6xxx_g1_stats_read(chip, reg + 1, &high);
+                break;
+        default:
+                return UINT64_MAX;
         }
         value = (((u64)high) << 16) | low;
         return value;
diff --git a/drivers/net/ethernet/8390/ax88796.c b/drivers/net/ethernet/8390/ax88796.c
index b0a3b85fc6f8..db02bc2fb4b2 100644
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -748,13 +748,13 @@ static int ax_init_dev(struct net_device *dev)
 
         ret = ax_mii_init(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         ax_NS8390_init(dev, 0);
 
         ret = register_netdev(dev);
         if (ret)
-                goto out_irq;
+                goto err_out;
 
         netdev_info(dev, "%dbit, irq %d, %lx, MAC: %pM\n",
                     ei_local->word16 ? 16 : 8, dev->irq, dev->base_addr,
@@ -762,9 +762,6 @@ static int ax_init_dev(struct net_device *dev)
 
         return 0;
 
- out_irq:
-        /* cleanup irq */
-        free_irq(dev->irq, dev);
  err_out:
         return ret;
 }
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
index 4ee15ff06a44..faeb4935ef3e 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
@@ -200,29 +200,18 @@ err_exit:
 static int hw_atl_a0_hw_offload_set(struct aq_hw_s *self,
                                     struct aq_nic_cfg_s *aq_nic_cfg)
 {
-        int err = 0;
-
         /* TX checksums offloads*/
         tpo_ipv4header_crc_offload_en_set(self, 1);
         tpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* RX checksums offloads*/
         rpo_ipv4header_crc_offload_en_set(self, 1);
         rpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* LSO offloads*/
         tdm_large_send_offload_en_set(self, 0xFFFFFFFFU);
-        if (err < 0)
-                goto err_exit;
-
-        err = aq_hw_err_from_flags(self);
 
-err_exit:
-        return err;
+        return aq_hw_err_from_flags(self);
 }
 
 static int hw_atl_a0_hw_init_tx_path(struct aq_hw_s *self)
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 42150708191d..1bceb7358e5c 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -200,25 +200,18 @@ err_exit:
 static int hw_atl_b0_hw_offload_set(struct aq_hw_s *self,
                                     struct aq_nic_cfg_s *aq_nic_cfg)
 {
-        int err = 0;
         unsigned int i;
 
         /* TX checksums offloads*/
         tpo_ipv4header_crc_offload_en_set(self, 1);
         tpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* RX checksums offloads*/
         rpo_ipv4header_crc_offload_en_set(self, 1);
         rpo_tcp_udp_crc_offload_en_set(self, 1);
-        if (err < 0)
-                goto err_exit;
 
         /* LSO offloads*/
         tdm_large_send_offload_en_set(self, 0xFFFFFFFFU);
-        if (err < 0)
-                goto err_exit;
 
 /* LRO offloads */
         {
@@ -245,10 +238,7 @@ static int hw_atl_b0_hw_offload_set(struct aq_hw_s *self,
 
                 rpo_lro_en_set(self, aq_nic_cfg->is_lro ? 0xFFFFFFFFU : 0U);
         }
-        err = aq_hw_err_from_flags(self);
-
-err_exit:
-        return err;
+        return aq_hw_err_from_flags(self);
 }
 
 static int hw_atl_b0_hw_init_tx_path(struct aq_hw_s *self)
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index 63f2deec2a52..77a1c03255de 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1353,6 +1353,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) &&
                 pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
                 printk(KERN_ERR "atl2: No usable DMA configuration, aborting\n");
+                err = -EIO;
                 goto err_dma;
         }
 
@@ -1366,10 +1367,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * pcibios_set_master to do the needed arch specific settings */
         pci_set_master(pdev);
 
-        err = -ENOMEM;
         netdev = alloc_etherdev(sizeof(struct atl2_adapter));
-        if (!netdev)
+        if (!netdev) {
+                err = -ENOMEM;
                 goto err_alloc_etherdev;
+        }
 
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
@@ -1408,8 +1410,6 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto err_sw_init;
 
-        err = -EIO;
-
         netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX;
         netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
 
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index b56c54d68d5e..03f55daecb20 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -7630,8 +7630,6 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->min_mtu = ETH_ZLEN;
         dev->max_mtu = BNXT_MAX_MTU;
 
-        bnxt_dcb_init(bp);
-
 #ifdef CONFIG_BNXT_SRIOV
         init_waitqueue_head(&bp->sriov_cfg_wait);
 #endif
@@ -7669,6 +7667,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         bnxt_hwrm_func_qcfg(bp);
         bnxt_hwrm_port_led_qcaps(bp);
         bnxt_ethtool_init(bp);
+        bnxt_dcb_init(bp);
 
         bnxt_set_rx_skb_mode(bp, false);
         bnxt_set_tpa_flags(bp);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
index 46de2f8ff024..5c6dd0ce209f 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
@@ -553,8 +553,10 @@ static u8 bnxt_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         if ((mode & DCB_CAP_DCBX_VER_CEE) || !(mode & DCB_CAP_DCBX_VER_IEEE))
                 return 1;
 
-        if ((mode & DCB_CAP_DCBX_HOST) && BNXT_VF(bp))
-                return 1;
+        if (mode & DCB_CAP_DCBX_HOST) {
+                if (BNXT_VF(bp) || (bp->flags & BNXT_FLAG_FW_LLDP_AGENT))
+                        return 1;
+        }
 
         if (mode == bp->dcbx_cap)
                 return 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index fa376444e57c..3549d3876278 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x21
+#define T4FW_VERSION_MICRO 0x2B
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x21
+#define T5FW_VERSION_MICRO 0x2B
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x21
+#define T6FW_VERSION_MICRO 0x2B
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index f3a09ab55900..4eee18ce9be4 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5078,9 +5078,11 @@ static netdev_features_t be_features_check(struct sk_buff *skb,
         struct be_adapter *adapter = netdev_priv(dev);
         u8 l4_hdr = 0;
 
-        /* The code below restricts offload features for some tunneled packets.
+        /* The code below restricts offload features for some tunneled and
+         * Q-in-Q packets.
          * Offload features for normal (non tunnel) packets are unchanged.
          */
+        features = vlan_features_check(skb, features);
         if (!skb->encapsulation ||
             !(adapter->flags & BE_FLAGS_VXLAN_OFFLOADS))
                 return features;
diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
index 6ac336b546e6..1536356e2ea8 100644
--- a/drivers/net/ethernet/faraday/ftmac100.c
+++ b/drivers/net/ethernet/faraday/ftmac100.c
@@ -1174,11 +1174,17 @@ static int ftmac100_remove(struct platform_device *pdev)
         return 0;
 }
 
+static const struct of_device_id ftmac100_of_ids[] = {
+        { .compatible = "andestech,atmac100" },
+        { }
+};
+
 static struct platform_driver ftmac100_driver = {
         .probe          = ftmac100_probe,
         .remove         = ftmac100_remove,
         .driver         = {
                 .name   = DRV_NAME,
+                .of_match_table = ftmac100_of_ids
         },
 };
 
@@ -1202,3 +1208,4 @@ module_exit(ftmac100_exit);
 MODULE_AUTHOR("Po-Yu Chuang <ratbert@faraday-tech.com>");
 MODULE_DESCRIPTION("FTMAC100 driver");
 MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(of, ftmac100_of_ids);
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 56a563f90b0b..f7c8649fd28f 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3192,7 +3192,7 @@ static int fec_reset_phy(struct platform_device *pdev)
 {
         int err, phy_reset;
         bool active_high = false;
-        int msec = 1;
+        int msec = 1, phy_post_delay = 0;
         struct device_node *np = pdev->dev.of_node;
 
         if (!np)
@@ -3209,6 +3209,11 @@ static int fec_reset_phy(struct platform_device *pdev)
         else if (!gpio_is_valid(phy_reset))
                 return 0;
 
+        err = of_property_read_u32(np, "phy-reset-post-delay", &phy_post_delay);
+        /* valid reset duration should be less than 1s */
+        if (!err && phy_post_delay > 1000)
+                return -EINVAL;
+
         active_high = of_property_read_bool(np, "phy-reset-active-high");
 
         err = devm_gpio_request_one(&pdev->dev, phy_reset,
@@ -3226,6 +3231,15 @@ static int fec_reset_phy(struct platform_device *pdev)
 
         gpio_set_value_cansleep(phy_reset, !active_high);
 
+        if (!phy_post_delay)
+                return 0;
+
+        if (phy_post_delay > 20)
+                msleep(phy_post_delay);
+        else
+                usleep_range(phy_post_delay * 1000,
+                             phy_post_delay * 1000 + 1000);
+
         return 0;
 }
 #else /* CONFIG_OF */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 703205475524..83aab1e4c8c8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2862,12 +2862,10 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
         int port = 0;
 
         if (msi_x) {
-                int nreq = dev->caps.num_ports * num_online_cpus() + 1;
-
-                nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
-                             nreq);
-                if (nreq > MAX_MSIX)
-                        nreq = MAX_MSIX;
+                int nreq = min3(dev->caps.num_ports *
+                                (int)num_online_cpus() + 1,
+                                dev->caps.num_eqs - dev->caps.reserved_eqs,
+                                MAX_MSIX);
 
                 entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
                 if (!entries)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index fc52d742b7f7..27251a78075c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -13,7 +13,7 @@ config MLX5_CORE
 
 config MLX5_CORE_EN
         bool "Mellanox Technologies ConnectX-4 Ethernet support"
-        depends on NETDEVICES && ETHERNET && PCI && MLX5_CORE
+        depends on NETDEVICES && ETHERNET && INET && PCI && MLX5_CORE
         depends on IPV6=y || IPV6=n || MLX5_CORE=m
         imply PTP_1588_CLOCK
         default n
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index 5bdaf3d545b2..10d282841f5b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -774,7 +774,7 @@ static void cb_timeout_handler(struct work_struct *work)
         mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
                        mlx5_command_str(msg_to_opcode(ent->in)),
                        msg_to_opcode(ent->in));
-        mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+        mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
 }
 
 static void cmd_work_handler(struct work_struct *work)
@@ -804,6 +804,7 @@ static void cmd_work_handler(struct work_struct *work)
         }
 
         cmd->ent_arr[ent->idx] = ent;
+        set_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, &ent->state);
         lay = get_inst(cmd, ent->idx);
         ent->lay = lay;
         memset(lay, 0, sizeof(*lay));
@@ -825,6 +826,20 @@ static void cmd_work_handler(struct work_struct *work)
         if (ent->callback)
                 schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
 
+        /* Skip sending command to fw if internal error */
+        if (pci_channel_offline(dev->pdev) ||
+            dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+                u8 status = 0;
+                u32 drv_synd;
+
+                ent->ret = mlx5_internal_err_ret_value(dev, msg_to_opcode(ent->in), &drv_synd, &status);
+                MLX5_SET(mbox_out, ent->out, status, status);
+                MLX5_SET(mbox_out, ent->out, syndrome, drv_synd);
+
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
+                return;
+        }
+
         /* ring doorbell after the descriptor is valid */
         mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
         wmb();
@@ -835,7 +850,7 @@ static void cmd_work_handler(struct work_struct *work)
                 poll_timeout(ent);
                 /* make sure we read the descriptor after ownership is SW */
                 rmb();
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, (ent->ret == -ETIMEDOUT));
         }
 }
 
@@ -879,7 +894,7 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
                 wait_for_completion(&ent->done);
         } else if (!wait_for_completion_timeout(&ent->done, timeout)) {
                 ent->ret = -ETIMEDOUT;
-                mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+                mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
         }
 
         err = ent->ret;
@@ -1375,7 +1390,7 @@ static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg)
         }
 }
 
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced)
 {
         struct mlx5_cmd *cmd = &dev->cmd;
         struct mlx5_cmd_work_ent *ent;
@@ -1395,6 +1410,19 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                         struct semaphore *sem;
 
                         ent = cmd->ent_arr[i];
+
+                        /* if we already completed the command, ignore it */
+                        if (!test_and_clear_bit(MLX5_CMD_ENT_STATE_PENDING_COMP,
+                                                &ent->state)) {
+                                /* only real completion can free the cmd slot */
+                                if (!forced) {
+                                        mlx5_core_err(dev, "Command completion arrived after timeout (entry idx = %d).\n",
+                                                      ent->idx);
+                                        free_ent(cmd, ent->idx);
+                                }
+                                continue;
+                        }
+
                         if (ent->callback)
                                 cancel_delayed_work(&ent->cb_timeout_work);
                         if (ent->page_queue)
@@ -1417,7 +1445,10 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec)
                                 mlx5_core_dbg(dev, "command completed. ret 0x%x, delivery status %s(0x%x)\n",
                                               ent->ret, deliv_status_to_str(ent->status), ent->status);
                         }
-                        free_ent(cmd, ent->idx);
+
+                        /* only real completion will free the entry slot */
+                        if (!forced)
+                                free_ent(cmd, ent->idx);
 
                         if (ent->callback) {
                                 ds = ent->ts2 - ent->ts1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 0099a3e397bc..2fd044b23875 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -1003,7 +1003,7 @@ int mlx5e_create_direct_tirs(struct mlx5e_priv *priv);
 void mlx5e_destroy_direct_tirs(struct mlx5e_priv *priv);
 void mlx5e_destroy_rqt(struct mlx5e_priv *priv, struct mlx5e_rqt *rqt);
 
-int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn);
+int mlx5e_create_ttc_table(struct mlx5e_priv *priv);
 void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv);
 
 int mlx5e_create_tis(struct mlx5_core_dev *mdev, int tc,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index ce7b09d72ff6..8209affa75c3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -794,7 +794,6 @@ static void get_supported(u32 eth_proto_cap,
         ptys2ethtool_supported_port(link_ksettings, eth_proto_cap);
         ptys2ethtool_supported_link(supported, eth_proto_cap);
         ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Pause);
-        ethtool_link_ksettings_add_link_mode(link_ksettings, supported, Asym_Pause);
 }
 
 static void get_advertising(u32 eth_proto_cap, u8 tx_pause,
@@ -804,7 +803,7 @@ static void get_advertising(u32 eth_proto_cap, u8 tx_pause,
         unsigned long *advertising = link_ksettings->link_modes.advertising;
 
         ptys2ethtool_adver_link(advertising, eth_proto_cap);
-        if (tx_pause)
+        if (rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Pause);
         if (tx_pause ^ rx_pause)
                 ethtool_link_ksettings_add_link_mode(link_ksettings, advertising, Asym_Pause);
@@ -849,6 +848,8 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         struct mlx5e_priv *priv    = netdev_priv(netdev);
         struct mlx5_core_dev *mdev = priv->mdev;
         u32 out[MLX5_ST_SZ_DW(ptys_reg)] = {0};
+        u32 rx_pause = 0;
+        u32 tx_pause = 0;
         u32 eth_proto_cap;
         u32 eth_proto_admin;
         u32 eth_proto_lp;
@@ -871,11 +872,13 @@ static int mlx5e_get_link_ksettings(struct net_device *netdev,
         an_disable_admin = MLX5_GET(ptys_reg, out, an_disable_admin);
         an_status        = MLX5_GET(ptys_reg, out, an_status);
 
+        mlx5_query_port_pause(mdev, &rx_pause, &tx_pause);
+
         ethtool_link_ksettings_zero_link_mode(link_ksettings, supported);
         ethtool_link_ksettings_zero_link_mode(link_ksettings, advertising);
 
         get_supported(eth_proto_cap, link_ksettings);
-        get_advertising(eth_proto_admin, 0, 0, link_ksettings);
+        get_advertising(eth_proto_admin, tx_pause, rx_pause, link_ksettings);
         get_speed_duplex(netdev, eth_proto_oper, link_ksettings);
 
         eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 576d6787b484..53ed58320a24 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -800,7 +800,7 @@ void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv)
         mlx5e_destroy_flow_table(&ttc->ft);
 }
 
-int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn)
+int mlx5e_create_ttc_table(struct mlx5e_priv *priv)
 {
         struct mlx5e_ttc_table *ttc = &priv->fs.ttc;
         struct mlx5_flow_table_attr ft_attr = {};
@@ -810,7 +810,6 @@ int mlx5e_create_ttc_table(struct mlx5e_priv *priv, u32 underlay_qpn)
         ft_attr.max_fte = MLX5E_TTC_TABLE_SIZE;
         ft_attr.level = MLX5E_TTC_FT_LEVEL;
         ft_attr.prio = MLX5E_NIC_PRIO;
-        ft_attr.underlay_qpn = underlay_qpn;
 
         ft->t = mlx5_create_flow_table(priv->fs.ns, &ft_attr);
         if (IS_ERR(ft->t)) {
@@ -1147,7 +1146,7 @@ int mlx5e_create_flow_steering(struct mlx5e_priv *priv)
                 priv->netdev->hw_features &= ~NETIF_F_NTUPLE;
         }
 
-        err = mlx5e_create_ttc_table(priv, 0);
+        err = mlx5e_create_ttc_table(priv);
         if (err) {
                 netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
                            err);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index a61b71b6fff3..41cd22a223dc 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2976,7 +2976,7 @@ static int mlx5e_setup_tc(struct net_device *netdev, u8 tc)
         new_channels.params = priv->channels.params;
         new_channels.params.num_tc = tc ? tc : 1;
 
-        if (test_bit(MLX5E_STATE_OPENED, &priv->state)) {
+        if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) {
                 priv->channels.params = new_channels.params;
                 goto out;
         }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 7b1566f0ae58..66b5fec15313 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1041,6 +1041,8 @@ void mlx5e_free_xdpsq_descs(struct mlx5e_xdpsq *sq)
 #define MLX5_IB_GRH_BYTES       40
 #define MLX5_IPOIB_ENCAP_LEN    4
 #define MLX5_GID_SIZE           16
+#define MLX5_IPOIB_PSEUDO_LEN   20
+#define MLX5_IPOIB_HARD_LEN     (MLX5_IPOIB_PSEUDO_LEN + MLX5_IPOIB_ENCAP_LEN)
 
 static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct mlx5_cqe64 *cqe,
@@ -1048,6 +1050,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
                                          struct sk_buff *skb)
 {
         struct net_device *netdev = rq->netdev;
+        char *pseudo_header;
         u8 *dgid;
         u8 g;
 
@@ -1076,8 +1079,11 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq,
         if (likely(netdev->features & NETIF_F_RXHASH))
                 mlx5e_skb_set_hash(cqe, skb);
 
+        /* 20 bytes of ipoib header and 4 for encap existing */
+        pseudo_header = skb_push(skb, MLX5_IPOIB_PSEUDO_LEN);
+        memset(pseudo_header, 0, MLX5_IPOIB_PSEUDO_LEN);
         skb_reset_mac_header(skb);
-        skb_pull(skb, MLX5_IPOIB_ENCAP_LEN);
+        skb_pull(skb, MLX5_IPOIB_HARD_LEN);
 
         skb->dev = netdev;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 11c27e4fadf6..ec63158ab643 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -43,6 +43,7 @@
 #include <net/tc_act/tc_vlan.h>
 #include <net/tc_act/tc_tunnel_key.h>
 #include <net/tc_act/tc_pedit.h>
+#include <net/tc_act/tc_csum.h>
 #include <net/vxlan.h>
 #include <net/arp.h>
 #include "en.h"
@@ -384,7 +385,7 @@ static void mlx5e_detach_encap(struct mlx5e_priv *priv,
                 if (e->flags & MLX5_ENCAP_ENTRY_VALID)
                         mlx5_encap_dealloc(priv->mdev, e->encap_id);
 
-                hlist_del_rcu(&e->encap_hlist);
+                hash_del_rcu(&e->encap_hlist);
                 kfree(e->encap_header);
                 kfree(e);
         }
@@ -925,11 +926,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr)
 {
         struct pedit_headers *set_masks, *add_masks, *set_vals, *add_vals;
-        int i, action_size, nactions, max_actions, first, last;
+        int i, action_size, nactions, max_actions, first, last, first_z;
         void *s_masks_p, *a_masks_p, *vals_p;
-        u32 s_mask, a_mask, val;
         struct mlx5_fields *f;
         u8 cmd, field_bsize;
+        u32 s_mask, a_mask;
         unsigned long mask;
         void *action;
 
@@ -946,7 +947,8 @@ static int offload_pedit_fields(struct pedit_headers *masks,
         for (i = 0; i < ARRAY_SIZE(fields); i++) {
                 f = &fields[i];
                 /* avoid seeing bits set from previous iterations */
-                s_mask = a_mask = mask = val = 0;
+                s_mask = 0;
+                a_mask = 0;
 
                 s_masks_p = (void *)set_masks + f->offset;
                 a_masks_p = (void *)add_masks + f->offset;
@@ -981,12 +983,12 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                         memset(a_masks_p, 0, f->size);
                 }
 
-                memcpy(&val, vals_p, f->size);
-
                 field_bsize = f->size * BITS_PER_BYTE;
+
+                first_z = find_first_zero_bit(&mask, field_bsize);
                 first = find_first_bit(&mask, field_bsize);
                 last  = find_last_bit(&mask, field_bsize);
-                if (first > 0 || last != (field_bsize - 1)) {
+                if (first > 0 || last != (field_bsize - 1) || first_z < last) {
                         printk(KERN_WARNING "mlx5: partial rewrite (mask %lx) is currently not offloaded\n",
                                mask);
                         return -EOPNOTSUPP;
@@ -1002,11 +1004,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
                 }
 
                 if (field_bsize == 32)
-                        MLX5_SET(set_action_in, action, data, ntohl(val));
+                        MLX5_SET(set_action_in, action, data, ntohl(*(__be32 *)vals_p));
                 else if (field_bsize == 16)
-                        MLX5_SET(set_action_in, action, data, ntohs(val));
+                        MLX5_SET(set_action_in, action, data, ntohs(*(__be16 *)vals_p));
                 else if (field_bsize == 8)
-                        MLX5_SET(set_action_in, action, data, val);
+                        MLX5_SET(set_action_in, action, data, *(u8 *)vals_p);
 
                 action += action_size;
                 nactions++;
@@ -1109,6 +1111,28 @@ out_err:
         return err;
 }
 
+static bool csum_offload_supported(struct mlx5e_priv *priv, u32 action, u32 update_flags)
+{
+        u32 prot_flags = TCA_CSUM_UPDATE_FLAG_IPV4HDR | TCA_CSUM_UPDATE_FLAG_TCP |
+                         TCA_CSUM_UPDATE_FLAG_UDP;
+
+        /*  The HW recalcs checksums only if re-writing headers */
+        if (!(action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR)) {
+                netdev_warn(priv->netdev,
+                            "TC csum action is only offloaded with pedit\n");
+                return false;
+        }
+
+        if (update_flags & ~prot_flags) {
+                netdev_warn(priv->netdev,
+                            "can't offload TC csum action for some header/s - flags %#x\n",
+                            update_flags);
+                return false;
+        }
+
+        return true;
+}
+
 static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 struct mlx5e_tc_flow_parse_attr *parse_attr,
                                 struct mlx5e_tc_flow *flow)
@@ -1149,6 +1173,14 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_skbedit_mark(a)) {
                         u32 mark = tcf_skbedit_mark(a);
 
@@ -1651,6 +1683,14 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                         continue;
                 }
 
+                if (is_tcf_csum(a)) {
+                        if (csum_offload_supported(priv, attr->action,
+                                                   tcf_csum_update_flags(a)))
+                                continue;
+
+                        return -EOPNOTSUPP;
+                }
+
                 if (is_tcf_mirred_egress_redirect(a)) {
                         int ifindex = tcf_mirred_ifindex(a);
                         struct net_device *out_dev, *encap_dev = NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index ea5d8d37a75c..33eae5ad2fb0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -422,7 +422,7 @@ static irqreturn_t mlx5_eq_int(int irq, void *eq_ptr)
                         break;
 
                 case MLX5_EVENT_TYPE_CMD:
-                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector));
+                        mlx5_cmd_comp_handler(dev, be32_to_cpu(eqe->data.cmd.vector), false);
                         break;
 
                 case MLX5_EVENT_TYPE_PORT_CHANGE:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 19e3d2fc2099..fcec7bedd3cd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -40,28 +40,25 @@
 #include "eswitch.h"
 
 int mlx5_cmd_update_root_ft(struct mlx5_core_dev *dev,
-                            struct mlx5_flow_table *ft)
+                            struct mlx5_flow_table *ft, u32 underlay_qpn)
 {
         u32 in[MLX5_ST_SZ_DW(set_flow_table_root_in)]   = {0};
         u32 out[MLX5_ST_SZ_DW(set_flow_table_root_out)] = {0};
 
         if ((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_IB) &&
-            ft->underlay_qpn == 0)
+            underlay_qpn == 0)
                 return 0;
 
         MLX5_SET(set_flow_table_root_in, in, opcode,
                  MLX5_CMD_OP_SET_FLOW_TABLE_ROOT);
         MLX5_SET(set_flow_table_root_in, in, table_type, ft->type);
         MLX5_SET(set_flow_table_root_in, in, table_id, ft->id);
+        MLX5_SET(set_flow_table_root_in, in, underlay_qpn, underlay_qpn);
         if (ft->vport) {
                 MLX5_SET(set_flow_table_root_in, in, vport_number, ft->vport);
                 MLX5_SET(set_flow_table_root_in, in, other_vport, 1);
         }
 
-        if ((MLX5_CAP_GEN(dev, port_type) == MLX5_CAP_PORT_TYPE_IB) &&
-            ft->underlay_qpn != 0)
-                MLX5_SET(set_flow_table_root_in, in, underlay_qpn, ft->underlay_qpn);
-
         return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
index 8fad80688536..0f98a7cf4877 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.h
@@ -71,7 +71,8 @@ int mlx5_cmd_delete_fte(struct mlx5_core_dev *dev,
                         unsigned int index);
 
 int mlx5_cmd_update_root_ft(struct mlx5_core_dev *dev,
-                            struct mlx5_flow_table *ft);
+                            struct mlx5_flow_table *ft,
+                            u32 underlay_qpn);
 
 int mlx5_cmd_fc_alloc(struct mlx5_core_dev *dev, u16 *id);
 int mlx5_cmd_fc_free(struct mlx5_core_dev *dev, u16 id);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index b8a176503d38..0e487e8ca634 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -650,7 +650,7 @@ static int update_root_ft_create(struct mlx5_flow_table *ft, struct fs_prio
         if (ft->level >= min_level)
                 return 0;
 
-        err = mlx5_cmd_update_root_ft(root->dev, ft);
+        err = mlx5_cmd_update_root_ft(root->dev, ft, root->underlay_qpn);
         if (err)
                 mlx5_core_warn(root->dev, "Update root flow table of id=%u failed\n",
                                ft->id);
@@ -818,8 +818,6 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa
                 goto unlock_root;
         }
 
-        ft->underlay_qpn = ft_attr->underlay_qpn;
-
         tree_init_node(&ft->node, 1, del_flow_table);
         log_table_sz = ft->max_fte ? ilog2(ft->max_fte) : 0;
         next_ft = find_next_chained_ft(fs_prio);
@@ -1489,7 +1487,8 @@ static int update_root_ft_destroy(struct mlx5_flow_table *ft)
 
         new_root_ft = find_next_ft(ft);
         if (new_root_ft) {
-                int err = mlx5_cmd_update_root_ft(root->dev, new_root_ft);
+                int err = mlx5_cmd_update_root_ft(root->dev, new_root_ft,
+                                                  root->underlay_qpn);
 
                 if (err) {
                         mlx5_core_warn(root->dev, "Update root flow table of id=%u failed\n",
@@ -2062,3 +2061,21 @@ err:
         mlx5_cleanup_fs(dev);
         return err;
 }
+
+int mlx5_fs_add_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn)
+{
+        struct mlx5_flow_root_namespace *root = dev->priv.steering->root_ns;
+
+        root->underlay_qpn = underlay_qpn;
+        return 0;
+}
+EXPORT_SYMBOL(mlx5_fs_add_rx_underlay_qpn);
+
+int mlx5_fs_remove_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn)
+{
+        struct mlx5_flow_root_namespace *root = dev->priv.steering->root_ns;
+
+        root->underlay_qpn = 0;
+        return 0;
+}
+EXPORT_SYMBOL(mlx5_fs_remove_rx_underlay_qpn);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 81eafc7b9dd9..990acee6fb09 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -118,7 +118,6 @@ struct mlx5_flow_table {
         /* FWD rules that point on this flow table */
         struct list_head                fwd_rules;
         u32                             flags;
-        u32                             underlay_qpn;
 };
 
 struct mlx5_fc_cache {
@@ -195,6 +194,7 @@ struct mlx5_flow_root_namespace {
         struct mlx5_flow_table          *root_ft;
         /* Should be held when chaining flow tables */
         struct mutex                    chain_lock;
+        u32                             underlay_qpn;
 };
 
 int mlx5_init_fc_stats(struct mlx5_core_dev *dev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c
index d0515391d33b..44f59b1d6f0f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -90,7 +90,7 @@ static void trigger_cmd_completions(struct mlx5_core_dev *dev)
         spin_unlock_irqrestore(&dev->cmd.alloc_lock, flags);
 
         mlx5_core_dbg(dev, "vector 0x%llx\n", vector);
-        mlx5_cmd_comp_handler(dev, vector);
+        mlx5_cmd_comp_handler(dev, vector, true);
         return;
 
 no_trig:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
index 019c230da498..cc1858752e70 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib.c
@@ -66,6 +66,10 @@ static void mlx5i_init(struct mlx5_core_dev *mdev,
 
         mlx5e_build_nic_params(mdev, &priv->channels.params, profile->max_nch(mdev));
 
+        /* Override RQ params as IPoIB supports only LINKED LIST RQ for now */
+        mlx5e_set_rq_type_params(mdev, &priv->channels.params, MLX5_WQ_TYPE_LINKED_LIST);
+        priv->channels.params.lro_en = false;
+
         mutex_init(&priv->state_lock);
 
         netdev->hw_features    |= NETIF_F_SG;
@@ -156,6 +160,8 @@ out:
 
 static void mlx5i_destroy_underlay_qp(struct mlx5_core_dev *mdev, struct mlx5_core_qp *qp)
 {
+        mlx5_fs_remove_rx_underlay_qpn(mdev, qp->qpn);
+
         mlx5_core_destroy_qp(mdev, qp);
 }
 
@@ -170,6 +176,8 @@ static int mlx5i_init_tx(struct mlx5e_priv *priv)
                 return err;
         }
 
+        mlx5_fs_add_rx_underlay_qpn(priv->mdev, ipriv->qp.qpn);
+
         err = mlx5e_create_tis(priv->mdev, 0 /* tc */, ipriv->qp.qpn, &priv->tisn[0]);
         if (err) {
                 mlx5_core_warn(priv->mdev, "create tis failed, %d\n", err);
@@ -189,7 +197,6 @@ static void mlx5i_cleanup_tx(struct mlx5e_priv *priv)
 
 static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
 {
-        struct mlx5i_priv *ipriv = priv->ppriv;
         int err;
 
         priv->fs.ns = mlx5_get_flow_namespace(priv->mdev,
@@ -205,7 +212,7 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
                 priv->netdev->hw_features &= ~NETIF_F_NTUPLE;
         }
 
-        err = mlx5e_create_ttc_table(priv, ipriv->qp.qpn);
+        err = mlx5e_create_ttc_table(priv);
         if (err) {
                 netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
                            err);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 0c123d571b4c..fe5546bb4153 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -612,7 +612,6 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         struct mlx5_priv *priv  = &mdev->priv;
         struct msix_entry *msix = priv->msix_arr;
         int irq                 = msix[i + MLX5_EQ_VEC_COMP_BASE].vector;
-        int err;
 
         if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
                 mlx5_core_warn(mdev, "zalloc_cpumask_var failed");
@@ -622,18 +621,12 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
         cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
                         priv->irq_info[i].mask);
 
-        err = irq_set_affinity_hint(irq, priv->irq_info[i].mask);
-        if (err) {
-                mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x",
-                               irq);
-                goto err_clear_mask;
-        }
+#ifdef CONFIG_SMP
+        if (irq_set_affinity_hint(irq, priv->irq_info[i].mask))
+                mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq);
+#endif
 
         return 0;
-
-err_clear_mask:
-        free_cpumask_var(priv->irq_info[i].mask);
-        return err;
 }
 
 static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
index ea56f6ade6b4..5f0a7bc692a4 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
@@ -199,10 +199,11 @@ static int mlxsw_sp_erif_entry_get(struct mlxsw_sp *mlxsw_sp,
 
         entry->counter_valid = false;
         entry->counter = 0;
+        entry->index = mlxsw_sp_rif_index(rif);
+
         if (!counters_enabled)
                 return 0;
 
-        entry->index = mlxsw_sp_rif_index(rif);
         err = mlxsw_sp_rif_counter_value_get(mlxsw_sp, rif,
                                              MLXSW_SP_RIF_COUNTER_EGRESS,
                                              &cnt);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 33cec1cc1642..9f89c4137d21 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -206,6 +206,9 @@ void mlxsw_sp_rif_counter_free(struct mlxsw_sp *mlxsw_sp,
 {
         unsigned int *p_counter_index;
 
+        if (!mlxsw_sp_rif_counter_valid_get(rif, dir))
+                return;
+
         p_counter_index = mlxsw_sp_rif_p_counter_get(rif, dir);
         if (WARN_ON(!p_counter_index))
                 return;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 0d8411f1f954..f4bb0c0b7c1d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1497,8 +1497,7 @@ do_fdb_op:
         err = mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid,
                                       adding, true);
         if (err) {
-                if (net_ratelimit())
-                        netdev_err(mlxsw_sp_port->dev, "Failed to set FDB entry\n");
+                dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to set FDB entry\n");
                 return;
         }
 
@@ -1558,8 +1557,7 @@ do_fdb_op:
         err = mlxsw_sp_port_fdb_uc_lag_op(mlxsw_sp, lag_id, mac, fid, lag_vid,
                                           adding, true);
         if (err) {
-                if (net_ratelimit())
-                        netdev_err(mlxsw_sp_port->dev, "Failed to set FDB entry\n");
+                dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to set FDB entry\n");
                 return;
         }
 
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
index b8d5270359cd..e30676515529 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
@@ -247,7 +247,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter *adapter, int mtu)
         cmd.req.arg3 = 0;
 
         if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE)
-                netxen_issue_cmd(adapter, &cmd);
+                rcode = netxen_issue_cmd(adapter, &cmd);
 
         if (rcode != NX_RCODE_SUCCESS)
                 return -EIO;
diff --git a/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c b/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
index 67200c5498ab..0a8fde629991 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_init_fw_funcs.c
@@ -983,7 +983,7 @@ void qed_set_rfs_mode_disable(struct qed_hwfn *p_hwfn,
         memset(&camline, 0, sizeof(union gft_cam_line_union));
         qed_wr(p_hwfn, p_ptt, PRS_REG_GFT_CAM + CAM_LINE_SIZE * pf_id,
                camline.cam_line_mapped.camline);
-        memset(&ramline, 0, sizeof(union gft_cam_line_union));
+        memset(&ramline, 0, sizeof(ramline));
 
         for (i = 0; i < RAM_LINE_SIZE / REG_SIZE; i++) {
                 u32 hw_addr = PRS_REG_GFT_PROFILE_MASK_RAM;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 49bad00a0f8f..7245b1072518 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -37,8 +37,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 3
-#define _QLCNIC_LINUX_SUBVERSION 65
-#define QLCNIC_LINUX_VERSIONID  "5.3.65"
+#define _QLCNIC_LINUX_SUBVERSION 66
+#define QLCNIC_LINUX_VERSIONID  "5.3.66"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 718bf58a7da6..4fb68797630e 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -3168,6 +3168,40 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr,
         return 0;
 }
 
+void qlcnic_83xx_get_port_type(struct qlcnic_adapter *adapter)
+{
+        struct qlcnic_hardware_context *ahw = adapter->ahw;
+        struct qlcnic_cmd_args cmd;
+        u32 config;
+        int err;
+
+        err = qlcnic_alloc_mbx_args(&cmd, adapter, QLCNIC_CMD_GET_LINK_STATUS);
+        if (err)
+                return;
+
+        err = qlcnic_issue_cmd(adapter, &cmd);
+        if (err) {
+                dev_info(&adapter->pdev->dev,
+                         "Get Link Status Command failed: 0x%x\n", err);
+                goto out;
+        } else {
+                config = cmd.rsp.arg[3];
+
+                switch (QLC_83XX_SFP_MODULE_TYPE(config)) {
+                case QLC_83XX_MODULE_FIBRE_1000BASE_SX:
+                case QLC_83XX_MODULE_FIBRE_1000BASE_LX:
+                case QLC_83XX_MODULE_FIBRE_1000BASE_CX:
+                case QLC_83XX_MODULE_TP_1000BASE_T:
+                        ahw->port_type = QLCNIC_GBE;
+                        break;
+                default:
+                        ahw->port_type = QLCNIC_XGBE;
+                }
+        }
+out:
+        qlcnic_free_mbx_args(&cmd);
+}
+
 int qlcnic_83xx_test_link(struct qlcnic_adapter *adapter)
 {
         u8 pci_func;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
index 3dfe8e27b51c..b75a81246856 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.h
@@ -637,6 +637,7 @@ void qlcnic_83xx_get_pauseparam(struct qlcnic_adapter *,
 int qlcnic_83xx_set_pauseparam(struct qlcnic_adapter *,
                                struct ethtool_pauseparam *);
 int qlcnic_83xx_test_link(struct qlcnic_adapter *);
+void qlcnic_83xx_get_port_type(struct qlcnic_adapter *adapter);
 int qlcnic_83xx_reg_test(struct qlcnic_adapter *);
 int qlcnic_83xx_get_regs_len(struct qlcnic_adapter *);
 int qlcnic_83xx_get_registers(struct qlcnic_adapter *, u32 *);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index 9a869c15d8bf..7f7deeaf1cf0 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -486,6 +486,9 @@ static int qlcnic_set_link_ksettings(struct net_device *dev,
         u32 ret = 0;
         struct qlcnic_adapter *adapter = netdev_priv(dev);
 
+        if (qlcnic_83xx_check(adapter))
+                qlcnic_83xx_get_port_type(adapter);
+
         if (adapter->ahw->port_type != QLCNIC_GBE)
                 return -EOPNOTSUPP;
 
diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index 513e6c74e199..24ca7df15d07 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -296,8 +296,9 @@ qcaspi_receive(struct qcaspi *qca)
 
         /* Allocate rx SKB if we don't have one available. */
         if (!qca->rx_skb) {
-                qca->rx_skb = netdev_alloc_skb(net_dev,
-                                               net_dev->mtu + VLAN_ETH_HLEN);
+                qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
+                                                        net_dev->mtu +
+                                                        VLAN_ETH_HLEN);
                 if (!qca->rx_skb) {
                         netdev_dbg(net_dev, "out of RX resources\n");
                         qca->stats.out_of_mem++;
@@ -377,7 +378,7 @@ qcaspi_receive(struct qcaspi *qca)
                                         qca->rx_skb, qca->rx_skb->dev);
                                 qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
                                 netif_rx_ni(qca->rx_skb);
-                                qca->rx_skb = netdev_alloc_skb(net_dev,
+                                qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
                                         net_dev->mtu + VLAN_ETH_HLEN);
                                 if (!qca->rx_skb) {
                                         netdev_dbg(net_dev, "out of RX resources\n");
@@ -759,7 +760,8 @@ qcaspi_netdev_init(struct net_device *dev)
         if (!qca->rx_buffer)
                 return -ENOBUFS;
 
-        qca->rx_skb = netdev_alloc_skb(dev, qca->net_dev->mtu + VLAN_ETH_HLEN);
+        qca->rx_skb = netdev_alloc_skb_ip_align(dev, qca->net_dev->mtu +
+                                                VLAN_ETH_HLEN);
         if (!qca->rx_skb) {
                 kfree(qca->rx_buffer);
                 netdev_info(qca->net_dev, "Failed to allocate RX sk_buff.\n");
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index f68c4db656ed..2d686ccf971b 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -3220,7 +3220,8 @@ static int sh_eth_drv_probe(struct platform_device *pdev)
         /* MDIO bus init */
         ret = sh_mdio_init(mdp, pd);
         if (ret) {
-                dev_err(&ndev->dev, "failed to initialise MDIO\n");
+                if (ret != -EPROBE_DEFER)
+                        dev_err(&pdev->dev, "MDIO init failed: %d\n", ret);
                 goto out_release;
         }
 
diff --git a/drivers/net/ethernet/sfc/nic.h b/drivers/net/ethernet/sfc/nic.h
index 7b916aa21bde..4d7fb8af880d 100644
--- a/drivers/net/ethernet/sfc/nic.h
+++ b/drivers/net/ethernet/sfc/nic.h
@@ -18,8 +18,12 @@
 #include "mcdi.h"
 
 enum {
-        EFX_REV_SIENA_A0 = 0,
-        EFX_REV_HUNT_A0 = 1,
+        /* Revisions 0-2 were Falcon A0, A1 and B0 respectively.
+         * They are not supported by this driver but these revision numbers
+         * form part of the ethtool API for register dumping.
+         */
+        EFX_REV_SIENA_A0 = 3,
+        EFX_REV_HUNT_A0 = 4,
 };
 
 static inline int efx_nic_rev(struct efx_nic *efx)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index cd8c60132390..a74c481401c4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3725,7 +3725,7 @@ static void sysfs_display_ring(void *head, int size, int extend_desc,
                         ep++;
                 } else {
                         seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n",
-                                   i, (unsigned int)virt_to_phys(ep),
+                                   i, (unsigned int)virt_to_phys(p),
                                    le32_to_cpu(p->des0), le32_to_cpu(p->des1),
                                    le32_to_cpu(p->des2), le32_to_cpu(p->des3));
                         p++;
diff --git a/drivers/net/ethernet/sun/ldmvsw.c b/drivers/net/ethernet/sun/ldmvsw.c
index 5a90fed06260..5b56c24b6ed2 100644
--- a/drivers/net/ethernet/sun/ldmvsw.c
+++ b/drivers/net/ethernet/sun/ldmvsw.c
@@ -411,13 +411,14 @@ static int vsw_port_remove(struct vio_dev *vdev)
 
         if (port) {
                 del_timer_sync(&port->vio.timer);
+                del_timer_sync(&port->clean_timer);
 
                 napi_disable(&port->napi);
+                unregister_netdev(port->dev);
 
                 list_del_rcu(&port->list);
 
                 synchronize_rcu();
-                del_timer_sync(&port->clean_timer);
                 spin_lock_irqsave(&port->vp->lock, flags);
                 sunvnet_port_rm_txq_common(port);
                 spin_unlock_irqrestore(&port->vp->lock, flags);
@@ -427,7 +428,6 @@ static int vsw_port_remove(struct vio_dev *vdev)
 
                 dev_set_drvdata(&vdev->dev, NULL);
 
-                unregister_netdev(port->dev);
                 free_netdev(port->dev);
         }
 
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index 729a7da90b5b..e6222e535019 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1353,9 +1353,10 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
 
         tx_pipe->dma_channel = knav_dma_open_channel(dev,
                                 tx_pipe->dma_chan_name, &config);
-        if (IS_ERR_OR_NULL(tx_pipe->dma_channel)) {
+        if (IS_ERR(tx_pipe->dma_channel)) {
                 dev_err(dev, "failed opening tx chan(%s)\n",
                         tx_pipe->dma_chan_name);
+                ret = PTR_ERR(tx_pipe->dma_channel);
                 goto err;
         }
 
@@ -1673,9 +1674,10 @@ static int netcp_setup_navigator_resources(struct net_device *ndev)
 
         netcp->rx_channel = knav_dma_open_channel(netcp->netcp_device->device,
                                         netcp->dma_chan_name, &config);
-        if (IS_ERR_OR_NULL(netcp->rx_channel)) {
+        if (IS_ERR(netcp->rx_channel)) {
                 dev_err(netcp->ndev_dev, "failed opening rx chan(%s\n",
                         netcp->dma_chan_name);
+                ret = PTR_ERR(netcp->rx_channel);
                 goto fail;
         }
 
diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c
index 897176fc5043..dd92950a4615 100644
--- a/drivers/net/ethernet/ti/netcp_ethss.c
+++ b/drivers/net/ethernet/ti/netcp_ethss.c
@@ -2651,7 +2651,6 @@ static int gbe_hwtstamp_set(struct gbe_intf *gbe_intf, struct ifreq *ifr)
         case HWTSTAMP_FILTER_NONE:
                 cpts_rx_enable(cpts, 0);
                 break;
-        case HWTSTAMP_FILTER_ALL:
         case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
         case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
         case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index dec5d563ab19..959fd12d2e67 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1293,7 +1293,7 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
         if (nla_put_u32(skb, IFLA_GENEVE_ID, vni))
                 goto nla_put_failure;
 
-        if (ip_tunnel_info_af(info) == AF_INET) {
+        if (rtnl_dereference(geneve->sock4)) {
                 if (nla_put_in_addr(skb, IFLA_GENEVE_REMOTE,
                                     info->key.u.ipv4.dst))
                         goto nla_put_failure;
@@ -1302,8 +1302,10 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                                !!(info->key.tun_flags & TUNNEL_CSUM)))
                         goto nla_put_failure;
 
+        }
+
 #if IS_ENABLED(CONFIG_IPV6)
-        } else {
+        if (rtnl_dereference(geneve->sock6)) {
                 if (nla_put_in6_addr(skb, IFLA_GENEVE_REMOTE6,
                                      &info->key.u.ipv6.dst))
                         goto nla_put_failure;
@@ -1315,8 +1317,8 @@ static int geneve_fill_info(struct sk_buff *skb, const struct net_device *dev)
                 if (nla_put_u8(skb, IFLA_GENEVE_UDP_ZERO_CSUM6_RX,
                                !geneve->use_udp6_rx_checksums))
                         goto nla_put_failure;
-#endif
         }
+#endif
 
         if (nla_put_u8(skb, IFLA_GENEVE_TTL, info->key.ttl) ||
             nla_put_u8(skb, IFLA_GENEVE_TOS, info->key.tos) ||
diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 4fea1b3dfbb4..7b652bb7ebe4 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -873,7 +873,7 @@ static struct gtp_dev *gtp_find_dev(struct net *src_net, struct nlattr *nla[])
 
         /* Check if there's an existing gtpX device to configure */
         dev = dev_get_by_index_rcu(net, nla_get_u32(nla[GTPA_LINK]));
-        if (dev->netdev_ops == &gtp_netdev_ops)
+        if (dev && dev->netdev_ops == &gtp_netdev_ops)
                 gtp = netdev_priv(dev);
 
         put_net(net);
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 8716b8c07feb..6f3c805f7211 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1077,7 +1077,7 @@ static int stir421x_patch_device(struct irda_usb_cb *self)
          * are "42101001.sb" or "42101002.sb"
          */
         sprintf(stir421x_fw_name, "4210%4X.sb",
-                self->usbdev->descriptor.bcdDevice);
+                le16_to_cpu(self->usbdev->descriptor.bcdDevice));
         ret = request_firmware(&fw, stir421x_fw_name, &self->usbdev->dev);
         if (ret < 0)
                 return ret;
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index b34eaaae03fd..346ad2ff3998 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -789,10 +789,12 @@ static int macvlan_change_mtu(struct net_device *dev, int new_mtu)
  */
 static struct lock_class_key macvlan_netdev_addr_lock_key;
 
-#define ALWAYS_ON_FEATURES \
-        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | NETIF_F_LLTX | \
+#define ALWAYS_ON_OFFLOADS \
+        (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_GSO_SOFTWARE | \
          NETIF_F_GSO_ROBUST)
 
+#define ALWAYS_ON_FEATURES (ALWAYS_ON_OFFLOADS | NETIF_F_LLTX)
+
 #define MACVLAN_FEATURES \
         (NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
          NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_LRO | \
@@ -827,6 +829,7 @@ static int macvlan_init(struct net_device *dev)
         dev->features           |= ALWAYS_ON_FEATURES;
         dev->hw_features        |= NETIF_F_LRO;
         dev->vlan_features      = lowerdev->vlan_features & MACVLAN_FEATURES;
+        dev->vlan_features      |= ALWAYS_ON_OFFLOADS;
         dev->gso_max_size       = lowerdev->gso_max_size;
         dev->gso_max_segs       = lowerdev->gso_max_segs;
         dev->hard_header_len    = lowerdev->hard_header_len;
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 60ffc9da6a28..c360dd6ead22 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -108,7 +108,7 @@ config MDIO_MOXART
 config MDIO_OCTEON
         tristate "Octeon and some ThunderX SOCs MDIO buses"
         depends on 64BIT
-        depends on HAS_IOMEM
+        depends on HAS_IOMEM && OF_MDIO
         select MDIO_CAVIUM
         help
           This module provides a driver for the Octeon and ThunderX MDIO
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 272b051a0199..9097e42bec2e 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -255,34 +255,6 @@ static int marvell_config_aneg(struct phy_device *phydev)
 {
         int err;
 
-        /* The Marvell PHY has an errata which requires
-         * that certain registers get written in order
-         * to restart autonegotiation */
-        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
-
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x1f);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x200c);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1d, 0x5);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0);
-        if (err < 0)
-                return err;
-
-        err = phy_write(phydev, 0x1e, 0x100);
-        if (err < 0)
-                return err;
-
         err = marvell_set_polarity(phydev, phydev->mdix_ctrl);
         if (err < 0)
                 return err;
@@ -316,6 +288,42 @@ static int marvell_config_aneg(struct phy_device *phydev)
         return 0;
 }
 
+static int m88e1101_config_aneg(struct phy_device *phydev)
+{
+        int err;
+
+        /* This Marvell PHY has an errata which requires
+         * that certain registers get written in order
+         * to restart autonegotiation
+         */
+        err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x1f);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x200c);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1d, 0x5);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0);
+        if (err < 0)
+                return err;
+
+        err = phy_write(phydev, 0x1e, 0x100);
+        if (err < 0)
+                return err;
+
+        return marvell_config_aneg(phydev);
+}
+
 static int m88e1111_config_aneg(struct phy_device *phydev)
 {
         int err;
@@ -1892,7 +1900,7 @@ static struct phy_driver marvell_drivers[] = {
                 .flags = PHY_HAS_INTERRUPT,
                 .probe = marvell_probe,
                 .config_init = &marvell_config_init,
-                .config_aneg = &marvell_config_aneg,
+                .config_aneg = &m88e1101_config_aneg,
                 .read_status = &genphy_read_status,
                 .ack_interrupt = &marvell_ack_interrupt,
                 .config_intr = &marvell_config_intr,
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 963838d4fac1..599ce24c514f 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -122,10 +122,9 @@ int mdio_mux_init(struct device *dev,
         pb = devm_kzalloc(dev, sizeof(*pb), GFP_KERNEL);
         if (pb == NULL) {
                 ret_val = -ENOMEM;
-                goto err_parent_bus;
+                goto err_pb_kz;
         }
 
-
         pb->switch_data = data;
         pb->switch_fn = switch_fn;
         pb->current_child = -1;
@@ -154,6 +153,7 @@ int mdio_mux_init(struct device *dev,
                 cb->mii_bus = mdiobus_alloc();
                 if (!cb->mii_bus) {
                         ret_val = -ENOMEM;
+                        devm_kfree(dev, cb);
                         of_node_put(child_bus_node);
                         break;
                 }
@@ -170,7 +170,6 @@ int mdio_mux_init(struct device *dev,
                         mdiobus_free(cb->mii_bus);
                         devm_kfree(dev, cb);
                 } else {
-                        of_node_get(child_bus_node);
                         cb->next = pb->children;
                         pb->children = cb;
                 }
@@ -181,9 +180,11 @@ int mdio_mux_init(struct device *dev,
                 return 0;
         }
 
+        devm_kfree(dev, pb);
+err_pb_kz:
         /* balance the reference of_mdio_find_bus() took */
-        put_device(&pb->mii_bus->dev);
-
+        if (!mux_bus)
+                put_device(&parent_bus->dev);
 err_parent_bus:
         of_node_put(parent_bus_node);
         return ret_val;
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index a898e5c4ef1b..8e73f5f36e71 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -364,9 +364,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
 
         mutex_init(&bus->mdio_lock);
 
-        if (bus->reset)
-                bus->reset(bus);
-
         /* de-assert bus level PHY GPIO resets */
         if (bus->num_reset_gpios > 0) {
                 bus->reset_gpiod = devm_kcalloc(&bus->dev,
@@ -396,6 +393,9 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
                 }
         }
 
+        if (bus->reset)
+                bus->reset(bus);
+
         for (i = 0; i < PHY_MAX_ADDR; i++) {
                 if ((bus->phy_mask & (1 << i)) == 0) {
                         struct phy_device *phydev;
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index f3ae88fdf332..8ab281b478f2 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -310,6 +310,26 @@ skip:
                 return -ENODEV;
         }
 
+        return 0;
+
+bad_desc:
+        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
+        return -ENODEV;
+}
+EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+
+
+/* like usbnet_generic_cdc_bind() but handles filter initialization
+ * correctly
+ */
+int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int rv;
+
+        rv = usbnet_generic_cdc_bind(dev, intf);
+        if (rv < 0)
+                goto bail_out;
+
         /* Some devices don't initialise properly. In particular
          * the packet filter is not reset. There are devices that
          * don't do reset all the way. So the packet filter should
@@ -317,13 +337,10 @@ skip:
          */
         usbnet_cdc_update_filter(dev);
 
-        return 0;
-
-bad_desc:
-        dev_info(&dev->udev->dev, "bad CDC descriptors\n");
-        return -ENODEV;
+bail_out:
+        return rv;
 }
-EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+EXPORT_SYMBOL_GPL(usbnet_ether_cdc_bind);
 
 void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
@@ -417,7 +434,7 @@ int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data)
                         < sizeof(struct cdc_state)));
 
-        status = usbnet_generic_cdc_bind(dev, intf);
+        status = usbnet_ether_cdc_bind(dev, intf);
         if (status < 0)
                 return status;
 
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index c4f1c363e24b..9df3c1ffff35 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -310,8 +310,8 @@ static int get_mac_address(struct usbnet *dev, unsigned char *data)
         int rd_mac_len = 0;
 
         netdev_dbg(dev->net, "get_mac_address:\n\tusbnet VID:%0x PID:%0x\n",
-                   dev->udev->descriptor.idVendor,
-                   dev->udev->descriptor.idProduct);
+                   le16_to_cpu(dev->udev->descriptor.idVendor),
+                   le16_to_cpu(dev->udev->descriptor.idProduct));
 
         memset(mac_addr, 0, sizeof(mac_addr));
         rd_mac_len = control_read(dev, REQUEST_READ, 0,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d7165767ca9d..8f923a147fa9 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1196,6 +1196,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x9071, 10)},   /* Sierra Wireless MC74xx */
         {QMI_FIXED_INTF(0x1199, 0x9079, 8)},    /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1199, 0x9079, 10)},   /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x907b, 8)},    /* Sierra Wireless EM74xx */
+        {QMI_FIXED_INTF(0x1199, 0x907b, 10)},   /* Sierra Wireless EM74xx */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
         {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},    /* Alcatel L800MA */
         {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 765400b62168..2dfca96a63b6 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -681,7 +681,7 @@ static int smsc95xx_set_features(struct net_device *netdev,
         if (ret < 0)
                 return ret;
 
-        if (features & NETIF_F_HW_CSUM)
+        if (features & NETIF_F_IP_CSUM)
                 read_buf |= Tx_COE_EN_;
         else
                 read_buf &= ~Tx_COE_EN_;
@@ -1279,12 +1279,19 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
         spin_lock_init(&pdata->mac_cr_lock);
 
+        /* LAN95xx devices do not alter the computed checksum of 0 to 0xffff.
+         * RFC 2460, ipv6 UDP calculated checksum yields a result of zero must
+         * be changed to 0xffff. RFC 768, ipv4 UDP computed checksum is zero,
+         * it is transmitted as all ones. The zero transmitted checksum means
+         * transmitter generated no checksum. Hence, enable csum offload only
+         * for ipv4 packets.
+         */
         if (DEFAULT_TX_CSUM_ENABLE)
-                dev->net->features |= NETIF_F_HW_CSUM;
+                dev->net->features |= NETIF_F_IP_CSUM;
         if (DEFAULT_RX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_RXCSUM;
 
-        dev->net->hw_features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
+        dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
         smsc95xx_init_mac_address(dev);
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9320d96a1632..3e9246cc49c3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1989,6 +1989,7 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_poll_controller = virtnet_netpoll,
 #endif
         .ndo_xdp                = virtnet_xdp,
+        .ndo_features_check     = passthru_features_check,
 };
 
 static void virtnet_config_changed_work(struct work_struct *work)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 25bc764ae7dc..d1c7029ded7c 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2962,6 +2962,11 @@ vmxnet3_force_close(struct vmxnet3_adapter *adapter)
         /* we need to enable NAPI, otherwise dev_close will deadlock */
         for (i = 0; i < adapter->num_rx_queues; i++)
                 napi_enable(&adapter->rx_queue[i].napi);
+        /*
+         * Need to clear the quiesce bit to ensure that vmxnet3_close
+         * can quiesce the device properly
+         */
+        clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state);
         dev_close(adapter->netdev);
 }
 
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index ceda5861da78..db882493875c 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -989,6 +989,7 @@ static u32 vrf_fib_table(const struct net_device *dev)
 
 static int vrf_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+        kfree_skb(skb);
         return 0;
 }
 
@@ -998,7 +999,7 @@ static struct sk_buff *vrf_rcv_nfhook(u8 pf, unsigned int hook,
 {
         struct net *net = dev_net(dev);
 
-        if (NF_HOOK(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) < 0)
+        if (nf_hook(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) != 1)
                 skb = NULL;    /* kfree_skb(skb) handled by nf code */
 
         return skb;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 6ffc482550c1..7b61adb6270c 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1934,8 +1934,7 @@ abort_transaction_no_dev_fatal:
         xennet_disconnect_backend(info);
         xennet_destroy_queues(info);
  out:
-        unregister_netdev(info->netdev);
-        xennet_free_netdev(info->netdev);
+        device_unregister(&dev->dev);
         return err;
 }
 
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d5e0906262ea..a60926410438 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -925,6 +925,29 @@ static int nvme_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 }
 
 #ifdef CONFIG_BLK_DEV_INTEGRITY
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+        struct nvme_ns *ns = disk->private_data;
+        u16 old_ms = ns->ms;
+        u8 pi_type = 0;
+
+        ns->ms = le16_to_cpu(id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ms);
+        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+
+        /* PI implementation requires metadata equal t10 pi tuple size */
+        if (ns->ms == sizeof(struct t10_pi_tuple))
+                pi_type = id->dps & NVME_NS_DPS_PI_MASK;
+
+        if (blk_get_integrity(disk) &&
+            (ns->pi_type != pi_type || ns->ms != old_ms ||
+             bs != queue_logical_block_size(disk->queue) ||
+             (ns->ms && ns->ext)))
+                blk_integrity_unregister(disk);
+
+        ns->pi_type = pi_type;
+}
+
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
         struct blk_integrity integrity;
@@ -951,6 +974,10 @@ static void nvme_init_integrity(struct nvme_ns *ns)
         blk_queue_max_integrity_segments(ns->queue, 1);
 }
 #else
+static void nvme_prep_integrity(struct gendisk *disk, struct nvme_id_ns *id,
+                u16 bs)
+{
+}
 static void nvme_init_integrity(struct nvme_ns *ns)
 {
 }
@@ -997,37 +1024,22 @@ static int nvme_revalidate_ns(struct nvme_ns *ns, struct nvme_id_ns **id)
 static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id)
 {
         struct nvme_ns *ns = disk->private_data;
-        u8 lbaf, pi_type;
-        u16 old_ms;
-        unsigned short bs;
-
-        old_ms = ns->ms;
-        lbaf = id->flbas & NVME_NS_FLBAS_LBA_MASK;
-        ns->lba_shift = id->lbaf[lbaf].ds;
-        ns->ms = le16_to_cpu(id->lbaf[lbaf].ms);
-        ns->ext = ns->ms && (id->flbas & NVME_NS_FLBAS_META_EXT);
+        u16 bs;
 
         /*
          * If identify namespace failed, use default 512 byte block size so
          * block layer can use before failing read/write for 0 capacity.
          */
+        ns->lba_shift = id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ds;
         if (ns->lba_shift == 0)
                 ns->lba_shift = 9;
         bs = 1 << ns->lba_shift;
-        /* XXX: PI implementation requires metadata equal t10 pi tuple size */
-        pi_type = ns->ms == sizeof(struct t10_pi_tuple) ?
-                                        id->dps & NVME_NS_DPS_PI_MASK : 0;
 
         blk_mq_freeze_queue(disk->queue);
-        if (blk_get_integrity(disk) && (ns->pi_type != pi_type ||
-                                ns->ms != old_ms ||
-                                bs != queue_logical_block_size(disk->queue) ||
-                                (ns->ms && ns->ext)))
-                blk_integrity_unregister(disk);
 
-        ns->pi_type = pi_type;
+        if (ns->ctrl->ops->flags & NVME_F_METADATA_SUPPORTED)
+                nvme_prep_integrity(disk, id, bs);
         blk_queue_logical_block_size(ns->queue, bs);
-
         if (ns->ms && !blk_get_integrity(disk) && !ns->ext)
                 nvme_init_integrity(ns);
         if (ns->ms && !(ns->ms == 8 && ns->pi_type) && !blk_get_integrity(disk))
@@ -1605,7 +1617,7 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
         }
         memcpy(ctrl->psd, id->psd, sizeof(ctrl->psd));
 
-        if (ctrl->ops->is_fabrics) {
+        if (ctrl->ops->flags & NVME_F_FABRICS) {
                 ctrl->icdoff = le16_to_cpu(id->icdoff);
                 ctrl->ioccsz = le32_to_cpu(id->ioccsz);
                 ctrl->iorcsz = le32_to_cpu(id->iorcsz);
@@ -2098,7 +2110,6 @@ static void nvme_ns_remove(struct nvme_ns *ns)
                 if (ns->ndev)
                         nvme_nvm_unregister_sysfs(ns);
                 del_gendisk(ns->disk);
-                blk_mq_abort_requeue_list(ns->queue);
                 blk_cleanup_queue(ns->queue);
         }
 
@@ -2436,8 +2447,16 @@ void nvme_kill_queues(struct nvme_ctrl *ctrl)
                         continue;
                 revalidate_disk(ns->disk);
                 blk_set_queue_dying(ns->queue);
-                blk_mq_abort_requeue_list(ns->queue);
-                blk_mq_start_stopped_hw_queues(ns->queue, true);
+
+                /*
+                 * Forcibly start all queues to avoid having stuck requests.
+                 * Note that we must ensure the queues are not stopped
+                 * when the final removal happens.
+                 */
+                blk_mq_start_hw_queues(ns->queue);
+
+                /* draining requests in requeue list */
+                blk_mq_kick_requeue_list(ns->queue);
         }
         mutex_unlock(&ctrl->namespaces_mutex);
 }
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 70e689bf1cad..5b14cbefb724 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -45,8 +45,6 @@ enum nvme_fc_queue_flags {
 
 #define NVMEFC_QUEUE_DELAY      3               /* ms units */
 
-#define NVME_FC_MAX_CONNECT_ATTEMPTS    1
-
 struct nvme_fc_queue {
         struct nvme_fc_ctrl     *ctrl;
         struct device           *dev;
@@ -165,8 +163,6 @@ struct nvme_fc_ctrl {
         struct work_struct      delete_work;
         struct work_struct      reset_work;
         struct delayed_work     connect_work;
-        int                     reconnect_delay;
-        int                     connect_attempts;
 
         struct kref             ref;
         u32                     flags;
@@ -1376,9 +1372,9 @@ done:
         complete_rq = __nvme_fc_fcpop_chk_teardowns(ctrl, op);
         if (!complete_rq) {
                 if (unlikely(op->flags & FCOP_FLAGS_TERMIO)) {
-                        status = cpu_to_le16(NVME_SC_ABORT_REQ);
+                        status = cpu_to_le16(NVME_SC_ABORT_REQ << 1);
                         if (blk_queue_dying(rq->q))
-                                status |= cpu_to_le16(NVME_SC_DNR);
+                                status |= cpu_to_le16(NVME_SC_DNR << 1);
                 }
                 nvme_end_request(rq, status, result);
         } else
@@ -1751,9 +1747,13 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
         dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: transport association error detected: %s\n",
                 ctrl->cnum, errmsg);
-        dev_info(ctrl->ctrl.device,
+        dev_warn(ctrl->ctrl.device,
                 "NVME-FC{%d}: resetting controller\n", ctrl->cnum);
 
+        /* stop the queues on error, cleanup is in reset thread */
+        if (ctrl->queue_count > 1)
+                nvme_stop_queues(&ctrl->ctrl);
+
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
@@ -2191,9 +2191,6 @@ nvme_fc_create_io_queues(struct nvme_fc_ctrl *ctrl)
         if (!opts->nr_io_queues)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
@@ -2264,9 +2261,6 @@ nvme_fc_reinit_io_queues(struct nvme_fc_ctrl *ctrl)
         if (ctrl->queue_count == 1)
                 return 0;
 
-        dev_info(ctrl->ctrl.device, "Recreating %d I/O queues.\n",
-                        opts->nr_io_queues);
-
         nvme_fc_init_io_queues(ctrl);
 
         ret = blk_mq_reinit_tagset(&ctrl->tag_set);
@@ -2302,7 +2296,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         int ret;
         bool changed;
 
-        ctrl->connect_attempts++;
+        ++ctrl->ctrl.opts->nr_reconnects;
 
         /*
          * Create the admin queue
@@ -2399,9 +2393,7 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
         WARN_ON_ONCE(!changed);
 
-        ctrl->connect_attempts = 0;
-
-        kref_get(&ctrl->ctrl.kref);
+        ctrl->ctrl.opts->nr_reconnects = 0;
 
         if (ctrl->queue_count > 1) {
                 nvme_start_queues(&ctrl->ctrl);
@@ -2532,26 +2524,32 @@ nvme_fc_delete_ctrl_work(struct work_struct *work)
 
         /*
          * tear down the controller
-         * This will result in the last reference on the nvme ctrl to
-         * expire, calling the transport nvme_fc_nvme_ctrl_freed() callback.
-         * From there, the transport will tear down it's logical queues and
-         * association.
+         * After the last reference on the nvme ctrl is removed,
+         * the transport nvme_fc_nvme_ctrl_freed() callback will be
+         * invoked. From there, the transport will tear down it's
+         * logical queues and association.
          */
         nvme_uninit_ctrl(&ctrl->ctrl);
 
         nvme_put_ctrl(&ctrl->ctrl);
 }
 
-static int
-__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+static bool
+__nvme_fc_schedule_delete_work(struct nvme_fc_ctrl *ctrl)
 {
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_DELETING))
-                return -EBUSY;
+                return true;
 
         if (!queue_work(nvme_fc_wq, &ctrl->delete_work))
-                return -EBUSY;
+                return true;
 
-        return 0;
+        return false;
+}
+
+static int
+__nvme_fc_del_ctrl(struct nvme_fc_ctrl *ctrl)
+{
+        return __nvme_fc_schedule_delete_work(ctrl) ? -EBUSY : 0;
 }
 
 /*
@@ -2577,6 +2575,35 @@ nvme_fc_del_nvme_ctrl(struct nvme_ctrl *nctrl)
 }
 
 static void
+nvme_fc_reconnect_or_delete(struct nvme_fc_ctrl *ctrl, int status)
+{
+        /* If we are resetting/deleting then do nothing */
+        if (ctrl->ctrl.state != NVME_CTRL_RECONNECTING) {
+                WARN_ON_ONCE(ctrl->ctrl.state == NVME_CTRL_NEW ||
+                        ctrl->ctrl.state == NVME_CTRL_LIVE);
+                return;
+        }
+
+        dev_info(ctrl->ctrl.device,
+                "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
+                ctrl->cnum, status);
+
+        if (nvmf_should_reconnect(&ctrl->ctrl)) {
+                dev_info(ctrl->ctrl.device,
+                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
+                        ctrl->cnum, ctrl->ctrl.opts->reconnect_delay);
+                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
+                                ctrl->ctrl.opts->reconnect_delay * HZ);
+        } else {
+                dev_warn(ctrl->ctrl.device,
+                                "NVME-FC{%d}: Max reconnect attempts (%d) "
+                                "reached. Removing controller\n",
+                                ctrl->cnum, ctrl->ctrl.opts->nr_reconnects);
+                WARN_ON(__nvme_fc_schedule_delete_work(ctrl));
+        }
+}
+
+static void
 nvme_fc_reset_ctrl_work(struct work_struct *work)
 {
         struct nvme_fc_ctrl *ctrl =
@@ -2587,34 +2614,9 @@ nvme_fc_reset_ctrl_work(struct work_struct *work)
         nvme_fc_delete_association(ctrl);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: reset: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reset complete\n", ctrl->cnum);
 }
@@ -2628,7 +2630,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
 
-        dev_warn(ctrl->ctrl.device,
+        dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: admin requested controller reset\n", ctrl->cnum);
 
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RESETTING))
@@ -2645,7 +2647,7 @@ nvme_fc_reset_nvme_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_fc_ctrl_ops = {
         .name                   = "fc",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
@@ -2667,34 +2669,9 @@ nvme_fc_connect_ctrl_work(struct work_struct *work)
                                 struct nvme_fc_ctrl, connect_work);
 
         ret = nvme_fc_create_association(ctrl);
-        if (ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt failed (%d)\n",
-                        ctrl->cnum, ret);
-                if (ctrl->connect_attempts >= NVME_FC_MAX_CONNECT_ATTEMPTS) {
-                        dev_warn(ctrl->ctrl.device,
-                                "NVME-FC{%d}: Max reconnect attempts (%d) "
-                                "reached. Removing controller\n",
-                                ctrl->cnum, ctrl->connect_attempts);
-
-                        if (!nvme_change_ctrl_state(&ctrl->ctrl,
-                                NVME_CTRL_DELETING)) {
-                                dev_err(ctrl->ctrl.device,
-                                        "NVME-FC{%d}: failed to change state "
-                                        "to DELETING\n", ctrl->cnum);
-                                return;
-                        }
-
-                        WARN_ON(!queue_work(nvme_fc_wq, &ctrl->delete_work));
-                        return;
-                }
-
-                dev_warn(ctrl->ctrl.device,
-                        "NVME-FC{%d}: Reconnect attempt in %d seconds.\n",
-                        ctrl->cnum, ctrl->reconnect_delay);
-                queue_delayed_work(nvme_fc_wq, &ctrl->connect_work,
-                                ctrl->reconnect_delay * HZ);
-        } else
+        if (ret)
+                nvme_fc_reconnect_or_delete(ctrl, ret);
+        else
                 dev_info(ctrl->ctrl.device,
                         "NVME-FC{%d}: controller reconnect complete\n",
                         ctrl->cnum);
@@ -2720,6 +2697,12 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         unsigned long flags;
         int ret, idx;
 
+        if (!(rport->remoteport.port_role &
+            (FC_PORT_ROLE_NVME_DISCOVERY | FC_PORT_ROLE_NVME_TARGET))) {
+                ret = -EBADR;
+                goto out_fail;
+        }
+
         ctrl = kzalloc(sizeof(*ctrl), GFP_KERNEL);
         if (!ctrl) {
                 ret = -ENOMEM;
@@ -2745,7 +2728,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         INIT_WORK(&ctrl->delete_work, nvme_fc_delete_ctrl_work);
         INIT_WORK(&ctrl->reset_work, nvme_fc_reset_ctrl_work);
         INIT_DELAYED_WORK(&ctrl->connect_work, nvme_fc_connect_ctrl_work);
-        ctrl->reconnect_delay = opts->reconnect_delay;
         spin_lock_init(&ctrl->lock);
 
         /* io queue count */
@@ -2809,7 +2791,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 ctrl->ctrl.opts = NULL;
                 /* initiate nvme ctrl ref counting teardown */
                 nvme_uninit_ctrl(&ctrl->ctrl);
-                nvme_put_ctrl(&ctrl->ctrl);
 
                 /* as we're past the point where we transition to the ref
                  * counting teardown path, if we return a bad pointer here,
@@ -2825,6 +2806,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
                 return ERR_PTR(ret);
         }
 
+        kref_get(&ctrl->ctrl.kref);
+
         dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: new ctrl: NQN \"%s\"\n",
                 ctrl->cnum, ctrl->ctrl.opts->subsysnqn);
@@ -2961,7 +2944,7 @@ nvme_fc_create_ctrl(struct device *dev, struct nvmf_ctrl_options *opts)
 static struct nvmf_transport_ops nvme_fc_transport = {
         .name           = "fc",
         .required_opts  = NVMF_OPT_TRADDR | NVMF_OPT_HOST_TRADDR,
-        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY,
+        .allowed_opts   = NVMF_OPT_RECONNECT_DELAY | NVMF_OPT_CTRL_LOSS_TMO,
         .create_ctrl    = nvme_fc_create_ctrl,
 };
 
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 29c708ca9621..9d6a070d4391 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -208,7 +208,9 @@ struct nvme_ns {
 struct nvme_ctrl_ops {
         const char *name;
         struct module *module;
-        bool is_fabrics;
+        unsigned int flags;
+#define NVME_F_FABRICS                  (1 << 0)
+#define NVME_F_METADATA_SUPPORTED       (1 << 1)
         int (*reg_read32)(struct nvme_ctrl *ctrl, u32 off, u32 *val);
         int (*reg_write32)(struct nvme_ctrl *ctrl, u32 off, u32 val);
         int (*reg_read64)(struct nvme_ctrl *ctrl, u32 off, u64 *val);
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index fed803232edc..d52701df7245 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -263,7 +263,7 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
         c.dbbuf.prp2 = cpu_to_le64(dev->dbbuf_eis_dma_addr);
 
         if (nvme_submit_sync_cmd(dev->ctrl.admin_q, &c, NULL, 0)) {
-                dev_warn(dev->dev, "unable to set dbbuf\n");
+                dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
                 /* Free memory and continue on */
                 nvme_dbbuf_dma_free(dev);
         }
@@ -1394,11 +1394,11 @@ static void nvme_warn_reset(struct nvme_dev *dev, u32 csts)
         result = pci_read_config_word(to_pci_dev(dev->dev), PCI_STATUS,
                                       &pci_status);
         if (result == PCIBIOS_SUCCESSFUL)
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS=0x%hx\n",
                          csts, pci_status);
         else
-                dev_warn(dev->dev,
+                dev_warn(dev->ctrl.device,
                          "controller is down; will reset: CSTS=0x%x, PCI_STATUS read failed (%d)\n",
                          csts, result);
 }
@@ -1506,6 +1506,11 @@ static inline void nvme_release_cmb(struct nvme_dev *dev)
         if (dev->cmb) {
                 iounmap(dev->cmb);
                 dev->cmb = NULL;
+                if (dev->cmbsz) {
+                        sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+                                                     &dev_attr_cmb.attr, NULL);
+                        dev->cmbsz = 0;
+                }
         }
 }
 
@@ -1735,8 +1740,8 @@ static int nvme_pci_enable(struct nvme_dev *dev)
          */
         if (pdev->vendor == PCI_VENDOR_ID_APPLE && pdev->device == 0x2001) {
                 dev->q_depth = 2;
-                dev_warn(dev->dev, "detected Apple NVMe controller, set "
-                        "queue depth=%u to work around controller resets\n",
+                dev_warn(dev->ctrl.device, "detected Apple NVMe controller, "
+                        "set queue depth=%u to work around controller resets\n",
                         dev->q_depth);
         }
 
@@ -1754,7 +1759,7 @@ static int nvme_pci_enable(struct nvme_dev *dev)
                 if (dev->cmbsz) {
                         if (sysfs_add_file_to_group(&dev->ctrl.device->kobj,
                                                     &dev_attr_cmb.attr, NULL))
-                                dev_warn(dev->dev,
+                                dev_warn(dev->ctrl.device,
                                          "failed to add sysfs attribute for CMB\n");
                 }
         }
@@ -1779,6 +1784,7 @@ static void nvme_pci_disable(struct nvme_dev *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev->dev);
 
+        nvme_release_cmb(dev);
         pci_free_irq_vectors(pdev);
 
         if (pci_is_enabled(pdev)) {
@@ -2041,6 +2047,7 @@ static int nvme_pci_reset_ctrl(struct nvme_ctrl *ctrl)
 static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = {
         .name                   = "pcie",
         .module                 = THIS_MODULE,
+        .flags                  = NVME_F_METADATA_SUPPORTED,
         .reg_read32             = nvme_pci_reg_read32,
         .reg_write32            = nvme_pci_reg_write32,
         .reg_read64             = nvme_pci_reg_read64,
@@ -2184,7 +2191,6 @@ static void nvme_remove(struct pci_dev *pdev)
         nvme_dev_disable(dev, true);
         nvme_dev_remove_admin(dev);
         nvme_free_queues(dev, 0);
-        nvme_release_cmb(dev);
         nvme_release_prp_pools(dev);
         nvme_dev_unmap(dev);
         nvme_put_ctrl(&dev->ctrl);
@@ -2288,6 +2294,8 @@ static const struct pci_device_id nvme_id_table[] = {
         { PCI_VDEVICE(INTEL, 0x0a54),
                 .driver_data = NVME_QUIRK_STRIPE_SIZE |
                                 NVME_QUIRK_DEALLOCATE_ZEROES, },
+        { PCI_VDEVICE(INTEL, 0xf1a5),   /* Intel 600P/P3100 */
+                .driver_data = NVME_QUIRK_NO_DEEPEST_PS },
         { PCI_VDEVICE(INTEL, 0x5845),   /* Qemu emulated controller */
                 .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index dd1c6deef82f..28bd255c144d 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -1038,6 +1038,19 @@ static void nvme_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc)
                 nvme_rdma_wr_error(cq, wc, "SEND");
 }
 
+static inline int nvme_rdma_queue_sig_limit(struct nvme_rdma_queue *queue)
+{
+        int sig_limit;
+
+        /*
+         * We signal completion every queue depth/2 and also handle the
+         * degenerated case of a  device with queue_depth=1, where we
+         * would need to signal every message.
+         */
+        sig_limit = max(queue->queue_size / 2, 1);
+        return (++queue->sig_count % sig_limit) == 0;
+}
+
 static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
                 struct nvme_rdma_qe *qe, struct ib_sge *sge, u32 num_sge,
                 struct ib_send_wr *first, bool flush)
@@ -1065,9 +1078,6 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * Would have been way to obvious to handle this in hardware or
          * at least the RDMA stack..
          *
-         * This messy and racy code sniplet is copy and pasted from the iSER
-         * initiator, and the magic '32' comes from there as well.
-         *
          * Always signal the flushes. The magic request used for the flush
          * sequencer is not allocated in our driver's tagset and it's
          * triggered to be freed by blk_cleanup_queue(). So we need to
@@ -1075,7 +1085,7 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue,
          * embedded in request's payload, is not freed when __ib_process_cq()
          * calls wr_cqe->done().
          */
-        if ((++queue->sig_count % 32) == 0 || flush)
+        if (nvme_rdma_queue_sig_limit(queue) || flush)
                 wr.send_flags |= IB_SEND_SIGNALED;
 
         if (first)
@@ -1782,7 +1792,7 @@ static int nvme_rdma_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_rdma_ctrl_ops = {
         .name                   = "rdma",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index cf90713043da..eb9399ac97cf 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -529,6 +529,12 @@ fail:
 }
 EXPORT_SYMBOL_GPL(nvmet_req_init);
 
+void nvmet_req_uninit(struct nvmet_req *req)
+{
+        percpu_ref_put(&req->sq->ref);
+}
+EXPORT_SYMBOL_GPL(nvmet_req_uninit);
+
 static inline bool nvmet_cc_en(u32 cc)
 {
         return cc & 0x1;
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 62eba29c85fb..2006fae61980 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -517,9 +517,7 @@ nvmet_fc_queue_to_cpu(struct nvmet_fc_tgtport *tgtport, int qid)
 {
         int cpu, idx, cnt;
 
-        if (!(tgtport->ops->target_features &
-                        NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED) ||
-            tgtport->ops->max_hw_queues == 1)
+        if (tgtport->ops->max_hw_queues == 1)
                 return WORK_CPU_UNBOUND;
 
         /* Simple cpu selection based on qid modulo active cpu count */
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 15551ef79c8c..294a6611fb24 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -698,7 +698,6 @@ static struct nvmet_fc_target_template tgttemplate = {
         .dma_boundary           = FCLOOP_DMABOUND_4G,
         /* optional features */
         .target_features        = NVMET_FCTGTFEAT_CMD_IN_ISR |
-                                  NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED |
                                   NVMET_FCTGTFEAT_OPDONE_IN_ISR,
         /* sizes of additional private data for data structures */
         .target_priv_sz         = sizeof(struct fcloop_tport),
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index feb497134aee..e503cfff0337 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -558,7 +558,7 @@ static int nvme_loop_reset_ctrl(struct nvme_ctrl *nctrl)
 static const struct nvme_ctrl_ops nvme_loop_ctrl_ops = {
         .name                   = "loop",
         .module                 = THIS_MODULE,
-        .is_fabrics             = true,
+        .flags                  = NVME_F_FABRICS,
         .reg_read32             = nvmf_reg_read32,
         .reg_read64             = nvmf_reg_read64,
         .reg_write32            = nvmf_reg_write32,
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 7cb77ba5993b..cfc5c7fb0ab7 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -261,6 +261,7 @@ u16 nvmet_parse_fabrics_cmd(struct nvmet_req *req);
 
 bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq,
                 struct nvmet_sq *sq, struct nvmet_fabrics_ops *ops);
+void nvmet_req_uninit(struct nvmet_req *req);
 void nvmet_req_complete(struct nvmet_req *req, u16 status);
 
 void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq, u16 qid,
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 99c69018a35f..9e45cde63376 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -567,6 +567,7 @@ static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc)
         rsp->n_rdma = 0;
 
         if (unlikely(wc->status != IB_WC_SUCCESS)) {
+                nvmet_req_uninit(&rsp->req);
                 nvmet_rdma_release_rsp(rsp);
                 if (wc->status != IB_WC_WR_FLUSH_ERR) {
                         pr_info("RDMA READ for CQE 0x%p failed with status %s (%d).\n",
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 3080d9dd031d..43bd69dceabf 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -507,6 +507,9 @@ void *__unflatten_device_tree(const void *blob,
 
         /* Allocate memory for the expanded device tree */
         mem = dt_alloc(size + 4, __alignof__(struct device_node));
+        if (!mem)
+                return NULL;
+
         memset(mem, 0, size);
 
         *(__be32 *)(mem + size) = cpu_to_be32(0xdeadbeef);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 4dec07ea510f..d507c3569a88 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -197,7 +197,7 @@ static int __init __reserved_mem_init_node(struct reserved_mem *rmem)
         const struct of_device_id *i;
 
         for (i = __reservedmem_of_table; i < &__rmem_of_table_sentinel; i++) {
-                int const (*initfn)(struct reserved_mem *rmem) = i->data;
+                reservedmem_of_init_fn initfn = i->data;
                 const char *compat = i->compatible;
 
                 if (!of_flat_dt_is_compatible(rmem->fdt_node, compat))
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 71fecc2debfc..703a42118ffc 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -523,7 +523,7 @@ static int __init of_platform_default_populate_init(void)
 arch_initcall_sync(of_platform_default_populate_init);
 #endif
 
-static int of_platform_device_destroy(struct device *dev, void *data)
+int of_platform_device_destroy(struct device *dev, void *data)
 {
         /* Do not touch devices not populated from the device tree */
         if (!dev->of_node || !of_node_check_flag(dev->of_node, OF_POPULATED))
@@ -544,6 +544,7 @@ static int of_platform_device_destroy(struct device *dev, void *data)
         of_node_clear_flag(dev->of_node, OF_POPULATED_BUS);
         return 0;
 }
+EXPORT_SYMBOL_GPL(of_platform_device_destroy);
 
 /**
  * of_platform_depopulate() - Remove devices populated from device tree
diff --git a/drivers/pci/dwc/pci-imx6.c b/drivers/pci/dwc/pci-imx6.c
index a98cba55c7f0..19a289b8cc94 100644
--- a/drivers/pci/dwc/pci-imx6.c
+++ b/drivers/pci/dwc/pci-imx6.c
@@ -252,7 +252,34 @@ static void imx6_pcie_reset_phy(struct imx6_pcie *imx6_pcie)
 static int imx6q_pcie_abort_handler(unsigned long addr,
                 unsigned int fsr, struct pt_regs *regs)
 {
-        return 0;
+        unsigned long pc = instruction_pointer(regs);
+        unsigned long instr = *(unsigned long *)pc;
+        int reg = (instr >> 12) & 15;
+
+        /*
+         * If the instruction being executed was a read,
+         * make it look like it read all-ones.
+         */
+        if ((instr & 0x0c100000) == 0x04100000) {
+                unsigned long val;
+
+                if (instr & 0x00400000)
+                        val = 255;
+                else
+                        val = -1;
+
+                regs->uregs[reg] = val;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        if ((instr & 0x0e100090) == 0x00100090) {
+                regs->uregs[reg] = -1;
+                regs->ARM_pc += 4;
+                return 0;
+        }
+
+        return 1;
 }
 
 static void imx6_pcie_assert_core_reset(struct imx6_pcie *imx6_pcie)
@@ -819,8 +846,8 @@ static int __init imx6_pcie_init(void)
          * we can install the handler here without risking it
          * accessing some uninitialized driver state.
          */
-        hook_fault_code(16 + 6, imx6q_pcie_abort_handler, SIGBUS, 0,
-                        "imprecise external abort");
+        hook_fault_code(8, imx6q_pcie_abort_handler, SIGBUS, 0,
+                        "external abort on non-linefetch");
 
         return platform_driver_register(&imx6_pcie_driver);
 }
diff --git a/drivers/pci/endpoint/Kconfig b/drivers/pci/endpoint/Kconfig
index c23f146fb5a6..c09623ca8c3b 100644
--- a/drivers/pci/endpoint/Kconfig
+++ b/drivers/pci/endpoint/Kconfig
@@ -6,6 +6,7 @@ menu "PCI Endpoint"
 
 config PCI_ENDPOINT
         bool "PCI Endpoint Support"
+        depends on HAS_DMA
         help
            Enable this configuration option to support configurable PCI
            endpoint. This should be enabled if the platform has a PCI
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index b01bd5bba8e6..563901cd9c06 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2144,7 +2144,8 @@ bool pci_dev_keep_suspended(struct pci_dev *pci_dev)
 
         if (!pm_runtime_suspended(dev)
             || pci_target_state(pci_dev) != pci_dev->current_state
-            || platform_pci_need_resume(pci_dev))
+            || platform_pci_need_resume(pci_dev)
+            || (pci_dev->dev_flags & PCI_DEV_FLAGS_NEEDS_RESUME))
                 return false;
 
         /*
diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
index cc6e085008fb..f6a63406c76e 100644
--- a/drivers/pci/switch/switchtec.c
+++ b/drivers/pci/switch/switchtec.c
@@ -1291,7 +1291,6 @@ static struct switchtec_dev *stdev_create(struct pci_dev *pdev)
         cdev = &stdev->cdev;
         cdev_init(cdev, &switchtec_fops);
         cdev->owner = THIS_MODULE;
-        cdev->kobj.parent = &dev->kobj;
 
         return stdev;
 
@@ -1442,12 +1441,15 @@ static int switchtec_init_pci(struct switchtec_dev *stdev,
         stdev->mmio_sys_info = stdev->mmio + SWITCHTEC_GAS_SYS_INFO_OFFSET;
         stdev->mmio_flash_info = stdev->mmio + SWITCHTEC_GAS_FLASH_INFO_OFFSET;
         stdev->mmio_ntb = stdev->mmio + SWITCHTEC_GAS_NTB_OFFSET;
-        stdev->partition = ioread8(&stdev->mmio_ntb->partition_id);
+        stdev->partition = ioread8(&stdev->mmio_sys_info->partition_id);
         stdev->partition_count = ioread8(&stdev->mmio_ntb->partition_count);
         stdev->mmio_part_cfg_all = stdev->mmio + SWITCHTEC_GAS_PART_CFG_OFFSET;
         stdev->mmio_part_cfg = &stdev->mmio_part_cfg_all[stdev->partition];
         stdev->mmio_pff_csr = stdev->mmio + SWITCHTEC_GAS_PFF_CSR_OFFSET;
 
+        if (stdev->partition_count < 1)
+                stdev->partition_count = 1;
+
         init_pff(stdev);
 
         pci_set_drvdata(pdev, stdev);
@@ -1479,11 +1481,7 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
                   SWITCHTEC_EVENT_EN_IRQ,
                   &stdev->mmio_part_cfg->mrpc_comp_hdr);
 
-        rc = cdev_add(&stdev->cdev, stdev->dev.devt, 1);
-        if (rc)
-                goto err_put;
-
-        rc = device_add(&stdev->dev);
+        rc = cdev_device_add(&stdev->cdev, &stdev->dev);
         if (rc)
                 goto err_devadd;
 
@@ -1492,7 +1490,6 @@ static int switchtec_pci_probe(struct pci_dev *pdev,
         return 0;
 
 err_devadd:
-        cdev_del(&stdev->cdev);
         stdev_kill(stdev);
 err_put:
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
@@ -1506,8 +1503,7 @@ static void switchtec_pci_remove(struct pci_dev *pdev)
 
         pci_set_drvdata(pdev, NULL);
 
-        device_del(&stdev->dev);
-        cdev_del(&stdev->cdev);
+        cdev_device_del(&stdev->cdev, &stdev->dev);
         ida_simple_remove(&switchtec_minor_ida, MINOR(stdev->dev.devt));
         dev_info(&stdev->dev, "unregistered.\n");
 
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 14bde0db8c24..5b10b50f8686 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_zone(
 
         power_zone->id = result;
         idr_init(&power_zone->idr);
+        result = -ENOMEM;
         power_zone->name = kstrdup(name, GFP_KERNEL);
         if (!power_zone->name)
                 goto err_name_alloc;
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index b3de973a6260..9dca53df3584 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -1088,7 +1088,7 @@ static u32 rtc_handler(void *context)
         }
         spin_unlock_irqrestore(&rtc_lock, flags);
 
-        pm_wakeup_event(dev, 0);
+        pm_wakeup_hard_event(dev);
         acpi_clear_event(ACPI_EVENT_RTC);
         acpi_disable_event(ACPI_EVENT_RTC, 0);
         return ACPI_INTERRUPT_HANDLED;
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index e443b0d0b236..34b9ad6b3143 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -35,7 +35,7 @@ static struct bus_type ccwgroup_bus_type;
 static void __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
 {
         int i;
-        char str[8];
+        char str[16];
 
         for (i = 0; i < gdev->count; i++) {
                 sprintf(str, "cdev%d", i);
@@ -238,7 +238,7 @@ static void ccwgroup_release(struct device *dev)
 
 static int __ccwgroup_create_symlinks(struct ccwgroup_device *gdev)
 {
-        char str[8];
+        char str[16];
         int i, rc;
 
         for (i = 0; i < gdev->count; i++) {
diff --git a/drivers/s390/cio/qdio_debug.h b/drivers/s390/cio/qdio_debug.h
index f33ce8577619..1d595d17bf11 100644
--- a/drivers/s390/cio/qdio_debug.h
+++ b/drivers/s390/cio/qdio_debug.h
@@ -11,7 +11,7 @@
 #include "qdio.h"
 
 /* that gives us 15 characters in the text event views */
-#define QDIO_DBF_LEN    16
+#define QDIO_DBF_LEN    32
 
 extern debug_info_t *qdio_dbf_setup;
 extern debug_info_t *qdio_dbf_error;
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index f6aa21176d89..30bc6105aac3 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -701,6 +701,7 @@ enum qeth_discipline_id {
 };
 
 struct qeth_discipline {
+        const struct device_type *devtype;
         void (*start_poll)(struct ccw_device *, int, unsigned long);
         qdio_handler_t *input_handler;
         qdio_handler_t *output_handler;
@@ -875,6 +876,9 @@ extern struct qeth_discipline qeth_l2_discipline;
 extern struct qeth_discipline qeth_l3_discipline;
 extern const struct attribute_group *qeth_generic_attr_groups[];
 extern const struct attribute_group *qeth_osn_attr_groups[];
+extern const struct attribute_group qeth_device_attr_group;
+extern const struct attribute_group qeth_device_blkt_group;
+extern const struct device_type qeth_generic_devtype;
 extern struct workqueue_struct *qeth_wq;
 
 int qeth_card_hw_is_reachable(struct qeth_card *);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 38114a8d56e0..fc6d85f2b38d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -5530,10 +5530,12 @@ void qeth_core_free_discipline(struct qeth_card *card)
         card->discipline = NULL;
 }
 
-static const struct device_type qeth_generic_devtype = {
+const struct device_type qeth_generic_devtype = {
         .name = "qeth_generic",
         .groups = qeth_generic_attr_groups,
 };
+EXPORT_SYMBOL_GPL(qeth_generic_devtype);
+
 static const struct device_type qeth_osn_devtype = {
         .name = "qeth_osn",
         .groups = qeth_osn_attr_groups,
@@ -5659,23 +5661,22 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev)
                 goto err_card;
         }
 
-        if (card->info.type == QETH_CARD_TYPE_OSN)
-                gdev->dev.type = &qeth_osn_devtype;
-        else
-                gdev->dev.type = &qeth_generic_devtype;
-
         switch (card->info.type) {
         case QETH_CARD_TYPE_OSN:
         case QETH_CARD_TYPE_OSM:
                 rc = qeth_core_load_discipline(card, QETH_DISCIPLINE_LAYER2);
                 if (rc)
                         goto err_card;
+
+                gdev->dev.type = (card->info.type != QETH_CARD_TYPE_OSN)
+                                        ? card->discipline->devtype
+                                        : &qeth_osn_devtype;
                 rc = card->discipline->setup(card->gdev);
                 if (rc)
                         goto err_disc;
-        case QETH_CARD_TYPE_OSD:
-        case QETH_CARD_TYPE_OSX:
+                break;
         default:
+                gdev->dev.type = &qeth_generic_devtype;
                 break;
         }
 
@@ -5731,8 +5732,10 @@ static int qeth_core_set_online(struct ccwgroup_device *gdev)
                 if (rc)
                         goto err;
                 rc = card->discipline->setup(card->gdev);
-                if (rc)
+                if (rc) {
+                        qeth_core_free_discipline(card);
                         goto err;
+                }
         }
         rc = card->discipline->set_online(gdev);
 err:
diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c
index 75b29fd2fcf4..db6a285d41e0 100644
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -413,12 +413,16 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
 
         if (card->options.layer2 == newdis)
                 goto out;
-        else {
-                card->info.mac_bits  = 0;
-                if (card->discipline) {
-                        card->discipline->remove(card->gdev);
-                        qeth_core_free_discipline(card);
-                }
+        if (card->info.type == QETH_CARD_TYPE_OSM) {
+                /* fixed layer, can't switch */
+                rc = -EOPNOTSUPP;
+                goto out;
+        }
+
+        card->info.mac_bits = 0;
+        if (card->discipline) {
+                card->discipline->remove(card->gdev);
+                qeth_core_free_discipline(card);
         }
 
         rc = qeth_core_load_discipline(card, newdis);
@@ -426,6 +430,8 @@ static ssize_t qeth_dev_layer2_store(struct device *dev,
                 goto out;
 
         rc = card->discipline->setup(card->gdev);
+        if (rc)
+                qeth_core_free_discipline(card);
 out:
         mutex_unlock(&card->discipline_mutex);
         return rc ? rc : count;
@@ -703,10 +709,11 @@ static struct attribute *qeth_blkt_device_attrs[] = {
         &dev_attr_inter_jumbo.attr,
         NULL,
 };
-static struct attribute_group qeth_device_blkt_group = {
+const struct attribute_group qeth_device_blkt_group = {
         .name = "blkt",
         .attrs = qeth_blkt_device_attrs,
 };
+EXPORT_SYMBOL_GPL(qeth_device_blkt_group);
 
 static struct attribute *qeth_device_attrs[] = {
         &dev_attr_state.attr,
@@ -726,9 +733,10 @@ static struct attribute *qeth_device_attrs[] = {
         &dev_attr_switch_attrs.attr,
         NULL,
 };
-static struct attribute_group qeth_device_attr_group = {
+const struct attribute_group qeth_device_attr_group = {
         .attrs = qeth_device_attrs,
 };
+EXPORT_SYMBOL_GPL(qeth_device_attr_group);
 
 const struct attribute_group *qeth_generic_attr_groups[] = {
         &qeth_device_attr_group,
diff --git a/drivers/s390/net/qeth_l2.h b/drivers/s390/net/qeth_l2.h
index 29d9fb3890ad..0d59f9a45ea9 100644
--- a/drivers/s390/net/qeth_l2.h
+++ b/drivers/s390/net/qeth_l2.h
@@ -8,6 +8,8 @@
 
 #include "qeth_core.h"
 
+extern const struct attribute_group *qeth_l2_attr_groups[];
+
 int qeth_l2_create_device_attributes(struct device *);
 void qeth_l2_remove_device_attributes(struct device *);
 void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 1b07f382d74c..bd2df62a5cdf 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -880,11 +880,21 @@ static int qeth_l2_stop(struct net_device *dev)
         return 0;
 }
 
+static const struct device_type qeth_l2_devtype = {
+        .name = "qeth_layer2",
+        .groups = qeth_l2_attr_groups,
+};
+
 static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+        int rc;
 
-        qeth_l2_create_device_attributes(&gdev->dev);
+        if (gdev->dev.type == &qeth_generic_devtype) {
+                rc = qeth_l2_create_device_attributes(&gdev->dev);
+                if (rc)
+                        return rc;
+        }
         INIT_LIST_HEAD(&card->vid_list);
         hash_init(card->mac_htable);
         card->options.layer2 = 1;
@@ -896,7 +906,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev)
 {
         struct qeth_card *card = dev_get_drvdata(&cgdev->dev);
 
-        qeth_l2_remove_device_attributes(&cgdev->dev);
+        if (cgdev->dev.type == &qeth_generic_devtype)
+                qeth_l2_remove_device_attributes(&cgdev->dev);
         qeth_set_allowed_threads(card, 0, 1);
         wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0);
 
@@ -954,7 +965,6 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         case QETH_CARD_TYPE_OSN:
                 card->dev = alloc_netdev(0, "osn%d", NET_NAME_UNKNOWN,
                                          ether_setup);
-                card->dev->flags |= IFF_NOARP;
                 break;
         default:
                 card->dev = alloc_etherdev(0);
@@ -969,9 +979,12 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
         card->dev->min_mtu = 64;
         card->dev->max_mtu = ETH_MAX_MTU;
         card->dev->netdev_ops = &qeth_l2_netdev_ops;
-        card->dev->ethtool_ops =
-                (card->info.type != QETH_CARD_TYPE_OSN) ?
-                &qeth_l2_ethtool_ops : &qeth_l2_osn_ops;
+        if (card->info.type == QETH_CARD_TYPE_OSN) {
+                card->dev->ethtool_ops = &qeth_l2_osn_ops;
+                card->dev->flags |= IFF_NOARP;
+        } else {
+                card->dev->ethtool_ops = &qeth_l2_ethtool_ops;
+        }
         card->dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER;
         if (card->info.type == QETH_CARD_TYPE_OSD && !card->info.guestlan) {
                 card->dev->hw_features = NETIF_F_SG;
@@ -1269,6 +1282,7 @@ static int qeth_l2_control_event(struct qeth_card *card,
 }
 
 struct qeth_discipline qeth_l2_discipline = {
+        .devtype = &qeth_l2_devtype,
         .start_poll = qeth_qdio_start_poll,
         .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
         .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c
index 687972356d6b..9696baa49e2d 100644
--- a/drivers/s390/net/qeth_l2_sys.c
+++ b/drivers/s390/net/qeth_l2_sys.c
@@ -269,3 +269,11 @@ void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card)
         } else
                 qeth_bridgeport_an_set(card, 0);
 }
+
+const struct attribute_group *qeth_l2_attr_groups[] = {
+        &qeth_device_attr_group,
+        &qeth_device_blkt_group,
+        /* l2 specific, see l2_{create,remove}_device_attributes(): */
+        &qeth_l2_bridgeport_attr_group,
+        NULL,
+};
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 6e0354ef4b86..d8df1e635163 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3039,8 +3039,13 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
 static int qeth_l3_probe_device(struct ccwgroup_device *gdev)
 {
         struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+        int rc;
 
-        qeth_l3_create_device_attributes(&gdev->dev);
+        rc = qeth_l3_create_device_attributes(&gdev->dev);
+        if (rc)
+                return rc;
+        hash_init(card->ip_htable);
+        hash_init(card->ip_mc_htable);
         card->options.layer2 = 0;
         card->info.hwtrap = 0;
         return 0;
@@ -3306,6 +3311,7 @@ static int qeth_l3_control_event(struct qeth_card *card,
 }
 
 struct qeth_discipline qeth_l3_discipline = {
+        .devtype = &qeth_generic_devtype,
         .start_poll = qeth_qdio_start_poll,
         .input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
         .output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
index 2a76ea78a0bf..b18fe2014cf2 100644
--- a/drivers/s390/virtio/virtio_ccw.c
+++ b/drivers/s390/virtio/virtio_ccw.c
@@ -87,7 +87,7 @@ struct vq_info_block {
 } __packed;
 
 struct virtio_feature_desc {
-        __u32 features;
+        __le32 features;
         __u8 index;
 } __packed;
 
diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
index 622bdabc8894..dab195f04da7 100644
--- a/drivers/scsi/csiostor/csio_hw.c
+++ b/drivers/scsi/csiostor/csio_hw.c
@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
                 goto bye;
         }
 
-        mempool_free(mbp, hw->mb_mempool);
         if (finicsum != cfcsum) {
                 csio_warn(hw,
                       "Config File checksum mismatch: csum=%#x, computed=%#x\n",
@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, int reset, u32 *fw_cfg_param)
         rv = csio_hw_validate_caps(hw, mbp);
         if (rv != 0)
                 goto bye;
+
+        mempool_free(mbp, hw->mb_mempool);
+        mbp = NULL;
+
         /*
          * Note that we're operating with parameters
          * not supplied by the driver, rather than from hard-wired
diff --git a/drivers/scsi/cxlflash/Kconfig b/drivers/scsi/cxlflash/Kconfig
index c052104e523e..a011c5dbf214 100644
--- a/drivers/scsi/cxlflash/Kconfig
+++ b/drivers/scsi/cxlflash/Kconfig
@@ -5,6 +5,7 @@
 config CXLFLASH
         tristate "Support for IBM CAPI Flash"
         depends on PCI && SCSI && CXL && EEH
+        select IRQ_POLL
         default m
         help
           Allows CAPI Accelerated IO to Flash
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index a808e8ef1d08..234352da5c3c 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -407,11 +407,12 @@ unlock:
  * can_queue. Eventually we will hit the point where we run
  * on all reserved structs.
  */
-static void fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
+static bool fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
 {
         struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
         unsigned long flags;
         int can_queue;
+        bool changed = false;
 
         spin_lock_irqsave(lport->host->host_lock, flags);
 
@@ -427,9 +428,11 @@ static void fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
         if (!can_queue)
                 can_queue = 1;
         lport->host->can_queue = can_queue;
+        changed = true;
 
 unlock:
         spin_unlock_irqrestore(lport->host->host_lock, flags);
+        return changed;
 }
 
 /*
@@ -1896,11 +1899,11 @@ int fc_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *sc_cmd)
 
         if (!fc_fcp_lport_queue_ready(lport)) {
                 if (lport->qfull) {
-                        fc_fcp_can_queue_ramp_down(lport);
-                        shost_printk(KERN_ERR, lport->host,
-                                     "libfc: queue full, "
-                                     "reducing can_queue to %d.\n",
-                                     lport->host->can_queue);
+                        if (fc_fcp_can_queue_ramp_down(lport))
+                                shost_printk(KERN_ERR, lport->host,
+                                             "libfc: queue full, "
+                                             "reducing can_queue to %d.\n",
+                                             lport->host->can_queue);
                 }
                 rc = SCSI_MLQUEUE_HOST_BUSY;
                 goto out;
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index b44c3136eb51..520325867e2b 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -1422,7 +1422,7 @@ static void fc_rport_recv_rtv_req(struct fc_rport_priv *rdata,
         fp = fc_frame_alloc(lport, sizeof(*rtv));
         if (!fp) {
                 rjt_data.reason = ELS_RJT_UNAB;
-                rjt_data.reason = ELS_EXPL_INSUF_RES;
+                rjt_data.explan = ELS_EXPL_INSUF_RES;
                 fc_seq_els_rsp_send(in_fp, ELS_LS_RJT, &rjt_data);
                 goto drop;
         }
diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 6d7840b096e6..f2c0ba6ced78 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h
@@ -141,6 +141,13 @@ struct lpfc_dmabuf {
         uint32_t   buffer_tag;  /* used for tagged queue ring */
 };
 
+struct lpfc_nvmet_ctxbuf {
+        struct list_head list;
+        struct lpfc_nvmet_rcv_ctx *context;
+        struct lpfc_iocbq *iocbq;
+        struct lpfc_sglq *sglq;
+};
+
 struct lpfc_dma_pool {
         struct lpfc_dmabuf   *elements;
         uint32_t    max_count;
@@ -163,9 +170,7 @@ struct rqb_dmabuf {
         struct lpfc_dmabuf dbuf;
         uint16_t total_size;
         uint16_t bytes_recv;
-        void *context;
-        struct lpfc_iocbq *iocbq;
-        struct lpfc_sglq *sglq;
+        uint16_t idx;
         struct lpfc_queue *hrq;   /* ptr to associated Header RQ */
         struct lpfc_queue *drq;   /* ptr to associated Data RQ */
 };
@@ -670,6 +675,8 @@ struct lpfc_hba {
                                         /* INIT_LINK mailbox command */
 #define LS_NPIV_FAB_SUPPORTED 0x2       /* Fabric supports NPIV */
 #define LS_IGNORE_ERATT       0x4       /* intr handler should ignore ERATT */
+#define LS_MDS_LINK_DOWN      0x8       /* MDS Diagnostics Link Down */
+#define LS_MDS_LOOPBACK      0x16       /* MDS Diagnostics Link Up (Loopback) */
 
         uint32_t hba_flag;      /* hba generic flags */
 #define HBA_ERATT_HANDLED       0x1 /* This flag is set when eratt handled */
@@ -777,7 +784,6 @@ struct lpfc_hba {
         uint32_t cfg_nvme_oas;
         uint32_t cfg_nvme_io_channel;
         uint32_t cfg_nvmet_mrq;
-        uint32_t cfg_nvmet_mrq_post;
         uint32_t cfg_enable_nvmet;
         uint32_t cfg_nvme_enable_fb;
         uint32_t cfg_nvmet_fb_size;
@@ -943,6 +949,7 @@ struct lpfc_hba {
         struct pci_pool *lpfc_mbuf_pool;
         struct pci_pool *lpfc_hrb_pool; /* header receive buffer pool */
         struct pci_pool *lpfc_drb_pool; /* data receive buffer pool */
+        struct pci_pool *lpfc_nvmet_drb_pool; /* data receive buffer pool */
         struct pci_pool *lpfc_hbq_pool; /* SLI3 hbq buffer pool */
         struct pci_pool *txrdy_payload_pool;
         struct lpfc_dma_pool lpfc_mbuf_safety_pool;
@@ -1228,7 +1235,11 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
 static inline struct lpfc_sli_ring *
 lpfc_phba_elsring(struct lpfc_hba *phba)
 {
-        if (phba->sli_rev == LPFC_SLI_REV4)
-                return phba->sli4_hba.els_wq->pring;
+        if (phba->sli_rev == LPFC_SLI_REV4) {
+                if (phba->sli4_hba.els_wq)
+                        return phba->sli4_hba.els_wq->pring;
+                else
+                        return NULL;
+        }
         return &phba->sli.sli3_ring[LPFC_ELS_RING];
 }
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
index 4830370bfab1..bb2d9e238225 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
@@ -60,9 +60,9 @@
 #define LPFC_MIN_DEVLOSS_TMO    1
 #define LPFC_MAX_DEVLOSS_TMO    255
 
-#define LPFC_DEF_MRQ_POST       256
-#define LPFC_MIN_MRQ_POST       32
-#define LPFC_MAX_MRQ_POST       512
+#define LPFC_DEF_MRQ_POST       512
+#define LPFC_MIN_MRQ_POST       512
+#define LPFC_MAX_MRQ_POST       2048
 
 /*
  * Write key size should be multiple of 4. If write key is changed
@@ -205,8 +205,9 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_ls_rsp_error));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP: Rcv %08x Drop %08x\n",
+                                "FCP: Rcv %08x Release %08x Drop %08x\n",
                                 atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->xmt_fcp_release),
                                 atomic_read(&tgtp->rcv_fcp_cmd_drop));
 
                 if (atomic_read(&tgtp->rcv_fcp_cmd_in) !=
@@ -218,15 +219,12 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                 }
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x\n",
+                                "FCP Rsp: RD %08x rsp %08x WR %08x rsp %08x "
+                                "drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_read),
                                 atomic_read(&tgtp->xmt_fcp_read_rsp),
                                 atomic_read(&tgtp->xmt_fcp_write),
-                                atomic_read(&tgtp->xmt_fcp_rsp));
-
-                len += snprintf(buf+len, PAGE_SIZE-len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_rsp),
                                 atomic_read(&tgtp->xmt_fcp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
@@ -236,10 +234,22 @@ lpfc_nvme_info_show(struct device *dev, struct device_attribute *attr,
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf+len, PAGE_SIZE-len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
+
+                len += snprintf(buf + len, PAGE_SIZE - len,
+                                "IO_CTX: %08x outstanding %08x total %x",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
 
                 len +=  snprintf(buf+len, PAGE_SIZE-len, "\n");
                 return len;
@@ -3312,14 +3322,6 @@ LPFC_ATTR_R(nvmet_mrq,
             "Specify number of RQ pairs for processing NVMET cmds");
 
 /*
- * lpfc_nvmet_mrq_post: Specify number buffers to post on every MRQ
- *
- */
-LPFC_ATTR_R(nvmet_mrq_post, LPFC_DEF_MRQ_POST,
-            LPFC_MIN_MRQ_POST, LPFC_MAX_MRQ_POST,
-            "Specify number of buffers to post on every MRQ");
-
-/*
  * lpfc_enable_fc4_type: Defines what FC4 types are supported.
  * Supported Values:  1 - register just FCP
  *                    3 - register both FCP and NVME
@@ -5154,7 +5156,6 @@ struct device_attribute *lpfc_hba_attrs[] = {
         &dev_attr_lpfc_suppress_rsp,
         &dev_attr_lpfc_nvme_io_channel,
         &dev_attr_lpfc_nvmet_mrq,
-        &dev_attr_lpfc_nvmet_mrq_post,
         &dev_attr_lpfc_nvme_enable_fb,
         &dev_attr_lpfc_nvmet_fb_size,
         &dev_attr_lpfc_enable_bg,
@@ -6194,7 +6195,6 @@ lpfc_get_cfgparam(struct lpfc_hba *phba)
 
         lpfc_enable_fc4_type_init(phba, lpfc_enable_fc4_type);
         lpfc_nvmet_mrq_init(phba, lpfc_nvmet_mrq);
-        lpfc_nvmet_mrq_post_init(phba, lpfc_nvmet_mrq_post);
 
         /* Initialize first burst. Target vs Initiator are different. */
         lpfc_nvme_enable_fb_init(phba, lpfc_nvme_enable_fb);
@@ -6291,7 +6291,6 @@ lpfc_nvme_mod_param_dep(struct lpfc_hba *phba)
                 /* Not NVME Target mode.  Turn off Target parameters. */
                 phba->nvmet_support = 0;
                 phba->cfg_nvmet_mrq = 0;
-                phba->cfg_nvmet_mrq_post = 0;
                 phba->cfg_nvmet_fb_size = 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 944b32ca4931..8912767e7bc8 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -75,6 +75,10 @@ void lpfc_init_vpi_cmpl(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_cancel_all_vport_retry_delay_timer(struct lpfc_hba *);
 void lpfc_retry_pport_discovery(struct lpfc_hba *);
 void lpfc_release_rpi(struct lpfc_hba *, struct lpfc_vport *, uint16_t);
+int lpfc_init_iocb_list(struct lpfc_hba *phba, int cnt);
+void lpfc_free_iocb_list(struct lpfc_hba *phba);
+int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                        struct lpfc_queue *drq, int count, int idx);
 
 void lpfc_mbx_cmpl_local_config_link(struct lpfc_hba *, LPFC_MBOXQ_t *);
 void lpfc_mbx_cmpl_reg_login(struct lpfc_hba *, LPFC_MBOXQ_t *);
@@ -246,16 +250,14 @@ struct hbq_dmabuf *lpfc_sli4_rb_alloc(struct lpfc_hba *);
 void lpfc_sli4_rb_free(struct lpfc_hba *, struct hbq_dmabuf *);
 struct rqb_dmabuf *lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba);
 void lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab);
-void lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                        struct lpfc_dmabuf *mp);
+void lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba,
+                            struct lpfc_nvmet_ctxbuf *ctxp);
 int lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
                                struct fc_frame_header *fc_hdr);
 void lpfc_sli4_build_dflt_fcf_record(struct lpfc_hba *, struct fcf_record *,
                         uint16_t);
 int lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
                      struct lpfc_rqe *hrqe, struct lpfc_rqe *drqe);
-int lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq,
-                        struct lpfc_queue *dq, int count);
 int lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hq);
 void lpfc_unregister_fcf(struct lpfc_hba *);
 void lpfc_unregister_fcf_rescan(struct lpfc_hba *);
@@ -271,6 +273,7 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *, uint16_t);
 void lpfc_sli4_clear_fcf_rr_bmask(struct lpfc_hba *);
 
 int lpfc_mem_alloc(struct lpfc_hba *, int align);
+int lpfc_nvmet_mem_alloc(struct lpfc_hba *phba);
 int lpfc_mem_alloc_active_rrq_pool_s4(struct lpfc_hba *);
 void lpfc_mem_free(struct lpfc_hba *);
 void lpfc_mem_free_all(struct lpfc_hba *);
@@ -294,6 +297,7 @@ int lpfc_selective_reset(struct lpfc_hba *);
 void lpfc_reset_barrier(struct lpfc_hba *);
 int lpfc_sli_brdready(struct lpfc_hba *, uint32_t);
 int lpfc_sli_brdkill(struct lpfc_hba *);
+int lpfc_sli_chipset_init(struct lpfc_hba *phba);
 int lpfc_sli_brdreset(struct lpfc_hba *);
 int lpfc_sli_brdrestart(struct lpfc_hba *);
 int lpfc_sli_hba_setup(struct lpfc_hba *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 1487406aea77..f2cd19c6c2df 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -630,7 +630,7 @@ lpfc_ns_rsp(struct lpfc_vport *vport, struct lpfc_dmabuf *mp, uint8_t fc4_type,
                                                 NLP_EVT_DEVICE_RECOVERY);
                         spin_lock_irq(shost->host_lock);
                         ndlp->nlp_flag &= ~NLP_NVMET_RECOV;
-                        spin_lock_irq(shost->host_lock);
+                        spin_unlock_irq(shost->host_lock);
                 }
         }
 
@@ -2092,6 +2092,7 @@ lpfc_fdmi_port_attr_fc4type(struct lpfc_vport *vport,
 
         ae->un.AttrTypes[3] = 0x02; /* Type 1 - ELS */
         ae->un.AttrTypes[2] = 0x01; /* Type 8 - FCP */
+        ae->un.AttrTypes[6] = 0x01; /* Type 40 - NVME */
         ae->un.AttrTypes[7] = 0x01; /* Type 32 - CT */
         size = FOURBYTES + 32;
         ad->AttrLen = cpu_to_be16(size);
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index fce549a91911..4bcb92c844ca 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -798,21 +798,22 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                                 atomic_read(&tgtp->xmt_fcp_rsp));
 
                 len += snprintf(buf + len, size - len,
-                                "FCP Rsp: abort %08x drop %08x\n",
-                                atomic_read(&tgtp->xmt_fcp_abort),
-                                atomic_read(&tgtp->xmt_fcp_drop));
-
-                len += snprintf(buf + len, size - len,
                                 "FCP Rsp Cmpl: %08x err %08x drop %08x\n",
                                 atomic_read(&tgtp->xmt_fcp_rsp_cmpl),
                                 atomic_read(&tgtp->xmt_fcp_rsp_error),
                                 atomic_read(&tgtp->xmt_fcp_rsp_drop));
 
                 len += snprintf(buf + len, size - len,
-                                "ABORT: Xmt %08x Err %08x Cmpl %08x",
+                                "ABORT: Xmt %08x Cmpl %08x\n",
+                                atomic_read(&tgtp->xmt_fcp_abort),
+                                atomic_read(&tgtp->xmt_fcp_abort_cmpl));
+
+                len += snprintf(buf + len, size - len,
+                                "ABORT: Sol %08x  Usol %08x Err %08x Cmpl %08x",
+                                atomic_read(&tgtp->xmt_abort_sol),
+                                atomic_read(&tgtp->xmt_abort_unsol),
                                 atomic_read(&tgtp->xmt_abort_rsp),
-                                atomic_read(&tgtp->xmt_abort_rsp_error),
-                                atomic_read(&tgtp->xmt_abort_cmpl));
+                                atomic_read(&tgtp->xmt_abort_rsp_error));
 
                 len +=  snprintf(buf + len, size - len, "\n");
 
@@ -841,6 +842,12 @@ lpfc_debugfs_nvmestat_data(struct lpfc_vport *vport, char *buf, int size)
                         }
                         spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 }
+
+                len += snprintf(buf + len, size - len,
+                                "IO_CTX: %08x  outstanding %08x total %08x\n",
+                                phba->sli4_hba.nvmet_ctx_cnt,
+                                phba->sli4_hba.nvmet_io_wait_cnt,
+                                phba->sli4_hba.nvmet_io_wait_total);
         } else {
                 if (!(phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME))
                         return len;
@@ -1959,6 +1966,7 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -1967,19 +1975,22 @@ lpfc_debugfs_nvmestat_write(struct file *file, const char __user *buf,
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
 
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return nbytes;
 }
@@ -3070,11 +3081,11 @@ __lpfc_idiag_print_wq(struct lpfc_queue *qp, char *wqtype,
                         qp->assoc_qid, qp->q_cnt_1,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\t\tWQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len,
                         LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
         return len;
@@ -3121,11 +3132,11 @@ __lpfc_idiag_print_cq(struct lpfc_queue *qp, char *cqtype,
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\tCQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "\tCQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count,
                         qp->entry_size, qp->host_index,
-                        qp->hba_index);
+                        qp->hba_index, qp->entry_repost);
 
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
@@ -3143,20 +3154,20 @@ __lpfc_idiag_print_rqpair(struct lpfc_queue *qp, struct lpfc_queue *datqp,
                         "\t\t%s RQ info: ", rqtype);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
                         "AssocCQID[%02d]: RQ-STAT[nopost:x%x nobuf:x%x "
-                        "trunc:x%x rcv:x%llx]\n",
+                        "posted:x%x rcv:x%llx]\n",
                         qp->assoc_qid, qp->q_cnt_1, qp->q_cnt_2,
                         qp->q_cnt_3, (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tHQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]\n",
+                        "\t\tDQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]\n",
                         datqp->queue_id, datqp->entry_count,
                         datqp->entry_size, datqp->host_index,
-                        datqp->hba_index);
+                        datqp->hba_index, datqp->entry_repost);
         return len;
 }
 
@@ -3242,10 +3253,10 @@ __lpfc_idiag_print_eq(struct lpfc_queue *qp, char *eqtype,
                         eqtype, qp->q_cnt_1, qp->q_cnt_2, qp->q_cnt_3,
                         (unsigned long long)qp->q_cnt_4);
         len += snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len,
-                        "EQID[%02d], QE-CNT[%04d], QE-SIZE[%04d], "
-                        "HOST-IDX[%04d], PORT-IDX[%04d]",
+                        "EQID[%02d], QE-CNT[%04d], QE-SZ[%04d], "
+                        "HST-IDX[%04d], PRT-IDX[%04d], PST[%03d]",
                         qp->queue_id, qp->entry_count, qp->entry_size,
-                        qp->host_index, qp->hba_index);
+                        qp->host_index, qp->hba_index, qp->entry_repost);
         len +=  snprintf(pbuffer + len, LPFC_QUE_INFO_GET_BUF_SIZE - len, "\n");
 
         return len;
@@ -5855,8 +5866,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport)
                         atomic_dec(&lpfc_debugfs_hba_count);
                 }
 
-                debugfs_remove(lpfc_debugfs_root); /* lpfc */
-                lpfc_debugfs_root = NULL;
+                if (atomic_read(&lpfc_debugfs_hba_count) == 0) {
+                        debugfs_remove(lpfc_debugfs_root); /* lpfc */
+                        lpfc_debugfs_root = NULL;
+                }
         }
 #endif
         return;
diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h
index 9d5a379f4b15..094c97b9e5f7 100644
--- a/drivers/scsi/lpfc/lpfc_disc.h
+++ b/drivers/scsi/lpfc/lpfc_disc.h
@@ -90,6 +90,7 @@ struct lpfc_nodelist {
 #define NLP_FCP_INITIATOR  0x10                 /* entry is an FCP Initiator */
 #define NLP_NVME_TARGET    0x20                 /* entry is a NVME Target */
 #define NLP_NVME_INITIATOR 0x40                 /* entry is a NVME Initiator */
+#define NLP_NVME_DISCOVERY 0x80                 /* entry has NVME disc srvc */
 
         uint16_t        nlp_fc4_type;           /* FC types node supports. */
                                                 /* Assigned from GID_FF, only
diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index 67827e397431..8e532b39ae93 100644
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -1047,6 +1047,13 @@ stop_rr_fcf_flogi:
                                  irsp->ulpStatus, irsp->un.ulpWord[4],
                                  irsp->ulpTimeout);
 
+
+                /* If this is not a loop open failure, bail out */
+                if (!(irsp->ulpStatus == IOSTAT_LOCAL_REJECT &&
+                      ((irsp->un.ulpWord[4] & IOERR_PARAM_MASK) ==
+                                        IOERR_LOOP_OPEN_FAILURE)))
+                        goto flogifail;
+
                 /* FLOGI failed, so there is no fabric */
                 spin_lock_irq(shost->host_lock);
                 vport->fc_flag &= ~(FC_FABRIC | FC_PUBLIC_LOOP);
@@ -2077,16 +2084,19 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
 
         if (irsp->ulpStatus) {
                 /* Check for retry */
+                ndlp->fc4_prli_sent--;
                 if (lpfc_els_retry(phba, cmdiocb, rspiocb)) {
                         /* ELS command is being retried */
-                        ndlp->fc4_prli_sent--;
                         goto out;
                 }
+
                 /* PRLI failed */
                 lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS,
-                                 "2754 PRLI failure DID:%06X Status:x%x/x%x\n",
+                                 "2754 PRLI failure DID:%06X Status:x%x/x%x, "
+                                 "data: x%x\n",
                                  ndlp->nlp_DID, irsp->ulpStatus,
-                                 irsp->un.ulpWord[4]);
+                                 irsp->un.ulpWord[4], ndlp->fc4_prli_sent);
+
                 /* Do not call DSM for lpfc_els_abort'ed ELS cmds */
                 if (lpfc_error_lost_link(irsp))
                         goto out;
@@ -7441,6 +7451,13 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)
          */
         spin_lock_irq(&phba->hbalock);
         pring = lpfc_phba_elsring(phba);
+
+        /* Bail out if we've no ELS wq, like in PCI error recovery case. */
+        if (unlikely(!pring)) {
+                spin_unlock_irq(&phba->hbalock);
+                return;
+        }
+
         if (phba->sli_rev == LPFC_SLI_REV4)
                 spin_lock(&pring->ring_lock);
 
@@ -8667,7 +8684,8 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
                 lpfc_do_scr_ns_plogi(phba, vport);
         goto out;
 fdisc_failed:
-        if (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS)
+        if (vport->fc_vport &&
+            (vport->fc_vport->vport_state != FC_VPORT_NO_FABRIC_RSCS))
                 lpfc_vport_set_state(vport, FC_VPORT_FAILED);
         /* Cancel discovery timer */
         lpfc_can_disctmo(vport);
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 0482c5580331..3ffcd9215ca8 100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -693,15 +693,16 @@ lpfc_work_done(struct lpfc_hba *phba)
         pring = lpfc_phba_elsring(phba);
         status = (ha_copy & (HA_RXMASK  << (4*LPFC_ELS_RING)));
         status >>= (4*LPFC_ELS_RING);
-        if ((status & HA_RXMASK) ||
-            (pring->flag & LPFC_DEFERRED_RING_EVENT) ||
-            (phba->hba_flag & HBA_SP_QUEUE_EVT)) {
+        if (pring && (status & HA_RXMASK ||
+                      pring->flag & LPFC_DEFERRED_RING_EVENT ||
+                      phba->hba_flag & HBA_SP_QUEUE_EVT)) {
                 if (pring->flag & LPFC_STOP_IOCB_EVENT) {
                         pring->flag |= LPFC_DEFERRED_RING_EVENT;
                         /* Set the lpfc data pending flag */
                         set_bit(LPFC_DATA_READY, &phba->data_flags);
                 } else {
-                        if (phba->link_state >= LPFC_LINK_UP) {
+                        if (phba->link_state >= LPFC_LINK_UP ||
+                            phba->link_flag & LS_MDS_LOOPBACK) {
                                 pring->flag &= ~LPFC_DEFERRED_RING_EVENT;
                                 lpfc_sli_handle_slow_ring_event(phba, pring,
                                                                 (status &
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index 1d12f2be36bc..e0a5fce416ae 100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
@@ -1356,6 +1356,7 @@ struct lpfc_mbx_wq_destroy {
 
 #define LPFC_HDR_BUF_SIZE 128
 #define LPFC_DATA_BUF_SIZE 2048
+#define LPFC_NVMET_DATA_BUF_SIZE 128
 struct rq_context {
         uint32_t word0;
 #define lpfc_rq_context_rqe_count_SHIFT 16      /* Version 0 Only */
@@ -4420,6 +4421,19 @@ struct fcp_treceive64_wqe {
 };
 #define TXRDY_PAYLOAD_LEN      12
 
+#define CMD_SEND_FRAME  0xE1
+
+struct send_frame_wqe {
+        struct ulp_bde64 bde;          /* words 0-2 */
+        uint32_t frame_len;            /* word 3 */
+        uint32_t fc_hdr_wd0;           /* word 4 */
+        uint32_t fc_hdr_wd1;           /* word 5 */
+        struct wqe_common wqe_com;     /* words 6-11 */
+        uint32_t fc_hdr_wd2;           /* word 12 */
+        uint32_t fc_hdr_wd3;           /* word 13 */
+        uint32_t fc_hdr_wd4;           /* word 14 */
+        uint32_t fc_hdr_wd5;           /* word 15 */
+};
 
 union lpfc_wqe {
         uint32_t words[16];
@@ -4438,7 +4452,7 @@ union lpfc_wqe {
         struct fcp_trsp64_wqe fcp_trsp;
         struct fcp_tsend64_wqe fcp_tsend;
         struct fcp_treceive64_wqe fcp_treceive;
-
+        struct send_frame_wqe send_frame;
 };
 
 union lpfc_wqe128 {
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 90ae354a9c45..9add9473cae5 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -1099,7 +1099,7 @@ lpfc_hba_down_post_s4(struct lpfc_hba *phba)
 
                 list_for_each_entry_safe(ctxp, ctxp_next, &nvmet_aborts, list) {
                         ctxp->flag &= ~(LPFC_NVMET_XBUSY | LPFC_NVMET_ABORT_OP);
-                        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
                 }
         }
 
@@ -3381,7 +3381,7 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
 {
         struct lpfc_sglq *sglq_entry = NULL, *sglq_entry_next = NULL;
         uint16_t i, lxri, xri_cnt, els_xri_cnt;
-        uint16_t nvmet_xri_cnt, tot_cnt;
+        uint16_t nvmet_xri_cnt;
         LIST_HEAD(nvmet_sgl_list);
         int rc;
 
@@ -3389,15 +3389,9 @@ lpfc_sli4_nvmet_sgl_update(struct lpfc_hba *phba)
          * update on pci function's nvmet xri-sgl list
          */
         els_xri_cnt = lpfc_sli4_get_els_iocb_cnt(phba);
-        nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-        tot_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
-        if (nvmet_xri_cnt > tot_cnt) {
-                phba->cfg_nvmet_mrq_post = tot_cnt / phba->cfg_nvmet_mrq;
-                nvmet_xri_cnt = phba->cfg_nvmet_mrq * phba->cfg_nvmet_mrq_post;
-                lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
-                                "6301 NVMET post-sgl count changed to %d\n",
-                                phba->cfg_nvmet_mrq_post);
-        }
+
+        /* For NVMET, ALL remaining XRIs are dedicated for IO processing */
+        nvmet_xri_cnt = phba->sli4_hba.max_cfg_param.max_xri - els_xri_cnt;
 
         if (nvmet_xri_cnt > phba->sli4_hba.nvmet_xri_cnt) {
                 /* els xri-sgl expanded */
@@ -3602,6 +3596,13 @@ lpfc_get_wwpn(struct lpfc_hba *phba)
         LPFC_MBOXQ_t *mboxq;
         MAILBOX_t *mb;
 
+        if (phba->sli_rev < LPFC_SLI_REV4) {
+                /* Reset the port first */
+                lpfc_sli_brdrestart(phba);
+                rc = lpfc_sli_chipset_init(phba);
+                if (rc)
+                        return (uint64_t)-1;
+        }
 
         mboxq = (LPFC_MBOXQ_t *) mempool_alloc(phba->mbox_mem_pool,
                                                 GFP_KERNEL);
@@ -4539,6 +4540,19 @@ lpfc_sli4_async_fc_evt(struct lpfc_hba *phba, struct lpfc_acqe_fc_la *acqe_fc)
         pmb->vport = phba->pport;
 
         if (phba->sli4_hba.link_state.status != LPFC_FC_LA_TYPE_LINK_UP) {
+                phba->link_flag &= ~(LS_MDS_LINK_DOWN | LS_MDS_LOOPBACK);
+
+                switch (phba->sli4_hba.link_state.status) {
+                case LPFC_FC_LA_TYPE_MDS_LINK_DOWN:
+                        phba->link_flag |= LS_MDS_LINK_DOWN;
+                        break;
+                case LPFC_FC_LA_TYPE_MDS_LOOPBACK:
+                        phba->link_flag |= LS_MDS_LOOPBACK;
+                        break;
+                default:
+                        break;
+                }
+
                 /* Parse and translate status field */
                 mb = &pmb->u.mb;
                 mb->mbxStatus = lpfc_sli4_parse_latt_fault(phba,
@@ -5823,6 +5837,9 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 spin_lock_init(&phba->sli4_hba.abts_nvme_buf_list_lock);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvme_buf_list);
                 INIT_LIST_HEAD(&phba->sli4_hba.lpfc_abts_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_ctx_list);
+                INIT_LIST_HEAD(&phba->sli4_hba.lpfc_nvmet_io_wait_list);
+
                 /* Fast-path XRI aborted CQ Event work queue list */
                 INIT_LIST_HEAD(&phba->sli4_hba.sp_nvme_xri_aborted_work_queue);
         }
@@ -5830,6 +5847,7 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
         /* This abort list used by worker thread */
         spin_lock_init(&phba->sli4_hba.sgl_list_lock);
         spin_lock_init(&phba->sli4_hba.nvmet_io_lock);
+        spin_lock_init(&phba->sli4_hba.nvmet_io_wait_lock);
 
         /*
          * Initialize driver internal slow-path work queues
@@ -5944,16 +5962,21 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba)
                 for (i = 0; i < lpfc_enable_nvmet_cnt; i++) {
                         if (wwn == lpfc_enable_nvmet[i]) {
 #if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+                                if (lpfc_nvmet_mem_alloc(phba))
+                                        break;
+
+                                phba->nvmet_support = 1; /* a match */
+
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6017 NVME Target %016llx\n",
                                                 wwn);
-                                phba->nvmet_support = 1; /* a match */
 #else
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "6021 Can't enable NVME Target."
                                                 " NVME_TARGET_FC infrastructure"
                                                 " is not in kernel\n");
 #endif
+                                break;
                         }
                 }
         }
@@ -6262,7 +6285,7 @@ lpfc_unset_driver_resource_phase2(struct lpfc_hba *phba)
  *
  * This routine is invoked to free the driver's IOCB list and memory.
  **/
-static void
+void
 lpfc_free_iocb_list(struct lpfc_hba *phba)
 {
         struct lpfc_iocbq *iocbq_entry = NULL, *iocbq_next = NULL;
@@ -6290,7 +6313,7 @@ lpfc_free_iocb_list(struct lpfc_hba *phba)
  *      0 - successful
  *      other values - error
  **/
-static int
+int
 lpfc_init_iocb_list(struct lpfc_hba *phba, int iocb_count)
 {
         struct lpfc_iocbq *iocbq_entry = NULL;
@@ -6518,7 +6541,6 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         uint16_t rpi_limit, curr_rpi_range;
         struct lpfc_dmabuf *dmabuf;
         struct lpfc_rpi_hdr *rpi_hdr;
-        uint32_t rpi_count;
 
         /*
          * If the SLI4 port supports extents, posting the rpi header isn't
@@ -6531,8 +6553,7 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
                 return NULL;
 
         /* The limit on the logical index is just the max_rpi count. */
-        rpi_limit = phba->sli4_hba.max_cfg_param.rpi_base +
-        phba->sli4_hba.max_cfg_param.max_rpi - 1;
+        rpi_limit = phba->sli4_hba.max_cfg_param.max_rpi;
 
         spin_lock_irq(&phba->hbalock);
         /*
@@ -6543,18 +6564,10 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
         curr_rpi_range = phba->sli4_hba.next_rpi;
         spin_unlock_irq(&phba->hbalock);
 
-        /*
-         * The port has a limited number of rpis. The increment here
-         * is LPFC_RPI_HDR_COUNT - 1 to account for the starting value
-         * and to allow the full max_rpi range per port.
-         */
-        if ((curr_rpi_range + (LPFC_RPI_HDR_COUNT - 1)) > rpi_limit)
-                rpi_count = rpi_limit - curr_rpi_range;
-        else
-                rpi_count = LPFC_RPI_HDR_COUNT;
-
-        if (!rpi_count)
+        /* Reached full RPI range */
+        if (curr_rpi_range == rpi_limit)
                 return NULL;
+
         /*
          * First allocate the protocol header region for the port.  The
          * port expects a 4KB DMA-mapped memory region that is 4K aligned.
@@ -6588,13 +6601,9 @@ lpfc_sli4_create_rpi_hdr(struct lpfc_hba *phba)
 
         /* The rpi_hdr stores the logical index only. */
         rpi_hdr->start_rpi = curr_rpi_range;
+        rpi_hdr->next_rpi = phba->sli4_hba.next_rpi + LPFC_RPI_HDR_COUNT;
         list_add_tail(&rpi_hdr->list, &phba->sli4_hba.lpfc_rpi_hdr_list);
 
-        /*
-         * The next_rpi stores the next logical module-64 rpi value used
-         * to post physical rpis in subsequent rpi postings.
-         */
-        phba->sli4_hba.next_rpi += rpi_count;
         spin_unlock_irq(&phba->hbalock);
         return rpi_hdr;
 
@@ -8165,7 +8174,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for header */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3146 Failed allocate "
@@ -8187,7 +8196,7 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
                         /* Create NVMET Receive Queue for data */
                         qdesc = lpfc_sli4_queue_alloc(phba,
                                                       phba->sli4_hba.rq_esize,
-                                                      phba->sli4_hba.rq_ecount);
+                                                      LPFC_NVMET_RQE_DEF_COUNT);
                         if (!qdesc) {
                                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                                 "3156 Failed allocate "
@@ -8319,46 +8328,6 @@ lpfc_sli4_queue_destroy(struct lpfc_hba *phba)
 }
 
 int
-lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
-                    struct lpfc_queue *drq, int count)
-{
-        int rc, i;
-        struct lpfc_rqe hrqe;
-        struct lpfc_rqe drqe;
-        struct lpfc_rqb *rqbp;
-        struct rqb_dmabuf *rqb_buffer;
-        LIST_HEAD(rqb_buf_list);
-
-        rqbp = hrq->rqbp;
-        for (i = 0; i < count; i++) {
-                rqb_buffer = (rqbp->rqb_alloc_buffer)(phba);
-                if (!rqb_buffer)
-                        break;
-                rqb_buffer->hrq = hrq;
-                rqb_buffer->drq = drq;
-                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
-        }
-        while (!list_empty(&rqb_buf_list)) {
-                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
-                                 hbuf.list);
-
-                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
-                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
-                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
-                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
-                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
-                if (rc < 0) {
-                        (rqbp->rqb_free_buffer)(phba, rqb_buffer);
-                } else {
-                        list_add_tail(&rqb_buffer->hbuf.list,
-                                      &rqbp->rqb_buffer_list);
-                        rqbp->buffer_count++;
-                }
-        }
-        return 1;
-}
-
-int
 lpfc_free_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *rq)
 {
         struct lpfc_rqb *rqbp;
@@ -8777,9 +8746,6 @@ lpfc_sli4_queue_setup(struct lpfc_hba *phba)
                 goto out_destroy;
         }
 
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.hdr_rq, LPFC_ELS_HBQ);
-        lpfc_rq_adjust_repost(phba, phba->sli4_hba.dat_rq, LPFC_ELS_HBQ);
-
         rc = lpfc_rq_create(phba, phba->sli4_hba.hdr_rq, phba->sli4_hba.dat_rq,
                             phba->sli4_hba.els_cq, LPFC_USOL);
         if (rc) {
@@ -8847,7 +8813,7 @@ lpfc_sli4_queue_unset(struct lpfc_hba *phba)
                 lpfc_wq_destroy(phba, phba->sli4_hba.nvmels_wq);
 
         /* Unset ELS work queue */
-        if (phba->sli4_hba.els_cq)
+        if (phba->sli4_hba.els_wq)
                 lpfc_wq_destroy(phba, phba->sli4_hba.els_wq);
 
         /* Unset unsolicited receive queue */
@@ -11103,7 +11069,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         struct lpfc_hba   *phba;
         struct lpfc_vport *vport = NULL;
         struct Scsi_Host  *shost = NULL;
-        int error, cnt;
+        int error;
         uint32_t cfg_mode, intr_mode;
 
         /* Allocate memory for HBA structure */
@@ -11137,22 +11103,6 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
                 goto out_unset_pci_mem_s4;
         }
 
-        cnt = phba->cfg_iocb_cnt * 1024;
-        if (phba->nvmet_support)
-                cnt += phba->cfg_nvmet_mrq_post * phba->cfg_nvmet_mrq;
-
-        /* Initialize and populate the iocb list per host */
-        lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
-                        "2821 initialize iocb list %d total %d\n",
-                        phba->cfg_iocb_cnt, cnt);
-        error = lpfc_init_iocb_list(phba, cnt);
-
-        if (error) {
-                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
-                                "1413 Failed to initialize iocb list.\n");
-                goto out_unset_driver_resource_s4;
-        }
-
         INIT_LIST_HEAD(&phba->active_rrq_list);
         INIT_LIST_HEAD(&phba->fcf.fcf_pri_list);
 
@@ -11161,7 +11111,7 @@ lpfc_pci_probe_one_s4(struct pci_dev *pdev, const struct pci_device_id *pid)
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
                                 "1414 Failed to set up driver resource.\n");
-                goto out_free_iocb_list;
+                goto out_unset_driver_resource_s4;
         }
 
         /* Get the default values for Model Name and Description */
@@ -11261,8 +11211,6 @@ out_destroy_shost:
         lpfc_destroy_shost(phba);
 out_unset_driver_resource:
         lpfc_unset_driver_resource_phase2(phba);
-out_free_iocb_list:
-        lpfc_free_iocb_list(phba);
 out_unset_driver_resource_s4:
         lpfc_sli4_driver_resource_unset(phba);
 out_unset_pci_mem_s4:
diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
index 5986c7957199..fcc05a1517c2 100644
--- a/drivers/scsi/lpfc/lpfc_mem.c
+++ b/drivers/scsi/lpfc/lpfc_mem.c
@@ -214,6 +214,21 @@ fail_free_drb_pool:
         return -ENOMEM;
 }
 
+int
+lpfc_nvmet_mem_alloc(struct lpfc_hba *phba)
+{
+        phba->lpfc_nvmet_drb_pool =
+                pci_pool_create("lpfc_nvmet_drb_pool",
+                                phba->pcidev, LPFC_NVMET_DATA_BUF_SIZE,
+                                SGL_ALIGN_SZ, 0);
+        if (!phba->lpfc_nvmet_drb_pool) {
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6024 Can't enable NVME Target - no memory\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+
 /**
  * lpfc_mem_free - Frees memory allocated by lpfc_mem_alloc
  * @phba: HBA to free memory for
@@ -232,6 +247,9 @@ lpfc_mem_free(struct lpfc_hba *phba)
 
         /* Free HBQ pools */
         lpfc_sli_hbqbuf_free_all(phba);
+        if (phba->lpfc_nvmet_drb_pool)
+                pci_pool_destroy(phba->lpfc_nvmet_drb_pool);
+        phba->lpfc_nvmet_drb_pool = NULL;
         if (phba->lpfc_drb_pool)
                 pci_pool_destroy(phba->lpfc_drb_pool);
         phba->lpfc_drb_pool = NULL;
@@ -611,8 +629,6 @@ struct rqb_dmabuf *
 lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 {
         struct rqb_dmabuf *dma_buf;
-        struct lpfc_iocbq *nvmewqe;
-        union lpfc_wqe128 *wqe;
 
         dma_buf = kzalloc(sizeof(struct rqb_dmabuf), GFP_KERNEL);
         if (!dma_buf)
@@ -624,69 +640,15 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
-                                            &dma_buf->dbuf.phys);
+        dma_buf->dbuf.virt = pci_pool_alloc(phba->lpfc_nvmet_drb_pool,
+                                            GFP_KERNEL, &dma_buf->dbuf.phys);
         if (!dma_buf->dbuf.virt) {
                 pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
                               dma_buf->hbuf.phys);
                 kfree(dma_buf);
                 return NULL;
         }
-        dma_buf->total_size = LPFC_DATA_BUF_SIZE;
-
-        dma_buf->context = kzalloc(sizeof(struct lpfc_nvmet_rcv_ctx),
-                                   GFP_KERNEL);
-        if (!dma_buf->context) {
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                return NULL;
-        }
-
-        dma_buf->iocbq = lpfc_sli_get_iocbq(phba);
-        if (!dma_buf->iocbq) {
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "2621 Ran out of nvmet iocb/WQEs\n");
-                return NULL;
-        }
-        dma_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
-        nvmewqe = dma_buf->iocbq;
-        wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
-        /* Initialize WQE */
-        memset(wqe, 0, sizeof(union lpfc_wqe));
-        /* Word 7 */
-        bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
-        bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
-        bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
-        /* Word 10 */
-        bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
-        bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
-        bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
-
-        dma_buf->iocbq->context1 = NULL;
-        spin_lock(&phba->sli4_hba.sgl_list_lock);
-        dma_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, dma_buf->iocbq);
-        spin_unlock(&phba->sli4_hba.sgl_list_lock);
-        if (!dma_buf->sglq) {
-                lpfc_sli_release_iocbq(phba, dma_buf->iocbq);
-                kfree(dma_buf->context);
-                pci_pool_free(phba->lpfc_drb_pool, dma_buf->dbuf.virt,
-                              dma_buf->dbuf.phys);
-                pci_pool_free(phba->lpfc_hrb_pool, dma_buf->hbuf.virt,
-                              dma_buf->hbuf.phys);
-                kfree(dma_buf);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
-                                "6132 Ran out of nvmet XRIs\n");
-                return NULL;
-        }
+        dma_buf->total_size = LPFC_NVMET_DATA_BUF_SIZE;
         return dma_buf;
 }
 
@@ -705,20 +667,9 @@ lpfc_sli4_nvmet_alloc(struct lpfc_hba *phba)
 void
 lpfc_sli4_nvmet_free(struct lpfc_hba *phba, struct rqb_dmabuf *dmab)
 {
-        unsigned long flags;
-
-        __lpfc_clear_active_sglq(phba, dmab->sglq->sli4_lxritag);
-        dmab->sglq->state = SGL_FREED;
-        dmab->sglq->ndlp = NULL;
-
-        spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
-        list_add_tail(&dmab->sglq->list, &phba->sli4_hba.lpfc_nvmet_sgl_list);
-        spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock, flags);
-
-        lpfc_sli_release_iocbq(phba, dmab->iocbq);
-        kfree(dmab->context);
         pci_pool_free(phba->lpfc_hrb_pool, dmab->hbuf.virt, dmab->hbuf.phys);
-        pci_pool_free(phba->lpfc_drb_pool, dmab->dbuf.virt, dmab->dbuf.phys);
+        pci_pool_free(phba->lpfc_nvmet_drb_pool,
+                      dmab->dbuf.virt, dmab->dbuf.phys);
         kfree(dmab);
 }
 
@@ -803,6 +754,11 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
         rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
         if (rc < 0) {
                 (rqbp->rqb_free_buffer)(phba, rqb_entry);
+                lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                "6409 Cannot post to RQ %d: %x %x\n",
+                                rqb_entry->hrq->queue_id,
+                                rqb_entry->hrq->host_index,
+                                rqb_entry->hrq->hba_index);
         } else {
                 list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
                 rqbp->buffer_count++;
diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index 8777c2d5f50d..bff3de053df4 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1944,7 +1944,13 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp,
 
                 /* Target driver cannot solicit NVME FB. */
                 if (bf_get_be32(prli_tgt, nvpr)) {
+                        /* Complete the nvme target roles.  The transport
+                         * needs to know if the rport is capable of
+                         * discovery in addition to its role.
+                         */
                         ndlp->nlp_type |= NLP_NVME_TARGET;
+                        if (bf_get_be32(prli_disc, nvpr))
+                                ndlp->nlp_type |= NLP_NVME_DISCOVERY;
                         if ((bf_get_be32(prli_fba, nvpr) == 1) &&
                             (bf_get_be32(prli_fb_sz, nvpr) > 0) &&
                             (phba->cfg_nvme_enable_fb) &&
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 94434e621c33..074a6b5e7763 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -142,7 +142,7 @@ out:
 }
 
 /**
- * lpfc_nvmet_rq_post - Repost a NVMET RQ DMA buffer and clean up context
+ * lpfc_nvmet_ctxbuf_post - Repost a NVMET RQ DMA buffer and clean up context
  * @phba: HBA buffer is associated with
  * @ctxp: context to clean up
  * @mp: Buffer to free
@@ -155,24 +155,113 @@ out:
  * Returns: None
  **/
 void
-lpfc_nvmet_rq_post(struct lpfc_hba *phba, struct lpfc_nvmet_rcv_ctx *ctxp,
-                   struct lpfc_dmabuf *mp)
+lpfc_nvmet_ctxbuf_post(struct lpfc_hba *phba, struct lpfc_nvmet_ctxbuf *ctx_buf)
 {
-        if (ctxp) {
-                if (ctxp->flag)
-                        lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
-                                "6314 rq_post ctx xri x%x flag x%x\n",
-                                ctxp->oxid, ctxp->flag);
-
-                if (ctxp->txrdy) {
-                        pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
-                                      ctxp->txrdy_phys);
-                        ctxp->txrdy = NULL;
-                        ctxp->txrdy_phys = 0;
+#if (IS_ENABLED(CONFIG_NVME_TARGET_FC))
+        struct lpfc_nvmet_rcv_ctx *ctxp = ctx_buf->context;
+        struct lpfc_nvmet_tgtport *tgtp;
+        struct fc_frame_header *fc_hdr;
+        struct rqb_dmabuf *nvmebuf;
+        struct lpfc_dmabuf *hbufp;
+        uint32_t *payload;
+        uint32_t size, oxid, sid, rc;
+        unsigned long iflag;
+
+        if (ctxp->txrdy) {
+                pci_pool_free(phba->txrdy_payload_pool, ctxp->txrdy,
+                              ctxp->txrdy_phys);
+                ctxp->txrdy = NULL;
+                ctxp->txrdy_phys = 0;
+        }
+        ctxp->state = LPFC_NVMET_STE_FREE;
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+        if (phba->sli4_hba.nvmet_io_wait_cnt) {
+                hbufp = &nvmebuf->hbuf;
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_io_wait_list,
+                                 nvmebuf, struct rqb_dmabuf,
+                                 hbuf.list);
+                phba->sli4_hba.nvmet_io_wait_cnt--;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
+                oxid = be16_to_cpu(fc_hdr->fh_ox_id);
+                tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+                payload = (uint32_t *)(nvmebuf->dbuf.virt);
+                size = nvmebuf->bytes_recv;
+                sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+                ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
+                memset(ctxp, 0, sizeof(ctxp->ctx));
+                ctxp->wqeq = NULL;
+                ctxp->txrdy = NULL;
+                ctxp->offset = 0;
+                ctxp->phba = phba;
+                ctxp->size = size;
+                ctxp->oxid = oxid;
+                ctxp->sid = sid;
+                ctxp->state = LPFC_NVMET_STE_RCV;
+                ctxp->entry_cnt = 1;
+                ctxp->flag = 0;
+                ctxp->ctxbuf = ctx_buf;
+                spin_lock_init(&ctxp->ctxlock);
+
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+                if (phba->ktime_on) {
+                        ctxp->ts_cmd_nvme = ktime_get_ns();
+                        ctxp->ts_isr_cmd = ctxp->ts_cmd_nvme;
+                        ctxp->ts_nvme_data = 0;
+                        ctxp->ts_data_wqput = 0;
+                        ctxp->ts_isr_data = 0;
+                        ctxp->ts_data_nvme = 0;
+                        ctxp->ts_nvme_status = 0;
+                        ctxp->ts_status_wqput = 0;
+                        ctxp->ts_isr_status = 0;
+                        ctxp->ts_status_nvme = 0;
                 }
-                ctxp->state = LPFC_NVMET_STE_FREE;
+#endif
+                atomic_inc(&tgtp->rcv_fcp_cmd_in);
+                /*
+                 * The calling sequence should be:
+                 * nvmet_fc_rcv_fcp_req->lpfc_nvmet_xmt_fcp_op/cmp- req->done
+                 * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+                 * When we return from nvmet_fc_rcv_fcp_req, all relevant info
+                 * the NVME command / FC header is stored.
+                 * A buffer has already been reposted for this IO, so just free
+                 * the nvmebuf.
+                 */
+                rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
+                                          payload, size);
+
+                /* Process FCP command */
+                if (rc == 0) {
+                        atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                        nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                        return;
+                }
+
+                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
+                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
+                                "2582 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                                ctxp->oxid, rc,
+                                atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                atomic_read(&tgtp->xmt_fcp_release));
+
+                lpfc_nvmet_defer_release(phba, ctxp);
+                lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                nvmebuf->hrq->rqbp->rqb_free_buffer(phba, nvmebuf);
+                return;
         }
-        lpfc_rq_buf_free(phba, mp);
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        list_add_tail(&ctx_buf->list,
+                      &phba->sli4_hba.lpfc_nvmet_ctx_list);
+        phba->sli4_hba.nvmet_ctx_cnt++;
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
+#endif
 }
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -502,6 +591,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
                                 "6150 LS Drop IO x%x: Prep\n",
                                 ctxp->oxid);
                 lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+                atomic_inc(&nvmep->xmt_ls_abort);
                 lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp,
                                                 ctxp->sid, ctxp->oxid);
                 return -ENOMEM;
@@ -545,6 +635,7 @@ lpfc_nvmet_xmt_ls_rsp(struct nvmet_fc_target_port *tgtport,
         lpfc_nlp_put(nvmewqeq->context1);
 
         lpfc_in_buf_free(phba, &nvmebuf->dbuf);
+        atomic_inc(&nvmep->xmt_ls_abort);
         lpfc_nvmet_unsol_ls_issue_abort(phba, ctxp, ctxp->sid, ctxp->oxid);
         return -ENXIO;
 }
@@ -612,9 +703,9 @@ lpfc_nvmet_xmt_fcp_op(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmeio_data(phba, "NVMET FCP CMND: xri x%x op x%x len x%x\n",
                          ctxp->oxid, rsp->op, rsp->rsplen);
 
+        ctxp->flag |= LPFC_NVMET_IO_INP;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, nvmewqeq);
         if (rc == WQE_SUCCESS) {
-                ctxp->flag |= LPFC_NVMET_IO_INP;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
                 if (!phba->ktime_on)
                         return 0;
@@ -692,6 +783,7 @@ static void
 lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
                            struct nvmefc_tgt_fcp_req *rsp)
 {
+        struct lpfc_nvmet_tgtport *lpfc_nvmep = tgtport->private;
         struct lpfc_nvmet_rcv_ctx *ctxp =
                 container_of(rsp, struct lpfc_nvmet_rcv_ctx, ctx.fcp_req);
         struct lpfc_hba *phba = ctxp->phba;
@@ -710,10 +802,12 @@ lpfc_nvmet_xmt_fcp_release(struct nvmet_fc_target_port *tgtport,
         lpfc_nvmeio_data(phba, "NVMET FCP FREE: xri x%x ste %d\n", ctxp->oxid,
                          ctxp->state, 0);
 
+        atomic_inc(&lpfc_nvmep->xmt_fcp_release);
+
         if (aborting)
                 return;
 
-        lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 }
 
 static struct nvmet_fc_target_template lpfc_tgttemplate = {
@@ -734,17 +828,128 @@ static struct nvmet_fc_target_template lpfc_tgttemplate = {
         .target_priv_sz = sizeof(struct lpfc_nvmet_tgtport),
 };
 
+void
+lpfc_nvmet_cleanup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf, *next_ctx_buf;
+        unsigned long flags;
+
+        list_for_each_entry_safe(
+                ctx_buf, next_ctx_buf,
+                &phba->sli4_hba.lpfc_nvmet_ctx_list, list) {
+                spin_lock_irqsave(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                list_del_init(&ctx_buf->list);
+                spin_unlock_irqrestore(
+                        &phba->sli4_hba.abts_nvme_buf_list_lock, flags);
+                __lpfc_clear_active_sglq(phba,
+                                         ctx_buf->sglq->sli4_lxritag);
+                ctx_buf->sglq->state = SGL_FREED;
+                ctx_buf->sglq->ndlp = NULL;
+
+                spin_lock_irqsave(&phba->sli4_hba.sgl_list_lock, flags);
+                list_add_tail(&ctx_buf->sglq->list,
+                              &phba->sli4_hba.lpfc_nvmet_sgl_list);
+                spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock,
+                                       flags);
+
+                lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                kfree(ctx_buf->context);
+        }
+}
+
+int
+lpfc_nvmet_setup_io_context(struct lpfc_hba *phba)
+{
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
+        struct lpfc_iocbq *nvmewqe;
+        union lpfc_wqe128 *wqe;
+        int i;
+
+        lpfc_printf_log(phba, KERN_INFO, LOG_NVME,
+                        "6403 Allocate NVMET resources for %d XRIs\n",
+                        phba->sli4_hba.nvmet_xri_cnt);
+
+        /* For all nvmet xris, allocate resources needed to process a
+         * received command on a per xri basis.
+         */
+        for (i = 0; i < phba->sli4_hba.nvmet_xri_cnt; i++) {
+                ctx_buf = kzalloc(sizeof(*ctx_buf), GFP_KERNEL);
+                if (!ctx_buf) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6404 Ran out of memory for NVMET\n");
+                        return -ENOMEM;
+                }
+
+                ctx_buf->context = kzalloc(sizeof(*ctx_buf->context),
+                                           GFP_KERNEL);
+                if (!ctx_buf->context) {
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6405 Ran out of NVMET "
+                                        "context memory\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->context->ctxbuf = ctx_buf;
+
+                ctx_buf->iocbq = lpfc_sli_get_iocbq(phba);
+                if (!ctx_buf->iocbq) {
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6406 Ran out of NVMET iocb/WQEs\n");
+                        return -ENOMEM;
+                }
+                ctx_buf->iocbq->iocb_flag = LPFC_IO_NVMET;
+                nvmewqe = ctx_buf->iocbq;
+                wqe = (union lpfc_wqe128 *)&nvmewqe->wqe;
+                /* Initialize WQE */
+                memset(wqe, 0, sizeof(union lpfc_wqe));
+                /* Word 7 */
+                bf_set(wqe_ct, &wqe->generic.wqe_com, SLI4_CT_RPI);
+                bf_set(wqe_class, &wqe->generic.wqe_com, CLASS3);
+                bf_set(wqe_pu, &wqe->generic.wqe_com, 1);
+                /* Word 10 */
+                bf_set(wqe_nvme, &wqe->fcp_tsend.wqe_com, 1);
+                bf_set(wqe_ebde_cnt, &wqe->generic.wqe_com, 0);
+                bf_set(wqe_qosd, &wqe->generic.wqe_com, 0);
+
+                ctx_buf->iocbq->context1 = NULL;
+                spin_lock(&phba->sli4_hba.sgl_list_lock);
+                ctx_buf->sglq = __lpfc_sli_get_nvmet_sglq(phba, ctx_buf->iocbq);
+                spin_unlock(&phba->sli4_hba.sgl_list_lock);
+                if (!ctx_buf->sglq) {
+                        lpfc_sli_release_iocbq(phba, ctx_buf->iocbq);
+                        kfree(ctx_buf->context);
+                        kfree(ctx_buf);
+                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
+                                        "6407 Ran out of NVMET XRIs\n");
+                        return -ENOMEM;
+                }
+                spin_lock(&phba->sli4_hba.nvmet_io_lock);
+                list_add_tail(&ctx_buf->list,
+                              &phba->sli4_hba.lpfc_nvmet_ctx_list);
+                spin_unlock(&phba->sli4_hba.nvmet_io_lock);
+        }
+        phba->sli4_hba.nvmet_ctx_cnt = phba->sli4_hba.nvmet_xri_cnt;
+        return 0;
+}
+
 int
 lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
 {
         struct lpfc_vport  *vport = phba->pport;
         struct lpfc_nvmet_tgtport *tgtp;
         struct nvmet_fc_port_info pinfo;
-        int error = 0;
+        int error;
 
         if (phba->targetport)
                 return 0;
 
+        error = lpfc_nvmet_setup_io_context(phba);
+        if (error)
+                return error;
+
         memset(&pinfo, 0, sizeof(struct nvmet_fc_port_info));
         pinfo.node_name = wwn_to_u64(vport->fc_nodename.u.wwn);
         pinfo.port_name = wwn_to_u64(vport->fc_portname.u.wwn);
@@ -764,7 +969,6 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
         lpfc_tgttemplate.max_sgl_segments = phba->cfg_nvme_seg_cnt + 1;
         lpfc_tgttemplate.max_hw_queues = phba->cfg_nvme_io_channel;
         lpfc_tgttemplate.target_features = NVMET_FCTGTFEAT_READDATA_RSP |
-                                           NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED |
                                            NVMET_FCTGTFEAT_CMD_IN_ISR |
                                            NVMET_FCTGTFEAT_OPDONE_IN_ISR;
 
@@ -773,13 +977,16 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                                              &phba->pcidev->dev,
                                              &phba->targetport);
 #else
-        error = -ENOMEM;
+        error = -ENOENT;
 #endif
         if (error) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_DISC,
                                 "6025 Cannot register NVME targetport "
                                 "x%x\n", error);
                 phba->targetport = NULL;
+
+                lpfc_nvmet_cleanup_io_context(phba);
+
         } else {
                 tgtp = (struct lpfc_nvmet_tgtport *)
                         phba->targetport->private;
@@ -796,6 +1003,7 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_ls_req_out, 0);
                 atomic_set(&tgtp->rcv_ls_req_drop, 0);
                 atomic_set(&tgtp->xmt_ls_abort, 0);
+                atomic_set(&tgtp->xmt_ls_abort_cmpl, 0);
                 atomic_set(&tgtp->xmt_ls_rsp, 0);
                 atomic_set(&tgtp->xmt_ls_drop, 0);
                 atomic_set(&tgtp->xmt_ls_rsp_error, 0);
@@ -803,18 +1011,21 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
                 atomic_set(&tgtp->rcv_fcp_cmd_in, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_out, 0);
                 atomic_set(&tgtp->rcv_fcp_cmd_drop, 0);
-                atomic_set(&tgtp->xmt_fcp_abort, 0);
                 atomic_set(&tgtp->xmt_fcp_drop, 0);
                 atomic_set(&tgtp->xmt_fcp_read_rsp, 0);
                 atomic_set(&tgtp->xmt_fcp_read, 0);
                 atomic_set(&tgtp->xmt_fcp_write, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp, 0);
+                atomic_set(&tgtp->xmt_fcp_release, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_cmpl, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_error, 0);
                 atomic_set(&tgtp->xmt_fcp_rsp_drop, 0);
+                atomic_set(&tgtp->xmt_fcp_abort, 0);
+                atomic_set(&tgtp->xmt_fcp_abort_cmpl, 0);
+                atomic_set(&tgtp->xmt_abort_unsol, 0);
+                atomic_set(&tgtp->xmt_abort_sol, 0);
                 atomic_set(&tgtp->xmt_abort_rsp, 0);
                 atomic_set(&tgtp->xmt_abort_rsp_error, 0);
-                atomic_set(&tgtp->xmt_abort_cmpl, 0);
         }
         return error;
 }
@@ -865,7 +1076,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 /* Check if we already received a free context call
@@ -886,7 +1097,7 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                     (ndlp->nlp_state == NLP_STE_UNMAPPED_NODE ||
                      ndlp->nlp_state == NLP_STE_MAPPED_NODE)) {
                         lpfc_set_rrq_active(phba, ndlp,
-                                ctxp->rqb_buffer->sglq->sli4_lxritag,
+                                ctxp->ctxbuf->sglq->sli4_lxritag,
                                 rxid, 1);
                         lpfc_sli4_abts_err_handler(phba, ndlp, axri);
                 }
@@ -895,8 +1106,8 @@ lpfc_sli4_nvmet_xri_aborted(struct lpfc_hba *phba,
                                 "6318 XB aborted %x flg x%x (%x)\n",
                                 ctxp->oxid, ctxp->flag, released);
                 if (released)
-                        lpfc_nvmet_rq_post(phba, ctxp,
-                                           &ctxp->rqb_buffer->hbuf);
+                        lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
+
                 if (rrq_empty)
                         lpfc_worker_wake_up(phba);
                 return;
@@ -924,7 +1135,7 @@ lpfc_nvmet_rcv_unsol_abort(struct lpfc_vport *vport,
         list_for_each_entry_safe(ctxp, next_ctxp,
                                  &phba->sli4_hba.lpfc_abts_nvmet_ctx_list,
                                  list) {
-                if (ctxp->rqb_buffer->sglq->sli4_xritag != xri)
+                if (ctxp->ctxbuf->sglq->sli4_xritag != xri)
                         continue;
 
                 spin_unlock(&phba->sli4_hba.abts_nvme_buf_list_lock);
@@ -976,6 +1187,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                 init_completion(&tgtp->tport_unreg_done);
                 nvmet_fc_unregister_targetport(phba->targetport);
                 wait_for_completion_timeout(&tgtp->tport_unreg_done, 5);
+                lpfc_nvmet_cleanup_io_context(phba);
         }
         phba->targetport = NULL;
 #endif
@@ -1011,6 +1223,7 @@ lpfc_nvmet_unsol_ls_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
@@ -1105,39 +1318,71 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         struct lpfc_nvmet_rcv_ctx *ctxp;
         struct lpfc_nvmet_tgtport *tgtp;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_ctxbuf *ctx_buf;
         uint32_t *payload;
-        uint32_t size, oxid, sid, rc;
+        uint32_t size, oxid, sid, rc, qno;
+        unsigned long iflag;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint32_t id;
 #endif
 
+        ctx_buf = NULL;
         if (!nvmebuf || !phba->targetport) {
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6157 FCP Drop IO\n");
+                                "6157 NVMET FCP Drop IO\n");
                 oxid = 0;
                 size = 0;
                 sid = 0;
+                ctxp = NULL;
                 goto dropit;
         }
 
+        spin_lock_irqsave(&phba->sli4_hba.nvmet_io_lock, iflag);
+        if (phba->sli4_hba.nvmet_ctx_cnt) {
+                list_remove_head(&phba->sli4_hba.lpfc_nvmet_ctx_list,
+                                 ctx_buf, struct lpfc_nvmet_ctxbuf, list);
+                phba->sli4_hba.nvmet_ctx_cnt--;
+        }
+        spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_lock, iflag);
 
-        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        payload = (uint32_t *)(nvmebuf->dbuf.virt);
         fc_hdr = (struct fc_frame_header *)(nvmebuf->hbuf.virt);
-        size = nvmebuf->bytes_recv;
         oxid = be16_to_cpu(fc_hdr->fh_ox_id);
-        sid = sli4_sid_from_fc_hdr(fc_hdr);
+        size = nvmebuf->bytes_recv;
 
-        ctxp = (struct lpfc_nvmet_rcv_ctx *)nvmebuf->context;
-        if (ctxp == NULL) {
-                atomic_inc(&tgtp->rcv_fcp_cmd_drop);
-                lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                                "6158 FCP Drop IO x%x: Alloc\n",
-                                oxid);
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-                /* Cannot send ABTS without context */
+#ifdef CONFIG_SCSI_LPFC_DEBUG_FS
+        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
+                id = smp_processor_id();
+                if (id < LPFC_CHECK_CPU_CNT)
+                        phba->cpucheck_rcv_io[id]++;
+        }
+#endif
+
+        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
+                         oxid, size, smp_processor_id());
+
+        if (!ctx_buf) {
+                /* Queue this NVME IO to process later */
+                spin_lock_irqsave(&phba->sli4_hba.nvmet_io_wait_lock, iflag);
+                list_add_tail(&nvmebuf->hbuf.list,
+                              &phba->sli4_hba.lpfc_nvmet_io_wait_list);
+                phba->sli4_hba.nvmet_io_wait_cnt++;
+                phba->sli4_hba.nvmet_io_wait_total++;
+                spin_unlock_irqrestore(&phba->sli4_hba.nvmet_io_wait_lock,
+                                       iflag);
+
+                /* Post a brand new DMA buffer to RQ */
+                qno = nvmebuf->idx;
+                lpfc_post_rq_buffer(
+                        phba, phba->sli4_hba.nvmet_mrq_hdr[qno],
+                        phba->sli4_hba.nvmet_mrq_data[qno], 1, qno);
                 return;
         }
+
+        tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
+        payload = (uint32_t *)(nvmebuf->dbuf.virt);
+        sid = sli4_sid_from_fc_hdr(fc_hdr);
+
+        ctxp = (struct lpfc_nvmet_rcv_ctx *)ctx_buf->context;
         memset(ctxp, 0, sizeof(ctxp->ctx));
         ctxp->wqeq = NULL;
         ctxp->txrdy = NULL;
@@ -1147,9 +1392,9 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         ctxp->oxid = oxid;
         ctxp->sid = sid;
         ctxp->state = LPFC_NVMET_STE_RCV;
-        ctxp->rqb_buffer = nvmebuf;
         ctxp->entry_cnt = 1;
         ctxp->flag = 0;
+        ctxp->ctxbuf = ctx_buf;
         spin_lock_init(&ctxp->ctxlock);
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
@@ -1165,22 +1410,16 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
                 ctxp->ts_isr_status = 0;
                 ctxp->ts_status_nvme = 0;
         }
-
-        if (phba->cpucheck_on & LPFC_CHECK_NVMET_RCV) {
-                id = smp_processor_id();
-                if (id < LPFC_CHECK_CPU_CNT)
-                        phba->cpucheck_rcv_io[id]++;
-        }
 #endif
 
-        lpfc_nvmeio_data(phba, "NVMET FCP  RCV: xri x%x sz %d CPU %02x\n",
-                         oxid, size, smp_processor_id());
-
         atomic_inc(&tgtp->rcv_fcp_cmd_in);
         /*
          * The calling sequence should be:
          * nvmet_fc_rcv_fcp_req -> lpfc_nvmet_xmt_fcp_op/cmp -> req->done
          * lpfc_nvmet_xmt_fcp_op_cmp should free the allocated ctxp.
+         * When we return from nvmet_fc_rcv_fcp_req, all relevant info in
+         * the NVME command / FC header is stored, so we are free to repost
+         * the buffer.
          */
         rc = nvmet_fc_rcv_fcp_req(phba->targetport, &ctxp->ctx.fcp_req,
                                   payload, size);
@@ -1188,26 +1427,32 @@ lpfc_nvmet_unsol_fcp_buffer(struct lpfc_hba *phba,
         /* Process FCP command */
         if (rc == 0) {
                 atomic_inc(&tgtp->rcv_fcp_cmd_out);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
         atomic_inc(&tgtp->rcv_fcp_cmd_drop);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
-                        "6159 FCP Drop IO x%x: err x%x\n",
-                        ctxp->oxid, rc);
+                        "6159 FCP Drop IO x%x: err x%x: x%x x%x x%x\n",
+                        ctxp->oxid, rc,
+                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                        atomic_read(&tgtp->xmt_fcp_release));
 dropit:
         lpfc_nvmeio_data(phba, "NVMET FCP DROP: xri x%x sz %d from %06x\n",
                          oxid, size, sid);
         if (oxid) {
+                lpfc_nvmet_defer_release(phba, ctxp);
                 lpfc_nvmet_unsol_fcp_issue_abort(phba, ctxp, sid, oxid);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
                 return;
         }
 
-        if (nvmebuf) {
-                nvmebuf->iocbq->hba_wqidx = 0;
-                /* We assume a rcv'ed cmd ALWAYs fits into 1 buffer */
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
-        }
+        if (ctx_buf)
+                lpfc_nvmet_ctxbuf_post(phba, ctx_buf);
+
+        if (nvmebuf)
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf); /* repost */
 #endif
 }
 
@@ -1259,7 +1504,7 @@ lpfc_nvmet_unsol_fcp_event(struct lpfc_hba *phba,
                            uint64_t isr_timestamp)
 {
         if (phba->nvmet_support == 0) {
-                lpfc_nvmet_rq_post(phba, NULL, &nvmebuf->hbuf);
+                lpfc_rq_buf_free(phba, &nvmebuf->hbuf);
                 return;
         }
         lpfc_nvmet_unsol_fcp_buffer(phba, pring, nvmebuf,
@@ -1460,7 +1705,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
         nvmewqe = ctxp->wqeq;
         if (nvmewqe == NULL) {
                 /* Allocate buffer for  command wqe */
-                nvmewqe = ctxp->rqb_buffer->iocbq;
+                nvmewqe = ctxp->ctxbuf->iocbq;
                 if (nvmewqe == NULL) {
                         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_IOERR,
                                         "6110 lpfc_nvmet_prep_fcp_wqe: No "
@@ -1487,7 +1732,7 @@ lpfc_nvmet_prep_fcp_wqe(struct lpfc_hba *phba,
                 return NULL;
         }
 
-        sgl  = (struct sli4_sge *)ctxp->rqb_buffer->sglq->sgl;
+        sgl  = (struct sli4_sge *)ctxp->ctxbuf->sglq->sgl;
         switch (rsp->op) {
         case NVMET_FCOP_READDATA:
         case NVMET_FCOP_READDATA_RSP:
@@ -1812,7 +2057,8 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         ctxp->state = LPFC_NVMET_STE_DONE;
 
@@ -1827,6 +2073,7 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
                         "6165 ABORT cmpl: xri x%x flg x%x (%d) "
@@ -1835,15 +2082,16 @@ lpfc_nvmet_sol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
 
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+        /* This is the iocbq for the abort, not the command */
         lpfc_sli_release_iocbq(phba, cmdwqe);
 
         /* Since iaab/iaar are NOT set, there is no work left.
@@ -1877,7 +2125,8 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        if (ctxp->flag & LPFC_NVMET_ABORT_OP)
+                atomic_inc(&tgtp->xmt_fcp_abort_cmpl);
 
         if (!ctxp) {
                 /* if context is clear, related io alrady complete */
@@ -1907,6 +2156,7 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         }
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         spin_unlock_irqrestore(&ctxp->ctxlock, flags);
+        atomic_inc(&tgtp->xmt_abort_rsp);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6316 ABTS cmpl xri x%x flg x%x (%x) "
@@ -1914,15 +2164,15 @@ lpfc_nvmet_unsol_fcp_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
                         ctxp->oxid, ctxp->flag, released,
                         wcqe->word0, wcqe->total_data_placed,
                         result, wcqe->word3);
+
+        cmdwqe->context2 = NULL;
+        cmdwqe->context3 = NULL;
         /*
          * if transport has released ctx, then can reuse it. Otherwise,
          * will be recycled by transport release call.
          */
         if (released)
-                lpfc_nvmet_rq_post(phba, ctxp, &ctxp->rqb_buffer->hbuf);
-
-        cmdwqe->context2 = NULL;
-        cmdwqe->context3 = NULL;
+                lpfc_nvmet_ctxbuf_post(phba, ctxp->ctxbuf);
 
         /* Since iaab/iaar are NOT set, there is no work left.
          * For LPFC_NVMET_XBUSY, lpfc_sli4_nvmet_xri_aborted
@@ -1953,7 +2203,7 @@ lpfc_nvmet_xmt_ls_abort_cmp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdwqe,
         result = wcqe->parameter;
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        atomic_inc(&tgtp->xmt_abort_cmpl);
+        atomic_inc(&tgtp->xmt_ls_abort_cmpl);
 
         lpfc_printf_log(phba, KERN_INFO, LOG_NVME_ABTS,
                         "6083 Abort cmpl: ctx %p WCQE: %08x %08x %08x %08x\n",
@@ -1984,10 +2234,6 @@ lpfc_nvmet_unsol_issue_abort(struct lpfc_hba *phba,
                         sid, xri, ctxp->wqeq->sli4_xritag);
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
-        if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
-                ctxp->wqeq->hba_wqidx = 0;
-        }
 
         ndlp = lpfc_findnode_did(phba->pport, sid);
         if (!ndlp || !NLP_CHK_NODE_ACT(ndlp) ||
@@ -2083,7 +2329,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2104,6 +2350,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Issue ABTS for this WQE based on iotag */
         ctxp->abort_wqeq = lpfc_sli_get_iocbq(phba);
         if (!ctxp->abort_wqeq) {
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
                                 "6161 ABORT failed: No wqeqs: "
                                 "xri: x%x\n", ctxp->oxid);
@@ -2128,6 +2375,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* driver queued commands are in process of being flushed */
         if (phba->hba_flag & HBA_NVME_IOQ_FLUSH) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6163 Driver in reset cleanup - flushing "
                                 "NVME Req now. hba_flag x%x oxid x%x\n",
@@ -2140,6 +2388,7 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         /* Outstanding abort is in progress */
         if (abts_wqeq->iocb_flag & LPFC_DRIVER_ABORTED) {
                 spin_unlock_irqrestore(&phba->hbalock, flags);
+                atomic_inc(&tgtp->xmt_abort_rsp_error);
                 lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                 "6164 Outstanding NVME I/O Abort Request "
                                 "still pending on oxid x%x\n",
@@ -2190,9 +2439,12 @@ lpfc_nvmet_sol_fcp_issue_abort(struct lpfc_hba *phba,
         abts_wqeq->context2 = ctxp;
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
-        if (rc == WQE_SUCCESS)
+        if (rc == WQE_SUCCESS) {
+                atomic_inc(&tgtp->xmt_abort_sol);
                 return 0;
+        }
 
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         lpfc_sli_release_iocbq(phba, abts_wqeq);
         lpfc_printf_log(phba, KERN_ERR, LOG_NVME_ABTS,
@@ -2215,7 +2467,7 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
 
         tgtp = (struct lpfc_nvmet_tgtport *)phba->targetport->private;
         if (!ctxp->wqeq) {
-                ctxp->wqeq = ctxp->rqb_buffer->iocbq;
+                ctxp->wqeq = ctxp->ctxbuf->iocbq;
                 ctxp->wqeq->hba_wqidx = 0;
         }
 
@@ -2231,11 +2483,11 @@ lpfc_nvmet_unsol_fcp_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_FCP_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
                 return 0;
         }
 
 aerr:
+        atomic_inc(&tgtp->xmt_abort_rsp_error);
         ctxp->flag &= ~LPFC_NVMET_ABORT_OP;
         atomic_inc(&tgtp->xmt_abort_rsp_error);
         lpfc_printf_log(phba, KERN_WARNING, LOG_NVME_ABTS,
@@ -2270,6 +2522,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         }
         abts_wqeq = ctxp->wqeq;
         wqe_abts = &abts_wqeq->wqe;
+
         lpfc_nvmet_unsol_issue_abort(phba, ctxp, sid, xri);
 
         spin_lock_irqsave(&phba->hbalock, flags);
@@ -2279,7 +2532,7 @@ lpfc_nvmet_unsol_ls_issue_abort(struct lpfc_hba *phba,
         rc = lpfc_sli4_issue_wqe(phba, LPFC_ELS_RING, abts_wqeq);
         spin_unlock_irqrestore(&phba->hbalock, flags);
         if (rc == WQE_SUCCESS) {
-                atomic_inc(&tgtp->xmt_abort_rsp);
+                atomic_inc(&tgtp->xmt_abort_unsol);
                 return 0;
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h
index 128759fe6650..6eb2f5d8d4ed 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.h
+++ b/drivers/scsi/lpfc/lpfc_nvmet.h
@@ -22,6 +22,7 @@
  ********************************************************************/
 
 #define LPFC_NVMET_DEFAULT_SEGS         (64 + 1)        /* 256K IOs */
+#define LPFC_NVMET_RQE_DEF_COUNT        512
 #define LPFC_NVMET_SUCCESS_LEN  12
 
 /* Used for NVME Target */
@@ -34,6 +35,7 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_ls_req_out;
         atomic_t rcv_ls_req_drop;
         atomic_t xmt_ls_abort;
+        atomic_t xmt_ls_abort_cmpl;
 
         /* Stats counters - lpfc_nvmet_xmt_ls_rsp */
         atomic_t xmt_ls_rsp;
@@ -47,9 +49,9 @@ struct lpfc_nvmet_tgtport {
         atomic_t rcv_fcp_cmd_in;
         atomic_t rcv_fcp_cmd_out;
         atomic_t rcv_fcp_cmd_drop;
+        atomic_t xmt_fcp_release;
 
         /* Stats counters - lpfc_nvmet_xmt_fcp_op */
-        atomic_t xmt_fcp_abort;
         atomic_t xmt_fcp_drop;
         atomic_t xmt_fcp_read_rsp;
         atomic_t xmt_fcp_read;
@@ -62,12 +64,13 @@ struct lpfc_nvmet_tgtport {
         atomic_t xmt_fcp_rsp_drop;
 
 
-        /* Stats counters - lpfc_nvmet_unsol_issue_abort */
+        /* Stats counters - lpfc_nvmet_xmt_fcp_abort */
+        atomic_t xmt_fcp_abort;
+        atomic_t xmt_fcp_abort_cmpl;
+        atomic_t xmt_abort_sol;
+        atomic_t xmt_abort_unsol;
         atomic_t xmt_abort_rsp;
         atomic_t xmt_abort_rsp_error;
-
-        /* Stats counters - lpfc_nvmet_xmt_abort_cmp */
-        atomic_t xmt_abort_cmpl;
 };
 
 struct lpfc_nvmet_rcv_ctx {
@@ -103,6 +106,7 @@ struct lpfc_nvmet_rcv_ctx {
 #define LPFC_NVMET_CTX_RLS              0x8  /* ctx free requested */
 #define LPFC_NVMET_ABTS_RCV             0x10  /* ABTS received on exchange */
         struct rqb_dmabuf *rqb_buffer;
+        struct lpfc_nvmet_ctxbuf *ctxbuf;
 
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS
         uint64_t ts_isr_cmd;
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index cf19f4976f5f..d6b184839bc2 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -74,6 +74,8 @@ static struct lpfc_iocbq *lpfc_sli4_els_wcqe_to_rspiocbq(struct lpfc_hba *,
                                                          struct lpfc_iocbq *);
 static void lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *,
                                       struct hbq_dmabuf *);
+static void lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                                          struct hbq_dmabuf *dmabuf);
 static int lpfc_sli4_fp_handle_cqe(struct lpfc_hba *, struct lpfc_queue *,
                                     struct lpfc_cqe *);
 static int lpfc_sli4_post_sgl_list(struct lpfc_hba *, struct list_head *,
@@ -479,22 +481,23 @@ lpfc_sli4_rq_put(struct lpfc_queue *hq, struct lpfc_queue *dq,
         if (unlikely(!hq) || unlikely(!dq))
                 return -ENOMEM;
         put_index = hq->host_index;
-        temp_hrqe = hq->qe[hq->host_index].rqe;
+        temp_hrqe = hq->qe[put_index].rqe;
         temp_drqe = dq->qe[dq->host_index].rqe;
 
         if (hq->type != LPFC_HRQ || dq->type != LPFC_DRQ)
                 return -EINVAL;
-        if (hq->host_index != dq->host_index)
+        if (put_index != dq->host_index)
                 return -EINVAL;
         /* If the host has not yet processed the next entry then we are done */
-        if (((hq->host_index + 1) % hq->entry_count) == hq->hba_index)
+        if (((put_index + 1) % hq->entry_count) == hq->hba_index)
                 return -EBUSY;
         lpfc_sli_pcimem_bcopy(hrqe, temp_hrqe, hq->entry_size);
         lpfc_sli_pcimem_bcopy(drqe, temp_drqe, dq->entry_size);
 
         /* Update the host index to point to the next slot */
-        hq->host_index = ((hq->host_index + 1) % hq->entry_count);
+        hq->host_index = ((put_index + 1) % hq->entry_count);
         dq->host_index = ((dq->host_index + 1) % dq->entry_count);
+        hq->RQ_buf_posted++;
 
         /* Ring The Header Receive Queue Doorbell */
         if (!(hq->host_index % hq->entry_repost)) {
@@ -4204,13 +4207,16 @@ lpfc_sli_brdreset(struct lpfc_hba *phba)
         /* Reset HBA */
         lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
                         "0325 Reset HBA Data: x%x x%x\n",
-                        phba->pport->port_state, psli->sli_flag);
+                        (phba->pport) ? phba->pport->port_state : 0,
+                        psli->sli_flag);
 
         /* perform board reset */
         phba->fc_eventTag = 0;
         phba->link_events = 0;
-        phba->pport->fc_myDID = 0;
-        phba->pport->fc_prevDID = 0;
+        if (phba->pport) {
+                phba->pport->fc_myDID = 0;
+                phba->pport->fc_prevDID = 0;
+        }
 
         /* Turn off parity checking and serr during the physical reset */
         pci_read_config_word(phba->pcidev, PCI_COMMAND, &cfg_value);
@@ -4336,7 +4342,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         /* Restart HBA */
         lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
                         "0337 Restart HBA Data: x%x x%x\n",
-                        phba->pport->port_state, psli->sli_flag);
+                        (phba->pport) ? phba->pport->port_state : 0,
+                        psli->sli_flag);
 
         word0 = 0;
         mb = (MAILBOX_t *) &word0;
@@ -4350,7 +4357,7 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         readl(to_slim); /* flush */
 
         /* Only skip post after fc_ffinit is completed */
-        if (phba->pport->port_state)
+        if (phba->pport && phba->pport->port_state)
                 word0 = 1;      /* This is really setting up word1 */
         else
                 word0 = 0;      /* This is really setting up word1 */
@@ -4359,7 +4366,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         readl(to_slim); /* flush */
 
         lpfc_sli_brdreset(phba);
-        phba->pport->stopped = 0;
+        if (phba->pport)
+                phba->pport->stopped = 0;
         phba->link_state = LPFC_INIT_START;
         phba->hba_flag = 0;
         spin_unlock_irq(&phba->hbalock);
@@ -4446,7 +4454,7 @@ lpfc_sli_brdrestart(struct lpfc_hba *phba)
  * iteration, the function will restart the HBA again. The function returns
  * zero if HBA successfully restarted else returns negative error code.
  **/
-static int
+int
 lpfc_sli_chipset_init(struct lpfc_hba *phba)
 {
         uint32_t status, i = 0;
@@ -5901,7 +5909,7 @@ lpfc_set_features(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox,
                 bf_set(lpfc_mbx_set_feature_mds,
                        &mbox->u.mqe.un.set_feature, 1);
                 bf_set(lpfc_mbx_set_feature_mds_deep_loopbk,
-                       &mbox->u.mqe.un.set_feature, 0);
+                       &mbox->u.mqe.un.set_feature, 1);
                 mbox->u.mqe.un.set_feature.feature = LPFC_SET_MDS_DIAGS;
                 mbox->u.mqe.un.set_feature.param_len = 8;
                 break;
@@ -6507,6 +6515,50 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
                  (phba->hba_flag & HBA_FCOE_MODE) ? "FCoE" : "FC");
 }
 
+int
+lpfc_post_rq_buffer(struct lpfc_hba *phba, struct lpfc_queue *hrq,
+                    struct lpfc_queue *drq, int count, int idx)
+{
+        int rc, i;
+        struct lpfc_rqe hrqe;
+        struct lpfc_rqe drqe;
+        struct lpfc_rqb *rqbp;
+        struct rqb_dmabuf *rqb_buffer;
+        LIST_HEAD(rqb_buf_list);
+
+        rqbp = hrq->rqbp;
+        for (i = 0; i < count; i++) {
+                /* IF RQ is already full, don't bother */
+                if (rqbp->buffer_count + i >= rqbp->entry_count - 1)
+                        break;
+                rqb_buffer = rqbp->rqb_alloc_buffer(phba);
+                if (!rqb_buffer)
+                        break;
+                rqb_buffer->hrq = hrq;
+                rqb_buffer->drq = drq;
+                rqb_buffer->idx = idx;
+                list_add_tail(&rqb_buffer->hbuf.list, &rqb_buf_list);
+        }
+        while (!list_empty(&rqb_buf_list)) {
+                list_remove_head(&rqb_buf_list, rqb_buffer, struct rqb_dmabuf,
+                                 hbuf.list);
+
+                hrqe.address_lo = putPaddrLow(rqb_buffer->hbuf.phys);
+                hrqe.address_hi = putPaddrHigh(rqb_buffer->hbuf.phys);
+                drqe.address_lo = putPaddrLow(rqb_buffer->dbuf.phys);
+                drqe.address_hi = putPaddrHigh(rqb_buffer->dbuf.phys);
+                rc = lpfc_sli4_rq_put(hrq, drq, &hrqe, &drqe);
+                if (rc < 0) {
+                        rqbp->rqb_free_buffer(phba, rqb_buffer);
+                } else {
+                        list_add_tail(&rqb_buffer->hbuf.list,
+                                      &rqbp->rqb_buffer_list);
+                        rqbp->buffer_count++;
+                }
+        }
+        return 1;
+}
+
 /**
  * lpfc_sli4_hba_setup - SLI4 device initialization PCI function
  * @phba: Pointer to HBA context object.
@@ -6519,7 +6571,7 @@ lpfc_set_host_data(struct lpfc_hba *phba, LPFC_MBOXQ_t *mbox)
 int
 lpfc_sli4_hba_setup(struct lpfc_hba *phba)
 {
-        int rc, i;
+        int rc, i, cnt;
         LPFC_MBOXQ_t *mboxq;
         struct lpfc_mqe *mqe;
         uint8_t *vpd;
@@ -6870,6 +6922,21 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                         goto out_destroy_queue;
                 }
                 phba->sli4_hba.nvmet_xri_cnt = rc;
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* We need 1 iocbq for every SGL, for IO processing */
+                cnt += phba->sli4_hba.nvmet_xri_cnt;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2821 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "1413 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
+
                 lpfc_nvmet_create_targetport(phba);
         } else {
                 /* update host scsi xri-sgl sizes and mappings */
@@ -6889,28 +6956,34 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)
                                         "and mapping: %d\n", rc);
                         goto out_destroy_queue;
                 }
+
+                cnt = phba->cfg_iocb_cnt * 1024;
+                /* Initialize and populate the iocb list per host */
+                lpfc_printf_log(phba, KERN_INFO, LOG_INIT,
+                                "2820 initialize iocb list %d total %d\n",
+                                phba->cfg_iocb_cnt, cnt);
+                rc = lpfc_init_iocb_list(phba, cnt);
+                if (rc) {
+                        lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+                                        "6301 Failed to init iocb list.\n");
+                        goto out_destroy_queue;
+                }
         }
 
         if (phba->nvmet_support && phba->cfg_nvmet_mrq) {
-
                 /* Post initial buffers to all RQs created */
                 for (i = 0; i < phba->cfg_nvmet_mrq; i++) {
                         rqbp = phba->sli4_hba.nvmet_mrq_hdr[i]->rqbp;
                         INIT_LIST_HEAD(&rqbp->rqb_buffer_list);
                         rqbp->rqb_alloc_buffer = lpfc_sli4_nvmet_alloc;
                         rqbp->rqb_free_buffer = lpfc_sli4_nvmet_free;
-                        rqbp->entry_count = 256;
+                        rqbp->entry_count = LPFC_NVMET_RQE_DEF_COUNT;
                         rqbp->buffer_count = 0;
 
-                        /* Divide by 4 and round down to multiple of 16 */
-                        rc = (phba->cfg_nvmet_mrq_post >> 2) & 0xfff8;
-                        phba->sli4_hba.nvmet_mrq_hdr[i]->entry_repost = rc;
-                        phba->sli4_hba.nvmet_mrq_data[i]->entry_repost = rc;
-
                         lpfc_post_rq_buffer(
                                 phba, phba->sli4_hba.nvmet_mrq_hdr[i],
                                 phba->sli4_hba.nvmet_mrq_data[i],
-                                phba->cfg_nvmet_mrq_post);
+                                LPFC_NVMET_RQE_DEF_COUNT, i);
                 }
         }
 
@@ -7077,6 +7150,7 @@ out_unset_queue:
         /* Unset all the queues set up in this routine when error out */
         lpfc_sli4_queue_unset(phba);
 out_destroy_queue:
+        lpfc_free_iocb_list(phba);
         lpfc_sli4_queue_destroy(phba);
 out_stop_timers:
         lpfc_stop_hba_timers(phba);
@@ -8616,8 +8690,11 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 memset(wqe, 0, sizeof(union lpfc_wqe128));
         /* Some of the fields are in the right position already */
         memcpy(wqe, &iocbq->iocb, sizeof(union lpfc_wqe));
-        wqe->generic.wqe_com.word7 = 0; /* The ct field has moved so reset */
-        wqe->generic.wqe_com.word10 = 0;
+        if (iocbq->iocb.ulpCommand != CMD_SEND_FRAME) {
+                /* The ct field has moved so reset */
+                wqe->generic.wqe_com.word7 = 0;
+                wqe->generic.wqe_com.word10 = 0;
+        }
 
         abort_tag = (uint32_t) iocbq->iotag;
         xritag = iocbq->sli4_xritag;
@@ -9111,6 +9188,10 @@ lpfc_sli4_iocb2wqe(struct lpfc_hba *phba, struct lpfc_iocbq *iocbq,
                 }
 
                 break;
+        case CMD_SEND_FRAME:
+                bf_set(wqe_xri_tag, &wqe->generic.wqe_com, xritag);
+                bf_set(wqe_reqtag, &wqe->generic.wqe_com, iocbq->iotag);
+                return 0;
         case CMD_XRI_ABORTED_CX:
         case CMD_CREATE_XRI_CR: /* Do we expect to use this? */
         case CMD_IOCB_FCP_IBIDIR64_CR: /* bidirectional xfer */
@@ -12783,6 +12864,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         struct fc_frame_header *fc_hdr;
         struct lpfc_queue *hrq = phba->sli4_hba.hdr_rq;
         struct lpfc_queue *drq = phba->sli4_hba.dat_rq;
+        struct lpfc_nvmet_tgtport *tgtp;
         struct hbq_dmabuf *dma_buf;
         uint32_t status, rq_id;
         unsigned long iflags;
@@ -12803,7 +12885,6 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "2537 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12814,6 +12895,7 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                         goto out;
                 }
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 memcpy(&dma_buf->cq_event.cqe.rcqe_cmpl, rcqe, sizeof(*rcqe));
 
                 /* If a NVME LS event (type 0x28), treat it as Fast path */
@@ -12827,8 +12909,21 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 workposted = true;
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6402 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -12946,7 +13041,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                 while ((cqe = lpfc_sli4_cq_get(cq))) {
                         workposted |= lpfc_sli4_sp_handle_mcqe(phba, cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                         cq->CQ_mbox++;
                 }
                 break;
@@ -12960,7 +13055,7 @@ lpfc_sli4_sp_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe,
                                 workposted |= lpfc_sli4_sp_handle_cqe(phba, cq,
                                                                       cqe);
                         if (!(++ecount % cq->entry_repost))
-                                lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                                break;
                 }
 
                 /* Track the max number of CQEs processed in 1 EQ */
@@ -13130,6 +13225,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         struct lpfc_queue *drq;
         struct rqb_dmabuf *dma_buf;
         struct fc_frame_header *fc_hdr;
+        struct lpfc_nvmet_tgtport *tgtp;
         uint32_t status, rq_id;
         unsigned long iflags;
         uint32_t fctl, idx;
@@ -13160,8 +13256,6 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
         case FC_STATUS_RQ_BUF_LEN_EXCEEDED:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "6126 Receive Frame Truncated!!\n");
-                hrq->RQ_buf_trunc++;
-                break;
         case FC_STATUS_RQ_SUCCESS:
                 lpfc_sli4_rq_release(hrq, drq);
                 spin_lock_irqsave(&phba->hbalock, iflags);
@@ -13173,6 +13267,7 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
                 }
                 spin_unlock_irqrestore(&phba->hbalock, iflags);
                 hrq->RQ_rcv_buf++;
+                hrq->RQ_buf_posted--;
                 fc_hdr = (struct fc_frame_header *)dma_buf->hbuf.virt;
 
                 /* Just some basic sanity checks on FCP Command frame */
@@ -13195,14 +13290,23 @@ lpfc_sli4_nvmet_handle_rcqe(struct lpfc_hba *phba, struct lpfc_queue *cq,
 drop:
                 lpfc_in_buf_free(phba, &dma_buf->dbuf);
                 break;
-        case FC_STATUS_INSUFF_BUF_NEED_BUF:
         case FC_STATUS_INSUFF_BUF_FRM_DISC:
+                if (phba->nvmet_support) {
+                        tgtp = phba->targetport->private;
+                        lpfc_printf_log(phba, KERN_ERR, LOG_SLI | LOG_NVME,
+                                        "6401 RQE Error x%x, posted %d err_cnt "
+                                        "%d: %x %x %x\n",
+                                        status, hrq->RQ_buf_posted,
+                                        hrq->RQ_no_posted_buf,
+                                        atomic_read(&tgtp->rcv_fcp_cmd_in),
+                                        atomic_read(&tgtp->rcv_fcp_cmd_out),
+                                        atomic_read(&tgtp->xmt_fcp_release));
+                }
+                /* fallthrough */
+
+        case FC_STATUS_INSUFF_BUF_NEED_BUF:
                 hrq->RQ_no_posted_buf++;
                 /* Post more buffers if possible */
-                spin_lock_irqsave(&phba->hbalock, iflags);
-                phba->hba_flag |= HBA_POST_RECEIVE_BUFFER;
-                spin_unlock_irqrestore(&phba->hbalock, iflags);
-                workposted = true;
                 break;
         }
 out:
@@ -13356,7 +13460,7 @@ process_cq:
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13447,7 +13551,7 @@ lpfc_sli4_fof_handle_eqe(struct lpfc_hba *phba, struct lpfc_eqe *eqe)
         while ((cqe = lpfc_sli4_cq_get(cq))) {
                 workposted |= lpfc_sli4_fp_handle_cqe(phba, cq, cqe);
                 if (!(++ecount % cq->entry_repost))
-                        lpfc_sli4_cq_release(cq, LPFC_QUEUE_NOARM);
+                        break;
         }
 
         /* Track the max number of CQEs processed in 1 EQ */
@@ -13529,7 +13633,7 @@ lpfc_sli4_fof_intr_handler(int irq, void *dev_id)
         while ((eqe = lpfc_sli4_eq_get(eq))) {
                 lpfc_sli4_fof_handle_eqe(phba, eqe);
                 if (!(++ecount % eq->entry_repost))
-                        lpfc_sli4_eq_release(eq, LPFC_QUEUE_NOARM);
+                        break;
                 eq->EQ_processed++;
         }
 
@@ -13646,7 +13750,7 @@ lpfc_sli4_hba_intr_handler(int irq, void *dev_id)
 
                 lpfc_sli4_hba_handle_eqe(phba, eqe, hba_eqidx);
                 if (!(++ecount % fpeq->entry_repost))
-                        lpfc_sli4_eq_release(fpeq, LPFC_QUEUE_NOARM);
+                        break;
                 fpeq->EQ_processed++;
         }
 
@@ -13827,17 +13931,10 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t entry_size,
         }
         queue->entry_size = entry_size;
         queue->entry_count = entry_count;
-
-        /*
-         * entry_repost is calculated based on the number of entries in the
-         * queue. This works out except for RQs. If buffers are NOT initially
-         * posted for every RQE, entry_repost should be adjusted accordingly.
-         */
-        queue->entry_repost = (entry_count >> 3);
-        if (queue->entry_repost < LPFC_QUEUE_MIN_REPOST)
-                queue->entry_repost = LPFC_QUEUE_MIN_REPOST;
         queue->phba = phba;
 
+        /* entry_repost will be set during q creation */
+
         return queue;
 out_fail:
         lpfc_sli4_queue_free(queue);
@@ -14068,6 +14165,7 @@ lpfc_eq_create(struct lpfc_hba *phba, struct lpfc_queue *eq, uint32_t imax)
                 status = -ENXIO;
         eq->host_index = 0;
         eq->hba_index = 0;
+        eq->entry_repost = LPFC_EQ_REPOST;
 
         mempool_free(mbox, phba->mbox_mem_pool);
         return status;
@@ -14141,9 +14239,9 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         default:
                 lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
                                 "0361 Unsupported CQ count: "
-                                "entry cnt %d sz %d pg cnt %d repost %d\n",
+                                "entry cnt %d sz %d pg cnt %d\n",
                                 cq->entry_count, cq->entry_size,
-                                cq->page_count, cq->entry_repost);
+                                cq->page_count);
                 if (cq->entry_count < 256) {
                         status = -EINVAL;
                         goto out;
@@ -14196,6 +14294,7 @@ lpfc_cq_create(struct lpfc_hba *phba, struct lpfc_queue *cq,
         cq->assoc_qid = eq->queue_id;
         cq->host_index = 0;
         cq->hba_index = 0;
+        cq->entry_repost = LPFC_CQ_REPOST;
 
 out:
         mempool_free(mbox, phba->mbox_mem_pool);
@@ -14387,6 +14486,7 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp,
                 cq->assoc_qid = eq->queue_id;
                 cq->host_index = 0;
                 cq->hba_index = 0;
+                cq->entry_repost = LPFC_CQ_REPOST;
 
                 rc = 0;
                 list_for_each_entry(dmabuf, &cq->page_list, list) {
@@ -14635,6 +14735,7 @@ lpfc_mq_create(struct lpfc_hba *phba, struct lpfc_queue *mq,
         mq->subtype = subtype;
         mq->host_index = 0;
         mq->hba_index = 0;
+        mq->entry_repost = LPFC_MQ_REPOST;
 
         /* link the mq onto the parent cq child list */
         list_add_tail(&mq->list, &cq->child_list);
@@ -14860,34 +14961,6 @@ out:
 }
 
 /**
- * lpfc_rq_adjust_repost - Adjust entry_repost for an RQ
- * @phba: HBA structure that indicates port to create a queue on.
- * @rq:   The queue structure to use for the receive queue.
- * @qno:  The associated HBQ number
- *
- *
- * For SLI4 we need to adjust the RQ repost value based on
- * the number of buffers that are initially posted to the RQ.
- */
-void
-lpfc_rq_adjust_repost(struct lpfc_hba *phba, struct lpfc_queue *rq, int qno)
-{
-        uint32_t cnt;
-
-        /* sanity check on queue memory */
-        if (!rq)
-                return;
-        cnt = lpfc_hbq_defs[qno]->entry_count;
-
-        /* Recalc repost for RQs based on buffers initially posted */
-        cnt = (cnt >> 3);
-        if (cnt < LPFC_QUEUE_MIN_REPOST)
-                cnt = LPFC_QUEUE_MIN_REPOST;
-
-        rq->entry_repost = cnt;
-}
-
-/**
  * lpfc_rq_create - Create a Receive Queue on the HBA
  * @phba: HBA structure that indicates port to create a queue on.
  * @hrq: The queue structure to use to create the header receive queue.
@@ -15072,6 +15145,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         hrq->subtype = subtype;
         hrq->host_index = 0;
         hrq->hba_index = 0;
+        hrq->entry_repost = LPFC_RQ_REPOST;
 
         /* now create the data queue */
         lpfc_sli4_config(phba, mbox, LPFC_MBOX_SUBSYSTEM_FCOE,
@@ -15082,7 +15156,12 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         if (phba->sli4_hba.pc_sli4_params.rqv == LPFC_Q_CREATE_VERSION_1) {
                 bf_set(lpfc_rq_context_rqe_count_1,
                        &rq_create->u.request.context, hrq->entry_count);
-                rq_create->u.request.context.buffer_size = LPFC_DATA_BUF_SIZE;
+                if (subtype == LPFC_NVMET)
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_NVMET_DATA_BUF_SIZE;
+                else
+                        rq_create->u.request.context.buffer_size =
+                                LPFC_DATA_BUF_SIZE;
                 bf_set(lpfc_rq_context_rqe_size, &rq_create->u.request.context,
                        LPFC_RQE_SIZE_8);
                 bf_set(lpfc_rq_context_page_size, &rq_create->u.request.context,
@@ -15119,8 +15198,14 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
                                LPFC_RQ_RING_SIZE_4096);
                         break;
                 }
-                bf_set(lpfc_rq_context_buf_size, &rq_create->u.request.context,
-                       LPFC_DATA_BUF_SIZE);
+                if (subtype == LPFC_NVMET)
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_NVMET_DATA_BUF_SIZE);
+                else
+                        bf_set(lpfc_rq_context_buf_size,
+                               &rq_create->u.request.context,
+                               LPFC_DATA_BUF_SIZE);
         }
         bf_set(lpfc_rq_context_cq_id, &rq_create->u.request.context,
                cq->queue_id);
@@ -15153,6 +15238,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq,
         drq->subtype = subtype;
         drq->host_index = 0;
         drq->hba_index = 0;
+        drq->entry_repost = LPFC_RQ_REPOST;
 
         /* link the header and data RQs onto the parent cq child list */
         list_add_tail(&hrq->list, &cq->child_list);
@@ -15265,7 +15351,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                                cq->queue_id);
                         bf_set(lpfc_rq_context_data_size,
                                &rq_create->u.request.context,
-                               LPFC_DATA_BUF_SIZE);
+                               LPFC_NVMET_DATA_BUF_SIZE);
                         bf_set(lpfc_rq_context_hdr_size,
                                &rq_create->u.request.context,
                                LPFC_HDR_BUF_SIZE);
@@ -15310,6 +15396,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 hrq->subtype = subtype;
                 hrq->host_index = 0;
                 hrq->hba_index = 0;
+                hrq->entry_repost = LPFC_RQ_REPOST;
 
                 drq->db_format = LPFC_DB_RING_FORMAT;
                 drq->db_regaddr = phba->sli4_hba.RQDBregaddr;
@@ -15318,6 +15405,7 @@ lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                 drq->subtype = subtype;
                 drq->host_index = 0;
                 drq->hba_index = 0;
+                drq->entry_repost = LPFC_RQ_REPOST;
 
                 list_add_tail(&hrq->list, &cq->child_list);
                 list_add_tail(&drq->list, &cq->child_list);
@@ -16058,6 +16146,8 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         struct fc_vft_header *fc_vft_hdr;
         uint32_t *header = (uint32_t *) fc_hdr;
 
+#define FC_RCTL_MDS_DIAGS       0xF4
+
         switch (fc_hdr->fh_r_ctl) {
         case FC_RCTL_DD_UNCAT:          /* uncategorized information */
         case FC_RCTL_DD_SOL_DATA:       /* solicited data */
@@ -16085,6 +16175,7 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         case FC_RCTL_F_BSY:     /* fabric busy to data frame */
         case FC_RCTL_F_BSYL:    /* fabric busy to link control frame */
         case FC_RCTL_LCR:       /* link credit reset */
+        case FC_RCTL_MDS_DIAGS: /* MDS Diagnostics */
         case FC_RCTL_END:       /* end */
                 break;
         case FC_RCTL_VFTH:      /* Virtual Fabric tagging Header */
@@ -16094,12 +16185,16 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         default:
                 goto drop;
         }
+
+#define FC_TYPE_VENDOR_UNIQUE   0xFF
+
         switch (fc_hdr->fh_type) {
         case FC_TYPE_BLS:
         case FC_TYPE_ELS:
         case FC_TYPE_FCP:
         case FC_TYPE_CT:
         case FC_TYPE_NVME:
+        case FC_TYPE_VENDOR_UNIQUE:
                 break;
         case FC_TYPE_IP:
         case FC_TYPE_ILS:
@@ -16110,12 +16205,14 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
         lpfc_printf_log(phba, KERN_INFO, LOG_ELS,
                         "2538 Received frame rctl:%s (x%x), type:%s (x%x), "
                         "frame Data:%08x %08x %08x %08x %08x %08x %08x\n",
+                        (fc_hdr->fh_r_ctl == FC_RCTL_MDS_DIAGS) ? "MDS Diags" :
                         lpfc_rctl_names[fc_hdr->fh_r_ctl], fc_hdr->fh_r_ctl,
-                        lpfc_type_names[fc_hdr->fh_type], fc_hdr->fh_type,
-                        be32_to_cpu(header[0]), be32_to_cpu(header[1]),
-                        be32_to_cpu(header[2]), be32_to_cpu(header[3]),
-                        be32_to_cpu(header[4]), be32_to_cpu(header[5]),
-                        be32_to_cpu(header[6]));
+                        (fc_hdr->fh_type == FC_TYPE_VENDOR_UNIQUE) ?
+                        "Vendor Unique" : lpfc_type_names[fc_hdr->fh_type],
+                        fc_hdr->fh_type, be32_to_cpu(header[0]),
+                        be32_to_cpu(header[1]), be32_to_cpu(header[2]),
+                        be32_to_cpu(header[3]), be32_to_cpu(header[4]),
+                        be32_to_cpu(header[5]), be32_to_cpu(header[6]));
         return 0;
 drop:
         lpfc_printf_log(phba, KERN_WARNING, LOG_ELS,
@@ -16921,6 +17018,96 @@ lpfc_sli4_send_seq_to_ulp(struct lpfc_vport *vport,
         lpfc_sli_release_iocbq(phba, iocbq);
 }
 
+static void
+lpfc_sli4_mds_loopback_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+                            struct lpfc_iocbq *rspiocb)
+{
+        struct lpfc_dmabuf *pcmd = cmdiocb->context2;
+
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, cmdiocb);
+}
+
+static void
+lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+                              struct hbq_dmabuf *dmabuf)
+{
+        struct fc_frame_header *fc_hdr;
+        struct lpfc_hba *phba = vport->phba;
+        struct lpfc_iocbq *iocbq = NULL;
+        union  lpfc_wqe *wqe;
+        struct lpfc_dmabuf *pcmd = NULL;
+        uint32_t frame_len;
+        int rc;
+
+        fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+        frame_len = bf_get(lpfc_rcqe_length, &dmabuf->cq_event.cqe.rcqe_cmpl);
+
+        /* Send the received frame back */
+        iocbq = lpfc_sli_get_iocbq(phba);
+        if (!iocbq)
+                goto exit;
+
+        /* Allocate buffer for command payload */
+        pcmd = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
+        if (pcmd)
+                pcmd->virt = pci_pool_alloc(phba->lpfc_drb_pool, GFP_KERNEL,
+                                            &pcmd->phys);
+        if (!pcmd || !pcmd->virt)
+                goto exit;
+
+        INIT_LIST_HEAD(&pcmd->list);
+
+        /* copyin the payload */
+        memcpy(pcmd->virt, dmabuf->dbuf.virt, frame_len);
+
+        /* fill in BDE's for command */
+        iocbq->iocb.un.xseq64.bdl.addrHigh = putPaddrHigh(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.addrLow = putPaddrLow(pcmd->phys);
+        iocbq->iocb.un.xseq64.bdl.bdeFlags = BUFF_TYPE_BDE_64;
+        iocbq->iocb.un.xseq64.bdl.bdeSize = frame_len;
+
+        iocbq->context2 = pcmd;
+        iocbq->vport = vport;
+        iocbq->iocb_flag &= ~LPFC_FIP_ELS_ID_MASK;
+        iocbq->iocb_flag |= LPFC_USE_FCPWQIDX;
+
+        /*
+         * Setup rest of the iocb as though it were a WQE
+         * Build the SEND_FRAME WQE
+         */
+        wqe = (union lpfc_wqe *)&iocbq->iocb;
+
+        wqe->send_frame.frame_len = frame_len;
+        wqe->send_frame.fc_hdr_wd0 = be32_to_cpu(*((uint32_t *)fc_hdr));
+        wqe->send_frame.fc_hdr_wd1 = be32_to_cpu(*((uint32_t *)fc_hdr + 1));
+        wqe->send_frame.fc_hdr_wd2 = be32_to_cpu(*((uint32_t *)fc_hdr + 2));
+        wqe->send_frame.fc_hdr_wd3 = be32_to_cpu(*((uint32_t *)fc_hdr + 3));
+        wqe->send_frame.fc_hdr_wd4 = be32_to_cpu(*((uint32_t *)fc_hdr + 4));
+        wqe->send_frame.fc_hdr_wd5 = be32_to_cpu(*((uint32_t *)fc_hdr + 5));
+
+        iocbq->iocb.ulpCommand = CMD_SEND_FRAME;
+        iocbq->iocb.ulpLe = 1;
+        iocbq->iocb_cmpl = lpfc_sli4_mds_loopback_cmpl;
+        rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, iocbq, 0);
+        if (rc == IOCB_ERROR)
+                goto exit;
+
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+        return;
+
+exit:
+        lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+                        "2023 Unable to process MDS loopback frame\n");
+        if (pcmd && pcmd->virt)
+                pci_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+        kfree(pcmd);
+        lpfc_sli_release_iocbq(phba, iocbq);
+        lpfc_in_buf_free(phba, &dmabuf->dbuf);
+}
+
 /**
  * lpfc_sli4_handle_received_buffer - Handle received buffers from firmware
  * @phba: Pointer to HBA context object.
@@ -16959,6 +17146,13 @@ lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba,
                 fcfi = bf_get(lpfc_rcqe_fcf_id,
                               &dmabuf->cq_event.cqe.rcqe_cmpl);
 
+        if (fc_hdr->fh_r_ctl == 0xF4 && fc_hdr->fh_type == 0xFF) {
+                vport = phba->pport;
+                /* Handle MDS Loopback frames */
+                lpfc_sli4_handle_mds_loopback(vport, dmabuf);
+                return;
+        }
+
         /* d_id this frame is directed to */
         did = sli4_did_from_fc_hdr(fc_hdr);
 
@@ -17132,6 +17326,14 @@ lpfc_sli4_post_rpi_hdr(struct lpfc_hba *phba, struct lpfc_rpi_hdr *rpi_page)
                                 "status x%x add_status x%x, mbx status x%x\n",
                                 shdr_status, shdr_add_status, rc);
                 rc = -ENXIO;
+        } else {
+                /*
+                 * The next_rpi stores the next logical module-64 rpi value used
+                 * to post physical rpis in subsequent rpi postings.
+                 */
+                spin_lock_irq(&phba->hbalock);
+                phba->sli4_hba.next_rpi = rpi_page->next_rpi;
+                spin_unlock_irq(&phba->hbalock);
         }
         return rc;
 }
@@ -18712,7 +18914,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phba, uint32_t ring_number,
 
                 spin_lock_irqsave(&pring->ring_lock, iflags);
                 ctxp = pwqe->context2;
-                sglq = ctxp->rqb_buffer->sglq;
+                sglq = ctxp->ctxbuf->sglq;
                 if (pwqe->sli4_xritag ==  NO_XRI) {
                         pwqe->sli4_lxritag = sglq->sli4_lxritag;
                         pwqe->sli4_xritag = sglq->sli4_xritag;
diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h
index da46471337c8..cf863db27700 100644
--- a/drivers/scsi/lpfc/lpfc_sli4.h
+++ b/drivers/scsi/lpfc/lpfc_sli4.h
@@ -24,7 +24,6 @@
 #define LPFC_XRI_EXCH_BUSY_WAIT_TMO             10000
 #define LPFC_XRI_EXCH_BUSY_WAIT_T1              10
 #define LPFC_XRI_EXCH_BUSY_WAIT_T2              30000
-#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32
 #define LPFC_RPI_LOW_WATER_MARK                 10
 
 #define LPFC_UNREG_FCF                          1
@@ -155,7 +154,11 @@ struct lpfc_queue {
         uint32_t entry_count;   /* Number of entries to support on the queue */
         uint32_t entry_size;    /* Size of each queue entry. */
         uint32_t entry_repost;  /* Count of entries before doorbell is rung */
-#define LPFC_QUEUE_MIN_REPOST   8
+#define LPFC_EQ_REPOST          8
+#define LPFC_MQ_REPOST          8
+#define LPFC_CQ_REPOST          64
+#define LPFC_RQ_REPOST          64
+#define LPFC_RELEASE_NOTIFICATION_INTERVAL      32  /* For WQs */
         uint32_t queue_id;      /* Queue ID assigned by the hardware */
         uint32_t assoc_qid;     /* Queue ID associated with, for CQ/WQ/MQ */
         uint32_t page_count;    /* Number of pages allocated for this queue */
@@ -195,7 +198,7 @@ struct lpfc_queue {
 /* defines for RQ stats */
 #define RQ_no_posted_buf        q_cnt_1
 #define RQ_no_buf_found         q_cnt_2
-#define RQ_buf_trunc            q_cnt_3
+#define RQ_buf_posted           q_cnt_3
 #define RQ_rcv_buf              q_cnt_4
 
         uint64_t isr_timestamp;
@@ -617,12 +620,17 @@ struct lpfc_sli4_hba {
         uint16_t scsi_xri_start;
         uint16_t els_xri_cnt;
         uint16_t nvmet_xri_cnt;
+        uint16_t nvmet_ctx_cnt;
+        uint16_t nvmet_io_wait_cnt;
+        uint16_t nvmet_io_wait_total;
         struct list_head lpfc_els_sgl_list;
         struct list_head lpfc_abts_els_sgl_list;
         struct list_head lpfc_nvmet_sgl_list;
         struct list_head lpfc_abts_nvmet_ctx_list;
         struct list_head lpfc_abts_scsi_buf_list;
         struct list_head lpfc_abts_nvme_buf_list;
+        struct list_head lpfc_nvmet_ctx_list;
+        struct list_head lpfc_nvmet_io_wait_list;
         struct lpfc_sglq **lpfc_sglq_active_list;
         struct list_head lpfc_rpi_hdr_list;
         unsigned long *rpi_bmask;
@@ -654,6 +662,7 @@ struct lpfc_sli4_hba {
         spinlock_t abts_scsi_buf_list_lock; /* list of aborted SCSI IOs */
         spinlock_t sgl_list_lock; /* list of aborted els IOs */
         spinlock_t nvmet_io_lock;
+        spinlock_t nvmet_io_wait_lock; /* IOs waiting for ctx resources */
         uint32_t physical_port;
 
         /* CPU to vector mapping information */
@@ -661,8 +670,6 @@ struct lpfc_sli4_hba {
         uint16_t num_online_cpu;
         uint16_t num_present_cpu;
         uint16_t curr_disp_cpu;
-
-        uint16_t nvmet_mrq_post_idx;
 };
 
 enum lpfc_sge_type {
@@ -698,6 +705,7 @@ struct lpfc_rpi_hdr {
         struct lpfc_dmabuf *dmabuf;
         uint32_t page_count;
         uint32_t start_rpi;
+        uint16_t next_rpi;
 };
 
 struct lpfc_rsrc_blks {
@@ -762,7 +770,6 @@ int lpfc_rq_create(struct lpfc_hba *, struct lpfc_queue *,
 int lpfc_mrq_create(struct lpfc_hba *phba, struct lpfc_queue **hrqp,
                         struct lpfc_queue **drqp, struct lpfc_queue **cqp,
                         uint32_t subtype);
-void lpfc_rq_adjust_repost(struct lpfc_hba *, struct lpfc_queue *, int);
 int lpfc_eq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_cq_destroy(struct lpfc_hba *, struct lpfc_queue *);
 int lpfc_mq_destroy(struct lpfc_hba *, struct lpfc_queue *);
diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
index 1c26dc67151b..c2653244221c 100644
--- a/drivers/scsi/lpfc/lpfc_version.h
+++ b/drivers/scsi/lpfc/lpfc_version.h
@@ -20,7 +20,7 @@
  * included with this package.                                     *
  *******************************************************************/
 
-#define LPFC_DRIVER_VERSION "11.2.0.12"
+#define LPFC_DRIVER_VERSION "11.2.0.14"
 #define LPFC_DRIVER_NAME                "lpfc"
 
 /* Used for SLI 2/3 */
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index a4aadf5f4dc6..1cc814f1505a 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3770,9 +3770,6 @@ static long pmcraid_ioctl_passthrough(
                         pmcraid_err("couldn't build passthrough ioadls\n");
                         goto out_free_cmd;
                 }
-        } else if (request_size < 0) {
-                rc = -EINVAL;
-                goto out_free_cmd;
         }
 
         /* If data is being written into the device, copy the data from user
diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h
index 40aeb6bb96a2..07ee88200e91 100644
--- a/drivers/scsi/qedf/qedf.h
+++ b/drivers/scsi/qedf/qedf.h
@@ -259,7 +259,7 @@ struct qedf_io_log {
         uint16_t task_id;
         uint32_t port_id; /* Remote port fabric ID */
         int lun;
-        char op; /* SCSI CDB */
+        unsigned char op; /* SCSI CDB */
         uint8_t lba[4];
         unsigned int bufflen; /* SCSI buffer length */
         unsigned int sg_count; /* Number of SG elements */
diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c
index c505d41f6dc8..90627033bde6 100644
--- a/drivers/scsi/qedf/qedf_els.c
+++ b/drivers/scsi/qedf/qedf_els.c
@@ -109,7 +109,7 @@ retry_els:
         did = fcport->rdata->ids.port_id;
         sid = fcport->sid;
 
-        __fc_fill_fc_hdr(fc_hdr, FC_RCTL_ELS_REQ, sid, did,
+        __fc_fill_fc_hdr(fc_hdr, FC_RCTL_ELS_REQ, did, sid,
                            FC_TYPE_ELS, FC_FC_FIRST_SEQ | FC_FC_END_SEQ |
                            FC_FC_SEQ_INIT, 0);
 
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index cceddd995a4b..a5c97342fd5d 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2895,7 +2895,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
         slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER;
         slowpath_params.drv_rev = QEDF_DRIVER_REV_VER;
         slowpath_params.drv_eng = QEDF_DRIVER_ENG_VER;
-        memcpy(slowpath_params.name, "qedf", QED_DRV_VER_STR_SIZE);
+        strncpy(slowpath_params.name, "qedf", QED_DRV_VER_STR_SIZE);
         rc = qed_ops->common->slowpath_start(qedf->cdev, &slowpath_params);
         if (rc) {
                 QEDF_ERR(&(qedf->dbg_ctx), "Cannot start slowpath.\n");
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 7bfbcfa7af40..61cdd99ae41e 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -763,6 +763,8 @@ struct scsi_device *__scsi_device_lookup(struct Scsi_Host *shost,
         struct scsi_device *sdev;
 
         list_for_each_entry(sdev, &shost->__devices, siblings) {
+                if (sdev->sdev_state == SDEV_DEL)
+                        continue;
                 if (sdev->channel == channel && sdev->id == id &&
                                 sdev->lun ==lun)
                         return sdev;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 814a4bd8405d..99e16ac479e3 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -30,6 +30,7 @@
 #include <scsi/scsi_driver.h>
 #include <scsi/scsi_eh.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_transport.h> /* __scsi_init_queue() */
 #include <scsi/scsi_dh.h>
 
 #include <trace/events/scsi.h>
@@ -1850,7 +1851,7 @@ static int scsi_mq_prep_fn(struct request *req)
 
         /* zero out the cmd, except for the embedded scsi_request */
         memset((char *)cmd + sizeof(cmd->req), 0,
-                sizeof(*cmd) - sizeof(cmd->req));
+                sizeof(*cmd) - sizeof(cmd->req) + shost->hostt->cmd_size);
 
         req->special = cmd;
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index f9d1432d7cc5..b6bb4e0ce0e3 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -827,21 +827,32 @@ static int sd_setup_write_zeroes_cmnd(struct scsi_cmnd *cmd)
         struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
         u64 sector = blk_rq_pos(rq) >> (ilog2(sdp->sector_size) - 9);
         u32 nr_sectors = blk_rq_sectors(rq) >> (ilog2(sdp->sector_size) - 9);
+        int ret;
 
         if (!(rq->cmd_flags & REQ_NOUNMAP)) {
                 switch (sdkp->zeroing_mode) {
                 case SD_ZERO_WS16_UNMAP:
-                        return sd_setup_write_same16_cmnd(cmd, true);
+                        ret = sd_setup_write_same16_cmnd(cmd, true);
+                        goto out;
                 case SD_ZERO_WS10_UNMAP:
-                        return sd_setup_write_same10_cmnd(cmd, true);
+                        ret = sd_setup_write_same10_cmnd(cmd, true);
+                        goto out;
                 }
         }
 
         if (sdp->no_write_same)
                 return BLKPREP_INVALID;
+
         if (sdkp->ws16 || sector > 0xffffffff || nr_sectors > 0xffff)
-                return sd_setup_write_same16_cmnd(cmd, false);
-        return sd_setup_write_same10_cmnd(cmd, false);
+                ret = sd_setup_write_same16_cmnd(cmd, false);
+        else
+                ret = sd_setup_write_same10_cmnd(cmd, false);
+
+out:
+        if (sd_is_zoned(sdkp) && ret == BLKPREP_OK)
+                return sd_zbc_write_lock_zone(cmd);
+
+        return ret;
 }
 
 static void sd_config_write_same(struct scsi_disk *sdkp)
@@ -948,6 +959,10 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
         rq->__data_len = sdp->sector_size;
         ret = scsi_init_io(cmd);
         rq->__data_len = nr_bytes;
+
+        if (sd_is_zoned(sdkp) && ret != BLKPREP_OK)
+                sd_zbc_write_unlock_zone(cmd);
+
         return ret;
 }
 
@@ -1567,17 +1582,21 @@ out:
         return retval;
 }
 
-static int sd_sync_cache(struct scsi_disk *sdkp)
+static int sd_sync_cache(struct scsi_disk *sdkp, struct scsi_sense_hdr *sshdr)
 {
         int retries, res;
         struct scsi_device *sdp = sdkp->device;
         const int timeout = sdp->request_queue->rq_timeout
                 * SD_FLUSH_TIMEOUT_MULTIPLIER;
-        struct scsi_sense_hdr sshdr;
+        struct scsi_sense_hdr my_sshdr;
 
         if (!scsi_device_online(sdp))
                 return -ENODEV;
 
+        /* caller might not be interested in sense, but we need it */
+        if (!sshdr)
+                sshdr = &my_sshdr;
+
         for (retries = 3; retries > 0; --retries) {
                 unsigned char cmd[10] = { 0 };
 
@@ -1586,7 +1605,7 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                  * Leave the rest of the command zero to indicate
                  * flush everything.
                  */
-                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, &sshdr,
+                res = scsi_execute(sdp, cmd, DMA_NONE, NULL, 0, NULL, sshdr,
                                 timeout, SD_MAX_RETRIES, 0, RQF_PM, NULL);
                 if (res == 0)
                         break;
@@ -1596,11 +1615,12 @@ static int sd_sync_cache(struct scsi_disk *sdkp)
                 sd_print_result(sdkp, "Synchronize Cache(10) failed", res);
 
                 if (driver_byte(res) & DRIVER_SENSE)
-                        sd_print_sense_hdr(sdkp, &sshdr);
+                        sd_print_sense_hdr(sdkp, sshdr);
+
                 /* we need to evaluate the error return  */
-                if (scsi_sense_valid(&sshdr) &&
-                        (sshdr.asc == 0x3a ||   /* medium not present */
-                         sshdr.asc == 0x20))    /* invalid command */
+                if (scsi_sense_valid(sshdr) &&
+                        (sshdr->asc == 0x3a ||  /* medium not present */
+                         sshdr->asc == 0x20))   /* invalid command */
                                 /* this is no error here */
                                 return 0;
 
@@ -3444,7 +3464,7 @@ static void sd_shutdown(struct device *dev)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                sd_sync_cache(sdkp);
+                sd_sync_cache(sdkp, NULL);
         }
 
         if (system_state != SYSTEM_RESTART && sdkp->device->manage_start_stop) {
@@ -3456,6 +3476,7 @@ static void sd_shutdown(struct device *dev)
 static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 {
         struct scsi_disk *sdkp = dev_get_drvdata(dev);
+        struct scsi_sense_hdr sshdr;
         int ret = 0;
 
         if (!sdkp)      /* E.g.: runtime suspend following sd_remove() */
@@ -3463,12 +3484,23 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
 
         if (sdkp->WCE && sdkp->media_present) {
                 sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
-                ret = sd_sync_cache(sdkp);
+                ret = sd_sync_cache(sdkp, &sshdr);
+
                 if (ret) {
                         /* ignore OFFLINE device */
                         if (ret == -ENODEV)
-                                ret = 0;
-                        goto done;
+                                return 0;
+
+                        if (!scsi_sense_valid(&sshdr) ||
+                            sshdr.sense_key != ILLEGAL_REQUEST)
+                                return ret;
+
+                        /*
+                         * sshdr.sense_key == ILLEGAL_REQUEST means this drive
+                         * doesn't support sync. There's not much to do and
+                         * suspend shouldn't fail.
+                         */
+                         ret = 0;
                 }
         }
 
@@ -3480,7 +3512,6 @@ static int sd_suspend_common(struct device *dev, bool ignore_stop_errors)
                         ret = 0;
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 0a38ba01b7b4..82c33a6edbea 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2074,11 +2074,12 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id)
                 if ((1 == resp->done) && (!resp->sg_io_owned) &&
                     ((-1 == pack_id) || (resp->header.pack_id == pack_id))) {
                         resp->done = 2; /* guard against other readers */
-                        break;
+                        write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+                        return resp;
                 }
         }
         write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
-        return resp;
+        return NULL;
 }
 
 /* always adds to end of list */
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index abc7e87937cc..ffe8d8608818 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -7698,6 +7698,12 @@ static inline void ufshcd_add_sysfs_nodes(struct ufs_hba *hba)
         ufshcd_add_spm_lvl_sysfs_nodes(hba);
 }
 
+static inline void ufshcd_remove_sysfs_nodes(struct ufs_hba *hba)
+{
+        device_remove_file(hba->dev, &hba->rpm_lvl_attr);
+        device_remove_file(hba->dev, &hba->spm_lvl_attr);
+}
+
 /**
  * ufshcd_shutdown - shutdown routine
  * @hba: per adapter instance
@@ -7735,6 +7741,7 @@ EXPORT_SYMBOL(ufshcd_shutdown);
  */
 void ufshcd_remove(struct ufs_hba *hba)
 {
+        ufshcd_remove_sysfs_nodes(hba);
         scsi_remove_host(hba->host);
         /* disable interrupts */
         ufshcd_disable_intr(hba, hba->intr_mask);
diff --git a/drivers/soc/bcm/brcmstb/common.c b/drivers/soc/bcm/brcmstb/common.c
index b6195fdf0d00..22e98a90468c 100644
--- a/drivers/soc/bcm/brcmstb/common.c
+++ b/drivers/soc/bcm/brcmstb/common.c
@@ -49,7 +49,7 @@ static const struct of_device_id sun_top_ctrl_match[] = {
         { .compatible = "brcm,bcm7420-sun-top-ctrl", },
         { .compatible = "brcm,bcm7425-sun-top-ctrl", },
         { .compatible = "brcm,bcm7429-sun-top-ctrl", },
-        { .compatible = "brcm,bcm7425-sun-top-ctrl", },
+        { .compatible = "brcm,bcm7435-sun-top-ctrl", },
         { .compatible = "brcm,brcmstb-sun-top-ctrl", },
         { }
 };
diff --git a/drivers/soc/imx/Kconfig b/drivers/soc/imx/Kconfig
index 357a5d8f8da0..a5b86a28f343 100644
--- a/drivers/soc/imx/Kconfig
+++ b/drivers/soc/imx/Kconfig
@@ -2,8 +2,9 @@ menu "i.MX SoC drivers"
 
 config IMX7_PM_DOMAINS
         bool "i.MX7 PM domains"
-        select PM_GENERIC_DOMAINS
         depends on SOC_IMX7D || (COMPILE_TEST && OF)
+        depends on PM
+        select PM_GENERIC_DOMAINS
         default y if SOC_IMX7D
 
 endmenu
diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index ecebe2eecc3a..026182d3b27c 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -413,7 +413,7 @@ static int of_channel_match_helper(struct device_node *np, const char *name,
  * @name:       slave channel name
  * @config:     dma configuration parameters
  *
- * Returns pointer to appropriate DMA channel on success or NULL.
+ * Returns pointer to appropriate DMA channel on success or error.
  */
 void *knav_dma_open_channel(struct device *dev, const char *name,
                                         struct knav_dma_cfg *config)
diff --git a/drivers/staging/android/ion/devicetree.txt b/drivers/staging/android/ion/devicetree.txt
deleted file mode 100644
index 168715271f06..000000000000
--- a/drivers/staging/android/ion/devicetree.txt
+++ /dev/null
@@ -1,51 +0,0 @@
-Ion Memory Manager
-
-Ion is a memory manager that allows for sharing of buffers via dma-buf.
-Ion allows for different types of allocation via an abstraction called
-a 'heap'. A heap represents a specific type of memory. Each heap has
-a different type. There can be multiple instances of the same heap
-type.
-
-Specific heap instances are tied to heap IDs. Heap IDs are not to be specified
-in the devicetree.
-
-Required properties for Ion
-
-- compatible: "linux,ion" PLUS a compatible property for the device
-
-All child nodes of a linux,ion node are interpreted as heaps
-
-required properties for heaps
-
-- compatible: compatible string for a heap type PLUS a compatible property
-for the specific instance of the heap. Current heap types
--- linux,ion-heap-system
--- linux,ion-heap-system-contig
--- linux,ion-heap-carveout
--- linux,ion-heap-chunk
--- linux,ion-heap-dma
--- linux,ion-heap-custom
-
-Optional properties
-- memory-region: A phandle to a memory region. Required for DMA heap type
-(see reserved-memory.txt for details on the reservation)
-
-Example:
-
-        ion {
-                compatbile = "hisilicon,ion", "linux,ion";
-
-                ion-system-heap {
-                        compatbile = "hisilicon,system-heap", "linux,ion-heap-system"
-                };
-
-                ion-camera-region {
-                        compatible = "hisilicon,camera-heap", "linux,ion-heap-dma"
-                        memory-region = <&camera_region>;
-                };
-
-                ion-fb-region {
-                        compatbile = "hisilicon,fb-heap", "linux,ion-heap-dma"
-                        memory-region = <&fb_region>;
-                };
-        }
diff --git a/drivers/staging/ccree/ssi_request_mgr.c b/drivers/staging/ccree/ssi_request_mgr.c
index 522bd62c102e..8611adf3bb2e 100644
--- a/drivers/staging/ccree/ssi_request_mgr.c
+++ b/drivers/staging/ccree/ssi_request_mgr.c
@@ -376,7 +376,6 @@ int send_request(
         rc = ssi_power_mgr_runtime_get(&drvdata->plat_dev->dev);
         if (rc != 0) {
                 SSI_LOG_ERR("ssi_power_mgr_runtime_get returned %x\n",rc);
-                spin_unlock_bh(&req_mgr_h->hw_lock);
                 return rc;
         }
 #endif
diff --git a/drivers/staging/fsl-dpaa2/Kconfig b/drivers/staging/fsl-dpaa2/Kconfig
index 2e325cb747ae..730fd6d4db33 100644
--- a/drivers/staging/fsl-dpaa2/Kconfig
+++ b/drivers/staging/fsl-dpaa2/Kconfig
@@ -12,6 +12,7 @@ config FSL_DPAA2
 config FSL_DPAA2_ETH
         tristate "Freescale DPAA2 Ethernet"
         depends on FSL_DPAA2 && FSL_MC_DPIO
+        depends on NETDEVICES && ETHERNET
         ---help---
           Ethernet driver for Freescale DPAA2 SoCs, using the
           Freescale MC bus driver
diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 4723a0bd5067..1c6ed5b2a6f9 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -97,8 +97,9 @@ void rtl92e_set_reg(struct net_device *dev, u8 variable, u8 *val)
 
         switch (variable) {
         case HW_VAR_BSSID:
-                rtl92e_writel(dev, BSSIDR, ((u32 *)(val))[0]);
-                rtl92e_writew(dev, BSSIDR+2, ((u16 *)(val+2))[0]);
+                /* BSSIDR 2 byte alignment */
+                rtl92e_writew(dev, BSSIDR, *(u16 *)val);
+                rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(val + 2));
                 break;
 
         case HW_VAR_MEDIA_STATUS:
@@ -624,7 +625,7 @@ void rtl92e_get_eeprom_size(struct net_device *dev)
         struct r8192_priv *priv = rtllib_priv(dev);
 
         RT_TRACE(COMP_INIT, "===========>%s()\n", __func__);
-        curCR = rtl92e_readl(dev, EPROM_CMD);
+        curCR = rtl92e_readw(dev, EPROM_CMD);
         RT_TRACE(COMP_INIT, "read from Reg Cmd9346CR(%x):%x\n", EPROM_CMD,
                  curCR);
         priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 :
@@ -961,8 +962,8 @@ static void _rtl92e_net_update(struct net_device *dev)
         rtl92e_config_rate(dev, &rate_config);
         priv->dot11CurrentPreambleMode = PREAMBLE_AUTO;
          priv->basic_rate = rate_config &= 0x15f;
-        rtl92e_writel(dev, BSSIDR, ((u32 *)net->bssid)[0]);
-        rtl92e_writew(dev, BSSIDR+4, ((u16 *)net->bssid)[2]);
+        rtl92e_writew(dev, BSSIDR, *(u16 *)net->bssid);
+        rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(net->bssid + 2));
 
         if (priv->rtllib->iw_mode == IW_MODE_ADHOC) {
                 rtl92e_writew(dev, ATIMWND, 2);
@@ -1182,8 +1183,7 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
                           struct cb_desc *cb_desc, struct sk_buff *skb)
 {
         struct r8192_priv *priv = rtllib_priv(dev);
-        dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
-                         PCI_DMA_TODEVICE);
+        dma_addr_t mapping;
         struct tx_fwinfo_8190pci *pTxFwInfo;
 
         pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1194,8 +1194,6 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,
                                                   pTxFwInfo->TxRate, cb_desc);
 
-        if (pci_dma_mapping_error(priv->pdev, mapping))
-                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
         if (cb_desc->bAMPDUEnable) {
                 pTxFwInfo->AllowAggregation = 1;
                 pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1230,6 +1228,14 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         }
 
         memset((u8 *)pdesc, 0, 12);
+
+        mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+                                 PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
+                return;
+        }
+
         pdesc->LINIP = 0;
         pdesc->CmdInit = 1;
         pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;
diff --git a/drivers/staging/rtl8192e/rtl819x_TSProc.c b/drivers/staging/rtl8192e/rtl819x_TSProc.c
index 48bbd9e8a52f..dcc4eb691889 100644
--- a/drivers/staging/rtl8192e/rtl819x_TSProc.c
+++ b/drivers/staging/rtl8192e/rtl819x_TSProc.c
@@ -306,11 +306,6 @@ static void MakeTSEntry(struct ts_common_info *pTsCommonInfo, u8 *Addr,
         pTsCommonInfo->TClasNum = TCLAS_Num;
 }
 
-static bool IsACValid(unsigned int tid)
-{
-        return tid < 7;
-}
-
 bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
            u8 *Addr, u8 TID, enum tr_select TxRxSelect, bool bAddNewTs)
 {
@@ -328,12 +323,6 @@ bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
         if (ieee->current_network.qos_data.supported == 0) {
                 UP = 0;
         } else {
-                if (!IsACValid(TID)) {
-                        netdev_warn(ieee->dev, "%s(): TID(%d) is not valid\n",
-                                    __func__, TID);
-                        return false;
-                }
-
                 switch (TID) {
                 case 0:
                 case 3:
@@ -351,6 +340,10 @@ bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
                 case 7:
                         UP = 7;
                         break;
+                default:
+                        netdev_warn(ieee->dev, "%s(): TID(%d) is not valid\n",
+                                    __func__, TID);
+                        return false;
                 }
         }
 
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 5e7a61f24f8d..36c3189fc4b7 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -3531,7 +3531,6 @@ int rtw_wdev_alloc(struct adapter *padapter, struct device *dev)
                 pwdev_priv->power_mgmt = true;
         else
                 pwdev_priv->power_mgmt = false;
-        kfree((u8 *)wdev);
 
         return ret;
 
diff --git a/drivers/staging/typec/fusb302/fusb302.c b/drivers/staging/typec/fusb302/fusb302.c
index 2cee9a952c9b..4a356e509fe4 100644
--- a/drivers/staging/typec/fusb302/fusb302.c
+++ b/drivers/staging/typec/fusb302/fusb302.c
@@ -264,22 +264,36 @@ static void fusb302_debugfs_exit(const struct fusb302_chip *chip) { }
 
 #define FUSB302_RESUME_RETRY 10
 #define FUSB302_RESUME_RETRY_SLEEP 50
-static int fusb302_i2c_write(struct fusb302_chip *chip,
-                             u8 address, u8 data)
+
+static bool fusb302_is_suspended(struct fusb302_chip *chip)
 {
         int retry_cnt;
-        int ret = 0;
 
-        atomic_set(&chip->i2c_busy, 1);
         for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
                 if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
+                        dev_err(chip->dev, "i2c: pm suspend, retry %d/%d\n",
+                                retry_cnt + 1, FUSB302_RESUME_RETRY);
                         msleep(FUSB302_RESUME_RETRY_SLEEP);
                 } else {
-                        break;
+                        return false;
                 }
         }
+
+        return true;
+}
+
+static int fusb302_i2c_write(struct fusb302_chip *chip,
+                             u8 address, u8 data)
+{
+        int ret = 0;
+
+        atomic_set(&chip->i2c_busy, 1);
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
+        }
+
         ret = i2c_smbus_write_byte_data(chip->i2c_client, address, data);
         if (ret < 0)
                 fusb302_log(chip, "cannot write 0x%02x to 0x%02x, ret=%d",
@@ -292,21 +306,17 @@ static int fusb302_i2c_write(struct fusb302_chip *chip,
 static int fusb302_i2c_block_write(struct fusb302_chip *chip, u8 address,
                                    u8 length, const u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         if (length <= 0)
                 return ret;
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_write_i2c_block_data(chip->i2c_client, address,
                                              length, data);
         if (ret < 0)
@@ -320,19 +330,15 @@ static int fusb302_i2c_block_write(struct fusb302_chip *chip, u8 address,
 static int fusb302_i2c_read(struct fusb302_chip *chip,
                             u8 address, u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_read_byte_data(chip->i2c_client, address);
         *data = (u8)ret;
         if (ret < 0)
@@ -345,33 +351,31 @@ static int fusb302_i2c_read(struct fusb302_chip *chip,
 static int fusb302_i2c_block_read(struct fusb302_chip *chip, u8 address,
                                   u8 length, u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         if (length <= 0)
                 return ret;
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_read_i2c_block_data(chip->i2c_client, address,
                                             length, data);
         if (ret < 0) {
                 fusb302_log(chip, "cannot block read 0x%02x, len=%d, ret=%d",
                             address, length, ret);
-                return ret;
+                goto done;
         }
         if (ret != length) {
                 fusb302_log(chip, "only read %d/%d bytes from 0x%02x",
                             ret, length, address);
-                return -EIO;
+                ret = -EIO;
         }
+
+done:
         atomic_set(&chip->i2c_busy, 0);
 
         return ret;
@@ -489,7 +493,7 @@ static int tcpm_init(struct tcpc_dev *dev)
         ret = fusb302_i2c_read(chip, FUSB_REG_STATUS0, &data);
         if (ret < 0)
                 return ret;
-        chip->vbus_present = !!(FUSB_REG_STATUS0 & FUSB_REG_STATUS0_VBUSOK);
+        chip->vbus_present = !!(data & FUSB_REG_STATUS0_VBUSOK);
         ret = fusb302_i2c_read(chip, FUSB_REG_DEVICE_ID, &data);
         if (ret < 0)
                 return ret;
@@ -1025,7 +1029,7 @@ static int fusb302_pd_send_message(struct fusb302_chip *chip,
         buf[pos++] = FUSB302_TKN_SYNC1;
         buf[pos++] = FUSB302_TKN_SYNC2;
 
-        len = pd_header_cnt(msg->header) * 4;
+        len = pd_header_cnt_le(msg->header) * 4;
         /* plug 2 for header */
         len += 2;
         if (len > 0x1F) {
@@ -1481,7 +1485,7 @@ static int fusb302_pd_read_message(struct fusb302_chip *chip,
                                      (u8 *)&msg->header);
         if (ret < 0)
                 return ret;
-        len = pd_header_cnt(msg->header) * 4;
+        len = pd_header_cnt_le(msg->header) * 4;
         /* add 4 to length to include the CRC */
         if (len > PD_MAX_PAYLOAD * 4) {
                 fusb302_log(chip, "PD message too long %d", len);
@@ -1663,14 +1667,12 @@ static int init_gpio(struct fusb302_chip *chip)
         if (ret < 0) {
                 fusb302_log(chip,
                             "cannot set GPIO Int_N to input, ret=%d", ret);
-                gpio_free(chip->gpio_int_n);
                 return ret;
         }
         ret = gpio_to_irq(chip->gpio_int_n);
         if (ret < 0) {
                 fusb302_log(chip,
                             "cannot request IRQ for GPIO Int_N, ret=%d", ret);
-                gpio_free(chip->gpio_int_n);
                 return ret;
         }
         chip->gpio_int_n_irq = ret;
@@ -1787,11 +1789,13 @@ static const struct of_device_id fusb302_dt_match[] = {
         {.compatible = "fcs,fusb302"},
         {},
 };
+MODULE_DEVICE_TABLE(of, fusb302_dt_match);
 
 static const struct i2c_device_id fusb302_i2c_device_id[] = {
         {"typec_fusb302", 0},
         {},
 };
+MODULE_DEVICE_TABLE(i2c, fusb302_i2c_device_id);
 
 static const struct dev_pm_ops fusb302_pm_ops = {
         .suspend = fusb302_pm_suspend,
diff --git a/drivers/staging/typec/pd.h b/drivers/staging/typec/pd.h
index 8d97bdb95f23..510ef7279900 100644
--- a/drivers/staging/typec/pd.h
+++ b/drivers/staging/typec/pd.h
@@ -92,6 +92,16 @@ static inline unsigned int pd_header_type_le(__le16 header)
         return pd_header_type(le16_to_cpu(header));
 }
 
+static inline unsigned int pd_header_msgid(u16 header)
+{
+        return (header >> PD_HEADER_ID_SHIFT) & PD_HEADER_ID_MASK;
+}
+
+static inline unsigned int pd_header_msgid_le(__le16 header)
+{
+        return pd_header_msgid(le16_to_cpu(header));
+}
+
 #define PD_MAX_PAYLOAD          7
 
 struct pd_message {
diff --git a/drivers/staging/typec/pd_vdo.h b/drivers/staging/typec/pd_vdo.h
index dba172e0e0d1..d92259f8de0a 100644
--- a/drivers/staging/typec/pd_vdo.h
+++ b/drivers/staging/typec/pd_vdo.h
@@ -22,6 +22,9 @@
  * VDM object is minimum of VDM header + 6 additional data objects.
  */
 
+#define VDO_MAX_OBJECTS         6
+#define VDO_MAX_SIZE            (VDO_MAX_OBJECTS + 1)
+
 /*
  * VDM header
  * ----------
@@ -34,7 +37,6 @@
  * <5>      :: reserved (SVDM), command type (UVDM)
  * <4:0>    :: command
  */
-#define VDO_MAX_SIZE 7
 #define VDO(vid, type, custom)                          \
         (((vid) << 16) |                                \
          ((type) << 15) |                               \
diff --git a/drivers/staging/typec/tcpci.c b/drivers/staging/typec/tcpci.c
index 5e5be74c7850..df72d8b01e73 100644
--- a/drivers/staging/typec/tcpci.c
+++ b/drivers/staging/typec/tcpci.c
@@ -425,7 +425,7 @@ static const struct regmap_config tcpci_regmap_config = {
         .max_register = 0x7F, /* 0x80 .. 0xFF are vendor defined */
 };
 
-const struct tcpc_config tcpci_tcpc_config = {
+static const struct tcpc_config tcpci_tcpc_config = {
         .type = TYPEC_PORT_DFP,
         .default_role = TYPEC_SINK,
 };
diff --git a/drivers/staging/typec/tcpm.c b/drivers/staging/typec/tcpm.c
index abba655ba00a..20eb4ebcf8c3 100644
--- a/drivers/staging/typec/tcpm.c
+++ b/drivers/staging/typec/tcpm.c
@@ -238,6 +238,7 @@ struct tcpm_port {
         unsigned int hard_reset_count;
         bool pd_capable;
         bool explicit_contract;
+        unsigned int rx_msgid;
 
         /* Partner capabilities/requests */
         u32 sink_request;
@@ -251,6 +252,8 @@ struct tcpm_port {
         unsigned int nr_src_pdo;
         u32 snk_pdo[PDO_MAX_OBJECTS];
         unsigned int nr_snk_pdo;
+        u32 snk_vdo[VDO_MAX_OBJECTS];
+        unsigned int nr_snk_vdo;
 
         unsigned int max_snk_mv;
         unsigned int max_snk_ma;
@@ -997,6 +1000,7 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
         struct pd_mode_data *modep;
         int rlen = 0;
         u16 svid;
+        int i;
 
         tcpm_log(port, "Rx VDM cmd 0x%x type %d cmd %d len %d",
                  p0, cmd_type, cmd, cnt);
@@ -1007,6 +1011,14 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
         case CMDT_INIT:
                 switch (cmd) {
                 case CMD_DISCOVER_IDENT:
+                        /* 6.4.4.3.1: Only respond as UFP (device) */
+                        if (port->data_role == TYPEC_DEVICE &&
+                            port->nr_snk_vdo) {
+                                for (i = 0; i <  port->nr_snk_vdo; i++)
+                                        response[i + 1]
+                                                = cpu_to_le32(port->snk_vdo[i]);
+                                rlen = port->nr_snk_vdo + 1;
+                        }
                         break;
                 case CMD_DISCOVER_SVID:
                         break;
@@ -1415,6 +1427,7 @@ static void tcpm_pd_ctrl_request(struct tcpm_port *port,
                         break;
                 case SOFT_RESET_SEND:
                         port->message_id = 0;
+                        port->rx_msgid = -1;
                         if (port->pwr_role == TYPEC_SOURCE)
                                 next_state = SRC_SEND_CAPABILITIES;
                         else
@@ -1503,6 +1516,22 @@ static void tcpm_pd_rx_handler(struct work_struct *work)
                  port->attached);
 
         if (port->attached) {
+                enum pd_ctrl_msg_type type = pd_header_type_le(msg->header);
+                unsigned int msgid = pd_header_msgid_le(msg->header);
+
+                /*
+                 * USB PD standard, 6.6.1.2:
+                 * "... if MessageID value in a received Message is the
+                 * same as the stored value, the receiver shall return a
+                 * GoodCRC Message with that MessageID value and drop
+                 * the Message (this is a retry of an already received
+                 * Message). Note: this shall not apply to the Soft_Reset
+                 * Message which always has a MessageID value of zero."
+                 */
+                if (msgid == port->rx_msgid && type != PD_CTRL_SOFT_RESET)
+                        goto done;
+                port->rx_msgid = msgid;
+
                 /*
                  * If both ends believe to be DFP/host, we have a data role
                  * mismatch.
@@ -1520,6 +1549,7 @@ static void tcpm_pd_rx_handler(struct work_struct *work)
                 }
         }
 
+done:
         mutex_unlock(&port->lock);
         kfree(event);
 }
@@ -1719,8 +1749,7 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
         }
         ma = min(ma, port->max_snk_ma);
 
-        /* XXX: Any other flags need to be set? */
-        flags = 0;
+        flags = RDO_USB_COMM | RDO_NO_SUSPEND;
 
         /* Set mismatch bit if offered power is less than operating power */
         mw = ma * mv / 1000;
@@ -1957,6 +1986,12 @@ static void tcpm_reset_port(struct tcpm_port *port)
         port->attached = false;
         port->pd_capable = false;
 
+        /*
+         * First Rx ID should be 0; set this to a sentinel of -1 so that
+         * we can check tcpm_pd_rx_handler() if we had seen it before.
+         */
+        port->rx_msgid = -1;
+
         port->tcpc->set_pd_rx(port->tcpc, false);
         tcpm_init_vbus(port);   /* also disables charging */
         tcpm_init_vconn(port);
@@ -2170,6 +2205,7 @@ static void run_state_machine(struct tcpm_port *port)
                 port->pwr_opmode = TYPEC_PWR_MODE_USB;
                 port->caps_count = 0;
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 port->explicit_contract = false;
                 tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
                 break;
@@ -2329,6 +2365,7 @@ static void run_state_machine(struct tcpm_port *port)
                 typec_set_pwr_opmode(port->typec_port, TYPEC_PWR_MODE_USB);
                 port->pwr_opmode = TYPEC_PWR_MODE_USB;
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 port->explicit_contract = false;
                 tcpm_set_state(port, SNK_DISCOVERY, 0);
                 break;
@@ -2496,6 +2533,7 @@ static void run_state_machine(struct tcpm_port *port)
         /* Soft_Reset states */
         case SOFT_RESET:
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 tcpm_pd_send_control(port, PD_CTRL_ACCEPT);
                 if (port->pwr_role == TYPEC_SOURCE)
                         tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
@@ -2504,6 +2542,7 @@ static void run_state_machine(struct tcpm_port *port)
                 break;
         case SOFT_RESET_SEND:
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 if (tcpm_pd_send_control(port, PD_CTRL_SOFT_RESET))
                         tcpm_set_state_cond(port, hard_reset_state(port), 0);
                 else
@@ -2568,6 +2607,14 @@ static void run_state_machine(struct tcpm_port *port)
                 break;
         case PR_SWAP_SRC_SNK_SOURCE_OFF:
                 tcpm_set_cc(port, TYPEC_CC_RD);
+                /*
+                 * USB-PD standard, 6.2.1.4, Port Power Role:
+                 * "During the Power Role Swap Sequence, for the initial Source
+                 * Port, the Port Power Role field shall be set to Sink in the
+                 * PS_RDY Message indicating that the initial Source’s power
+                 * supply is turned off"
+                 */
+                tcpm_set_pwr_role(port, TYPEC_SINK);
                 if (tcpm_pd_send_control(port, PD_CTRL_PS_RDY)) {
                         tcpm_set_state(port, ERROR_RECOVERY, 0);
                         break;
@@ -2575,7 +2622,6 @@ static void run_state_machine(struct tcpm_port *port)
                 tcpm_set_state_cond(port, SNK_UNATTACHED, PD_T_PS_SOURCE_ON);
                 break;
         case PR_SWAP_SRC_SNK_SINK_ON:
-                tcpm_set_pwr_role(port, TYPEC_SINK);
                 tcpm_swap_complete(port, 0);
                 tcpm_set_state(port, SNK_STARTUP, 0);
                 break;
@@ -2587,8 +2633,15 @@ static void run_state_machine(struct tcpm_port *port)
         case PR_SWAP_SNK_SRC_SOURCE_ON:
                 tcpm_set_cc(port, tcpm_rp_cc(port));
                 tcpm_set_vbus(port, true);
-                tcpm_pd_send_control(port, PD_CTRL_PS_RDY);
+                /*
+                 * USB PD standard, 6.2.1.4:
+                 * "Subsequent Messages initiated by the Policy Engine,
+                 * such as the PS_RDY Message sent to indicate that Vbus
+                 * is ready, will have the Port Power Role field set to
+                 * Source."
+                 */
                 tcpm_set_pwr_role(port, TYPEC_SOURCE);
+                tcpm_pd_send_control(port, PD_CTRL_PS_RDY);
                 tcpm_swap_complete(port, 0);
                 tcpm_set_state(port, SRC_STARTUP, 0);
                 break;
@@ -3292,6 +3345,20 @@ static int tcpm_copy_pdos(u32 *dest_pdo, const u32 *src_pdo,
         return nr_pdo;
 }
 
+static int tcpm_copy_vdos(u32 *dest_vdo, const u32 *src_vdo,
+                          unsigned int nr_vdo)
+{
+        unsigned int i;
+
+        if (nr_vdo > VDO_MAX_OBJECTS)
+                nr_vdo = VDO_MAX_OBJECTS;
+
+        for (i = 0; i < nr_vdo; i++)
+                dest_vdo[i] = src_vdo[i];
+
+        return nr_vdo;
+}
+
 void tcpm_update_source_capabilities(struct tcpm_port *port, const u32 *pdo,
                                      unsigned int nr_pdo)
 {
@@ -3382,6 +3449,8 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
                                           tcpc->config->nr_src_pdo);
         port->nr_snk_pdo = tcpm_copy_pdos(port->snk_pdo, tcpc->config->snk_pdo,
                                           tcpc->config->nr_snk_pdo);
+        port->nr_snk_vdo = tcpm_copy_vdos(port->snk_vdo, tcpc->config->snk_vdo,
+                                          tcpc->config->nr_snk_vdo);
 
         port->max_snk_mv = tcpc->config->max_snk_mv;
         port->max_snk_ma = tcpc->config->max_snk_ma;
diff --git a/drivers/staging/typec/tcpm.h b/drivers/staging/typec/tcpm.h
index 969b365e6549..19c307d31a5a 100644
--- a/drivers/staging/typec/tcpm.h
+++ b/drivers/staging/typec/tcpm.h
@@ -60,6 +60,9 @@ struct tcpc_config {
         const u32 *snk_pdo;
         unsigned int nr_snk_pdo;
 
+        const u32 *snk_vdo;
+        unsigned int nr_snk_vdo;
+
         unsigned int max_snk_mv;
         unsigned int max_snk_ma;
         unsigned int max_snk_mw;
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 988ee61fb4a7..d04db3f55519 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -502,8 +502,15 @@ create_pagelist(char __user *buf, size_t count, unsigned short type,
          */
         sg_init_table(scatterlist, num_pages);
         /* Now set the pages for each scatterlist */
-        for (i = 0; i < num_pages; i++)
-                sg_set_page(scatterlist + i, pages[i], PAGE_SIZE, 0);
+        for (i = 0; i < num_pages; i++) {
+                unsigned int len = PAGE_SIZE - offset;
+
+                if (len > count)
+                        len = count;
+                sg_set_page(scatterlist + i, pages[i], len, offset);
+                offset = 0;
+                count -= len;
+        }
 
         dma_buffers = dma_map_sg(g_dev,
                                  scatterlist,
@@ -524,20 +531,20 @@ create_pagelist(char __user *buf, size_t count, unsigned short type,
                 u32 addr = sg_dma_address(sg);
 
                 /* Note: addrs is the address + page_count - 1
-                 * The firmware expects the block to be page
+                 * The firmware expects blocks after the first to be page-
                  * aligned and a multiple of the page size
                  */
                 WARN_ON(len == 0);
-                WARN_ON(len & ~PAGE_MASK);
-                WARN_ON(addr & ~PAGE_MASK);
+                WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
+                WARN_ON(i && (addr & ~PAGE_MASK));
                 if (k > 0 &&
-                    ((addrs[k - 1] & PAGE_MASK) |
-                        ((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT)
-                    == addr) {
-                        addrs[k - 1] += (len >> PAGE_SHIFT);
-                } else {
-                        addrs[k++] = addr | ((len >> PAGE_SHIFT) - 1);
-                }
+                    ((addrs[k - 1] & PAGE_MASK) +
+                     (((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT))
+                    == (addr & PAGE_MASK))
+                        addrs[k - 1] += ((len + PAGE_SIZE - 1) >> PAGE_SHIFT);
+                else
+                        addrs[k++] = (addr & PAGE_MASK) |
+                                (((len + PAGE_SIZE - 1) >> PAGE_SHIFT) - 1);
         }
 
         /* Partial cache lines (fragments) require special measures */
diff --git a/drivers/tee/Kconfig b/drivers/tee/Kconfig
index 2330a4eb4e8b..a6df12d88f90 100644
--- a/drivers/tee/Kconfig
+++ b/drivers/tee/Kconfig
@@ -1,6 +1,7 @@
 # Generic Trusted Execution Environment Configuration
 config TEE
         tristate "Trusted Execution Environment support"
+        depends on HAVE_ARM_SMCCC || COMPILE_TEST
         select DMA_SHARED_BUFFER
         select GENERIC_ALLOCATOR
         help
diff --git a/drivers/thermal/broadcom/Kconfig b/drivers/thermal/broadcom/Kconfig
index ab08af4654ef..42c098e86f84 100644
--- a/drivers/thermal/broadcom/Kconfig
+++ b/drivers/thermal/broadcom/Kconfig
@@ -9,8 +9,9 @@ config BCM2835_THERMAL
 config BCM_NS_THERMAL
         tristate "Northstar thermal driver"
         depends on ARCH_BCM_IPROC || COMPILE_TEST
+        default y if ARCH_BCM_IPROC
         help
-          Northstar is a family of SoCs that includes e.g. BCM4708, BCM47081,
-          BCM4709 and BCM47094. It contains DMU (Device Management Unit) block
-          with a thermal sensor that allows checking CPU temperature. This
-          driver provides support for it.
+          Support for the Northstar and Northstar Plus family of SoCs (e.g.
+          BCM4708, BCM4709, BCM5301x, BCM95852X, etc). It contains DMU (Device
+          Management Unit) block with a thermal sensor that allows checking CPU
+          temperature.
diff --git a/drivers/thermal/qoriq_thermal.c b/drivers/thermal/qoriq_thermal.c
index 644ba526d9ea..4362a69ac88d 100644
--- a/drivers/thermal/qoriq_thermal.c
+++ b/drivers/thermal/qoriq_thermal.c
@@ -195,7 +195,6 @@ static struct thermal_zone_of_device_ops tmu_tz_ops = {
 static int qoriq_tmu_probe(struct platform_device *pdev)
 {
         int ret;
-        const struct thermal_trip *trip;
         struct qoriq_tmu_data *data;
         struct device_node *np = pdev->dev.of_node;
         u32 site = 0;
@@ -243,8 +242,6 @@ static int qoriq_tmu_probe(struct platform_device *pdev)
                 goto err_tmu;
         }
 
-        trip = of_thermal_get_trip_points(data->tz);
-
         /* Enable monitoring */
         site |= 0x1 << (15 - data->sensor_id);
         tmu_write(data, site | TMR_ME | TMR_ALPF, &data->regs->tmr);
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index b21b9cc2c8d6..5a51c740e372 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -359,7 +359,7 @@ static DECLARE_DELAYED_WORK(thermal_emergency_poweroff_work,
  * This may be called from any critical situation to trigger a system shutdown
  * after a known period of time. By default this is not scheduled.
  */
-void thermal_emergency_poweroff(void)
+static void thermal_emergency_poweroff(void)
 {
         int poweroff_delay_ms = CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS;
         /*
diff --git a/drivers/thermal/ti-soc-thermal/ti-bandgap.c b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
index ba9c302454fb..696ab3046b87 100644
--- a/drivers/thermal/ti-soc-thermal/ti-bandgap.c
+++ b/drivers/thermal/ti-soc-thermal/ti-bandgap.c
@@ -1010,7 +1010,7 @@ ti_bandgap_force_single_read(struct ti_bandgap *bgp, int id)
 }
 
 /**
- * ti_bandgap_set_continous_mode() - One time enabling of continuous mode
+ * ti_bandgap_set_continuous_mode() - One time enabling of continuous mode
  * @bgp: pointer to struct ti_bandgap
  *
  * Call this function only if HAS(MODE_CONFIG) is set. As this driver may
@@ -1214,22 +1214,18 @@ static struct ti_bandgap *ti_bandgap_build(struct platform_device *pdev)
         }
 
         bgp = devm_kzalloc(&pdev->dev, sizeof(*bgp), GFP_KERNEL);
-        if (!bgp) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        if (!bgp)
                 return ERR_PTR(-ENOMEM);
-        }
 
         of_id = of_match_device(of_ti_bandgap_match, &pdev->dev);
         if (of_id)
                 bgp->conf = of_id->data;
 
         /* register shadow for context save and restore */
-        bgp->regval = devm_kzalloc(&pdev->dev, sizeof(*bgp->regval) *
-                                   bgp->conf->sensor_count, GFP_KERNEL);
-        if (!bgp->regval) {
-                dev_err(&pdev->dev, "Unable to allocate mem for driver ref\n");
+        bgp->regval = devm_kcalloc(&pdev->dev, bgp->conf->sensor_count,
+                                   sizeof(*bgp->regval), GFP_KERNEL);
+        if (!bgp->regval)
                 return ERR_PTR(-ENOMEM);
-        }
 
         i = 0;
         do {
diff --git a/drivers/tty/ehv_bytechan.c b/drivers/tty/ehv_bytechan.c
index 7ac9bcdf1e61..61fe8d6fd24e 100644
--- a/drivers/tty/ehv_bytechan.c
+++ b/drivers/tty/ehv_bytechan.c
@@ -764,7 +764,7 @@ static int __init ehv_bc_init(void)
         ehv_bc_driver = alloc_tty_driver(count);
         if (!ehv_bc_driver) {
                 ret = -ENOMEM;
-                goto error;
+                goto err_free_bcs;
         }
 
         ehv_bc_driver->driver_name = "ehv-bc";
@@ -778,24 +778,23 @@ static int __init ehv_bc_init(void)
         ret = tty_register_driver(ehv_bc_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register tty driver (ret=%i)\n", ret);
-                goto error;
+                goto err_put_tty_driver;
         }
 
         ret = platform_driver_register(&ehv_bc_tty_driver);
         if (ret) {
                 pr_err("ehv-bc: could not register platform driver (ret=%i)\n",
                        ret);
-                goto error;
+                goto err_deregister_tty_driver;
         }
 
         return 0;
 
-error:
-        if (ehv_bc_driver) {
-                tty_unregister_driver(ehv_bc_driver);
-                put_tty_driver(ehv_bc_driver);
-        }
-
+err_deregister_tty_driver:
+        tty_unregister_driver(ehv_bc_driver);
+err_put_tty_driver:
+        put_tty_driver(ehv_bc_driver);
+err_free_bcs:
         kfree(bcs);
 
         return ret;
diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
index 433de5ea9b02..f71b47334149 100644
--- a/drivers/tty/serdev/core.c
+++ b/drivers/tty/serdev/core.c
@@ -122,6 +122,18 @@ void serdev_device_write_wakeup(struct serdev_device *serdev)
 }
 EXPORT_SYMBOL_GPL(serdev_device_write_wakeup);
 
+int serdev_device_write_buf(struct serdev_device *serdev,
+                            const unsigned char *buf, size_t count)
+{
+        struct serdev_controller *ctrl = serdev->ctrl;
+
+        if (!ctrl || !ctrl->ops->write_buf)
+                return -EINVAL;
+
+        return ctrl->ops->write_buf(ctrl, buf, count);
+}
+EXPORT_SYMBOL_GPL(serdev_device_write_buf);
+
 int serdev_device_write(struct serdev_device *serdev,
                         const unsigned char *buf, size_t count,
                         unsigned long timeout)
diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
index 487c88f6aa0e..d0a021c93986 100644
--- a/drivers/tty/serdev/serdev-ttyport.c
+++ b/drivers/tty/serdev/serdev-ttyport.c
@@ -102,9 +102,6 @@ static int ttyport_open(struct serdev_controller *ctrl)
                 return PTR_ERR(tty);
         serport->tty = tty;
 
-        serport->port->client_ops = &client_ops;
-        serport->port->client_data = ctrl;
-
         if (tty->ops->open)
                 tty->ops->open(serport->tty, NULL);
         else
@@ -215,6 +212,7 @@ struct device *serdev_tty_port_register(struct tty_port *port,
                                         struct device *parent,
                                         struct tty_driver *drv, int idx)
 {
+        const struct tty_port_client_operations *old_ops;
         struct serdev_controller *ctrl;
         struct serport *serport;
         int ret;
@@ -233,28 +231,37 @@ struct device *serdev_tty_port_register(struct tty_port *port,
 
         ctrl->ops = &ctrl_ops;
 
+        old_ops = port->client_ops;
+        port->client_ops = &client_ops;
+        port->client_data = ctrl;
+
         ret = serdev_controller_add(ctrl);
         if (ret)
-                goto err_controller_put;
+                goto err_reset_data;
 
         dev_info(&ctrl->dev, "tty port %s%d registered\n", drv->name, idx);
         return &ctrl->dev;
 
-err_controller_put:
+err_reset_data:
+        port->client_data = NULL;
+        port->client_ops = old_ops;
         serdev_controller_put(ctrl);
+
         return ERR_PTR(ret);
 }
 
-void serdev_tty_port_unregister(struct tty_port *port)
+int serdev_tty_port_unregister(struct tty_port *port)
 {
         struct serdev_controller *ctrl = port->client_data;
         struct serport *serport = serdev_controller_get_drvdata(ctrl);
 
         if (!serport)
-                return;
+                return -ENODEV;
 
         serdev_controller_remove(ctrl);
         port->client_ops = NULL;
         port->client_data = NULL;
         serdev_controller_put(ctrl);
+
+        return 0;
 }
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 09a65a3ec7f7..68fd045a7025 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -47,6 +47,7 @@
 /*
  * These are definitions for the Exar XR17V35X and XR17(C|D)15X
  */
+#define UART_EXAR_INT0          0x80
 #define UART_EXAR_SLEEP         0x8b    /* Sleep mode */
 #define UART_EXAR_DVID          0x8d    /* Device identification */
 
@@ -1337,7 +1338,7 @@ out_lock:
         /*
          * Check if the device is a Fintek F81216A
          */
-        if (port->type == PORT_16550A)
+        if (port->type == PORT_16550A && port->iotype == UPIO_PORT)
                 fintek_8250_probe(up);
 
         if (up->capabilities != old_capabilities) {
@@ -1869,17 +1870,13 @@ static int serial8250_default_handle_irq(struct uart_port *port)
 static int exar_handle_irq(struct uart_port *port)
 {
         unsigned int iir = serial_port_in(port, UART_IIR);
-        int ret;
+        int ret = 0;
 
-        ret = serial8250_handle_irq(port, iir);
+        if (((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X)) &&
+            serial_port_in(port, UART_EXAR_INT0) != 0)
+                ret = 1;
 
-        if ((port->type == PORT_XR17V35X) ||
-           (port->type == PORT_XR17D15X)) {
-                serial_port_in(port, 0x80);
-                serial_port_in(port, 0x81);
-                serial_port_in(port, 0x82);
-                serial_port_in(port, 0x83);
-        }
+        ret |= serial8250_handle_irq(port, iir);
 
         return ret;
 }
@@ -2177,6 +2174,8 @@ int serial8250_do_startup(struct uart_port *port)
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
 
         /*
          * At this point, there's no way the LSR could still be 0xff;
@@ -2335,6 +2334,8 @@ dont_test_tx_en:
         serial_port_in(port, UART_RX);
         serial_port_in(port, UART_IIR);
         serial_port_in(port, UART_MSR);
+        if ((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X))
+                serial_port_in(port, UART_EXAR_INT0);
         up->lsr_saved_flags = 0;
         up->msr_saved_flags = 0;
 
diff --git a/drivers/tty/serial/altera_jtaguart.c b/drivers/tty/serial/altera_jtaguart.c
index 18e3f8342b85..0475f5d261ce 100644
--- a/drivers/tty/serial/altera_jtaguart.c
+++ b/drivers/tty/serial/altera_jtaguart.c
@@ -478,6 +478,7 @@ static int altera_jtaguart_remove(struct platform_device *pdev)
 
         port = &altera_jtaguart_ports[i].port;
         uart_remove_one_port(&altera_jtaguart_driver, port);
+        iounmap(port->membase);
 
         return 0;
 }
diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c
index 46d3438a0d27..3e4b717670d7 100644
--- a/drivers/tty/serial/altera_uart.c
+++ b/drivers/tty/serial/altera_uart.c
@@ -615,6 +615,7 @@ static int altera_uart_remove(struct platform_device *pdev)
         if (port) {
                 uart_remove_one_port(&altera_uart_driver, port);
                 port->mapbase = 0;
+                iounmap(port->membase);
         }
 
         return 0;
diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c
index ebd8569f9ad5..9fff25be87f9 100644
--- a/drivers/tty/serial/efm32-uart.c
+++ b/drivers/tty/serial/efm32-uart.c
@@ -27,6 +27,7 @@
 #define UARTn_FRAME             0x04
 #define UARTn_FRAME_DATABITS__MASK      0x000f
 #define UARTn_FRAME_DATABITS(n)         ((n) - 3)
+#define UARTn_FRAME_PARITY__MASK        0x0300
 #define UARTn_FRAME_PARITY_NONE         0x0000
 #define UARTn_FRAME_PARITY_EVEN         0x0200
 #define UARTn_FRAME_PARITY_ODD          0x0300
@@ -572,12 +573,16 @@ static void efm32_uart_console_get_options(struct efm32_uart_port *efm_port,
                         16 * (4 + (clkdiv >> 6)));
 
         frame = efm32_uart_read32(efm_port, UARTn_FRAME);
-        if (frame & UARTn_FRAME_PARITY_ODD)
+        switch (frame & UARTn_FRAME_PARITY__MASK) {
+        case UARTn_FRAME_PARITY_ODD:
                 *parity = 'o';
-        else if (frame & UARTn_FRAME_PARITY_EVEN)
+                break;
+        case UARTn_FRAME_PARITY_EVEN:
                 *parity = 'e';
-        else
+                break;
+        default:
                 *parity = 'n';
+        }
 
         *bits = (frame & UARTn_FRAME_DATABITS__MASK) -
                         UARTn_FRAME_DATABITS(4) + 4;
diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
index 157883653256..f190a84a0246 100644
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1382,9 +1382,9 @@ static struct spi_driver ifx_spi_driver = {
 static void __exit ifx_spi_exit(void)
 {
         /* unregister */
+        spi_unregister_driver(&ifx_spi_driver);
         tty_unregister_driver(tty_drv);
         put_tty_driver(tty_drv);
-        spi_unregister_driver(&ifx_spi_driver);
         unregister_reboot_notifier(&ifx_modem_reboot_notifier_block);
 }
 
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 33509b4beaec..bbefddd92bfe 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2184,7 +2184,9 @@ static int serial_imx_probe(struct platform_device *pdev)
                  * and DCD (when they are outputs) or enables the respective
                  * irqs. So set this bit early, i.e. before requesting irqs.
                  */
-                writel(UFCR_DCEDTE, sport->port.membase + UFCR);
+                reg = readl(sport->port.membase + UFCR);
+                if (!(reg & UFCR_DCEDTE))
+                        writel(reg | UFCR_DCEDTE, sport->port.membase + UFCR);
 
                 /*
                  * Disable UCR3_RI and UCR3_DCD irqs. They are also not
@@ -2195,7 +2197,15 @@ static int serial_imx_probe(struct platform_device *pdev)
                        sport->port.membase + UCR3);
 
         } else {
-                writel(0, sport->port.membase + UFCR);
+                unsigned long ucr3 = UCR3_DSR;
+
+                reg = readl(sport->port.membase + UFCR);
+                if (reg & UFCR_DCEDTE)
+                        writel(reg & ~UFCR_DCEDTE, sport->port.membase + UFCR);
+
+                if (!is_imx1_uart(sport))
+                        ucr3 |= IMX21_UCR3_RXDMUXSEL | UCR3_ADNIMP;
+                writel(ucr3, sport->port.membase + UCR3);
         }
 
         clk_disable_unprepare(sport->clk_ipg);
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 0f45b7884a2c..13bfd5dcffce 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -2083,7 +2083,7 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
         mutex_lock(&port->mutex);
 
         tty_dev = device_find_child(uport->dev, &match, serial_match_port);
-        if (device_may_wakeup(tty_dev)) {
+        if (tty_dev && device_may_wakeup(tty_dev)) {
                 if (!enable_irq_wake(uport->irq))
                         uport->irq_wake = 1;
                 put_device(tty_dev);
@@ -2782,7 +2782,7 @@ int uart_add_one_port(struct uart_driver *drv, struct uart_port *uport)
          * Register the port whether it's detected or not.  This allows
          * setserial to be used to alter this port's parameters.
          */
-        tty_dev = tty_port_register_device_attr(port, drv->tty_driver,
+        tty_dev = tty_port_register_device_attr_serdev(port, drv->tty_driver,
                         uport->line, uport->dev, port, uport->tty_groups);
         if (likely(!IS_ERR(tty_dev))) {
                 device_set_wakeup_capable(tty_dev, 1);
@@ -2845,7 +2845,7 @@ int uart_remove_one_port(struct uart_driver *drv, struct uart_port *uport)
         /*
          * Remove the devices from the tty layer
          */
-        tty_unregister_device(drv->tty_driver, uport->line);
+        tty_port_unregister_device(port, drv->tty_driver, uport->line);
 
         tty = tty_port_tty_get(port);
         if (tty) {
diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 1d21a9c1d33e..4fb3165384c4 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -34,7 +34,9 @@ static int tty_port_default_receive_buf(struct tty_port *port,
         if (!disc)
                 return 0;
 
+        mutex_lock(&tty->atomic_write_lock);
         ret = tty_ldisc_receive_buf(disc, p, (char *)f, count);
+        mutex_unlock(&tty->atomic_write_lock);
 
         tty_ldisc_deref(disc);
 
@@ -129,19 +131,85 @@ struct device *tty_port_register_device_attr(struct tty_port *port,
                 struct device *device, void *drvdata,
                 const struct attribute_group **attr_grp)
 {
+        tty_port_link_device(port, driver, index);
+        return tty_register_device_attr(driver, index, device, drvdata,
+                        attr_grp);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+
+/**
+ * tty_port_register_device_attr_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ * @drvdata: driver data for the device
+ * @attr_grp: attribute group for the device
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_attr_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device, void *drvdata,
+                const struct attribute_group **attr_grp)
+{
         struct device *dev;
 
         tty_port_link_device(port, driver, index);
 
         dev = serdev_tty_port_register(port, device, driver, index);
-        if (PTR_ERR(dev) != -ENODEV)
+        if (PTR_ERR(dev) != -ENODEV) {
                 /* Skip creating cdev if we registered a serdev device */
                 return dev;
+        }
 
         return tty_register_device_attr(driver, index, device, drvdata,
                         attr_grp);
 }
-EXPORT_SYMBOL_GPL(tty_port_register_device_attr);
+EXPORT_SYMBOL_GPL(tty_port_register_device_attr_serdev);
+
+/**
+ * tty_port_register_device_serdev - register tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ * @device: parent if exists, otherwise NULL
+ *
+ * Register a serdev or tty device depending on if the parent device has any
+ * defined serdev clients or not.
+ */
+struct device *tty_port_register_device_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device)
+{
+        return tty_port_register_device_attr_serdev(port, driver, index,
+                        device, NULL, NULL);
+}
+EXPORT_SYMBOL_GPL(tty_port_register_device_serdev);
+
+/**
+ * tty_port_unregister_device - deregister a tty or serdev device
+ * @port: tty_port of the device
+ * @driver: tty_driver for this device
+ * @index: index of the tty
+ *
+ * If a tty or serdev device is registered with a call to
+ * tty_port_register_device_serdev() then this function must be called when
+ * the device is gone.
+ */
+void tty_port_unregister_device(struct tty_port *port,
+                struct tty_driver *driver, unsigned index)
+{
+        int ret;
+
+        ret = serdev_tty_port_unregister(port);
+        if (ret == 0)
+                return;
+
+        tty_unregister_device(driver, index);
+}
+EXPORT_SYMBOL_GPL(tty_port_unregister_device);
 
 int tty_port_alloc_xmit_buf(struct tty_port *port)
 {
@@ -189,9 +257,6 @@ static void tty_port_destructor(struct kref *kref)
         /* check if last port ref was dropped before tty release */
         if (WARN_ON(port->itty))
                 return;
-
-        serdev_tty_port_unregister(port);
-
         if (port->xmit_buf)
                 free_page((unsigned long)port->xmit_buf);
         tty_port_destroy(port);
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 1c196f87e9d9..ff04b7f8549f 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -279,7 +279,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                 map = kzalloc(sizeof(*map), GFP_KERNEL);
                 if (!map) {
                         ret = -ENOMEM;
-                        goto err_map_kobj;
+                        goto err_map;
                 }
                 kobject_init(&map->kobj, &map_attr_type);
                 map->mem = mem;
@@ -289,7 +289,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                         goto err_map_kobj;
                 ret = kobject_uevent(&map->kobj, KOBJ_ADD);
                 if (ret)
-                        goto err_map;
+                        goto err_map_kobj;
         }
 
         for (pi = 0; pi < MAX_UIO_PORT_REGIONS; pi++) {
@@ -308,7 +308,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                 portio = kzalloc(sizeof(*portio), GFP_KERNEL);
                 if (!portio) {
                         ret = -ENOMEM;
-                        goto err_portio_kobj;
+                        goto err_portio;
                 }
                 kobject_init(&portio->kobj, &portio_attr_type);
                 portio->port = port;
@@ -319,7 +319,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                         goto err_portio_kobj;
                 ret = kobject_uevent(&portio->kobj, KOBJ_ADD);
                 if (ret)
-                        goto err_portio;
+                        goto err_portio_kobj;
         }
 
         return 0;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index cfc3cff6e8d5..8e6ef671be9b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device *udev,
 
         if (userurb) {          /* Async */
                 if (when == SUBMIT)
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "length %u\n",
                                         userurb, ep, t, d, length);
                 else
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "actual_length %u status %d\n",
                                         userurb, ep, t, d, length,
                                         timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
 #endif
 
         case USBDEVFS_DISCARDURB:
-                snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+                snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
                 ret = proc_unlinkurb(ps, p);
                 break;
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 49550790a3cb..5dea98358c05 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1723,7 +1723,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
                 if (retval == 0)
                         retval = -EINPROGRESS;
                 else if (retval != -EIDRM && retval != -EBUSY)
-                        dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+                        dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
                                         urb, retval);
                 usb_put_dev(udev);
         }
@@ -1890,7 +1890,7 @@ rescan:
                 /* kick hcd */
                 unlink1(hcd, urb, -ESHUTDOWN);
                 dev_dbg (hcd->self.controller,
-                        "shutdown urb %p ep%d%s%s\n",
+                        "shutdown urb %pK ep%d%s%s\n",
                         urb, usb_endpoint_num(&ep->desc),
                         is_in ? "in" : "out",
                         ({      char *s;
@@ -2520,6 +2520,7 @@ struct usb_hcd *__usb_create_hcd(const struct hc_driver *driver,
                 hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
                                 GFP_KERNEL);
                 if (!hcd->bandwidth_mutex) {
+                        kfree(hcd->address0_mutex);
                         kfree(hcd);
                         dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");
                         return NULL;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 9dca59ef18b3..b8bb20d7acdb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -362,7 +362,8 @@ static void usb_set_lpm_parameters(struct usb_device *udev)
 }
 
 /* USB 2.0 spec Section 11.24.4.5 */
-static int get_hub_descriptor(struct usb_device *hdev, void *data)
+static int get_hub_descriptor(struct usb_device *hdev,
+                struct usb_hub_descriptor *desc)
 {
         int i, ret, size;
         unsigned dtype;
@@ -378,10 +379,18 @@ static int get_hub_descriptor(struct usb_device *hdev, void *data)
         for (i = 0; i < 3; i++) {
                 ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
-                        dtype << 8, 0, data, size,
+                        dtype << 8, 0, desc, size,
                         USB_CTRL_GET_TIMEOUT);
-                if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+                if (hub_is_superspeed(hdev)) {
+                        if (ret == size)
+                                return ret;
+                } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) {
+                        /* Make sure we have the DeviceRemovable field. */
+                        size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1;
+                        if (ret < size)
+                                return -EMSGSIZE;
                         return ret;
+                }
         }
         return -EINVAL;
 }
@@ -1313,7 +1322,7 @@ static int hub_configure(struct usb_hub *hub,
         }
         mutex_init(&hub->status_mutex);
 
-        hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
+        hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL);
         if (!hub->descriptor) {
                 ret = -ENOMEM;
                 goto fail;
@@ -1321,13 +1330,19 @@ static int hub_configure(struct usb_hub *hub,
 
         /* Request the entire hub descriptor.
          * hub->descriptor can handle USB_MAXCHILDREN ports,
-         * but the hub can/will return fewer bytes here.
+         * but a (non-SS) hub can/will return fewer bytes here.
          */
         ret = get_hub_descriptor(hdev, hub->descriptor);
         if (ret < 0) {
                 message = "can't read hub descriptor";
                 goto fail;
-        } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+        }
+
+        maxchild = USB_MAXCHILDREN;
+        if (hub_is_superspeed(hdev))
+                maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+        if (hub->descriptor->bNbrPorts > maxchild) {
                 message = "hub has too many ports!";
                 ret = -ENODEV;
                 goto fail;
diff --git a/drivers/usb/core/of.c b/drivers/usb/core/of.c
index d787f195a9a6..d563cbcf76cf 100644
--- a/drivers/usb/core/of.c
+++ b/drivers/usb/core/of.c
@@ -53,6 +53,9 @@ EXPORT_SYMBOL_GPL(usb_of_get_child_node);
  *
  * Find the companion device from platform bus.
  *
+ * Takes a reference to the returned struct device which needs to be dropped
+ * after use.
+ *
  * Return: On success, a pointer to the companion device, %NULL on failure.
  */
 struct device *usb_of_get_companion_dev(struct device *dev)
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index d75cb8c0f7df..47903d510955 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
         if (!urb || !urb->complete)
                 return -EINVAL;
         if (urb->hcpriv) {
-                WARN_ONCE(1, "URB %p submitted while active\n", urb);
+                WARN_ONCE(1, "URB %pK submitted while active\n", urb);
                 return -EBUSY;
         }
 
diff --git a/drivers/usb/dwc3/dwc3-keystone.c b/drivers/usb/dwc3/dwc3-keystone.c
index 72664700b8a2..12ee23f53cdd 100644
--- a/drivers/usb/dwc3/dwc3-keystone.c
+++ b/drivers/usb/dwc3/dwc3-keystone.c
@@ -107,6 +107,10 @@ static int kdwc3_probe(struct platform_device *pdev)
                 return PTR_ERR(kdwc->usbss);
 
         kdwc->clk = devm_clk_get(kdwc->dev, "usb");
+        if (IS_ERR(kdwc->clk)) {
+                dev_err(kdwc->dev, "unable to get usb clock\n");
+                return PTR_ERR(kdwc->clk);
+        }
 
         error = clk_prepare_enable(kdwc->clk);
         if (error < 0) {
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index a15ec71d0423..84a2cebfc712 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -39,6 +39,8 @@
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
 #define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
 #define PCI_DEVICE_ID_INTEL_GLK                 0x31aa
+#define PCI_DEVICE_ID_INTEL_CNPLP               0x9dee
+#define PCI_DEVICE_ID_INTEL_CNPH                0xa36e
 
 #define PCI_INTEL_BXT_DSM_UUID          "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
 #define PCI_INTEL_BXT_FUNC_PMU_PWR      4
@@ -270,6 +272,8 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6f6f0b3be3ad..aea9a5b948b4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1261,14 +1261,24 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
                                 __dwc3_gadget_start_isoc(dwc, dep, cur_uf);
                                 dep->flags &= ~DWC3_EP_PENDING_REQUEST;
                         }
+                        return 0;
                 }
-                return 0;
+
+                if ((dep->flags & DWC3_EP_BUSY) &&
+                    !(dep->flags & DWC3_EP_MISSED_ISOC)) {
+                        WARN_ON_ONCE(!dep->resource_index);
+                        ret = __dwc3_gadget_kick_transfer(dep,
+                                                          dep->resource_index);
+                }
+
+                goto out;
         }
 
         if (!dwc3_calc_trbs_left(dep))
                 return 0;
 
         ret = __dwc3_gadget_kick_transfer(dep, 0);
+out:
         if (ret == -EBUSY)
                 ret = 0;
 
@@ -3026,6 +3036,15 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt)
                 return IRQ_HANDLED;
         }
 
+        /*
+         * With PCIe legacy interrupt, test shows that top-half irq handler can
+         * be called again after HW interrupt deassertion. Check if bottom-half
+         * irq event handler completes before caching new event to prevent
+         * losing events.
+         */
+        if (evt->flags & DWC3_EVENT_PENDING)
+                return IRQ_HANDLED;
+
         count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
         count &= DWC3_GEVNTCOUNT_MASK;
         if (!count)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 71dd27c0d7f2..47dda3450abd 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1858,12 +1858,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
                 ep->ep->driver_data = ep;
                 ep->ep->desc = ds;
 
-                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
-                                USB_DT_ENDPOINT_SIZE);
-                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-
-                if (needs_comp_desc)
+                if (needs_comp_desc) {
+                        comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                        USB_DT_ENDPOINT_SIZE);
+                        ep->ep->maxburst = comp_desc->bMaxBurst + 1;
                         ep->ep->comp_desc = comp_desc;
+                }
 
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 000677c991b0..9b0805f55ad7 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -1256,7 +1256,7 @@ static void gserial_console_exit(void)
         struct gscons_info *info = &gscons_info;
 
         unregister_console(&gserial_cons);
-        if (info->console_thread != NULL)
+        if (!IS_ERR_OR_NULL(info->console_thread))
                 kthread_stop(info->console_thread);
         gs_buf_free(&info->con_buf);
 }
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c79081952ea0..ccabb51cb98d 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2008,7 +2008,7 @@ ss_hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
         desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/
-        desc->u.ss.DeviceRemovable = 0xffff;
+        desc->u.ss.DeviceRemovable = 0;
 }
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
@@ -2020,8 +2020,8 @@ static inline void hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_INDV_PORT_LPSM |
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        desc->u.hs.DeviceRemovable[0] = 0;
+        desc->u.hs.DeviceRemovable[1] = 0xff;   /* PortPwrCtrlMask */
 }
 
 static int dummy_hub_control(
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index bc7b9be12f54..f1908ea9fbd8 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -384,8 +384,10 @@ static int ehci_platform_resume(struct device *dev)
         }
 
         companion_dev = usb_of_get_companion_dev(hcd->self.controller);
-        if (companion_dev)
+        if (companion_dev) {
                 device_pm_wait_for_dev(hcd->self.controller, companion_dev);
+                put_device(companion_dev);
+        }
 
         ehci_resume(hcd, priv->reset_on_resume);
         return 0;
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index bfa7fa3d2eea..7bf78be1fd32 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
                         time = 30;
                         break;
                 default:
-                        time = 300;
+                        time = 50;
                         break;
                 }
 
@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                 pipe = td->pipe;
                 pipe_stop(r8a66597, pipe);
 
+                /* Select a different address or endpoint */
                 new_td = td;
                 do {
                         list_move_tail(&new_td->queue,
@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                                 new_td = td;
                                 break;
                         }
-                } while (td != new_td && td->address == new_td->address);
+                } while (td != new_td && td->address == new_td->address &&
+                        td->pipe->info.epnum == new_td->pipe->info.epnum);
 
                 start_transfer(r8a66597, new_td);
 
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 5e3e9d4c6956..0dde49c35dd2 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -419,7 +419,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
         wait_for_completion(cmd->completion);
 
         if (cmd->status == COMP_COMMAND_ABORTED ||
-                        cmd->status == COMP_STOPPED) {
+            cmd->status == COMP_COMMAND_RING_STOPPED) {
                 xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
                 ret = -ETIME;
         }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index bbe22bcc550a..1f1687e888d6 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci,
         }
 
         if (max_packet) {
-                seg->bounce_buf = kzalloc(max_packet, flags | GFP_DMA);
+                seg->bounce_buf = kzalloc(max_packet, flags);
                 if (!seg->bounce_buf) {
                         dma_pool_free(xhci->segment_pool, seg->trbs, dma);
                         kfree(seg);
@@ -1724,7 +1724,7 @@ static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
         xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
         for (i = 0; i < num_sp; i++) {
                 dma_addr_t dma;
-                void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+                void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
                                 flags);
                 if (!buf)
                         goto fail_sp4;
@@ -2307,10 +2307,11 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
         /* Place limits on the number of roothub ports so that the hub
          * descriptors aren't longer than the USB core will allocate.
          */
-        if (xhci->num_usb3_ports > 15) {
+        if (xhci->num_usb3_ports > USB_SS_MAXPORTS) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
-                                "Limiting USB 3.0 roothub ports to 15.");
-                xhci->num_usb3_ports = 15;
+                                "Limiting USB 3.0 roothub ports to %u.",
+                                USB_SS_MAXPORTS);
+                xhci->num_usb3_ports = USB_SS_MAXPORTS;
         }
         if (xhci->num_usb2_ports > USB_MAXCHILDREN) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7b86508ac8cf..fcf1f3f63e7a 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -52,6 +52,7 @@
 #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI              0x0aa8
 #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI              0x1aa8
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
 static const char hcd_name[] = "xhci_hcd";
 
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
-                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
                 xhci->quirks |= XHCI_PME_STUCK_QUIRK;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
             (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
-             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
                 xhci->quirks |= XHCI_MISSING_CAS;
 
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 7c2a9e7c8e0f..c04144b25a67 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -177,7 +177,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
 
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
-                return -ENODEV;
+                return irq;
 
         /*
          * sysdev must point to a device that is known to the system firmware
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 74bf5c60a260..03f63f50afb6 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -323,7 +323,7 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
                 if (i_cmd->status != COMP_COMMAND_ABORTED)
                         continue;
 
-                i_cmd->status = COMP_STOPPED;
+                i_cmd->status = COMP_COMMAND_RING_STOPPED;
 
                 xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
                          i_cmd->command_trb);
@@ -641,8 +641,8 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
         xhci_urb_free_priv(urb_priv);
         usb_hcd_unlink_urb_from_ep(hcd, urb);
         spin_unlock(&xhci->lock);
-        usb_hcd_giveback_urb(hcd, urb, status);
         trace_xhci_urb_giveback(urb);
+        usb_hcd_giveback_urb(hcd, urb, status);
         spin_lock(&xhci->lock);
 }
 
@@ -1380,7 +1380,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
         cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
 
         /* If CMD ring stopped we own the trbs between enqueue and dequeue */
-        if (cmd_comp_code == COMP_STOPPED) {
+        if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) {
                 complete_all(&xhci->cmd_ring_stop_completion);
                 return;
         }
@@ -1436,8 +1436,8 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 break;
         case TRB_CMD_NOOP:
                 /* Is this an aborted command turned to NO-OP? */
-                if (cmd->status == COMP_STOPPED)
-                        cmd_comp_code = COMP_STOPPED;
+                if (cmd->status == COMP_COMMAND_RING_STOPPED)
+                        cmd_comp_code = COMP_COMMAND_RING_STOPPED;
                 break;
         case TRB_RESET_EP:
                 WARN_ON(slot_id != TRB_TO_SLOT_ID(
@@ -2677,11 +2677,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         union xhci_trb *event_ring_deq;
         irqreturn_t ret = IRQ_NONE;
+        unsigned long flags;
         dma_addr_t deq;
         u64 temp_64;
         u32 status;
 
-        spin_lock(&xhci->lock);
+        spin_lock_irqsave(&xhci->lock, flags);
         /* Check if the xHC generated the interrupt, or the irq is shared */
         status = readl(&xhci->op_regs->status);
         if (status == ~(u32)0) {
@@ -2707,12 +2708,9 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
          */
         status |= STS_EINT;
         writel(status, &xhci->op_regs->status);
-        /* FIXME when MSI-X is supported and there are multiple vectors */
-        /* Clear the MSI-X event interrupt status */
 
-        if (hcd->irq) {
+        if (!hcd->msi_enabled) {
                 u32 irq_pending;
-                /* Acknowledge the PCI interrupt */
                 irq_pending = readl(&xhci->ir_set->irq_pending);
                 irq_pending |= IMAN_IP;
                 writel(irq_pending, &xhci->ir_set->irq_pending);
@@ -2757,7 +2755,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         ret = IRQ_HANDLED;
 
 out:
-        spin_unlock(&xhci->lock);
+        spin_unlock_irqrestore(&xhci->lock, flags);
 
         return ret;
 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2d1310220832..30f47d92a610 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -359,9 +359,10 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                 /* fall back to msi*/
                 ret = xhci_setup_msi(xhci);
 
-        if (!ret)
-                /* hcd->irq is 0, we have MSI */
+        if (!ret) {
+                hcd->msi_enabled = 1;
                 return 0;
+        }
 
         if (!pdev->irq) {
                 xhci_err(xhci, "No msi-x/msi found and no IRQ in BIOS\n");
@@ -1763,7 +1764,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for configure endpoint command\n");
                 ret = -ETIME;
                 break;
@@ -1813,7 +1814,7 @@ static int xhci_evaluate_context_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for evaluate context command\n");
                 ret = -ETIME;
                 break;
@@ -3432,7 +3433,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
         ret = reset_device_cmd->status;
         switch (ret) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout waiting for reset device command\n");
                 ret = -ETIME;
                 goto command_cleanup;
@@ -3817,7 +3818,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
          */
         switch (command->status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for setup device command\n");
                 ret = -ETIME;
                 break;
diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
index e9cae4d82af2..15d4e64d3b65 100644
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -192,7 +192,7 @@ static int chaoskey_probe(struct usb_interface *interface,
 
         dev->in_ep = in_ep;
 
-        if (udev->descriptor.idVendor != ALEA_VENDOR_ID)
+        if (le16_to_cpu(udev->descriptor.idVendor) != ALEA_VENDOR_ID)
                 dev->reads_started = 1;
 
         dev->size = size;
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 77569531b78a..83b05a287b0c 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -554,7 +554,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
                         info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
 
                         /* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
-                        info.speed = le16_to_cpu(dev->udev->speed);
+                        info.speed = dev->udev->speed;
                         info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
                         info.report_size = dev->report_size;
 
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index aa3c280fdf8d..0782ac6f5edf 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -926,6 +926,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
                  USB_MAJOR, dev->minor);
 
 exit:
+        kfree(get_version_reply);
         return retval;
 
 error:
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index 3c6948af726a..f019d80ca9e4 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -973,7 +973,7 @@ sisusbcon_set_origin(struct vc_data *c)
 
         mutex_unlock(&sisusb->lock);
 
-        return 1;
+        return true;
 }
 
 /* Interface routine */
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index ac3a4952abb4..dbe617a735d8 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2780,10 +2780,11 @@ int musb_host_setup(struct musb *musb, int power_budget)
         int ret;
         struct usb_hcd *hcd = musb->hcd;
 
-        MUSB_HST_MODE(musb);
-        musb->xceiv->otg->default_a = 1;
-        musb->xceiv->otg->state = OTG_STATE_A_IDLE;
-
+        if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                MUSB_HST_MODE(musb);
+                musb->xceiv->otg->default_a = 1;
+                musb->xceiv->otg->state = OTG_STATE_A_IDLE;
+        }
         otg_set_host(musb->xceiv->otg, &hcd->self);
         hcd->self.otg_port = 1;
         musb->xceiv->otg->host = &hcd->self;
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 8b43c4b99f04..7870b37e0ea5 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -219,6 +219,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         u32                             dma_remaining;
         int                             src_burst, dst_burst;
         u16                             csr;
+        u32                             psize;
         int                             ch;
         s8                              dmareq;
         s8                              sync_dev;
@@ -390,15 +391,19 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
 
         if (chdat->tx) {
                 /* Send transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~0x7ff;
+                psize |= chdat->transfer_packet_sz;
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_TX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
         } else {
                 /* Receive transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz << 16);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~(0x7ff << 16);
+                psize |= (chdat->transfer_packet_sz << 16);
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_RX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d38780fa8788..aba74f817dc6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -809,10 +809,10 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
         { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) },
         { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
@@ -1527,9 +1527,9 @@ static int set_serial_info(struct tty_struct *tty,
                                         (new_serial.flags & ASYNC_FLAGS));
         priv->custom_divisor = new_serial.custom_divisor;
 
+check_and_exit:
         write_latency_timer(port);
 
-check_and_exit:
         if ((old_priv.flags & ASYNC_SPD_MASK) !=
              (priv->flags & ASYNC_SPD_MASK)) {
                 if ((priv->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 71fb9e59db71..4fcf1cecb6d7 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -882,6 +882,8 @@
 /* Olimex */
 #define OLIMEX_VID                      0x15BA
 #define OLIMEX_ARM_USB_OCD_PID          0x0003
+#define OLIMEX_ARM_USB_TINY_PID 0x0004
+#define OLIMEX_ARM_USB_TINY_H_PID       0x002a
 #define OLIMEX_ARM_USB_OCD_H_PID        0x002b
 
 /*
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 87798e625d6c..6cefb9cb133d 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2336,8 +2336,11 @@ static void change_port_settings(struct tty_struct *tty,
         if (!baud) {
                 /* pick a default, any default... */
                 baud = 9600;
-        } else
+        } else {
+                /* Avoid a zero divisor. */
+                baud = min(baud, 461550);
                 tty_encode_baud_rate(tty, baud, baud);
+        }
 
         edge_port->baud_rate = baud;
         config->wBaudRate = (__u16)((461550L + baud/2) / baud);
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 73956d48a0c5..f9734a96d516 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -197,6 +197,7 @@ static u8 ir_xbof_change(u8 xbof)
 static int ir_startup(struct usb_serial *serial)
 {
         struct usb_irda_cs_descriptor *irda_desc;
+        int rates;
 
         irda_desc = irda_usb_find_class_desc(serial, 0);
         if (!irda_desc) {
@@ -205,18 +206,20 @@ static int ir_startup(struct usb_serial *serial)
                 return -ENODEV;
         }
 
+        rates = le16_to_cpu(irda_desc->wBaudRate);
+
         dev_dbg(&serial->dev->dev,
                 "%s - Baud rates supported:%s%s%s%s%s%s%s%s%s\n",
                 __func__,
-                (irda_desc->wBaudRate & USB_IRDA_BR_2400) ? " 2400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_9600) ? " 9600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_19200) ? " 19200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_38400) ? " 38400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_57600) ? " 57600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_115200) ? " 115200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_576000) ? " 576000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_1152000) ? " 1152000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_4000000) ? " 4000000" : "");
+                (rates & USB_IRDA_BR_2400) ? " 2400" : "",
+                (rates & USB_IRDA_BR_9600) ? " 9600" : "",
+                (rates & USB_IRDA_BR_19200) ? " 19200" : "",
+                (rates & USB_IRDA_BR_38400) ? " 38400" : "",
+                (rates & USB_IRDA_BR_57600) ? " 57600" : "",
+                (rates & USB_IRDA_BR_115200) ? " 115200" : "",
+                (rates & USB_IRDA_BR_576000) ? " 576000" : "",
+                (rates & USB_IRDA_BR_1152000) ? " 1152000" : "",
+                (rates & USB_IRDA_BR_4000000) ? " 4000000" : "");
 
         switch (irda_desc->bmAdditionalBOFs) {
         case USB_IRDA_AB_48:
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index edbc81f205c2..70f346f1aa86 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct tty_struct *tty,
                 return -ENOMEM;
 
         divisor = mct_u232_calculate_baud_rate(serial, value, &speed);
-        put_unaligned_le32(cpu_to_le32(divisor), buf);
+        put_unaligned_le32(divisor, buf);
         rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                                 MCT_U232_SET_BAUD_RATE_REQUEST,
                                 MCT_U232_SET_REQUEST_TYPE,
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index af67a0de6b5d..3bf61acfc26b 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -281,6 +281,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE922_USBCFG0             0x1042
 #define TELIT_PRODUCT_LE922_USBCFG3             0x1043
 #define TELIT_PRODUCT_LE922_USBCFG5             0x1045
+#define TELIT_PRODUCT_ME910                     0x1100
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
@@ -640,6 +641,11 @@ static const struct option_blacklist_info simcom_sim7100e_blacklist = {
         .reserved = BIT(5) | BIT(6),
 };
 
+static const struct option_blacklist_info telit_me910_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(3),
+};
+
 static const struct option_blacklist_info telit_le910_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(2),
@@ -1235,6 +1241,8 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+                .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
                 .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 38b3f0d8cd58..fd509ed6cf70 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x9071)},   /* Sierra Wireless MC74xx */
         {DEVICE_SWI(0x1199, 0x9078)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x1199, 0x9079)},   /* Sierra Wireless EM74xx */
+        {DEVICE_SWI(0x1199, 0x907a)},   /* Sierra Wireless EM74xx QDL */
+        {DEVICE_SWI(0x1199, 0x907b)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 369f3c24815a..44af719194b2 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -446,6 +446,10 @@ struct ms_lib_ctrl {
 #define SD_BLOCK_LEN  9
 
 struct ene_ub6250_info {
+
+        /* I/O bounce buffer */
+        u8              *bbuf;
+
         /* for 6250 code */
         struct SD_STATUS        SD_Status;
         struct MS_STATUS        MS_Status;
@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_data *us, unsigned char flag);
 
 static void ene_ub6250_info_destructor(void *extra)
 {
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra;
+
         if (!extra)
                 return;
+        kfree(info->bbuf);
 }
 
 static int ene_send_scsi_cmd(struct us_data *us, u8 fDir, void *buf, int use_sg)
@@ -860,8 +867,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
                 u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
         u32 bn = PhyBlockAddr * 0x20 + PageNum;
 
         result = ene_load_bincode(us, MS_RW_PATTERN);
@@ -901,7 +909,7 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         bcb->CDB[2]     = (unsigned char)(PhyBlockAddr>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -910,9 +918,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         ExtraDat->status0  = 0x10;  /* Not yet,fireware support */
 
         ExtraDat->status1  = 0x00;  /* Not yet,fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1332,8 +1340,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
                                 u8 PageNum, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
 
         memset(bcb, 0, sizeof(struct bulk_cb_wrap));
         bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
@@ -1347,7 +1356,7 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         bcb->CDB[2]     = (unsigned char)(PhyBlock>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -1355,9 +1364,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         ExtraDat->intr     = 0x80;  /* Not yet, waiting for fireware support */
         ExtraDat->status0  = 0x10;  /* Not yet, waiting for fireware support */
         ExtraDat->status1  = 0x00;  /* Not yet, waiting for fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1556,9 +1565,9 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
         u16 PhyBlock, newblk, i;
         u16 LogStart, LogEnde;
         struct ms_lib_type_extdat extdat;
-        u8 buf[0x200];
         u32 count = 0, index = 0;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         for (PhyBlock = 0; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {
                 ms_lib_phy_to_log_range(PhyBlock, &LogStart, &LogEnde);
@@ -1572,14 +1581,16 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
                         }
 
                         if (count == PhyBlock) {
-                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, &buf);
+                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80,
+                                                bbuf);
                                 count += 0x80;
                         }
                         index = (PhyBlock % 0x80) * 4;
 
-                        extdat.ovrflg = buf[index];
-                        extdat.mngflg = buf[index+1];
-                        extdat.logadr = memstick_logaddr(buf[index+2], buf[index+3]);
+                        extdat.ovrflg = bbuf[index];
+                        extdat.mngflg = bbuf[index+1];
+                        extdat.logadr = memstick_logaddr(bbuf[index+2],
+                                        bbuf[index+3]);
 
                         if ((extdat.ovrflg & MS_REG_OVR_BKST) != MS_REG_OVR_BKST_OK) {
                                 ms_lib_setacquired_errorblock(us, PhyBlock);
@@ -2062,9 +2073,9 @@ static int ene_ms_init(struct us_data *us)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         int result;
-        u8 buf[0x200];
         u16 MSP_BlockSize, MSP_UserAreaBlocks;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         printk(KERN_INFO "transport --- ENE_MSInit\n");
 
@@ -2083,13 +2094,13 @@ static int ene_ms_init(struct us_data *us)
         bcb->CDB[0]     = 0xF1;
         bcb->CDB[1]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 printk(KERN_ERR "Execution MS Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
         /* the same part to test ENE */
-        info->MS_Status = *(struct MS_STATUS *)&buf[0];
+        info->MS_Status = *(struct MS_STATUS *) bbuf;
 
         if (info->MS_Status.Insert && info->MS_Status.Ready) {
                 printk(KERN_INFO "Insert     = %x\n", info->MS_Status.Insert);
@@ -2098,15 +2109,15 @@ static int ene_ms_init(struct us_data *us)
                 printk(KERN_INFO "IsMSPHG    = %x\n", info->MS_Status.IsMSPHG);
                 printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP);
                 if (info->MS_Status.IsMSPro) {
-                        MSP_BlockSize      = (buf[6] << 8) | buf[7];
-                        MSP_UserAreaBlocks = (buf[10] << 8) | buf[11];
+                        MSP_BlockSize      = (bbuf[6] << 8) | bbuf[7];
+                        MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
                         info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
                 } else {
                         ms_card_init(us); /* Card is MS (to ms.c)*/
                 }
                 usb_stor_dbg(us, "MS Init Code OK !!\n");
         } else {
-                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
@@ -2116,9 +2127,9 @@ static int ene_ms_init(struct us_data *us)
 static int ene_sd_init(struct us_data *us)
 {
         int result;
-        u8  buf[0x200];
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         usb_stor_dbg(us, "transport --- ENE_SDInit\n");
         /* SD Init Part-1 */
@@ -2152,17 +2163,17 @@ static int ene_sd_init(struct us_data *us)
         bcb->Flags              = US_BULK_FLAG_IN;
         bcb->CDB[0]             = 0xF1;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_dbg(us, "Execution SD Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
-        info->SD_Status =  *(struct SD_STATUS *)&buf[0];
+        info->SD_Status =  *(struct SD_STATUS *) bbuf;
         if (info->SD_Status.Insert && info->SD_Status.Ready) {
                 struct SD_STATUS *s = &info->SD_Status;
 
-                ene_get_card_status(us, (unsigned char *)&buf);
+                ene_get_card_status(us, bbuf);
                 usb_stor_dbg(us, "Insert     = %x\n", s->Insert);
                 usb_stor_dbg(us, "Ready      = %x\n", s->Ready);
                 usb_stor_dbg(us, "IsMMC      = %x\n", s->IsMMC);
@@ -2170,7 +2181,7 @@ static int ene_sd_init(struct us_data *us)
                 usb_stor_dbg(us, "HiSpeed    = %x\n", s->HiSpeed);
                 usb_stor_dbg(us, "WtP        = %x\n", s->WtP);
         } else {
-                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
         return USB_STOR_TRANSPORT_GOOD;
@@ -2180,13 +2191,15 @@ static int ene_sd_init(struct us_data *us)
 static int ene_init(struct us_data *us)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+        u8 *bbuf = info->bbuf;
 
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, bbuf);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
+        misc_reg03 = bbuf[0];
         if (misc_reg03 & 0x01) {
                 if (!info->SD_Status.Ready) {
                         result = ene_sd_init(us);
@@ -2303,8 +2316,9 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                          const struct usb_device_id *id)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct us_data *us;
+        struct ene_ub6250_info *info;
 
         result = usb_stor_probe1(&us, intf, id,
                    (id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list,
@@ -2313,11 +2327,16 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* FIXME: where should the code alloc extra buf ? */
-        if (!us->extra) {
-                us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
-                if (!us->extra)
-                        return -ENOMEM;
-                us->extra_destructor = ene_ub6250_info_destructor;
+        us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
+        if (!us->extra)
+                return -ENOMEM;
+        us->extra_destructor = ene_ub6250_info_destructor;
+
+        info = (struct ene_ub6250_info *)(us->extra);
+        info->bbuf = kmalloc(512, GFP_KERNEL);
+        if (!info->bbuf) {
+                kfree(us->extra);
+                return -ENOMEM;
         }
 
         us->transport_name = "ene_ub6250";
@@ -2329,12 +2348,13 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* probe card type */
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_disconnect(intf);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
+        misc_reg03 = info->bbuf[0];
         if (!(misc_reg03 & 0x01)) {
                 pr_info("ums_eneub6250: This driver only supports SD/MS cards. "
                         "It does not support SM cards.\n");
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 5d8b2c261940..0585078638db 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -235,14 +235,19 @@ done:
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
 {
+        int width;
+
         memset(desc, 0, sizeof(*desc));
         desc->bDescriptorType = USB_DT_HUB;
-        desc->bDescLength = 9;
         desc->wHubCharacteristics = cpu_to_le16(
                 HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM);
+
         desc->bNbrPorts = VHCI_HC_PORTS;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN);
+        width = desc->bNbrPorts / 8 + 1;
+        desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width;
+        memset(&desc->u.hs.DeviceRemovable[0], 0, width);
+        memset(&desc->u.hs.DeviceRemovable[width], 0xff, width);
 }
 
 static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 6345e85822a4..a50cf45e530f 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -341,6 +341,7 @@ error_submit_ep1:
 static
 int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
 {
+        struct usb_device *udev = interface_to_usbdev(iface);
         struct i1480_usb *i1480_usb;
         struct i1480 *i1480;
         struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
                         iface->cur_altsetting->desc.bInterfaceNumber);
                 goto error;
         }
-        if (iface->num_altsetting > 1
-            && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) {
+        if (iface->num_altsetting > 1 &&
+                        le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) {
                 /* Need altsetting #1 [HW QUIRK] or EP1 won't work */
                 result = usb_set_interface(interface_to_usbdev(iface), 0, 1);
                 if (result < 0)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 52a70ee6014f..8b9049dac094 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -452,7 +452,7 @@ config DAVINCI_WATCHDOG
 
 config ORION_WATCHDOG
         tristate "Orion watchdog"
-        depends on ARCH_ORION5X || ARCH_DOVE || MACH_DOVE || ARCH_MVEBU || COMPILE_TEST
+        depends on ARCH_ORION5X || ARCH_DOVE || MACH_DOVE || ARCH_MVEBU || (COMPILE_TEST && !ARCH_EBSA110)
         depends on ARM
         select WATCHDOG_CORE
         help
diff --git a/drivers/watchdog/bcm_kona_wdt.c b/drivers/watchdog/bcm_kona_wdt.c
index 6fce17d5b9f1..a5775dfd8d5f 100644
--- a/drivers/watchdog/bcm_kona_wdt.c
+++ b/drivers/watchdog/bcm_kona_wdt.c
@@ -304,6 +304,8 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev)
         if (!wdt)
                 return -ENOMEM;
 
+        spin_lock_init(&wdt->lock);
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         wdt->base = devm_ioremap_resource(dev, res);
         if (IS_ERR(wdt->base))
@@ -316,7 +318,6 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        spin_lock_init(&wdt->lock);
         platform_set_drvdata(pdev, wdt);
         watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt);
         bcm_kona_wdt_wdd.parent = &pdev->dev;
diff --git a/drivers/watchdog/cadence_wdt.c b/drivers/watchdog/cadence_wdt.c
index 8d61e8bfe60b..86e0b5d2e761 100644
--- a/drivers/watchdog/cadence_wdt.c
+++ b/drivers/watchdog/cadence_wdt.c
@@ -49,7 +49,7 @@
 /* Counter maximum value */
 #define CDNS_WDT_COUNTER_MAX 0xFFF
 
-static int wdt_timeout = CDNS_WDT_DEFAULT_TIMEOUT;
+static int wdt_timeout;
 static int nowayout = WATCHDOG_NOWAYOUT;
 
 module_param(wdt_timeout, int, 0);
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 347f0389b089..c4f65873bfa4 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -306,16 +306,15 @@ static int iTCO_wdt_ping(struct watchdog_device *wd_dev)
 
         iTCO_vendor_pre_keepalive(p->smi_res, wd_dev->timeout);
 
+        /* Reset the timeout status bit so that the timer
+         * needs to count down twice again before rebooting */
+        outw(0x0008, TCO1_STS(p));      /* write 1 to clear bit */
+
         /* Reload the timer by writing to the TCO Timer Counter register */
-        if (p->iTCO_version >= 2) {
+        if (p->iTCO_version >= 2)
                 outw(0x01, TCO_RLD(p));
-        } else if (p->iTCO_version == 1) {
-                /* Reset the timeout status bit so that the timer
-                 * needs to count down twice again before rebooting */
-                outw(0x0008, TCO1_STS(p));      /* write 1 to clear bit */
-
+        else if (p->iTCO_version == 1)
                 outb(0x01, TCO_RLD(p));
-        }
 
         spin_unlock(&p->io_lock);
         return 0;
@@ -328,11 +327,8 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t)
         unsigned char val8;
         unsigned int tmrval;
 
-        tmrval = seconds_to_ticks(p, t);
-
-        /* For TCO v1 the timer counts down twice before rebooting */
-        if (p->iTCO_version == 1)
-                tmrval /= 2;
+        /* The timer counts down twice before rebooting */
+        tmrval = seconds_to_ticks(p, t) / 2;
 
         /* from the specs: */
         /* "Values of 0h-3h are ignored and should not be attempted" */
@@ -385,6 +381,8 @@ static unsigned int iTCO_wdt_get_timeleft(struct watchdog_device *wd_dev)
                 spin_lock(&p->io_lock);
                 val16 = inw(TCO_RLD(p));
                 val16 &= 0x3ff;
+                if (!(inw(TCO1_STS(p)) & 0x0008))
+                        val16 += (inw(TCOv2_TMR(p)) & 0x3ff);
                 spin_unlock(&p->io_lock);
 
                 time_left = ticks_to_seconds(p, val16);
diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
index 99ebf6ea3de6..5615f4013924 100644
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface,
                 return -ENODEV;
         }
 
+        if (iface_desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         /* check out the endpoint: it has to be Interrupt & IN */
         endpoint = &iface_desc->endpoint[0].desc;
 
diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
index f709962018ac..362fd229786d 100644
--- a/drivers/watchdog/sama5d4_wdt.c
+++ b/drivers/watchdog/sama5d4_wdt.c
@@ -6,6 +6,7 @@
  * Licensed under GPLv2.
  */
 
+#include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
@@ -29,6 +30,7 @@ struct sama5d4_wdt {
         struct watchdog_device  wdd;
         void __iomem            *reg_base;
         u32                     mr;
+        unsigned long           last_ping;
 };
 
 static int wdt_timeout = WDT_DEFAULT_TIMEOUT;
@@ -44,11 +46,34 @@ MODULE_PARM_DESC(nowayout,
         "Watchdog cannot be stopped once started (default="
         __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+#define wdt_enabled (!(wdt->mr & AT91_WDT_WDDIS))
+
 #define wdt_read(wdt, field) \
         readl_relaxed((wdt)->reg_base + (field))
 
-#define wdt_write(wtd, field, val) \
-        writel_relaxed((val), (wdt)->reg_base + (field))
+/* 4 slow clock periods is 4/32768 = 122.07µs*/
+#define WDT_DELAY       usecs_to_jiffies(123)
+
+static void wdt_write(struct sama5d4_wdt *wdt, u32 field, u32 val)
+{
+        /*
+         * WDT_CR and WDT_MR must not be modified within three slow clock
+         * periods following a restart of the watchdog performed by a write
+         * access in WDT_CR.
+         */
+        while (time_before(jiffies, wdt->last_ping + WDT_DELAY))
+                usleep_range(30, 125);
+        writel_relaxed(val, wdt->reg_base + field);
+        wdt->last_ping = jiffies;
+}
+
+static void wdt_write_nosleep(struct sama5d4_wdt *wdt, u32 field, u32 val)
+{
+        if (time_before(jiffies, wdt->last_ping + WDT_DELAY))
+                udelay(123);
+        writel_relaxed(val, wdt->reg_base + field);
+        wdt->last_ping = jiffies;
+}
 
 static int sama5d4_wdt_start(struct watchdog_device *wdd)
 {
@@ -89,7 +114,16 @@ static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd,
         wdt->mr &= ~AT91_WDT_WDD;
         wdt->mr |= AT91_WDT_SET_WDV(value);
         wdt->mr |= AT91_WDT_SET_WDD(value);
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr);
+
+        /*
+         * WDDIS has to be 0 when updating WDD/WDV. The datasheet states: When
+         * setting the WDDIS bit, and while it is set, the fields WDV and WDD
+         * must not be modified.
+         * If the watchdog is enabled, then the timeout can be updated. Else,
+         * wait that the user enables it.
+         */
+        if (wdt_enabled)
+                wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~AT91_WDT_WDDIS);
 
         wdd->timeout = timeout;
 
@@ -145,23 +179,21 @@ static int of_sama5d4_wdt_init(struct device_node *np, struct sama5d4_wdt *wdt)
 
 static int sama5d4_wdt_init(struct sama5d4_wdt *wdt)
 {
-        struct watchdog_device *wdd = &wdt->wdd;
-        u32 value = WDT_SEC2TICKS(wdd->timeout);
         u32 reg;
-
         /*
-         * Because the fields WDV and WDD must not be modified when the WDDIS
-         * bit is set, so clear the WDDIS bit before writing the WDT_MR.
+         * When booting and resuming, the bootloader may have changed the
+         * watchdog configuration.
+         * If the watchdog is already running, we can safely update it.
+         * Else, we have to disable it properly.
          */
-        reg = wdt_read(wdt, AT91_WDT_MR);
-        reg &= ~AT91_WDT_WDDIS;
-        wdt_write(wdt, AT91_WDT_MR, reg);
-
-        wdt->mr |= AT91_WDT_SET_WDD(value);
-        wdt->mr |= AT91_WDT_SET_WDV(value);
-
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr);
-
+        if (wdt_enabled) {
+                wdt_write_nosleep(wdt, AT91_WDT_MR, wdt->mr);
+        } else {
+                reg = wdt_read(wdt, AT91_WDT_MR);
+                if (!(reg & AT91_WDT_WDDIS))
+                        wdt_write_nosleep(wdt, AT91_WDT_MR,
+                                          reg | AT91_WDT_WDDIS);
+        }
         return 0;
 }
 
@@ -172,6 +204,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
         struct resource *res;
         void __iomem *regs;
         u32 irq = 0;
+        u32 timeout;
         int ret;
 
         wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
@@ -184,6 +217,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
         wdd->ops = &sama5d4_wdt_ops;
         wdd->min_timeout = MIN_WDT_TIMEOUT;
         wdd->max_timeout = MAX_WDT_TIMEOUT;
+        wdt->last_ping = jiffies;
 
         watchdog_set_drvdata(wdd, wdt);
 
@@ -221,6 +255,11 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        timeout = WDT_SEC2TICKS(wdd->timeout);
+
+        wdt->mr |= AT91_WDT_SET_WDD(timeout);
+        wdt->mr |= AT91_WDT_SET_WDV(timeout);
+
         ret = sama5d4_wdt_init(wdt);
         if (ret)
                 return ret;
@@ -263,9 +302,7 @@ static int sama5d4_wdt_resume(struct device *dev)
 {
         struct sama5d4_wdt *wdt = dev_get_drvdata(dev);
 
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~AT91_WDT_WDDIS);
-        if (wdt->mr & AT91_WDT_WDDIS)
-                wdt_write(wdt, AT91_WDT_MR, wdt->mr);
+        sama5d4_wdt_init(wdt);
 
         return 0;
 }
diff --git a/drivers/watchdog/wdt_pci.c b/drivers/watchdog/wdt_pci.c
index 48b2c058b009..bc7addc2dc06 100644
--- a/drivers/watchdog/wdt_pci.c
+++ b/drivers/watchdog/wdt_pci.c
@@ -332,7 +332,7 @@ static irqreturn_t wdtpci_interrupt(int irq, void *dev_id)
                 pr_crit("Would Reboot\n");
 #else
                 pr_crit("Initiating system reboot\n");
-                emergency_restart(NULL);
+                emergency_restart();
 #endif
 #else
                 pr_crit("Reset in 5ms\n");
diff --git a/drivers/watchdog/zx2967_wdt.c b/drivers/watchdog/zx2967_wdt.c
index e290d5a13a6d..c98252733c30 100644
--- a/drivers/watchdog/zx2967_wdt.c
+++ b/drivers/watchdog/zx2967_wdt.c
@@ -211,10 +211,8 @@ static int zx2967_wdt_probe(struct platform_device *pdev)
 
         base = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         wdt->reg_base = devm_ioremap_resource(dev, base);
-        if (IS_ERR(wdt->reg_base)) {
-                dev_err(dev, "ioremap failed\n");
+        if (IS_ERR(wdt->reg_base))
                 return PTR_ERR(wdt->reg_base);
-        }
 
         zx2967_wdt_reset_sysctrl(dev);
 
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 3fdde0b283c9..29308a80d66f 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1671,8 +1671,12 @@ static long ceph_fallocate(struct file *file, int mode,
         }
 
         size = i_size_read(inode);
-        if (!(mode & FALLOC_FL_KEEP_SIZE))
+        if (!(mode & FALLOC_FL_KEEP_SIZE)) {
                 endoff = offset + length;
+                ret = inode_newsize_ok(inode, endoff);
+                if (ret)
+                        goto unlock;
+        }
 
         if (fi->fmode & CEPH_FILE_MODE_LAZY)
                 want = CEPH_CAP_FILE_BUFFER | CEPH_CAP_FILE_LAZYIO;
diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index 15bac390dff9..b98436f5c7c7 100644
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -1135,20 +1135,19 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
         u32 acllen = 0;
         int rc = 0;
         struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
-        struct cifs_tcon *tcon;
+        struct smb_version_operations *ops;
 
         cifs_dbg(NOISY, "converting ACL to mode for %s\n", path);
 
         if (IS_ERR(tlink))
                 return PTR_ERR(tlink);
-        tcon = tlink_tcon(tlink);
 
-        if (pfid && (tcon->ses->server->ops->get_acl_by_fid))
-                pntsd = tcon->ses->server->ops->get_acl_by_fid(cifs_sb, pfid,
-                                                          &acllen);
-        else if (tcon->ses->server->ops->get_acl)
-                pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
-                                                        &acllen);
+        ops = tlink_tcon(tlink)->ses->server->ops;
+
+        if (pfid && (ops->get_acl_by_fid))
+                pntsd = ops->get_acl_by_fid(cifs_sb, pfid, &acllen);
+        else if (ops->get_acl)
+                pntsd = ops->get_acl(cifs_sb, inode, path, &acllen);
         else {
                 cifs_put_tlink(tlink);
                 return -EOPNOTSUPP;
@@ -1181,23 +1180,23 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
         struct cifs_ntsd *pnntsd = NULL; /* modified acl to be sent to server */
         struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
         struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);
-        struct cifs_tcon *tcon;
+        struct smb_version_operations *ops;
 
         if (IS_ERR(tlink))
                 return PTR_ERR(tlink);
-        tcon = tlink_tcon(tlink);
+
+        ops = tlink_tcon(tlink)->ses->server->ops;
 
         cifs_dbg(NOISY, "set ACL from mode for %s\n", path);
 
         /* Get the security descriptor */
 
-        if (tcon->ses->server->ops->get_acl == NULL) {
+        if (ops->get_acl == NULL) {
                 cifs_put_tlink(tlink);
                 return -EOPNOTSUPP;
         }
 
-        pntsd = tcon->ses->server->ops->get_acl(cifs_sb, inode, path,
-                                                &secdesclen);
+        pntsd = ops->get_acl(cifs_sb, inode, path, &secdesclen);
         if (IS_ERR(pntsd)) {
                 rc = PTR_ERR(pntsd);
                 cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);
@@ -1224,13 +1223,12 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 nmode,
 
         cifs_dbg(NOISY, "build_sec_desc rc: %d\n", rc);
 
-        if (tcon->ses->server->ops->set_acl == NULL)
+        if (ops->set_acl == NULL)
                 rc = -EOPNOTSUPP;
 
         if (!rc) {
                 /* Set the security descriptor */
-                rc = tcon->ses->server->ops->set_acl(pnntsd, secdesclen, inode,
-                                                     path, aclflag);
+                rc = ops->set_acl(pnntsd, secdesclen, inode, path, aclflag);
                 cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc);
         }
         cifs_put_tlink(tlink);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 8be55be70faf..bcc7d9acad64 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -418,7 +418,7 @@ struct smb_version_operations {
         int (*validate_negotiate)(const unsigned int, struct cifs_tcon *);
         ssize_t (*query_all_EAs)(const unsigned int, struct cifs_tcon *,
                         const unsigned char *, const unsigned char *, char *,
-                        size_t, const struct nls_table *, int);
+                        size_t, struct cifs_sb_info *);
         int (*set_EA)(const unsigned int, struct cifs_tcon *, const char *,
                         const char *, const void *, const __u16,
                         const struct nls_table *, int);
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index e49958c3f8bb..6eb3147132e3 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -480,8 +480,7 @@ extern int CIFSSMBCopy(unsigned int xid,
 extern ssize_t CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon,
                         const unsigned char *searchName,
                         const unsigned char *ea_name, char *EAData,
-                        size_t bufsize, const struct nls_table *nls_codepage,
-                        int remap_special_chars);
+                        size_t bufsize, struct cifs_sb_info *cifs_sb);
 extern int CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon,
                 const char *fileName, const char *ea_name,
                 const void *ea_value, const __u16 ea_value_len,
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 4c01b3f9abf0..fbb0d4cbda41 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -697,9 +697,7 @@ cifs_echo_callback(struct mid_q_entry *mid)
 {
         struct TCP_Server_Info *server = mid->callback_data;
 
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, 1, CIFS_ECHO_OP);
 }
 
@@ -1599,9 +1597,7 @@ cifs_readv_callback(struct mid_q_entry *mid)
         }
 
         queue_work(cifsiod_wq, &rdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, 1, 0);
 }
 
@@ -2058,7 +2054,6 @@ cifs_writev_callback(struct mid_q_entry *mid)
 {
         struct cifs_writedata *wdata = mid->callback_data;
         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
-        struct TCP_Server_Info *server = tcon->ses->server;
         unsigned int written;
         WRITE_RSP *smb = (WRITE_RSP *)mid->resp_buf;
 
@@ -2095,9 +2090,7 @@ cifs_writev_callback(struct mid_q_entry *mid)
         }
 
         queue_work(cifsiod_wq, &wdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(tcon->ses->server, 1, 0);
 }
 
@@ -6076,11 +6069,13 @@ ssize_t
 CIFSSMBQAllEAs(const unsigned int xid, struct cifs_tcon *tcon,
                 const unsigned char *searchName, const unsigned char *ea_name,
                 char *EAData, size_t buf_size,
-                const struct nls_table *nls_codepage, int remap)
+                struct cifs_sb_info *cifs_sb)
 {
                 /* BB assumes one setup word */
         TRANSACTION2_QPI_REQ *pSMB = NULL;
         TRANSACTION2_QPI_RSP *pSMBr = NULL;
+        int remap = cifs_remap(cifs_sb);
+        struct nls_table *nls_codepage = cifs_sb->local_nls;
         int rc = 0;
         int bytes_returned;
         int list_len;
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 6ef78ad838e6..0fd081bd2a2f 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -582,7 +582,7 @@ cifs_relock_file(struct cifsFileInfo *cfile)
         struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
         int rc = 0;
 
-        down_read(&cinode->lock_sem);
+        down_read_nested(&cinode->lock_sem, SINGLE_DEPTH_NESTING);
         if (cinode->can_cache_brlcks) {
                 /* can cache locks - no need to relock */
                 up_read(&cinode->lock_sem);
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index c3b2fa0b2ec8..4d1fcd76d022 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -563,8 +563,7 @@ static int cifs_sfu_mode(struct cifs_fattr *fattr, const unsigned char *path,
 
         rc = tcon->ses->server->ops->query_all_EAs(xid, tcon, path,
                         "SETFILEBITS", ea_value, 4 /* size of buf */,
-                        cifs_sb->local_nls,
-                        cifs_remap(cifs_sb));
+                        cifs_sb);
         cifs_put_tlink(tlink);
         if (rc < 0)
                 return (int)rc;
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 48ff7703b919..e4afdaae743f 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1240,15 +1240,19 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
                 goto tcon_exit;
         }
 
-        if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
+        switch (rsp->ShareType) {
+        case SMB2_SHARE_TYPE_DISK:
                 cifs_dbg(FYI, "connection to disk share\n");
-        else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
+                break;
+        case SMB2_SHARE_TYPE_PIPE:
                 tcon->ipc = true;
                 cifs_dbg(FYI, "connection to pipe share\n");
-        } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
-                tcon->print = true;
+                break;
+        case SMB2_SHARE_TYPE_PRINT:
+                tcon->ipc = true;
                 cifs_dbg(FYI, "connection to printer\n");
-        } else {
+                break;
+        default:
                 cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
                 rc = -EOPNOTSUPP;
                 goto tcon_error_exit;
@@ -2173,9 +2177,7 @@ smb2_echo_callback(struct mid_q_entry *mid)
         if (mid->mid_state == MID_RESPONSE_RECEIVED)
                 credits_received = le16_to_cpu(rsp->hdr.sync_hdr.CreditRequest);
 
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, credits_received, CIFS_ECHO_OP);
 }
 
@@ -2433,9 +2435,7 @@ smb2_readv_callback(struct mid_q_entry *mid)
                 cifs_stats_fail_inc(tcon, SMB2_READ_HE);
 
         queue_work(cifsiod_wq, &rdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(server, credits_received, 0);
 }
 
@@ -2594,7 +2594,6 @@ smb2_writev_callback(struct mid_q_entry *mid)
 {
         struct cifs_writedata *wdata = mid->callback_data;
         struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
-        struct TCP_Server_Info *server = tcon->ses->server;
         unsigned int written;
         struct smb2_write_rsp *rsp = (struct smb2_write_rsp *)mid->resp_buf;
         unsigned int credits_received = 1;
@@ -2634,9 +2633,7 @@ smb2_writev_callback(struct mid_q_entry *mid)
                 cifs_stats_fail_inc(tcon, SMB2_WRITE_HE);
 
         queue_work(cifsiod_wq, &wdata->work);
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         add_credits(tcon->ses->server, credits_received, 0);
 }
 
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 4d64b5b8fc9c..47a125ece11e 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -94,7 +94,7 @@ DeleteMidQEntry(struct mid_q_entry *midEntry)
         now = jiffies;
         /* commands taking longer than one second are indications that
            something is wrong, unless it is quite a slow link or server */
-        if ((now - midEntry->when_alloc) > HZ) {
+        if (time_after(now, midEntry->when_alloc + HZ)) {
                 if ((cifsFYI & CIFS_TIMER) && (midEntry->command != command)) {
                         pr_debug(" CIFS slow rsp: cmd %d mid %llu",
                                midEntry->command, midEntry->mid);
@@ -613,9 +613,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)
         }
         spin_unlock(&GlobalMid_Lock);
 
-        mutex_lock(&server->srv_mutex);
         DeleteMidQEntry(mid);
-        mutex_unlock(&server->srv_mutex);
         return rc;
 }
 
diff --git a/fs/cifs/xattr.c b/fs/cifs/xattr.c
index 20af5187ba63..3cb5c9e2d4e7 100644
--- a/fs/cifs/xattr.c
+++ b/fs/cifs/xattr.c
@@ -235,8 +235,7 @@ static int cifs_xattr_get(const struct xattr_handler *handler,
 
                 if (pTcon->ses->server->ops->query_all_EAs)
                         rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon,
-                                full_path, name, value, size,
-                                cifs_sb->local_nls, cifs_remap(cifs_sb));
+                                full_path, name, value, size, cifs_sb);
                 break;
 
         case XATTR_CIFS_ACL: {
@@ -336,8 +335,7 @@ ssize_t cifs_listxattr(struct dentry *direntry, char *data, size_t buf_size)
 
         if (pTcon->ses->server->ops->query_all_EAs)
                 rc = pTcon->ses->server->ops->query_all_EAs(xid, pTcon,
-                                full_path, NULL, data, buf_size,
-                                cifs_sb->local_nls, cifs_remap(cifs_sb));
+                                full_path, NULL, data, buf_size, cifs_sb);
 list_ea_exit:
         kfree(full_path);
         free_xid(xid);
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index 26d77f9f8c12..2dcbd5698884 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -817,7 +817,7 @@ static int ext2_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
         iomap->bdev = bdev;
         iomap->offset = (u64)first_block << blkbits;
         if (blk_queue_dax(bdev->bd_queue))
-                iomap->dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+                iomap->dax_dev = fs_dax_get_by_host(bdev->bd_disk->disk_name);
         else
                 iomap->dax_dev = NULL;
 
@@ -841,7 +841,7 @@ static int
 ext2_iomap_end(struct inode *inode, loff_t offset, loff_t length,
                 ssize_t written, unsigned flags, struct iomap *iomap)
 {
-        put_dax(iomap->dax_dev);
+        fs_put_dax(iomap->dax_dev);
         if (iomap->type == IOMAP_MAPPED &&
             written < length &&
             (flags & IOMAP_WRITE))
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5834c4d76be8..1bd0bfa547f6 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3412,7 +3412,7 @@ retry:
         bdev = inode->i_sb->s_bdev;
         iomap->bdev = bdev;
         if (blk_queue_dax(bdev->bd_queue))
-                iomap->dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+                iomap->dax_dev = fs_dax_get_by_host(bdev->bd_disk->disk_name);
         else
                 iomap->dax_dev = NULL;
         iomap->offset = first_block << blkbits;
@@ -3447,7 +3447,7 @@ static int ext4_iomap_end(struct inode *inode, loff_t offset, loff_t length,
         int blkbits = inode->i_blkbits;
         bool truncate = false;
 
-        put_dax(iomap->dax_dev);
+        fs_put_dax(iomap->dax_dev);
         if (!(flags & IOMAP_WRITE) || (flags & IOMAP_FAULT))
                 return 0;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 5a1b58f8fef4..65c88379a3a1 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -975,8 +975,15 @@ static int fuse_bdi_init(struct fuse_conn *fc, struct super_block *sb)
         int err;
         char *suffix = "";
 
-        if (sb->s_bdev)
+        if (sb->s_bdev) {
                 suffix = "-fuseblk";
+                /*
+                 * sb->s_bdi points to blkdev's bdi however we want to redirect
+                 * it to our private bdi...
+                 */
+                bdi_put(sb->s_bdi);
+                sb->s_bdi = &noop_backing_dev_info;
+        }
         err = super_setup_bdi_name(sb, "%u:%u%s", MAJOR(fc->dev),
                                    MINOR(fc->dev), suffix);
         if (err)
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index f02eb7673392..a7048eafa8e6 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1280,7 +1280,6 @@ xfs_bmap_read_extents(
                 xfs_bmbt_rec_t  *frp;
                 xfs_fsblock_t   nextbno;
                 xfs_extnum_t    num_recs;
-                xfs_extnum_t    start;
 
                 num_recs = xfs_btree_get_numrecs(block);
                 if (unlikely(i + num_recs > room)) {
@@ -1303,7 +1302,6 @@ xfs_bmap_read_extents(
                  * Copy records into the extent records.
                  */
                 frp = XFS_BMBT_REC_ADDR(mp, block, 1);
-                start = i;
                 for (j = 0; j < num_recs; j++, i++, frp++) {
                         xfs_bmbt_rec_host_t *trp = xfs_iext_get_ext(ifp, i);
                         trp->l0 = be64_to_cpu(frp->l0);
@@ -2065,8 +2063,10 @@ xfs_bmap_add_extent_delay_real(
                 }
                 temp = xfs_bmap_worst_indlen(bma->ip, temp);
                 temp2 = xfs_bmap_worst_indlen(bma->ip, temp2);
-                diff = (int)(temp + temp2 - startblockval(PREV.br_startblock) -
-                        (bma->cur ? bma->cur->bc_private.b.allocated : 0));
+                diff = (int)(temp + temp2 -
+                             (startblockval(PREV.br_startblock) -
+                              (bma->cur ?
+                               bma->cur->bc_private.b.allocated : 0)));
                 if (diff > 0) {
                         error = xfs_mod_fdblocks(bma->ip->i_mount,
                                                  -((int64_t)diff), false);
@@ -2123,7 +2123,6 @@ xfs_bmap_add_extent_delay_real(
                 temp = da_new;
                 if (bma->cur)
                         temp += bma->cur->bc_private.b.allocated;
-                ASSERT(temp <= da_old);
                 if (temp < da_old)
                         xfs_mod_fdblocks(bma->ip->i_mount,
                                         (int64_t)(da_old - temp), false);
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 5392674bf893..3a673ba201aa 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -4395,7 +4395,7 @@ xfs_btree_visit_blocks(
                         xfs_btree_readahead_ptr(cur, ptr, 1);
 
                         /* save for the next iteration of the loop */
-                        lptr = *ptr;
+                        xfs_btree_copy_ptrs(cur, &lptr, ptr, 1);
                 }
 
                 /* for each buffer in the level */
diff --git a/fs/xfs/libxfs/xfs_refcount.c b/fs/xfs/libxfs/xfs_refcount.c
index b177ef33cd4c..82a38d86ebad 100644
--- a/fs/xfs/libxfs/xfs_refcount.c
+++ b/fs/xfs/libxfs/xfs_refcount.c
@@ -1629,13 +1629,28 @@ xfs_refcount_recover_cow_leftovers(
         if (mp->m_sb.sb_agblocks >= XFS_REFC_COW_START)
                 return -EOPNOTSUPP;
 
-        error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp);
+        INIT_LIST_HEAD(&debris);
+
+        /*
+         * In this first part, we use an empty transaction to gather up
+         * all the leftover CoW extents so that we can subsequently
+         * delete them.  The empty transaction is used to avoid
+         * a buffer lock deadlock if there happens to be a loop in the
+         * refcountbt because we're allowed to re-grab a buffer that is
+         * already attached to our transaction.  When we're done
+         * recording the CoW debris we cancel the (empty) transaction
+         * and everything goes away cleanly.
+         */
+        error = xfs_trans_alloc_empty(mp, &tp);
         if (error)
                 return error;
-        cur = xfs_refcountbt_init_cursor(mp, NULL, agbp, agno, NULL);
+
+        error = xfs_alloc_read_agf(mp, tp, agno, 0, &agbp);
+        if (error)
+                goto out_trans;
+        cur = xfs_refcountbt_init_cursor(mp, tp, agbp, agno, NULL);
 
         /* Find all the leftover CoW staging extents. */
-        INIT_LIST_HEAD(&debris);
         memset(&low, 0, sizeof(low));
         memset(&high, 0, sizeof(high));
         low.rc.rc_startblock = XFS_REFC_COW_START;
@@ -1645,10 +1660,11 @@ xfs_refcount_recover_cow_leftovers(
         if (error)
                 goto out_cursor;
         xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
-        xfs_buf_relse(agbp);
+        xfs_trans_brelse(tp, agbp);
+        xfs_trans_cancel(tp);
 
         /* Now iterate the list to free the leftovers */
-        list_for_each_entry(rr, &debris, rr_list) {
+        list_for_each_entry_safe(rr, n, &debris, rr_list) {
                 /* Set up transaction. */
                 error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0, 0, 0, &tp);
                 if (error)
@@ -1676,8 +1692,16 @@ xfs_refcount_recover_cow_leftovers(
                 error = xfs_trans_commit(tp);
                 if (error)
                         goto out_free;
+
+                list_del(&rr->rr_list);
+                kmem_free(rr);
         }
 
+        return error;
+out_defer:
+        xfs_defer_cancel(&dfops);
+out_trans:
+        xfs_trans_cancel(tp);
 out_free:
         /* Free the leftover list */
         list_for_each_entry_safe(rr, n, &debris, rr_list) {
@@ -1688,11 +1712,6 @@ out_free:
 
 out_cursor:
         xfs_btree_del_cursor(cur, XFS_BTREE_ERROR);
-        xfs_buf_relse(agbp);
-        goto out_free;
-
-out_defer:
-        xfs_defer_cancel(&dfops);
-        xfs_trans_cancel(tp);
-        goto out_free;
+        xfs_trans_brelse(tp, agbp);
+        goto out_trans;
 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 2b954308a1d6..9e3cc2146d5b 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -582,9 +582,13 @@ xfs_getbmap(
                 }
                 break;
         default:
+                /* Local format data forks report no extents. */
+                if (ip->i_d.di_format == XFS_DINODE_FMT_LOCAL) {
+                        bmv->bmv_entries = 0;
+                        return 0;
+                }
                 if (ip->i_d.di_format != XFS_DINODE_FMT_EXTENTS &&
-                    ip->i_d.di_format != XFS_DINODE_FMT_BTREE &&
-                    ip->i_d.di_format != XFS_DINODE_FMT_LOCAL)
+                    ip->i_d.di_format != XFS_DINODE_FMT_BTREE)
                         return -EINVAL;
 
                 if (xfs_get_extsz_hint(ip) ||
@@ -712,7 +716,7 @@ xfs_getbmap(
                          * extents.
                          */
                         if (map[i].br_startblock == DELAYSTARTBLOCK &&
-                            map[i].br_startoff <= XFS_B_TO_FSB(mp, XFS_ISIZE(ip)))
+                            map[i].br_startoff < XFS_B_TO_FSB(mp, XFS_ISIZE(ip)))
                                 ASSERT((iflags & BMV_IF_DELALLOC) != 0);
 
                         if (map[i].br_startblock == HOLESTARTBLOCK &&
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 35703a801372..5fb5a0958a14 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1043,49 +1043,17 @@ xfs_find_get_desired_pgoff(
 
         index = startoff >> PAGE_SHIFT;
         endoff = XFS_FSB_TO_B(mp, map->br_startoff + map->br_blockcount);
-        end = endoff >> PAGE_SHIFT;
+        end = (endoff - 1) >> PAGE_SHIFT;
         do {
                 int             want;
                 unsigned        nr_pages;
                 unsigned int    i;
 
-                want = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+                want = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
                 nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
                                           want);
-                /*
-                 * No page mapped into given range.  If we are searching holes
-                 * and if this is the first time we got into the loop, it means
-                 * that the given offset is landed in a hole, return it.
-                 *
-                 * If we have already stepped through some block buffers to find
-                 * holes but they all contains data.  In this case, the last
-                 * offset is already updated and pointed to the end of the last
-                 * mapped page, if it does not reach the endpoint to search,
-                 * that means there should be a hole between them.
-                 */
-                if (nr_pages == 0) {
-                        /* Data search found nothing */
-                        if (type == DATA_OFF)
-                                break;
-
-                        ASSERT(type == HOLE_OFF);
-                        if (lastoff == startoff || lastoff < endoff) {
-                                found = true;
-                                *offset = lastoff;
-                        }
-                        break;
-                }
-
-                /*
-                 * At lease we found one page.  If this is the first time we
-                 * step into the loop, and if the first page index offset is
-                 * greater than the given search offset, a hole was found.
-                 */
-                if (type == HOLE_OFF && lastoff == startoff &&
-                    lastoff < page_offset(pvec.pages[0])) {
-                        found = true;
+                if (nr_pages == 0)
                         break;
-                }
 
                 for (i = 0; i < nr_pages; i++) {
                         struct page     *page = pvec.pages[i];
@@ -1098,18 +1066,18 @@ xfs_find_get_desired_pgoff(
                          * file mapping. However, page->index will not change
                          * because we have a reference on the page.
                          *
-                         * Searching done if the page index is out of range.
-                         * If the current offset is not reaches the end of
-                         * the specified search range, there should be a hole
-                         * between them.
+                         * If current page offset is beyond where we've ended,
+                         * we've found a hole.
                          */
-                        if (page->index > end) {
-                                if (type == HOLE_OFF && lastoff < endoff) {
-                                        *offset = lastoff;
-                                        found = true;
-                                }
+                        if (type == HOLE_OFF && lastoff < endoff &&
+                            lastoff < page_offset(pvec.pages[i])) {
+                                found = true;
+                                *offset = lastoff;
                                 goto out;
                         }
+                        /* Searching done if the page index is out of range. */
+                        if (page->index > end)
+                                goto out;
 
                         lock_page(page);
                         /*
@@ -1151,21 +1119,20 @@ xfs_find_get_desired_pgoff(
 
                 /*
                  * The number of returned pages less than our desired, search
-                 * done.  In this case, nothing was found for searching data,
-                 * but we found a hole behind the last offset.
+                 * done.
                  */
-                if (nr_pages < want) {
-                        if (type == HOLE_OFF) {
-                                *offset = lastoff;
-                                found = true;
-                        }
+                if (nr_pages < want)
                         break;
-                }
 
                 index = pvec.pages[i - 1]->index + 1;
                 pagevec_release(&pvec);
         } while (index <= end);
 
+        /* No page at lastoff and we are not done - we found a hole. */
+        if (type == HOLE_OFF && lastoff < endoff) {
+                *offset = lastoff;
+                found = true;
+        }
 out:
         pagevec_release(&pvec);
         return found;
diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
index 3683819887a5..814ed729881d 100644
--- a/fs/xfs/xfs_fsmap.c
+++ b/fs/xfs/xfs_fsmap.c
@@ -828,6 +828,7 @@ xfs_getfsmap(
         struct xfs_fsmap                dkeys[2];       /* per-dev keys */
         struct xfs_getfsmap_dev         handlers[XFS_GETFSMAP_DEVS];
         struct xfs_getfsmap_info        info = { NULL };
+        bool                            use_rmap;
         int                             i;
         int                             error = 0;
 
@@ -837,12 +838,14 @@ xfs_getfsmap(
             !xfs_getfsmap_is_valid_device(mp, &head->fmh_keys[1]))
                 return -EINVAL;
 
+        use_rmap = capable(CAP_SYS_ADMIN) &&
+                   xfs_sb_version_hasrmapbt(&mp->m_sb);
         head->fmh_entries = 0;
 
         /* Set up our device handlers. */
         memset(handlers, 0, sizeof(handlers));
         handlers[0].dev = new_encode_dev(mp->m_ddev_targp->bt_dev);
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
+        if (use_rmap)
                 handlers[0].fn = xfs_getfsmap_datadev_rmapbt;
         else
                 handlers[0].fn = xfs_getfsmap_datadev_bnobt;
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index a63f61c256bd..94e5bdf7304c 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -1068,7 +1068,7 @@ xfs_file_iomap_begin(
         /* optionally associate a dax device with the iomap bdev */
         bdev = iomap->bdev;
         if (blk_queue_dax(bdev->bd_queue))
-                iomap->dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+                iomap->dax_dev = fs_dax_get_by_host(bdev->bd_disk->disk_name);
         else
                 iomap->dax_dev = NULL;
 
@@ -1149,7 +1149,7 @@ xfs_file_iomap_end(
         unsigned                flags,
         struct iomap            *iomap)
 {
-        put_dax(iomap->dax_dev);
+        fs_put_dax(iomap->dax_dev);
         if ((flags & IOMAP_WRITE) && iomap->type == IOMAP_DELALLOC)
                 return xfs_file_iomap_end_delalloc(XFS_I(inode), offset,
                                 length, written, iomap);
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 97b8d3728b31..ef718586321c 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -195,7 +195,10 @@ struct vgic_dist {
                 /* either a GICv2 CPU interface */
                 gpa_t                   vgic_cpu_base;
                 /* or a number of GICv3 redistributor regions */
-                gpa_t                   vgic_redist_base;
+                struct {
+                        gpa_t           vgic_redist_base;
+                        gpa_t           vgic_redist_free_offset;
+                };
         };
 
         /* distributor enabled */
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index c47aa248c640..fcd641032f8d 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -238,7 +238,6 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head,
                                 bool kick_requeue_list);
 void blk_mq_kick_requeue_list(struct request_queue *q);
 void blk_mq_delay_kick_requeue_list(struct request_queue *q, unsigned long msecs);
-void blk_mq_abort_requeue_list(struct request_queue *q);
 void blk_mq_complete_request(struct request *rq);
 
 bool blk_mq_queue_stopped(struct request_queue *q);
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 5efb4db44e1e..d5093b52b485 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -40,6 +40,9 @@ struct bpf_reg_state {
          */
         s64 min_value;
         u64 max_value;
+        u32 min_align;
+        u32 aux_off;
+        u32 aux_off_align;
 };
 
 enum bpf_stack_slot_type {
@@ -87,6 +90,7 @@ struct bpf_verifier_env {
         struct bpf_prog *prog;          /* eBPF program being verified */
         struct bpf_verifier_stack_elem *head; /* stack of verifier states to be processed */
         int stack_size;                 /* number of states to be processed */
+        bool strict_alignment;          /* perform strict pointer alignment checks */
         struct bpf_verifier_state cur_state; /* current verifier state */
         struct bpf_verifier_state_list **explored_states; /* search pruning optimization */
         const struct bpf_ext_analyzer_ops *analyzer_ops; /* external analyzer ops */
diff --git a/include/linux/ceph/ceph_debug.h b/include/linux/ceph/ceph_debug.h
index aa2e19182d99..51c5bd64bd00 100644
--- a/include/linux/ceph/ceph_debug.h
+++ b/include/linux/ceph/ceph_debug.h
@@ -3,6 +3,8 @@
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
+#include <linux/string.h>
+
 #ifdef CONFIG_CEPH_LIB_PRETTYDEBUG
 
 /*
@@ -12,12 +14,10 @@
  */
 
 # if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
-extern const char *ceph_file_part(const char *s, int len);
 #  define dout(fmt, ...)                                                \
         pr_debug("%.*s %12.12s:%-4d : " fmt,                            \
                  8 - (int)sizeof(KBUILD_MODNAME), "    ",               \
-                 ceph_file_part(__FILE__, sizeof(__FILE__)),            \
-                 __LINE__, ##__VA_ARGS__)
+                 kbasename(__FILE__), __LINE__, ##__VA_ARGS__)
 # else
 /* faux printk call just to see any compiler warnings. */
 #  define dout(fmt, ...)        do {                            \
diff --git a/include/linux/dax.h b/include/linux/dax.h
index 00ebac854bb7..5ec1f6c47716 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -18,6 +18,20 @@ struct dax_operations {
                         void **, pfn_t *);
 };
 
+#if IS_ENABLED(CONFIG_DAX)
+struct dax_device *dax_get_by_host(const char *host);
+void put_dax(struct dax_device *dax_dev);
+#else
+static inline struct dax_device *dax_get_by_host(const char *host)
+{
+        return NULL;
+}
+
+static inline void put_dax(struct dax_device *dax_dev)
+{
+}
+#endif
+
 int bdev_dax_pgoff(struct block_device *, sector_t, size_t, pgoff_t *pgoff);
 #if IS_ENABLED(CONFIG_FS_DAX)
 int __bdev_dax_supported(struct super_block *sb, int blocksize);
@@ -25,23 +39,29 @@ static inline int bdev_dax_supported(struct super_block *sb, int blocksize)
 {
         return __bdev_dax_supported(sb, blocksize);
 }
+
+static inline struct dax_device *fs_dax_get_by_host(const char *host)
+{
+        return dax_get_by_host(host);
+}
+
+static inline void fs_put_dax(struct dax_device *dax_dev)
+{
+        put_dax(dax_dev);
+}
+
 #else
 static inline int bdev_dax_supported(struct super_block *sb, int blocksize)
 {
         return -EOPNOTSUPP;
 }
-#endif
 
-#if IS_ENABLED(CONFIG_DAX)
-struct dax_device *dax_get_by_host(const char *host);
-void put_dax(struct dax_device *dax_dev);
-#else
-static inline struct dax_device *dax_get_by_host(const char *host)
+static inline struct dax_device *fs_dax_get_by_host(const char *host)
 {
         return NULL;
 }
 
-static inline void put_dax(struct dax_device *dax_dev)
+static inline void fs_put_dax(struct dax_device *dax_dev)
 {
 }
 #endif
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 56197f82af45..62d948f80730 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -272,6 +272,16 @@ struct bpf_prog_aux;
                 .off   = OFF,                                   \
                 .imm   = IMM })
 
+/* Unconditional jumps, goto pc + off16 */
+
+#define BPF_JMP_A(OFF)                                          \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_JMP | BPF_JA,                      \
+                .dst_reg = 0,                                   \
+                .src_reg = 0,                                   \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Function call */
 
 #define BPF_EMIT_CALL(FUNC)                                     \
diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index 8d5fcd6284ce..283dc2f5364d 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -614,14 +614,16 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
 static inline netdev_features_t vlan_features_check(const struct sk_buff *skb,
                                                     netdev_features_t features)
 {
-        if (skb_vlan_tagged_multi(skb))
-                features = netdev_intersect_features(features,
-                                                     NETIF_F_SG |
-                                                     NETIF_F_HIGHDMA |
-                                                     NETIF_F_FRAGLIST |
-                                                     NETIF_F_HW_CSUM |
-                                                     NETIF_F_HW_VLAN_CTAG_TX |
-                                                     NETIF_F_HW_VLAN_STAG_TX);
+        if (skb_vlan_tagged_multi(skb)) {
+                /* In the case of multi-tagged packets, use a direct mask
+                 * instead of using netdev_interesect_features(), to make
+                 * sure that only devices supporting NETIF_F_HW_CSUM will
+                 * have checksum offloading support.
+                 */
+                features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_HW_CSUM |
+                            NETIF_F_FRAGLIST | NETIF_F_HW_VLAN_CTAG_TX |
+                            NETIF_F_HW_VLAN_STAG_TX;
+        }
 
         return features;
 }
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index 30f90c1a0aaf..541df0b5b815 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -349,6 +349,9 @@ extern int proc_kprobes_optimization_handler(struct ctl_table *table,
                                              int write, void __user *buffer,
                                              size_t *length, loff_t *ppos);
 #endif
+extern void wait_for_kprobe_optimizer(void);
+#else
+static inline void wait_for_kprobe_optimizer(void) { }
 #endif /* CONFIG_OPTPROBES */
 #ifdef CONFIG_KPROBES_ON_FTRACE
 extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h
index dd9a263ed368..a940ec6a046c 100644
--- a/include/linux/mlx5/device.h
+++ b/include/linux/mlx5/device.h
@@ -787,8 +787,14 @@ enum {
 };
 
 enum {
-        CQE_RSS_HTYPE_IP        = 0x3 << 6,
-        CQE_RSS_HTYPE_L4        = 0x3 << 2,
+        CQE_RSS_HTYPE_IP        = 0x3 << 2,
+        /* cqe->rss_hash_type[3:2] - IP destination selected for hash
+         * (00 = none,  01 = IPv4, 10 = IPv6, 11 = Reserved)
+         */
+        CQE_RSS_HTYPE_L4        = 0x3 << 6,
+        /* cqe->rss_hash_type[7:6] - L4 destination selected for hash
+         * (00 = none, 01 = TCP. 10 = UDP, 11 = IPSEC.SPI
+         */
 };
 
 enum {
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index bcdf739ee41a..93273d9ea4d1 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -787,7 +787,12 @@ enum {
 
 typedef void (*mlx5_cmd_cbk_t)(int status, void *context);
 
+enum {
+        MLX5_CMD_ENT_STATE_PENDING_COMP,
+};
+
 struct mlx5_cmd_work_ent {
+        unsigned long           state;
         struct mlx5_cmd_msg    *in;
         struct mlx5_cmd_msg    *out;
         void                   *uout;
@@ -976,7 +981,7 @@ void mlx5_cq_completion(struct mlx5_core_dev *dev, u32 cqn);
 void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type);
 void mlx5_srq_event(struct mlx5_core_dev *dev, u32 srqn, int event_type);
 struct mlx5_core_srq *mlx5_core_get_srq(struct mlx5_core_dev *dev, u32 srqn);
-void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec);
+void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forced);
 void mlx5_cq_event(struct mlx5_core_dev *dev, u32 cqn, int event_type);
 int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
                        int nent, u64 mask, const char *name,
diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h
index 1b166d2e19c5..b25e7baa273e 100644
--- a/include/linux/mlx5/fs.h
+++ b/include/linux/mlx5/fs.h
@@ -109,7 +109,6 @@ struct mlx5_flow_table_attr {
         int max_fte;
         u32 level;
         u32 flags;
-        u32 underlay_qpn;
 };
 
 struct mlx5_flow_table *
@@ -167,4 +166,7 @@ struct mlx5_fc *mlx5_fc_create(struct mlx5_core_dev *dev, bool aging);
 void mlx5_fc_destroy(struct mlx5_core_dev *dev, struct mlx5_fc *counter);
 void mlx5_fc_query_cached(struct mlx5_fc *counter,
                           u64 *bytes, u64 *packets, u64 *lastuse);
+int mlx5_fs_add_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn);
+int mlx5_fs_remove_rx_underlay_qpn(struct mlx5_core_dev *dev, u32 underlay_qpn);
+
 #endif
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 9c23bd2efb56..3f39d27decf4 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3296,11 +3296,15 @@ int dev_get_phys_port_id(struct net_device *dev,
 int dev_get_phys_port_name(struct net_device *dev,
                            char *name, size_t len);
 int dev_change_proto_down(struct net_device *dev, bool proto_down);
-int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
-                      int fd, u32 flags);
 struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *dev);
 struct sk_buff *dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                                     struct netdev_queue *txq, int *ret);
+
+typedef int (*xdp_op_t)(struct net_device *dev, struct netdev_xdp *xdp);
+int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
+                      int fd, u32 flags);
+bool __dev_xdp_attached(struct net_device *dev, xdp_op_t xdp_op);
+
 int __dev_forward_skb(struct net_device *dev, struct sk_buff *skb);
 int dev_forward_skb(struct net_device *dev, struct sk_buff *skb);
 bool is_skb_forwardable(const struct net_device *dev,
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index be378cf47fcc..b3044c2c62cb 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -294,7 +294,7 @@ int xt_match_to_user(const struct xt_entry_match *m,
 int xt_target_to_user(const struct xt_entry_target *t,
                       struct xt_entry_target __user *u);
 int xt_data_to_user(void __user *dst, const void *src,
-                    int usersize, int size);
+                    int usersize, int size, int aligned_size);
 
 void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                                  struct xt_counters_info *info, bool compat);
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index a30efb437e6d..e0cbf17af780 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -125,4 +125,9 @@ extern unsigned int ebt_do_table(struct sk_buff *skb,
 /* True if the target is not a standard target */
 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
 
+static inline bool ebt_invalid_target(int target)
+{
+        return (target < -NUM_STANDARD_TARGETS || target >= 0);
+}
+
 #endif
diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
index 0db37158a61d..6c8c5d8041b7 100644
--- a/include/linux/nvme-fc-driver.h
+++ b/include/linux/nvme-fc-driver.h
@@ -27,8 +27,8 @@
 
 /* FC Port role bitmask - can merge with FC Port Roles in fc transport */
 #define FC_PORT_ROLE_NVME_INITIATOR     0x10
-#define FC_PORT_ROLE_NVME_TARGET        0x11
-#define FC_PORT_ROLE_NVME_DISCOVERY     0x12
+#define FC_PORT_ROLE_NVME_TARGET        0x20
+#define FC_PORT_ROLE_NVME_DISCOVERY     0x40
 
 
 /**
@@ -642,15 +642,7 @@ enum {
                  * sequence in one LLDD operation. Errors during Data
                  * sequence transmit must not allow RSP sequence to be sent.
                  */
-        NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED = (1 << 1),
-                /* Bit 1: When 0, the LLDD will deliver FCP CMD
-                 * on the CPU it should be affinitized to. Thus work will
-                 * be scheduled on the cpu received on. When 1, the LLDD
-                 * may not deliver the CMD on the CPU it should be worked
-                 * on. The transport should pick a cpu to schedule the work
-                 * on.
-                 */
-        NVMET_FCTGTFEAT_CMD_IN_ISR = (1 << 2),
+        NVMET_FCTGTFEAT_CMD_IN_ISR = (1 << 1),
                 /* Bit 2: When 0, the LLDD is calling the cmd rcv handler
                  * in a non-isr context, allowing the transport to finish
                  * op completion in the calling context. When 1, the LLDD
@@ -658,7 +650,7 @@ enum {
                  * requiring the transport to transition to a workqueue
                  * for op completion.
                  */
-        NVMET_FCTGTFEAT_OPDONE_IN_ISR = (1 << 3),
+        NVMET_FCTGTFEAT_OPDONE_IN_ISR = (1 << 2),
                 /* Bit 3: When 0, the LLDD is calling the op done handler
                  * in a non-isr context, allowing the transport to finish
                  * op completion in the calling context. When 1, the LLDD
diff --git a/include/linux/of_irq.h b/include/linux/of_irq.h
index ec6b11deb773..1e0deb8e8494 100644
--- a/include/linux/of_irq.h
+++ b/include/linux/of_irq.h
@@ -8,7 +8,7 @@
 #include <linux/ioport.h>
 #include <linux/of.h>
 
-typedef int const (*of_irq_init_cb_t)(struct device_node *, struct device_node *);
+typedef int (*of_irq_init_cb_t)(struct device_node *, struct device_node *);
 
 /*
  * Workarounds only applied to 32bit powermac machines
diff --git a/include/linux/of_platform.h b/include/linux/of_platform.h
index dc8224ae28d5..e0d1946270f3 100644
--- a/include/linux/of_platform.h
+++ b/include/linux/of_platform.h
@@ -64,6 +64,7 @@ extern struct platform_device *of_platform_device_create(struct device_node *np,
                                                    const char *bus_id,
                                                    struct device *parent);
 
+extern int of_platform_device_destroy(struct device *dev, void *data);
 extern int of_platform_bus_probe(struct device_node *root,
                                  const struct of_device_id *matches,
                                  struct device *parent);
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 33c2b0b77429..8039f9f0ca05 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -183,6 +183,11 @@ enum pci_dev_flags {
         PCI_DEV_FLAGS_BRIDGE_XLATE_ROOT = (__force pci_dev_flags_t) (1 << 9),
         /* Do not use FLR even if device advertises PCI_AF_CAP */
         PCI_DEV_FLAGS_NO_FLR_RESET = (__force pci_dev_flags_t) (1 << 10),
+        /*
+         * Resume before calling the driver's system suspend hooks, disabling
+         * the direct_complete optimization.
+         */
+        PCI_DEV_FLAGS_NEEDS_RESUME = (__force pci_dev_flags_t) (1 << 11),
 };
 
 enum pci_irq_reroute_variant {
@@ -1342,9 +1347,9 @@ pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
                                unsigned int max_vecs, unsigned int flags,
                                const struct irq_affinity *aff_desc)
 {
-        if (min_vecs > 1)
-                return -EINVAL;
-        return 1;
+        if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1 && dev->irq)
+                return 1;
+        return -ENOSPC;
 }
 
 static inline void pci_free_irq_vectors(struct pci_dev *dev)
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 422bc2e4cb6a..ef3eb8bbfee4 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -54,7 +54,8 @@ extern int ptrace_request(struct task_struct *child, long request,
                           unsigned long addr, unsigned long data);
 extern void ptrace_notify(int exit_code);
 extern void __ptrace_link(struct task_struct *child,
-                          struct task_struct *new_parent);
+                          struct task_struct *new_parent,
+                          const struct cred *ptracer_cred);
 extern void __ptrace_unlink(struct task_struct *child);
 extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
 #define PTRACE_MODE_READ        0x01
@@ -206,7 +207,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
         if (unlikely(ptrace) && current->ptrace) {
                 child->ptrace = current->ptrace;
-                __ptrace_link(child, current->parent);
+                __ptrace_link(child, current->parent, current->ptracer_cred);
 
                 if (child->ptrace & PT_SEIZED)
                         task_set_jobctl_pending(child, JOBCTL_TRAP_STOP);
@@ -215,6 +216,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace)
 
                 set_tsk_thread_flag(child, TIF_SIGPENDING);
         }
+        else
+                child->ptracer_cred = NULL;
 }
 
 /**
diff --git a/include/linux/serdev.h b/include/linux/serdev.h
index cda76c6506ca..e69402d4a8ae 100644
--- a/include/linux/serdev.h
+++ b/include/linux/serdev.h
@@ -195,6 +195,7 @@ int serdev_device_open(struct serdev_device *);
 void serdev_device_close(struct serdev_device *);
 unsigned int serdev_device_set_baudrate(struct serdev_device *, unsigned int);
 void serdev_device_set_flow_control(struct serdev_device *, bool);
+int serdev_device_write_buf(struct serdev_device *, const unsigned char *, size_t);
 void serdev_device_wait_until_sent(struct serdev_device *, long);
 int serdev_device_get_tiocm(struct serdev_device *);
 int serdev_device_set_tiocm(struct serdev_device *, int, int);
@@ -236,6 +237,12 @@ static inline unsigned int serdev_device_set_baudrate(struct serdev_device *sdev
         return 0;
 }
 static inline void serdev_device_set_flow_control(struct serdev_device *sdev, bool enable) {}
+static inline int serdev_device_write_buf(struct serdev_device *serdev,
+                                          const unsigned char *buf,
+                                          size_t count)
+{
+        return -ENODEV;
+}
 static inline void serdev_device_wait_until_sent(struct serdev_device *sdev, long timeout) {}
 static inline int serdev_device_get_tiocm(struct serdev_device *serdev)
 {
@@ -301,7 +308,7 @@ struct tty_driver;
 struct device *serdev_tty_port_register(struct tty_port *port,
                                         struct device *parent,
                                         struct tty_driver *drv, int idx);
-void serdev_tty_port_unregister(struct tty_port *port);
+int serdev_tty_port_unregister(struct tty_port *port);
 #else
 static inline struct device *serdev_tty_port_register(struct tty_port *port,
                                            struct device *parent,
@@ -309,14 +316,10 @@ static inline struct device *serdev_tty_port_register(struct tty_port *port,
 {
         return ERR_PTR(-ENODEV);
 }
-static inline void serdev_tty_port_unregister(struct tty_port *port) {}
-#endif /* CONFIG_SERIAL_DEV_CTRL_TTYPORT */
-
-static inline int serdev_device_write_buf(struct serdev_device *serdev,
-                                          const unsigned char *data,
-                                          size_t count)
+static inline int serdev_tty_port_unregister(struct tty_port *port)
 {
-        return serdev_device_write(serdev, data, count, 0);
+        return -ENODEV;
 }
+#endif /* CONFIG_SERIAL_DEV_CTRL_TTYPORT */
 
 #endif /*_LINUX_SERDEV_H */
diff --git a/include/linux/soc/renesas/rcar-rst.h b/include/linux/soc/renesas/rcar-rst.h
index a18e0783946b..787e7ad53d45 100644
--- a/include/linux/soc/renesas/rcar-rst.h
+++ b/include/linux/soc/renesas/rcar-rst.h
@@ -1,6 +1,11 @@
 #ifndef __LINUX_SOC_RENESAS_RCAR_RST_H__
 #define __LINUX_SOC_RENESAS_RCAR_RST_H__
 
+#if defined(CONFIG_ARCH_RCAR_GEN1) || defined(CONFIG_ARCH_RCAR_GEN2) || \
+    defined(CONFIG_ARCH_R8A7795) || defined(CONFIG_ARCH_R8A7796)
 int rcar_rst_read_mode_pins(u32 *mode);
+#else
+static inline int rcar_rst_read_mode_pins(u32 *mode) { return -ENODEV; }
+#endif
 
 #endif /* __LINUX_SOC_RENESAS_RCAR_RST_H__ */
diff --git a/include/linux/tty.h b/include/linux/tty.h
index d07cd2105a6c..eccb4ec30a8a 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -558,6 +558,15 @@ extern struct device *tty_port_register_device_attr(struct tty_port *port,
                 struct tty_driver *driver, unsigned index,
                 struct device *device, void *drvdata,
                 const struct attribute_group **attr_grp);
+extern struct device *tty_port_register_device_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device);
+extern struct device *tty_port_register_device_attr_serdev(struct tty_port *port,
+                struct tty_driver *driver, unsigned index,
+                struct device *device, void *drvdata,
+                const struct attribute_group **attr_grp);
+extern void tty_port_unregister_device(struct tty_port *port,
+                struct tty_driver *driver, unsigned index);
 extern int tty_port_alloc_xmit_buf(struct tty_port *port);
 extern void tty_port_free_xmit_buf(struct tty_port *port);
 extern void tty_port_destroy(struct tty_port *port);
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index a469999a106d..50398b69ca44 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -148,6 +148,7 @@ struct usb_hcd {
         unsigned                rh_registered:1;/* is root hub registered? */
         unsigned                rh_pollable:1;  /* may we poll the root hub? */
         unsigned                msix_enabled:1; /* driver has MSI-X enabled? */
+        unsigned                msi_enabled:1;  /* driver has MSI enabled? */
         unsigned                remove_phy:1;   /* auto-remove USB phy */
 
         /* The next flag is a stopgap, to be removed when all the HCDs
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 7dffa5624ea6..97116379db5f 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -206,6 +206,7 @@ struct cdc_state {
 };
 
 extern int usbnet_generic_cdc_bind(struct usbnet *, struct usb_interface *);
+extern int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf);
 extern int usbnet_cdc_bind(struct usbnet *, struct usb_interface *);
 extern void usbnet_cdc_unbind(struct usbnet *, struct usb_interface *);
 extern void usbnet_cdc_status(struct usbnet *, struct urb *);
diff --git a/include/net/dst.h b/include/net/dst.h
index 049af33da3b6..cfc043784166 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -107,10 +107,16 @@ struct dst_entry {
         };
 };
 
+struct dst_metrics {
+        u32             metrics[RTAX_MAX];
+        atomic_t        refcnt;
+};
+extern const struct dst_metrics dst_default_metrics;
+
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
-extern const u32 dst_default_metrics[];
 
 #define DST_METRICS_READ_ONLY           0x1UL
+#define DST_METRICS_REFCOUNTED          0x2UL
 #define DST_METRICS_FLAGS               0x3UL
 #define __DST_METRICS_PTR(Y)    \
         ((u32 *)((Y) & ~DST_METRICS_FLAGS))
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 6692c5758b33..f7f6aa789c61 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -114,11 +114,11 @@ struct fib_info {
         __be32                  fib_prefsrc;
         u32                     fib_tb_id;
         u32                     fib_priority;
-        u32                     *fib_metrics;
-#define fib_mtu fib_metrics[RTAX_MTU-1]
-#define fib_window fib_metrics[RTAX_WINDOW-1]
-#define fib_rtt fib_metrics[RTAX_RTT-1]
-#define fib_advmss fib_metrics[RTAX_ADVMSS-1]
+        struct dst_metrics      *fib_metrics;
+#define fib_mtu fib_metrics->metrics[RTAX_MTU-1]
+#define fib_window fib_metrics->metrics[RTAX_WINDOW-1]
+#define fib_rtt fib_metrics->metrics[RTAX_RTT-1]
+#define fib_advmss fib_metrics->metrics[RTAX_ADVMSS-1]
         int                     fib_nhs;
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         int                     fib_weight;
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index e04fa7691e5d..c519bb5b5bb8 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -9,6 +9,7 @@
 
 #ifndef _NF_CONNTRACK_HELPER_H
 #define _NF_CONNTRACK_HELPER_H
+#include <linux/refcount.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_expect.h>
@@ -26,6 +27,7 @@ struct nf_conntrack_helper {
         struct hlist_node hnode;        /* Internal use. */
 
         char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
+        refcount_t refcnt;
         struct module *me;              /* pointer to self */
         const struct nf_conntrack_expect_policy *expect_policy;
 
@@ -79,6 +81,8 @@ struct nf_conntrack_helper *__nf_conntrack_helper_find(const char *name,
 struct nf_conntrack_helper *nf_conntrack_helper_try_module_get(const char *name,
                                                                u16 l3num,
                                                                u8 protonum);
+void nf_conntrack_helper_put(struct nf_conntrack_helper *helper);
+
 void nf_ct_helper_init(struct nf_conntrack_helper *helper,
                        u16 l3num, u16 protonum, const char *name,
                        u16 default_port, u16 spec_port, u32 id,
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 028faec8fc27..8a8bab8d7b15 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -176,7 +176,7 @@ struct nft_data_desc {
 int nft_data_init(const struct nft_ctx *ctx,
                   struct nft_data *data, unsigned int size,
                   struct nft_data_desc *desc, const struct nlattr *nla);
-void nft_data_uninit(const struct nft_data *data, enum nft_data_types type);
+void nft_data_release(const struct nft_data *data, enum nft_data_types type);
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
                   enum nft_data_types type, unsigned int len);
 
diff --git a/include/net/tc_act/tc_csum.h b/include/net/tc_act/tc_csum.h
index f31fb6331a53..3248beaf16b0 100644
--- a/include/net/tc_act/tc_csum.h
+++ b/include/net/tc_act/tc_csum.h
@@ -3,6 +3,7 @@
 
 #include <linux/types.h>
 #include <net/act_api.h>
+#include <linux/tc_act/tc_csum.h>
 
 struct tcf_csum {
         struct tc_action common;
@@ -11,4 +12,18 @@ struct tcf_csum {
 };
 #define to_tcf_csum(a) ((struct tcf_csum *)a)
 
+static inline bool is_tcf_csum(const struct tc_action *a)
+{
+#ifdef CONFIG_NET_CLS_ACT
+        if (a->ops && a->ops->type == TCA_ACT_CSUM)
+                return true;
+#endif
+        return false;
+}
+
+static inline u32 tcf_csum_update_flags(const struct tc_action *a)
+{
+        return to_tcf_csum(a)->update_flags;
+}
+
 #endif /* __NET_TC_CSUM_H */
diff --git a/include/net/x25.h b/include/net/x25.h
index c383aa4edbf0..6d30a01d281d 100644
--- a/include/net/x25.h
+++ b/include/net/x25.h
@@ -298,10 +298,10 @@ void x25_check_rbuf(struct sock *);
 
 /* sysctl_net_x25.c */
 #ifdef CONFIG_SYSCTL
-void x25_register_sysctl(void);
+int x25_register_sysctl(void);
 void x25_unregister_sysctl(void);
 #else
-static inline void x25_register_sysctl(void) {};
+static inline int x25_register_sysctl(void) { return 0; };
 static inline void x25_unregister_sysctl(void) {};
 #endif /* CONFIG_SYSCTL */
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 6793a30c66b1..7e7e2b0d2915 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -979,10 +979,6 @@ struct xfrm_dst {
         struct flow_cache_object flo;
         struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
         int num_pols, num_xfrms;
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct flowi *origin;
-        struct xfrm_selector *partner;
-#endif
         u32 xfrm_genid;
         u32 policy_genid;
         u32 route_mtu_cached;
@@ -998,12 +994,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
         dst_release(xdst->route);
         if (likely(xdst->u.dst.xfrm))
                 xfrm_state_put(xdst->u.dst.xfrm);
-#ifdef CONFIG_XFRM_SUB_POLICY
-        kfree(xdst->origin);
-        xdst->origin = NULL;
-        kfree(xdst->partner);
-        xdst->partner = NULL;
-#endif
 }
 #endif
 
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 945a1f5f63c5..94dfa9def355 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -132,6 +132,13 @@ enum bpf_attach_type {
  */
 #define BPF_F_ALLOW_OVERRIDE    (1U << 0)
 
+/* If BPF_F_STRICT_ALIGNMENT is used in BPF_PROG_LOAD command, the
+ * verifier will perform strict alignment checking as if the kernel
+ * has been built with CONFIG_EFFICIENT_UNALIGNED_ACCESS not set,
+ * and NET_IP_ALIGN defined to 2.
+ */
+#define BPF_F_STRICT_ALIGNMENT  (1U << 0)
+
 #define BPF_PSEUDO_MAP_FD       1
 
 /* flags for BPF_MAP_UPDATE_ELEM command */
@@ -177,6 +184,7 @@ union bpf_attr {
                 __u32           log_size;       /* size of user buffer */
                 __aligned_u64   log_buf;        /* user supplied buffer */
                 __u32           kern_version;   /* checked when prog_type=kprobe */
+                __u32           prog_flags;
         };
 
         struct { /* anonymous struct used by BPF_OBJ_* commands */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 8e56ac70e0d1..15ac20382aba 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -888,9 +888,18 @@ enum {
 /* XDP section */
 
 #define XDP_FLAGS_UPDATE_IF_NOEXIST     (1U << 0)
-#define XDP_FLAGS_SKB_MODE              (2U << 0)
+#define XDP_FLAGS_SKB_MODE              (1U << 1)
+#define XDP_FLAGS_DRV_MODE              (1U << 2)
 #define XDP_FLAGS_MASK                  (XDP_FLAGS_UPDATE_IF_NOEXIST | \
-                                         XDP_FLAGS_SKB_MODE)
+                                         XDP_FLAGS_SKB_MODE | \
+                                         XDP_FLAGS_DRV_MODE)
+
+/* These are stored into IFLA_XDP_ATTACHED on dump. */
+enum {
+        XDP_ATTACHED_NONE = 0,
+        XDP_ATTACHED_DRV,
+        XDP_ATTACHED_SKB,
+};
 
 enum {
         IFLA_XDP_UNSPEC,
diff --git a/include/uapi/linux/usb/ch11.h b/include/uapi/linux/usb/ch11.h
index 361297e96f58..576c704e3fb8 100644
--- a/include/uapi/linux/usb/ch11.h
+++ b/include/uapi/linux/usb/ch11.h
@@ -22,6 +22,9 @@
  */
 #define USB_MAXCHILDREN         31
 
+/* See USB 3.1 spec Table 10-5 */
+#define USB_SS_MAXPORTS         15
+
 /*
  * Hub request types
  */
diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c
index 5e00b2333c26..172dc8ee0e3b 100644
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -86,6 +86,7 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr)
         array->map.key_size = attr->key_size;
         array->map.value_size = attr->value_size;
         array->map.max_entries = attr->max_entries;
+        array->map.map_flags = attr->map_flags;
         array->elem_size = elem_size;
 
         if (!percpu)
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 39cfafd895b8..b09185f0f17d 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -432,6 +432,7 @@ static struct bpf_map *trie_alloc(union bpf_attr *attr)
         trie->map.key_size = attr->key_size;
         trie->map.value_size = attr->value_size;
         trie->map.max_entries = attr->max_entries;
+        trie->map.map_flags = attr->map_flags;
         trie->data_size = attr->key_size -
                           offsetof(struct bpf_lpm_trie_key, data);
         trie->max_prefixlen = trie->data_size * 8;
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 4dfd6f2ec2f9..31147d730abf 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -88,6 +88,7 @@ static struct bpf_map *stack_map_alloc(union bpf_attr *attr)
         smap->map.key_size = attr->key_size;
         smap->map.value_size = value_size;
         smap->map.max_entries = attr->max_entries;
+        smap->map.map_flags = attr->map_flags;
         smap->n_buckets = n_buckets;
         smap->map.pages = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT;
 
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index fd2411fd6914..265a0d854e33 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -783,7 +783,7 @@ struct bpf_prog *bpf_prog_get_type(u32 ufd, enum bpf_prog_type type)
 EXPORT_SYMBOL_GPL(bpf_prog_get_type);
 
 /* last field in 'union bpf_attr' used by this command */
-#define BPF_PROG_LOAD_LAST_FIELD kern_version
+#define BPF_PROG_LOAD_LAST_FIELD prog_flags
 
 static int bpf_prog_load(union bpf_attr *attr)
 {
@@ -796,6 +796,9 @@ static int bpf_prog_load(union bpf_attr *attr)
         if (CHECK_ATTR(BPF_PROG_LOAD))
                 return -EINVAL;
 
+        if (attr->prog_flags & ~BPF_F_STRICT_ALIGNMENT)
+                return -EINVAL;
+
         /* copy eBPF program license from user space */
         if (strncpy_from_user(license, u64_to_user_ptr(attr->license),
                               sizeof(license) - 1) < 0)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c5b56c92f8e2..339c8a1371de 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -140,7 +140,7 @@ struct bpf_verifier_stack_elem {
         struct bpf_verifier_stack_elem *next;
 };
 
-#define BPF_COMPLEXITY_LIMIT_INSNS      65536
+#define BPF_COMPLEXITY_LIMIT_INSNS      98304
 #define BPF_COMPLEXITY_LIMIT_STACK      1024
 
 #define BPF_MAP_PTR_POISON ((void *)0xeB9F + POISON_POINTER_DELTA)
@@ -241,6 +241,12 @@ static void print_verifier_state(struct bpf_verifier_state *state)
                 if (reg->max_value != BPF_REGISTER_MAX_RANGE)
                         verbose(",max_value=%llu",
                                 (unsigned long long)reg->max_value);
+                if (reg->min_align)
+                        verbose(",min_align=%u", reg->min_align);
+                if (reg->aux_off)
+                        verbose(",aux_off=%u", reg->aux_off);
+                if (reg->aux_off_align)
+                        verbose(",aux_off_align=%u", reg->aux_off_align);
         }
         for (i = 0; i < MAX_BPF_STACK; i += BPF_REG_SIZE) {
                 if (state->stack_slot_type[i] == STACK_SPILL)
@@ -457,16 +463,22 @@ static const int caller_saved[CALLER_SAVED_REGS] = {
         BPF_REG_0, BPF_REG_1, BPF_REG_2, BPF_REG_3, BPF_REG_4, BPF_REG_5
 };
 
+static void mark_reg_not_init(struct bpf_reg_state *regs, u32 regno)
+{
+        BUG_ON(regno >= MAX_BPF_REG);
+
+        memset(&regs[regno], 0, sizeof(regs[regno]));
+        regs[regno].type = NOT_INIT;
+        regs[regno].min_value = BPF_REGISTER_MIN_RANGE;
+        regs[regno].max_value = BPF_REGISTER_MAX_RANGE;
+}
+
 static void init_reg_state(struct bpf_reg_state *regs)
 {
         int i;
 
-        for (i = 0; i < MAX_BPF_REG; i++) {
-                regs[i].type = NOT_INIT;
-                regs[i].imm = 0;
-                regs[i].min_value = BPF_REGISTER_MIN_RANGE;
-                regs[i].max_value = BPF_REGISTER_MAX_RANGE;
-        }
+        for (i = 0; i < MAX_BPF_REG; i++)
+                mark_reg_not_init(regs, i);
 
         /* frame pointer */
         regs[BPF_REG_FP].type = FRAME_PTR;
@@ -492,6 +504,7 @@ static void reset_reg_range_values(struct bpf_reg_state *regs, u32 regno)
 {
         regs[regno].min_value = BPF_REGISTER_MIN_RANGE;
         regs[regno].max_value = BPF_REGISTER_MAX_RANGE;
+        regs[regno].min_align = 0;
 }
 
 static void mark_reg_unknown_value_and_range(struct bpf_reg_state *regs,
@@ -779,17 +792,37 @@ static bool is_pointer_value(struct bpf_verifier_env *env, int regno)
 }
 
 static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
-                                   int off, int size)
+                                   int off, int size, bool strict)
 {
-        if (reg->id && size != 1) {
-                verbose("Unknown alignment. Only byte-sized access allowed in packet access.\n");
-                return -EACCES;
+        int ip_align;
+        int reg_off;
+
+        /* Byte size accesses are always allowed. */
+        if (!strict || size == 1)
+                return 0;
+
+        reg_off = reg->off;
+        if (reg->id) {
+                if (reg->aux_off_align % size) {
+                        verbose("Packet access is only %u byte aligned, %d byte access not allowed\n",
+                                reg->aux_off_align, size);
+                        return -EACCES;
+                }
+                reg_off += reg->aux_off;
         }
 
-        /* skb->data is NET_IP_ALIGN-ed */
-        if ((NET_IP_ALIGN + reg->off + off) % size != 0) {
+        /* For platforms that do not have a Kconfig enabling
+         * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS the value of
+         * NET_IP_ALIGN is universally set to '2'.  And on platforms
+         * that do set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, we get
+         * to this code only in strict mode where we want to emulate
+         * the NET_IP_ALIGN==2 checking.  Therefore use an
+         * unconditional IP align value of '2'.
+         */
+        ip_align = 2;
+        if ((ip_align + reg_off + off) % size != 0) {
                 verbose("misaligned packet access off %d+%d+%d size %d\n",
-                        NET_IP_ALIGN, reg->off, off, size);
+                        ip_align, reg_off, off, size);
                 return -EACCES;
         }
 
@@ -797,9 +830,9 @@ static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
 }
 
 static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
-                                   int size)
+                                   int size, bool strict)
 {
-        if (size != 1) {
+        if (strict && size != 1) {
                 verbose("Unknown alignment. Only byte-sized access allowed in value access.\n");
                 return -EACCES;
         }
@@ -807,16 +840,17 @@ static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
         return 0;
 }
 
-static int check_ptr_alignment(const struct bpf_reg_state *reg,
+static int check_ptr_alignment(struct bpf_verifier_env *env,
+                               const struct bpf_reg_state *reg,
                                int off, int size)
 {
+        bool strict = env->strict_alignment;
+
         switch (reg->type) {
         case PTR_TO_PACKET:
-                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
-                       check_pkt_ptr_alignment(reg, off, size);
+                return check_pkt_ptr_alignment(reg, off, size, strict);
         case PTR_TO_MAP_VALUE_ADJ:
-                return IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) ? 0 :
-                       check_val_ptr_alignment(reg, size);
+                return check_val_ptr_alignment(reg, size, strict);
         default:
                 if (off % size != 0) {
                         verbose("misaligned access off %d size %d\n",
@@ -849,7 +883,7 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
         if (size < 0)
                 return size;
 
-        err = check_ptr_alignment(reg, off, size);
+        err = check_ptr_alignment(env, reg, off, size);
         if (err)
                 return err;
 
@@ -883,6 +917,8 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
                                                          value_regno);
                         /* note that reg.[id|off|range] == 0 */
                         state->regs[value_regno].type = reg_type;
+                        state->regs[value_regno].aux_off = 0;
+                        state->regs[value_regno].aux_off_align = 0;
                 }
 
         } else if (reg->type == FRAME_PTR || reg->type == PTR_TO_STACK) {
@@ -1313,7 +1349,6 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         struct bpf_verifier_state *state = &env->cur_state;
         const struct bpf_func_proto *fn = NULL;
         struct bpf_reg_state *regs = state->regs;
-        struct bpf_reg_state *reg;
         struct bpf_call_arg_meta meta;
         bool changes_data;
         int i, err;
@@ -1380,11 +1415,8 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
         }
 
         /* reset caller saved regs */
-        for (i = 0; i < CALLER_SAVED_REGS; i++) {
-                reg = regs + caller_saved[i];
-                reg->type = NOT_INIT;
-                reg->imm = 0;
-        }
+        for (i = 0; i < CALLER_SAVED_REGS; i++)
+                mark_reg_not_init(regs, caller_saved[i]);
 
         /* update return register */
         if (fn->ret_type == RET_INTEGER) {
@@ -1455,6 +1487,8 @@ add_imm:
                  */
                 dst_reg->off += imm;
         } else {
+                bool had_id;
+
                 if (src_reg->type == PTR_TO_PACKET) {
                         /* R6=pkt(id=0,off=0,r=62) R7=imm22; r7 += r6 */
                         tmp_reg = *dst_reg;  /* save r7 state */
@@ -1488,14 +1522,23 @@ add_imm:
                                 src_reg->imm);
                         return -EACCES;
                 }
+
+                had_id = (dst_reg->id != 0);
+
                 /* dst_reg stays as pkt_ptr type and since some positive
                  * integer value was added to the pointer, increment its 'id'
                  */
                 dst_reg->id = ++env->id_gen;
 
-                /* something was added to pkt_ptr, set range and off to zero */
+                /* something was added to pkt_ptr, set range to zero */
+                dst_reg->aux_off += dst_reg->off;
                 dst_reg->off = 0;
                 dst_reg->range = 0;
+                if (had_id)
+                        dst_reg->aux_off_align = min(dst_reg->aux_off_align,
+                                                     src_reg->min_align);
+                else
+                        dst_reg->aux_off_align = src_reg->min_align;
         }
         return 0;
 }
@@ -1669,6 +1712,13 @@ static void check_reg_overflow(struct bpf_reg_state *reg)
                 reg->min_value = BPF_REGISTER_MIN_RANGE;
 }
 
+static u32 calc_align(u32 imm)
+{
+        if (!imm)
+                return 1U << 31;
+        return imm - ((imm - 1) & imm);
+}
+
 static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                                     struct bpf_insn *insn)
 {
@@ -1676,8 +1726,10 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
         s64 min_val = BPF_REGISTER_MIN_RANGE;
         u64 max_val = BPF_REGISTER_MAX_RANGE;
         u8 opcode = BPF_OP(insn->code);
+        u32 dst_align, src_align;
 
         dst_reg = &regs[insn->dst_reg];
+        src_align = 0;
         if (BPF_SRC(insn->code) == BPF_X) {
                 check_reg_overflow(&regs[insn->src_reg]);
                 min_val = regs[insn->src_reg].min_value;
@@ -1693,12 +1745,18 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                     regs[insn->src_reg].type != UNKNOWN_VALUE) {
                         min_val = BPF_REGISTER_MIN_RANGE;
                         max_val = BPF_REGISTER_MAX_RANGE;
+                        src_align = 0;
+                } else {
+                        src_align = regs[insn->src_reg].min_align;
                 }
         } else if (insn->imm < BPF_REGISTER_MAX_RANGE &&
                    (s64)insn->imm > BPF_REGISTER_MIN_RANGE) {
                 min_val = max_val = insn->imm;
+                src_align = calc_align(insn->imm);
         }
 
+        dst_align = dst_reg->min_align;
+
         /* We don't know anything about what was done to this register, mark it
          * as unknown.
          */
@@ -1723,18 +1781,21 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                         dst_reg->min_value += min_val;
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value += max_val;
+                dst_reg->min_align = min(src_align, dst_align);
                 break;
         case BPF_SUB:
                 if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
                         dst_reg->min_value -= min_val;
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value -= max_val;
+                dst_reg->min_align = min(src_align, dst_align);
                 break;
         case BPF_MUL:
                 if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
                         dst_reg->min_value *= min_val;
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value *= max_val;
+                dst_reg->min_align = max(src_align, dst_align);
                 break;
         case BPF_AND:
                 /* Disallow AND'ing of negative numbers, ain't nobody got time
@@ -1746,17 +1807,23 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                 else
                         dst_reg->min_value = 0;
                 dst_reg->max_value = max_val;
+                dst_reg->min_align = max(src_align, dst_align);
                 break;
         case BPF_LSH:
                 /* Gotta have special overflow logic here, if we're shifting
                  * more than MAX_RANGE then just assume we have an invalid
                  * range.
                  */
-                if (min_val > ilog2(BPF_REGISTER_MAX_RANGE))
+                if (min_val > ilog2(BPF_REGISTER_MAX_RANGE)) {
                         dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
-                else if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
-                        dst_reg->min_value <<= min_val;
-
+                        dst_reg->min_align = 1;
+                } else {
+                        if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
+                                dst_reg->min_value <<= min_val;
+                        if (!dst_reg->min_align)
+                                dst_reg->min_align = 1;
+                        dst_reg->min_align <<= min_val;
+                }
                 if (max_val > ilog2(BPF_REGISTER_MAX_RANGE))
                         dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
                 else if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
@@ -1766,11 +1833,19 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                 /* RSH by a negative number is undefined, and the BPF_RSH is an
                  * unsigned shift, so make the appropriate casts.
                  */
-                if (min_val < 0 || dst_reg->min_value < 0)
+                if (min_val < 0 || dst_reg->min_value < 0) {
                         dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
-                else
+                } else {
                         dst_reg->min_value =
                                 (u64)(dst_reg->min_value) >> min_val;
+                }
+                if (min_val < 0) {
+                        dst_reg->min_align = 1;
+                } else {
+                        dst_reg->min_align >>= (u64) min_val;
+                        if (!dst_reg->min_align)
+                                dst_reg->min_align = 1;
+                }
                 if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value >>= max_val;
                 break;
@@ -1872,6 +1947,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                         regs[insn->dst_reg].imm = insn->imm;
                         regs[insn->dst_reg].max_value = insn->imm;
                         regs[insn->dst_reg].min_value = insn->imm;
+                        regs[insn->dst_reg].min_align = calc_align(insn->imm);
                 }
 
         } else if (opcode > BPF_END) {
@@ -2368,7 +2444,6 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
 {
         struct bpf_reg_state *regs = env->cur_state.regs;
         u8 mode = BPF_MODE(insn->code);
-        struct bpf_reg_state *reg;
         int i, err;
 
         if (!may_access_skb(env->prog->type)) {
@@ -2401,11 +2476,8 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
         }
 
         /* reset caller saved regs to unreadable */
-        for (i = 0; i < CALLER_SAVED_REGS; i++) {
-                reg = regs + caller_saved[i];
-                reg->type = NOT_INIT;
-                reg->imm = 0;
-        }
+        for (i = 0; i < CALLER_SAVED_REGS; i++)
+                mark_reg_not_init(regs, caller_saved[i]);
 
         /* mark destination R0 register as readable, since it contains
          * the value fetched from the packet
@@ -2564,6 +2636,7 @@ peek_stack:
                                 env->explored_states[t + 1] = STATE_LIST_MARK;
                 } else {
                         /* conditional jump with two edges */
+                        env->explored_states[t] = STATE_LIST_MARK;
                         ret = push_insn(t, t + 1, FALLTHROUGH, env);
                         if (ret == 1)
                                 goto peek_stack;
@@ -2615,7 +2688,8 @@ err_free:
 /* the following conditions reduce the number of explored insns
  * from ~140k to ~80k for ultra large programs that use a lot of ptr_to_packet
  */
-static bool compare_ptrs_to_packet(struct bpf_reg_state *old,
+static bool compare_ptrs_to_packet(struct bpf_verifier_env *env,
+                                   struct bpf_reg_state *old,
                                    struct bpf_reg_state *cur)
 {
         if (old->id != cur->id)
@@ -2658,7 +2732,7 @@ static bool compare_ptrs_to_packet(struct bpf_reg_state *old,
          * 'if (R4 > data_end)' and all further insn were already good with r=20,
          * so they will be good with r=30 and we can prune the search.
          */
-        if (old->off <= cur->off &&
+        if (!env->strict_alignment && old->off <= cur->off &&
             old->off >= old->range && cur->off >= cur->range)
                 return true;
 
@@ -2722,8 +2796,14 @@ static bool states_equal(struct bpf_verifier_env *env,
                      rcur->type != NOT_INIT))
                         continue;
 
+                /* Don't care about the reg->id in this case. */
+                if (rold->type == PTR_TO_MAP_VALUE_OR_NULL &&
+                    rcur->type == PTR_TO_MAP_VALUE_OR_NULL &&
+                    rold->map_ptr == rcur->map_ptr)
+                        continue;
+
                 if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&
-                    compare_ptrs_to_packet(rold, rcur))
+                    compare_ptrs_to_packet(env, rold, rcur))
                         continue;
 
                 return false;
@@ -2856,8 +2936,15 @@ static int do_check(struct bpf_verifier_env *env)
                         goto process_bpf_exit;
                 }
 
-                if (log_level && do_print_state) {
-                        verbose("\nfrom %d to %d:", prev_insn_idx, insn_idx);
+                if (need_resched())
+                        cond_resched();
+
+                if (log_level > 1 || (log_level && do_print_state)) {
+                        if (log_level > 1)
+                                verbose("%d:", insn_idx);
+                        else
+                                verbose("\nfrom %d to %d:",
+                                        prev_insn_idx, insn_idx);
                         print_verifier_state(&env->cur_state);
                         do_print_state = false;
                 }
@@ -3495,6 +3582,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr)
                 log_level = 0;
         }
 
+        env->strict_alignment = !!(attr->prog_flags & BPF_F_STRICT_ALIGNMENT);
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
+                env->strict_alignment = true;
+
         ret = replace_map_fd_with_map_ptr(env);
         if (ret < 0)
                 goto skip_full_check;
@@ -3600,6 +3691,10 @@ int bpf_analyzer(struct bpf_prog *prog, const struct bpf_ext_analyzer_ops *ops,
 
         log_level = 0;
 
+        env->strict_alignment = false;
+        if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
+                env->strict_alignment = true;
+
         env->explored_states = kcalloc(env->prog->len,
                                        sizeof(struct bpf_verifier_state_list *),
                                        GFP_KERNEL);
diff --git a/kernel/fork.c b/kernel/fork.c
index 06d759ab4c62..e53770d2bf95 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1577,6 +1577,18 @@ static __latent_entropy struct task_struct *copy_process(
         if (!p)
                 goto fork_out;
 
+        /*
+         * This _must_ happen before we call free_task(), i.e. before we jump
+         * to any of the bad_fork_* labels. This is to avoid freeing
+         * p->set_child_tid which is (ab)used as a kthread's data pointer for
+         * kernel threads (PF_KTHREAD).
+         */
+        p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
+        /*
+         * Clear TID on mm_release()?
+         */
+        p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
+
         ftrace_graph_init_task(p);
 
         rt_mutex_init_task(p);
@@ -1743,11 +1755,6 @@ static __latent_entropy struct task_struct *copy_process(
                 }
         }
 
-        p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
-        /*
-         * Clear TID on mm_release()?
-         */
-        p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
 #ifdef CONFIG_BLOCK
         p->plug = NULL;
 #endif
@@ -1845,11 +1852,13 @@ static __latent_entropy struct task_struct *copy_process(
         */
         recalc_sigpending();
         if (signal_pending(current)) {
-                spin_unlock(&current->sighand->siglock);
-                write_unlock_irq(&tasklist_lock);
                 retval = -ERESTARTNOINTR;
                 goto bad_fork_cancel_cgroup;
         }
+        if (unlikely(!(ns_of_pid(pid)->nr_hashed & PIDNS_HASH_ADDING))) {
+                retval = -ENOMEM;
+                goto bad_fork_cancel_cgroup;
+        }
 
         if (likely(p->pid)) {
                 ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
@@ -1907,6 +1916,8 @@ static __latent_entropy struct task_struct *copy_process(
         return p;
 
 bad_fork_cancel_cgroup:
+        spin_unlock(&current->sighand->siglock);
+        write_unlock_irq(&tasklist_lock);
         cgroup_cancel_fork(p);
 bad_fork_free_pid:
         cgroup_threadgroup_change_end(current);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 686be4b73018..c94da688ee9b 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -880,8 +880,8 @@ irq_set_chained_handler_and_data(unsigned int irq, irq_flow_handler_t handle,
         if (!desc)
                 return;
 
-        __irq_do_set_handler(desc, handle, 1, NULL);
         desc->irq_common_data.handler_data = data;
+        __irq_do_set_handler(desc, handle, 1, NULL);
 
         irq_put_desc_busunlock(desc, flags);
 }
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 7367e0ec6f81..adfe3b4cfe05 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -122,7 +122,7 @@ static void *alloc_insn_page(void)
         return module_alloc(PAGE_SIZE);
 }
 
-static void free_insn_page(void *page)
+void __weak free_insn_page(void *page)
 {
         module_memfree(page);
 }
@@ -595,7 +595,7 @@ static void kprobe_optimizer(struct work_struct *work)
 }
 
 /* Wait for completing optimization and unoptimization */
-static void wait_for_kprobe_optimizer(void)
+void wait_for_kprobe_optimizer(void)
 {
         mutex_lock(&kprobe_mutex);
 
@@ -2183,6 +2183,12 @@ static int kprobes_module_callback(struct notifier_block *nb,
                                  * The vaddr this probe is installed will soon
                                  * be vfreed buy not synced to disk. Hence,
                                  * disarming the breakpoint isn't needed.
+                                 *
+                                 * Note, this will also move any optimized probes
+                                 * that are pending to be removed from their
+                                 * corresponding lists to the freeing_list and
+                                 * will not be touched by the delayed
+                                 * kprobe_optimizer work handler.
                                  */
                                 kill_kprobe(p);
                         }
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index b95509416909..28cd09e635ed 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1785,12 +1785,14 @@ int rt_mutex_wait_proxy_lock(struct rt_mutex *lock,
         int ret;
 
         raw_spin_lock_irq(&lock->wait_lock);
-
-        set_current_state(TASK_INTERRUPTIBLE);
-
         /* sleep on the mutex */
+        set_current_state(TASK_INTERRUPTIBLE);
         ret = __rt_mutex_slowlock(lock, TASK_INTERRUPTIBLE, to, waiter);
-
+        /*
+         * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
+         * have to fix that up.
+         */
+        fixup_rt_mutex_waiters(lock);
         raw_spin_unlock_irq(&lock->wait_lock);
 
         return ret;
@@ -1822,15 +1824,25 @@ bool rt_mutex_cleanup_proxy_lock(struct rt_mutex *lock,
 
         raw_spin_lock_irq(&lock->wait_lock);
         /*
+         * Do an unconditional try-lock, this deals with the lock stealing
+         * state where __rt_mutex_futex_unlock() -> mark_wakeup_next_waiter()
+         * sets a NULL owner.
+         *
+         * We're not interested in the return value, because the subsequent
+         * test on rt_mutex_owner() will infer that. If the trylock succeeded,
+         * we will own the lock and it will have removed the waiter. If we
+         * failed the trylock, we're still not owner and we need to remove
+         * ourselves.
+         */
+        try_to_take_rt_mutex(lock, current, waiter);
+        /*
          * Unless we're the owner; we're still enqueued on the wait_list.
          * So check if we became owner, if not, take us off the wait_list.
          */
         if (rt_mutex_owner(lock) != current) {
                 remove_waiter(lock, waiter);
-                fixup_rt_mutex_waiters(lock);
                 cleanup = true;
         }
-
         /*
          * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might
          * have to fix that up.
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index d1f3e9f558b8..74a5a7255b4d 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -277,7 +277,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
          * if reparented.
          */
         for (;;) {
-                set_current_state(TASK_UNINTERRUPTIBLE);
+                set_current_state(TASK_INTERRUPTIBLE);
                 if (pid_ns->nr_hashed == init_pids)
                         break;
                 schedule();
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 3b1e0f3ad07f..fa46606f3356 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1425,7 +1425,7 @@ static unsigned int nr_meta_pages;
  * Numbers of normal and highmem page frames allocated for hibernation image
  * before suspending devices.
  */
-unsigned int alloc_normal, alloc_highmem;
+static unsigned int alloc_normal, alloc_highmem;
 /*
  * Memory bitmap used for marking saveable pages (during hibernation) or
  * hibernation image pages (during restore)
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 266ddcc1d8bb..60f356d91060 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -60,19 +60,25 @@ int ptrace_access_vm(struct task_struct *tsk, unsigned long addr,
 }
 
 
+void __ptrace_link(struct task_struct *child, struct task_struct *new_parent,
+                   const struct cred *ptracer_cred)
+{
+        BUG_ON(!list_empty(&child->ptrace_entry));
+        list_add(&child->ptrace_entry, &new_parent->ptraced);
+        child->parent = new_parent;
+        child->ptracer_cred = get_cred(ptracer_cred);
+}
+
 /*
  * ptrace a task: make the debugger its new parent and
  * move it to the ptrace list.
  *
  * Must be called with the tasklist lock write-held.
  */
-void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
+static void ptrace_link(struct task_struct *child, struct task_struct *new_parent)
 {
-        BUG_ON(!list_empty(&child->ptrace_entry));
-        list_add(&child->ptrace_entry, &new_parent->ptraced);
-        child->parent = new_parent;
         rcu_read_lock();
-        child->ptracer_cred = get_cred(__task_cred(new_parent));
+        __ptrace_link(child, new_parent, __task_cred(new_parent));
         rcu_read_unlock();
 }
 
@@ -386,7 +392,7 @@ static int ptrace_attach(struct task_struct *task, long request,
                 flags |= PT_SEIZED;
         task->ptrace = flags;
 
-        __ptrace_link(task, current);
+        ptrace_link(task, current);
 
         /* SEIZE doesn't trap tracee on attach */
         if (!seize)
@@ -459,7 +465,7 @@ static int ptrace_traceme(void)
                  */
                 if (!ret && !(current->real_parent->flags & PF_EXITING)) {
                         current->ptrace = PT_PTRACED;
-                        __ptrace_link(current, current->real_parent);
+                        ptrace_link(current, current->real_parent);
                 }
         }
         write_unlock_irq(&tasklist_lock);
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 759f4bd52cd6..803c3bc274c4 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3502,6 +3502,31 @@ asmlinkage __visible void __sched schedule(void)
 }
 EXPORT_SYMBOL(schedule);
 
+/*
+ * synchronize_rcu_tasks() makes sure that no task is stuck in preempted
+ * state (have scheduled out non-voluntarily) by making sure that all
+ * tasks have either left the run queue or have gone into user space.
+ * As idle tasks do not do either, they must not ever be preempted
+ * (schedule out non-voluntarily).
+ *
+ * schedule_idle() is similar to schedule_preempt_disable() except that it
+ * never enables preemption because it does not call sched_submit_work().
+ */
+void __sched schedule_idle(void)
+{
+        /*
+         * As this skips calling sched_submit_work(), which the idle task does
+         * regardless because that function is a nop when the task is in a
+         * TASK_RUNNING state, make sure this isn't used someplace that the
+         * current task can be in any other state. Note, idle is always in the
+         * TASK_RUNNING state.
+         */
+        WARN_ON_ONCE(current->state);
+        do {
+                __schedule(false);
+        } while (need_resched());
+}
+
 #ifdef CONFIG_CONTEXT_TRACKING
 asmlinkage __visible void __sched schedule_user(void)
 {
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 76877a62b5fa..622eed1b7658 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -245,11 +245,10 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
         sugov_update_commit(sg_policy, time, next_f);
 }
 
-static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu)
+static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time)
 {
         struct sugov_policy *sg_policy = sg_cpu->sg_policy;
         struct cpufreq_policy *policy = sg_policy->policy;
-        u64 last_freq_update_time = sg_policy->last_freq_update_time;
         unsigned long util = 0, max = 1;
         unsigned int j;
 
@@ -265,7 +264,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu)
                  * enough, don't take the CPU into account as it probably is
                  * idle now (and clear iowait_boost for it).
                  */
-                delta_ns = last_freq_update_time - j_sg_cpu->last_update;
+                delta_ns = time - j_sg_cpu->last_update;
                 if (delta_ns > TICK_NSEC) {
                         j_sg_cpu->iowait_boost = 0;
                         continue;
@@ -309,7 +308,7 @@ static void sugov_update_shared(struct update_util_data *hook, u64 time,
                 if (flags & SCHED_CPUFREQ_RT_DL)
                         next_f = sg_policy->policy->cpuinfo.max_freq;
                 else
-                        next_f = sugov_next_freq_shared(sg_cpu);
+                        next_f = sugov_next_freq_shared(sg_cpu, time);
 
                 sugov_update_commit(sg_policy, time, next_f);
         }
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 2a25a9ec2c6e..ef63adce0c9c 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -265,7 +265,7 @@ static void do_idle(void)
         smp_mb__after_atomic();
 
         sched_ttwu_pending();
-        schedule_preempt_disabled();
+        schedule_idle();
 
         if (unlikely(klp_patch_pending(current)))
                 klp_update_patch_state(current);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 7808ab050599..6dda2aab731e 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1467,6 +1467,8 @@ static inline struct cpuidle_state *idle_get_state(struct rq *rq)
 }
 #endif
 
+extern void schedule_idle(void);
+
 extern void sysrq_sched_debug_show(void);
 extern void sched_init_granularity(void);
 extern void update_max_interval(void);
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 1370f067fb51..d2a1e6dd0291 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -825,8 +825,10 @@ static void check_thread_timers(struct task_struct *tsk,
                          * At the hard limit, we just die.
                          * No need to calculate anything else now.
                          */
-                        pr_info("CPU Watchdog Timeout (hard): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("CPU Watchdog Timeout (hard): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
@@ -838,8 +840,10 @@ static void check_thread_timers(struct task_struct *tsk,
                                 soft += USEC_PER_SEC;
                                 sig->rlim[RLIMIT_RTTIME].rlim_cur = soft;
                         }
-                        pr_info("RT Watchdog Timeout (soft): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("RT Watchdog Timeout (soft): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
                 }
         }
@@ -936,8 +940,10 @@ static void check_process_timers(struct task_struct *tsk,
                          * At the hard limit, we just die.
                          * No need to calculate anything else now.
                          */
-                        pr_info("RT Watchdog Timeout (hard): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("RT Watchdog Timeout (hard): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
                         return;
                 }
@@ -945,8 +951,10 @@ static void check_process_timers(struct task_struct *tsk,
                         /*
                          * At the soft limit, send a SIGXCPU every second.
                          */
-                        pr_info("CPU Watchdog Timeout (soft): %s[%d]\n",
-                                tsk->comm, task_pid_nr(tsk));
+                        if (print_fatal_signals) {
+                                pr_info("CPU Watchdog Timeout (soft): %s[%d]\n",
+                                        tsk->comm, task_pid_nr(tsk));
+                        }
                         __group_send_sig_info(SIGXCPU, SEND_SIG_PRIV, tsk);
                         if (soft < hard) {
                                 soft++;
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index bd8ae8d5ae9c..193c5f5e3f79 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -1662,14 +1662,14 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
                 goto out;
 
         if (attr == &dev_attr_act_mask) {
-                if (sscanf(buf, "%llx", &value) != 1) {
+                if (kstrtoull(buf, 0, &value)) {
                         /* Assume it is a list of trace category names */
                         ret = blk_trace_str2mask(buf);
                         if (ret < 0)
                                 goto out;
                         value = ret;
                 }
-        } else if (sscanf(buf, "%llu", &value) != 1)
+        } else if (kstrtoull(buf, 0, &value))
                 goto out;
 
         ret = -ENXIO;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 39dca4e86a94..9e5841dc14b5 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4144,9 +4144,9 @@ unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
         int i, ret = -ENODEV;
         int size;
 
-        if (glob && (strcmp(glob, "*") == 0 || !strlen(glob)))
+        if (!glob || !strlen(glob) || !strcmp(glob, "*"))
                 func_g.search = NULL;
-        else if (glob) {
+        else {
                 int not;
 
                 func_g.type = filter_parse_regex(glob, strlen(glob),
@@ -4256,6 +4256,14 @@ unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
         return ret;
 }
 
+void clear_ftrace_function_probes(struct trace_array *tr)
+{
+        struct ftrace_func_probe *probe, *n;
+
+        list_for_each_entry_safe(probe, n, &tr->func_probes, list)
+                unregister_ftrace_function_probe_func(NULL, tr, probe->probe_ops);
+}
+
 static LIST_HEAD(ftrace_commands);
 static DEFINE_MUTEX(ftrace_cmd_mutex);
 
@@ -5055,7 +5063,7 @@ ftrace_graph_release(struct inode *inode, struct file *file)
         }
 
  out:
-        kfree(fgd->new_hash);
+        free_ftrace_hash(fgd->new_hash);
         kfree(fgd);
 
         return ret;
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c4536c449021..1122f151466f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1558,7 +1558,7 @@ static __init int init_trace_selftests(void)
 
         return 0;
 }
-early_initcall(init_trace_selftests);
+core_initcall(init_trace_selftests);
 #else
 static inline int run_tracer_selftest(struct tracer *type)
 {
@@ -2568,7 +2568,36 @@ static inline void ftrace_trace_stack(struct trace_array *tr,
 void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
                    int pc)
 {
-        __ftrace_trace_stack(tr->trace_buffer.buffer, flags, skip, pc, NULL);
+        struct ring_buffer *buffer = tr->trace_buffer.buffer;
+
+        if (rcu_is_watching()) {
+                __ftrace_trace_stack(buffer, flags, skip, pc, NULL);
+                return;
+        }
+
+        /*
+         * When an NMI triggers, RCU is enabled via rcu_nmi_enter(),
+         * but if the above rcu_is_watching() failed, then the NMI
+         * triggered someplace critical, and rcu_irq_enter() should
+         * not be called from NMI.
+         */
+        if (unlikely(in_nmi()))
+                return;
+
+        /*
+         * It is possible that a function is being traced in a
+         * location that RCU is not watching. A call to
+         * rcu_irq_enter() will make sure that it is, but there's
+         * a few internal rcu functions that could be traced
+         * where that wont work either. In those cases, we just
+         * do nothing.
+         */
+        if (unlikely(rcu_irq_enter_disabled()))
+                return;
+
+        rcu_irq_enter_irqson();
+        __ftrace_trace_stack(buffer, flags, skip, pc, NULL);
+        rcu_irq_exit_irqson();
 }
 
 /**
@@ -7550,6 +7579,7 @@ static int instance_rmdir(const char *name)
         }
 
         tracing_set_nop(tr);
+        clear_ftrace_function_probes(tr);
         event_trace_del_tracer(tr);
         ftrace_clear_pids(tr);
         ftrace_destroy_function_files(tr);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 291a1bca5748..39fd77330aab 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -980,6 +980,7 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
 extern int
 unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
                                       struct ftrace_probe_ops *ops);
+extern void clear_ftrace_function_probes(struct trace_array *tr);
 
 int register_ftrace_command(struct ftrace_func_command *cmd);
 int unregister_ftrace_command(struct ftrace_func_command *cmd);
@@ -998,6 +999,10 @@ static inline __init int unregister_ftrace_command(char *cmd_name)
 {
         return -EINVAL;
 }
+static inline void clear_ftrace_function_probes(struct trace_array *tr)
+{
+}
+
 /*
  * The ops parameter passed in is usually undefined.
  * This must be a macro.
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 8485f6738a87..c129fca6ec99 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1535,6 +1535,11 @@ static __init int kprobe_trace_self_tests_init(void)
 
 end:
         release_all_trace_kprobes();
+        /*
+         * Wait for the optimizer work to finish. Otherwise it might fiddle
+         * with probes in already freed __init text.
+         */
+        wait_for_kprobe_optimizer();
         if (warn)
                 pr_cont("NG: Some tests are failed. Please check them.\n");
         else
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index 889bc31785be..be88cbaadde3 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -4504,6 +4504,44 @@ static struct bpf_test tests[] = {
                 { },
                 { { 0, 1 } },
         },
+        {
+                "JMP_JSGE_K: Signed jump: value walk 1",
+                .u.insns_int = {
+                        BPF_ALU32_IMM(BPF_MOV, R0, 0),
+                        BPF_LD_IMM64(R1, -3),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 6),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 4),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 2),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 1),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 1),
+                        BPF_EXIT_INSN(),                /* bad exit */
+                        BPF_ALU32_IMM(BPF_MOV, R0, 1),  /* good exit */
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 1 } },
+        },
+        {
+                "JMP_JSGE_K: Signed jump: value walk 2",
+                .u.insns_int = {
+                        BPF_ALU32_IMM(BPF_MOV, R0, 0),
+                        BPF_LD_IMM64(R1, -3),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 4),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 2),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 2),
+                        BPF_ALU64_IMM(BPF_ADD, R1, 2),
+                        BPF_JMP_IMM(BPF_JSGE, R1, 0, 1),
+                        BPF_EXIT_INSN(),                /* bad exit */
+                        BPF_ALU32_IMM(BPF_MOV, R0, 1),  /* good exit */
+                        BPF_EXIT_INSN(),
+                },
+                INTERNAL,
+                { },
+                { { 0, 1 } },
+        },
         /* BPF_JMP | BPF_JGT | BPF_K */
         {
                 "JMP_JGT_K: if (3 > 2) return 1",
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 71e85643b3f9..6ad3e043c617 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -454,8 +454,8 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
                         goto error_xenbus;
         }
         priv->tag = xenbus_read(xbt, dev->nodename, "tag", NULL);
-        if (!priv->tag) {
-                ret = -EINVAL;
+        if (IS_ERR(priv->tag)) {
+                ret = PTR_ERR(priv->tag);
                 goto error_xenbus;
         }
         ret = xenbus_transaction_end(xbt, 0);
@@ -525,7 +525,7 @@ static struct xenbus_driver xen_9pfs_front_driver = {
         .otherend_changed = xen_9pfs_front_changed,
 };
 
-int p9_trans_xen_init(void)
+static int p9_trans_xen_init(void)
 {
         if (!xen_domain())
                 return -ENODEV;
@@ -537,7 +537,7 @@ int p9_trans_xen_init(void)
 }
 module_init(p9_trans_xen_init);
 
-void p9_trans_xen_exit(void)
+static void p9_trans_xen_exit(void)
 {
         v9fs_unregister_trans(&p9_xen_trans);
         return xenbus_unregister_driver(&xen_9pfs_front_driver);
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index c5ce7745b230..574f78824d8a 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -835,6 +835,13 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
                         return -EPROTONOSUPPORT;
                 }
         }
+
+        if (data[IFLA_BR_VLAN_DEFAULT_PVID]) {
+                __u16 defpvid = nla_get_u16(data[IFLA_BR_VLAN_DEFAULT_PVID]);
+
+                if (defpvid >= VLAN_VID_MASK)
+                        return -EINVAL;
+        }
 #endif
 
         return 0;
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 08341d2aa9c9..0db8102995a5 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -179,6 +179,7 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
+                mod_timer(&br->hello_timer, jiffies + br->hello_time);
                 br_port_state_selection(br);
         }
 
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index c98b3e5c140a..60b6fe277a8b 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -40,7 +40,7 @@ static void br_hello_timer_expired(unsigned long arg)
         if (br->dev->flags & IFF_UP) {
                 br_config_bpdu_generation(br);
 
-                if (br->stp_enabled != BR_USER_STP)
+                if (br->stp_enabled == BR_KERNEL_STP)
                         mod_timer(&br->hello_timer,
                                   round_jiffies(jiffies + br->hello_time));
         }
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 5929309beaa1..db85230e49c3 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -68,6 +68,9 @@ static int ebt_arpreply_tg_check(const struct xt_tgchk_param *par)
         if (e->ethproto != htons(ETH_P_ARP) ||
             e->invflags & EBT_IPROTO)
                 return -EINVAL;
+        if (ebt_invalid_target(info->target))
+                return -EINVAL;
+
         return 0;
 }
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 9ec0c9f908fa..9c6e619f452b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1373,7 +1373,8 @@ static inline int ebt_obj_to_user(char __user *um, const char *_name,
         strlcpy(name, _name, sizeof(name));
         if (copy_to_user(um, name, EBT_FUNCTION_MAXNAMELEN) ||
             put_user(datasize, (int __user *)(um + EBT_FUNCTION_MAXNAMELEN)) ||
-            xt_data_to_user(um + entrysize, data, usersize, datasize))
+            xt_data_to_user(um + entrysize, data, usersize, datasize,
+                            XT_ALIGN(datasize)))
                 return -EFAULT;
 
         return 0;
@@ -1658,7 +1659,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
                 if (match->compat_to_user(cm->data, m->data))
                         return -EFAULT;
         } else {
-                if (xt_data_to_user(cm->data, m->data, match->usersize, msize))
+                if (xt_data_to_user(cm->data, m->data, match->usersize, msize,
+                                    COMPAT_XT_ALIGN(msize)))
                         return -EFAULT;
         }
 
@@ -1687,7 +1689,8 @@ static int compat_target_to_user(struct ebt_entry_target *t,
                 if (target->compat_to_user(cm->data, t->data))
                         return -EFAULT;
         } else {
-                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize))
+                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize,
+                                    COMPAT_XT_ALIGN(tsize)))
                         return -EFAULT;
         }
 
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 2034fb926670..8757fb87dab8 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -151,7 +151,7 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         struct timespec validity;
         void *tp, *tpend;
         void **ptp;
-        struct ceph_crypto_key new_session_key;
+        struct ceph_crypto_key new_session_key = { 0 };
         struct ceph_buffer *new_ticket_blob;
         unsigned long new_expires, new_renew_after;
         u64 new_secret_id;
@@ -215,6 +215,9 @@ static int process_one_ticket(struct ceph_auth_client *ac,
         dout(" ticket blob is %d bytes\n", dlen);
         ceph_decode_need(ptp, tpend, 1 + sizeof(u64), bad);
         blob_struct_v = ceph_decode_8(ptp);
+        if (blob_struct_v != 1)
+                goto bad;
+
         new_secret_id = ceph_decode_64(ptp);
         ret = ceph_decode_buffer(&new_ticket_blob, ptp, tpend);
         if (ret)
@@ -234,13 +237,13 @@ static int process_one_ticket(struct ceph_auth_client *ac,
              type, ceph_entity_type_name(type), th->secret_id,
              (int)th->ticket_blob->vec.iov_len);
         xi->have_keys |= th->service;
-
-out:
-        return ret;
+        return 0;
 
 bad:
         ret = -EINVAL;
-        goto out;
+out:
+        ceph_crypto_key_destroy(&new_session_key);
+        return ret;
 }
 
 static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 4fd02831beed..47e94b560ba0 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -56,19 +56,6 @@ static const struct kernel_param_ops param_ops_supported_features = {
 module_param_cb(supported_features, &param_ops_supported_features, NULL,
                 S_IRUGO);
 
-/*
- * find filename portion of a path (/foo/bar/baz -> baz)
- */
-const char *ceph_file_part(const char *s, int len)
-{
-        const char *e = s + len;
-
-        while (e != s && *(e-1) != '/')
-                e--;
-        return e;
-}
-EXPORT_SYMBOL(ceph_file_part);
-
 const char *ceph_msg_type_name(int type)
 {
         switch (type) {
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 5766a6c896c4..588a91930051 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -1174,8 +1174,8 @@ static struct page *ceph_msg_data_next(struct ceph_msg_data_cursor *cursor,
  * Returns true if the result moves the cursor on to the next piece
  * of the data item.
  */
-static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
-                                size_t bytes)
+static void ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
+                                  size_t bytes)
 {
         bool new_piece;
 
@@ -1207,8 +1207,6 @@ static bool ceph_msg_data_advance(struct ceph_msg_data_cursor *cursor,
                 new_piece = true;
         }
         cursor->need_crc = new_piece;
-
-        return new_piece;
 }
 
 static size_t sizeof_footer(struct ceph_connection *con)
@@ -1577,7 +1575,6 @@ static int write_partial_message_data(struct ceph_connection *con)
                 size_t page_offset;
                 size_t length;
                 bool last_piece;
-                bool need_crc;
                 int ret;
 
                 page = ceph_msg_data_next(cursor, &page_offset, &length,
@@ -1592,7 +1589,7 @@ static int write_partial_message_data(struct ceph_connection *con)
                 }
                 if (do_datacrc && cursor->need_crc)
                         crc = ceph_crc32c_page(crc, page, page_offset, length);
-                need_crc = ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
         }
 
         dout("%s %p msg %p done\n", __func__, con, msg);
@@ -2231,10 +2228,18 @@ static void process_ack(struct ceph_connection *con)
         struct ceph_msg *m;
         u64 ack = le64_to_cpu(con->in_temp_ack);
         u64 seq;
+        bool reconnect = (con->in_tag == CEPH_MSGR_TAG_SEQ);
+        struct list_head *list = reconnect ? &con->out_queue : &con->out_sent;
 
-        while (!list_empty(&con->out_sent)) {
-                m = list_first_entry(&con->out_sent, struct ceph_msg,
-                                     list_head);
+        /*
+         * In the reconnect case, con_fault() has requeued messages
+         * in out_sent. We should cleanup old messages according to
+         * the reconnect seq.
+         */
+        while (!list_empty(list)) {
+                m = list_first_entry(list, struct ceph_msg, list_head);
+                if (reconnect && m->needs_out_seq)
+                        break;
                 seq = le64_to_cpu(m->hdr.seq);
                 if (seq > ack)
                         break;
@@ -2243,6 +2248,7 @@ static void process_ack(struct ceph_connection *con)
                 m->ack_stamp = jiffies;
                 ceph_msg_remove(m);
         }
+
         prepare_read_tag(con);
 }
 
@@ -2299,7 +2305,7 @@ static int read_partial_msg_data(struct ceph_connection *con)
 
                 if (do_datacrc)
                         crc = ceph_crc32c_page(crc, page, page_offset, ret);
-                (void) ceph_msg_data_advance(cursor, (size_t)ret);
+                ceph_msg_data_advance(cursor, (size_t)ret);
         }
         if (do_datacrc)
                 con->in_data_crc = crc;
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 29a0ef351c5e..250f11f78609 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -43,15 +43,13 @@ struct ceph_monmap *ceph_monmap_decode(void *p, void *end)
         int i, err = -EINVAL;
         struct ceph_fsid fsid;
         u32 epoch, num_mon;
-        u16 version;
         u32 len;
 
         ceph_decode_32_safe(&p, end, len, bad);
         ceph_decode_need(&p, end, len, bad);
 
         dout("monmap_decode %p %p len %d\n", p, end, (int)(end-p));
-
-        ceph_decode_16_safe(&p, end, version, bad);
+        p += sizeof(u16);  /* skip version */
 
         ceph_decode_need(&p, end, sizeof(fsid) + 2*sizeof(u32), bad);
         ceph_decode_copy(&p, &fsid, sizeof(fsid));
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index ffe9e904d4d1..55e3a477f92d 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -317,6 +317,7 @@ static struct crush_map *crush_decode(void *pbyval, void *end)
                 u32 yes;
                 struct crush_rule *r;
 
+                err = -EINVAL;
                 ceph_decode_32_safe(p, end, yes, bad);
                 if (!yes) {
                         dout("crush_decode NO rule %d off %x %p to %p\n",
diff --git a/net/core/dev.c b/net/core/dev.c
index 96cf83da0d66..fca407b4a6ea 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6852,6 +6852,32 @@ int dev_change_proto_down(struct net_device *dev, bool proto_down)
 }
 EXPORT_SYMBOL(dev_change_proto_down);
 
+bool __dev_xdp_attached(struct net_device *dev, xdp_op_t xdp_op)
+{
+        struct netdev_xdp xdp;
+
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_QUERY_PROG;
+
+        /* Query must always succeed. */
+        WARN_ON(xdp_op(dev, &xdp) < 0);
+        return xdp.prog_attached;
+}
+
+static int dev_xdp_install(struct net_device *dev, xdp_op_t xdp_op,
+                           struct netlink_ext_ack *extack,
+                           struct bpf_prog *prog)
+{
+        struct netdev_xdp xdp;
+
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_SETUP_PROG;
+        xdp.extack = extack;
+        xdp.prog = prog;
+
+        return xdp_op(dev, &xdp);
+}
+
 /**
  *      dev_change_xdp_fd - set or clear a bpf program for a device rx path
  *      @dev: device
@@ -6864,41 +6890,34 @@ EXPORT_SYMBOL(dev_change_proto_down);
 int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
                       int fd, u32 flags)
 {
-        int (*xdp_op)(struct net_device *dev, struct netdev_xdp *xdp);
         const struct net_device_ops *ops = dev->netdev_ops;
         struct bpf_prog *prog = NULL;
-        struct netdev_xdp xdp;
+        xdp_op_t xdp_op, xdp_chk;
         int err;
 
         ASSERT_RTNL();
 
-        xdp_op = ops->ndo_xdp;
+        xdp_op = xdp_chk = ops->ndo_xdp;
+        if (!xdp_op && (flags & XDP_FLAGS_DRV_MODE))
+                return -EOPNOTSUPP;
         if (!xdp_op || (flags & XDP_FLAGS_SKB_MODE))
                 xdp_op = generic_xdp_install;
+        if (xdp_op == xdp_chk)
+                xdp_chk = generic_xdp_install;
 
         if (fd >= 0) {
-                if (flags & XDP_FLAGS_UPDATE_IF_NOEXIST) {
-                        memset(&xdp, 0, sizeof(xdp));
-                        xdp.command = XDP_QUERY_PROG;
-
-                        err = xdp_op(dev, &xdp);
-                        if (err < 0)
-                                return err;
-                        if (xdp.prog_attached)
-                                return -EBUSY;
-                }
+                if (xdp_chk && __dev_xdp_attached(dev, xdp_chk))
+                        return -EEXIST;
+                if ((flags & XDP_FLAGS_UPDATE_IF_NOEXIST) &&
+                    __dev_xdp_attached(dev, xdp_op))
+                        return -EBUSY;
 
                 prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_XDP);
                 if (IS_ERR(prog))
                         return PTR_ERR(prog);
         }
 
-        memset(&xdp, 0, sizeof(xdp));
-        xdp.command = XDP_SETUP_PROG;
-        xdp.extack = extack;
-        xdp.prog = prog;
-
-        err = xdp_op(dev, &xdp);
+        err = dev_xdp_install(dev, xdp_op, extack, prog);
         if (err < 0 && prog)
                 bpf_prog_put(prog);
 
diff --git a/net/core/dst.c b/net/core/dst.c
index 960e503b5a52..6192f11beec9 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -151,13 +151,13 @@ int dst_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
 }
 EXPORT_SYMBOL(dst_discard_out);
 
-const u32 dst_default_metrics[RTAX_MAX + 1] = {
+const struct dst_metrics dst_default_metrics = {
         /* This initializer is needed to force linker to place this variable
          * into const section. Otherwise it might end into bss section.
          * We really want to avoid false sharing on this variable, and catch
          * any writes on it.
          */
-        [RTAX_MAX] = 0xdeadbeef,
+        .refcnt = ATOMIC_INIT(1),
 };
 
 void dst_init(struct dst_entry *dst, struct dst_ops *ops,
@@ -169,7 +169,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops,
         if (dev)
                 dev_hold(dev);
         dst->ops = ops;
-        dst_init_metrics(dst, dst_default_metrics, true);
+        dst_init_metrics(dst, dst_default_metrics.metrics, true);
         dst->expires = 0UL;
         dst->path = dst;
         dst->from = NULL;
@@ -314,25 +314,30 @@ EXPORT_SYMBOL(dst_release);
 
 u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
-        u32 *p = kmalloc(sizeof(u32) * RTAX_MAX, GFP_ATOMIC);
+        struct dst_metrics *p = kmalloc(sizeof(*p), GFP_ATOMIC);
 
         if (p) {
-                u32 *old_p = __DST_METRICS_PTR(old);
+                struct dst_metrics *old_p = (struct dst_metrics *)__DST_METRICS_PTR(old);
                 unsigned long prev, new;
 
-                memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+                atomic_set(&p->refcnt, 1);
+                memcpy(p->metrics, old_p->metrics, sizeof(p->metrics));
 
                 new = (unsigned long) p;
                 prev = cmpxchg(&dst->_metrics, old, new);
 
                 if (prev != old) {
                         kfree(p);
-                        p = __DST_METRICS_PTR(prev);
+                        p = (struct dst_metrics *)__DST_METRICS_PTR(prev);
                         if (prev & DST_METRICS_READ_ONLY)
                                 p = NULL;
+                } else if (prev & DST_METRICS_REFCOUNTED) {
+                        if (atomic_dec_and_test(&old_p->refcnt))
+                                kfree(old_p);
                 }
         }
-        return p;
+        BUILD_BUG_ON(offsetof(struct dst_metrics, metrics) != 0);
+        return (u32 *)p;
 }
 EXPORT_SYMBOL(dst_cow_metrics_generic);
 
@@ -341,7 +346,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old)
 {
         unsigned long prev, new;
 
-        new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY;
+        new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY;
         prev = cmpxchg(&dst->_metrics, old, new);
         if (prev == old)
                 kfree(__DST_METRICS_PTR(old));
diff --git a/net/core/filter.c b/net/core/filter.c
index a253a6197e6b..a6bb95fa87b2 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2281,6 +2281,7 @@ bool bpf_helper_changes_pkt_data(void *func)
             func == bpf_skb_change_head ||
             func == bpf_skb_change_tail ||
             func == bpf_skb_pull_data ||
+            func == bpf_clone_redirect ||
             func == bpf_l3_csum_replace ||
             func == bpf_l4_csum_replace ||
             func == bpf_xdp_adjust_head)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 58b0bcc125b5..d274f81fcc2c 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1132,10 +1132,6 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 lladdr = neigh->ha;
         }
 
-        if (new & NUD_CONNECTED)
-                neigh->confirmed = jiffies;
-        neigh->updated = jiffies;
-
         /* If entry was valid and address is not changed,
            do not change entry state, if new one is STALE.
          */
@@ -1157,6 +1153,16 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 }
         }
 
+        /* Update timestamps only once we know we will make a change to the
+         * neighbour entry. Otherwise we risk to move the locktime window with
+         * noop updates and ignore relevant ARP updates.
+         */
+        if (new != old || lladdr != neigh->ha) {
+                if (new & NUD_CONNECTED)
+                        neigh->confirmed = jiffies;
+                neigh->updated = jiffies;
+        }
+
         if (new != old) {
                 neigh_del_timer(neigh);
                 if (new & NUD_PROBE)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1934efd4a9d4..26bbfababff2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -315,6 +315,25 @@ out_undo:
         goto out;
 }
 
+static int __net_init net_defaults_init_net(struct net *net)
+{
+        net->core.sysctl_somaxconn = SOMAXCONN;
+        return 0;
+}
+
+static struct pernet_operations net_defaults_ops = {
+        .init = net_defaults_init_net,
+};
+
+static __init int net_defaults_init(void)
+{
+        if (register_pernet_subsys(&net_defaults_ops))
+                panic("Cannot initialize net default settings");
+
+        return 0;
+}
+
+core_initcall(net_defaults_init);
 
 #ifdef CONFIG_NET_NS
 static struct ucounts *inc_net_namespaces(struct user_namespace *ns)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index bcb0f610ee42..9e2c0a7cb325 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -899,8 +899,7 @@ static size_t rtnl_port_size(const struct net_device *dev,
 static size_t rtnl_xdp_size(void)
 {
         size_t xdp_size = nla_total_size(0) +   /* nest IFLA_XDP */
-                          nla_total_size(1) +   /* XDP_ATTACHED */
-                          nla_total_size(4);    /* XDP_FLAGS */
+                          nla_total_size(1);    /* XDP_ATTACHED */
 
         return xdp_size;
 }
@@ -1247,37 +1246,34 @@ static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
+static u8 rtnl_xdp_attached_mode(struct net_device *dev)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        ASSERT_RTNL();
+
+        if (rcu_access_pointer(dev->xdp_prog))
+                return XDP_ATTACHED_SKB;
+        if (ops->ndo_xdp && __dev_xdp_attached(dev, ops->ndo_xdp))
+                return XDP_ATTACHED_DRV;
+
+        return XDP_ATTACHED_NONE;
+}
+
 static int rtnl_xdp_fill(struct sk_buff *skb, struct net_device *dev)
 {
         struct nlattr *xdp;
-        u32 xdp_flags = 0;
-        u8 val = 0;
         int err;
 
         xdp = nla_nest_start(skb, IFLA_XDP);
         if (!xdp)
                 return -EMSGSIZE;
-        if (rcu_access_pointer(dev->xdp_prog)) {
-                xdp_flags = XDP_FLAGS_SKB_MODE;
-                val = 1;
-        } else if (dev->netdev_ops->ndo_xdp) {
-                struct netdev_xdp xdp_op = {};
-
-                xdp_op.command = XDP_QUERY_PROG;
-                err = dev->netdev_ops->ndo_xdp(dev, &xdp_op);
-                if (err)
-                        goto err_cancel;
-                val = xdp_op.prog_attached;
-        }
-        err = nla_put_u8(skb, IFLA_XDP_ATTACHED, val);
+
+        err = nla_put_u8(skb, IFLA_XDP_ATTACHED,
+                         rtnl_xdp_attached_mode(dev));
         if (err)
                 goto err_cancel;
 
-        if (xdp_flags) {
-                err = nla_put_u32(skb, IFLA_XDP_FLAGS, xdp_flags);
-                if (err)
-                        goto err_cancel;
-        }
         nla_nest_end(skb, xdp);
         return 0;
 
@@ -1631,13 +1627,13 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                                                cb->nlh->nlmsg_seq, 0,
                                                flags,
                                                ext_filter_mask);
-                        /* If we ran out of room on the first message,
-                         * we're in trouble
-                         */
-                        WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
 
-                        if (err < 0)
-                                goto out;
+                        if (err < 0) {
+                                if (likely(skb->len))
+                                        goto out;
+
+                                goto out_err;
+                        }
 
                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
@@ -1645,10 +1641,12 @@ cont:
                 }
         }
 out:
+        err = skb->len;
+out_err:
         cb->args[1] = idx;
         cb->args[0] = h;
 
-        return skb->len;
+        return err;
 }
 
 int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len,
@@ -2199,6 +2197,11 @@ static int do_setlink(const struct sk_buff *skb,
                                 err = -EINVAL;
                                 goto errout;
                         }
+                        if ((xdp_flags & XDP_FLAGS_SKB_MODE) &&
+                            (xdp_flags & XDP_FLAGS_DRV_MODE)) {
+                                err = -EINVAL;
+                                goto errout;
+                        }
                 }
 
                 if (xdp[IFLA_XDP_FD]) {
@@ -3228,8 +3231,11 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int err = 0;
         int fidx = 0;
 
-        if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
-                        IFLA_MAX, ifla_policy, NULL) == 0) {
+        err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+                          IFLA_MAX, ifla_policy, NULL);
+        if (err < 0) {
+                return -EINVAL;
+        } else if (err == 0) {
                 if (tb[IFLA_MASTER])
                         br_idx = nla_get_u32(tb[IFLA_MASTER]);
         }
@@ -3452,8 +3458,12 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                 err = br_dev->netdev_ops->ndo_bridge_getlink(
                                                 skb, portid, seq, dev,
                                                 filter_mask, NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
-                                        break;
+                                if (err < 0 && err != -EOPNOTSUPP) {
+                                        if (likely(skb->len))
+                                                break;
+
+                                        goto out_err;
+                                }
                         }
                         idx++;
                 }
@@ -3464,16 +3474,22 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                                               seq, dev,
                                                               filter_mask,
                                                               NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
-                                        break;
+                                if (err < 0 && err != -EOPNOTSUPP) {
+                                        if (likely(skb->len))
+                                                break;
+
+                                        goto out_err;
+                                }
                         }
                         idx++;
                 }
         }
+        err = skb->len;
+out_err:
         rcu_read_unlock();
         cb->args[0] = idx;
 
-        return skb->len;
+        return err;
 }
 
 static inline size_t bridge_nlmsg_size(void)
diff --git a/net/core/sock.c b/net/core/sock.c
index 79c6aee6af9b..727f924b7f91 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -139,10 +139,7 @@
 
 #include <trace/events/sock.h>
 
-#ifdef CONFIG_INET
 #include <net/tcp.h>
-#endif
-
 #include <net/busy_poll.h>
 
 static DEFINE_MUTEX(proto_list_mutex);
@@ -1803,28 +1800,24 @@ EXPORT_SYMBOL(skb_set_owner_w);
  * delay queue. We want to allow the owner socket to send more
  * packets, as if they were already TX completed by a typical driver.
  * But we also want to keep skb->sk set because some packet schedulers
- * rely on it (sch_fq for example). So we set skb->truesize to a small
- * amount (1) and decrease sk_wmem_alloc accordingly.
+ * rely on it (sch_fq for example).
  */
 void skb_orphan_partial(struct sk_buff *skb)
 {
-        /* If this skb is a TCP pure ACK or already went here,
-         * we have nothing to do. 2 is already a very small truesize.
-         */
-        if (skb->truesize <= 2)
+        if (skb_is_tcp_pure_ack(skb))
                 return;
 
-        /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
-         * so we do not completely orphan skb, but transfert all
-         * accounted bytes but one, to avoid unexpected reorders.
-         */
         if (skb->destructor == sock_wfree
 #ifdef CONFIG_INET
             || skb->destructor == tcp_wfree
 #endif
                 ) {
-                atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
-                skb->truesize = 1;
+                struct sock *sk = skb->sk;
+
+                if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+                        atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+                        skb->destructor = sock_efree;
+                }
         } else {
                 skb_orphan(skb);
         }
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index ea23254b2457..b7cd9aafe99e 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -479,8 +479,6 @@ static __net_init int sysctl_core_net_init(struct net *net)
 {
         struct ctl_table *tbl;
 
-        net->core.sysctl_somaxconn = SOMAXCONN;
-
         tbl = netns_core_table;
         if (!net_eq(net, &init_net)) {
                 tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 840f14aaa016..992621172220 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -426,6 +426,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
                 newsk->sk_backlog_rcv = dccp_v4_do_rcv;
                 newnp->pktoptions  = NULL;
                 newnp->opt         = NULL;
+                newnp->ipv6_mc_list = NULL;
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                 newnp->mcast_oif   = inet6_iif(skb);
                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
 
@@ -490,6 +493,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk,
         /* Clone RX bits */
         newnp->rxopt.all = np->rxopt.all;
 
+        newnp->ipv6_mc_list = NULL;
+        newnp->ipv6_ac_list = NULL;
+        newnp->ipv6_fl_list = NULL;
         newnp->pktoptions = NULL;
         newnp->opt        = NULL;
         newnp->mcast_oif  = inet6_iif(skb);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 0937b34c27ca..e9f3386a528b 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -641,6 +641,32 @@ void arp_xmit(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(arp_xmit);
 
+static bool arp_is_garp(struct net *net, struct net_device *dev,
+                        int *addr_type, __be16 ar_op,
+                        __be32 sip, __be32 tip,
+                        unsigned char *sha, unsigned char *tha)
+{
+        bool is_garp = tip == sip;
+
+        /* Gratuitous ARP _replies_ also require target hwaddr to be
+         * the same as source.
+         */
+        if (is_garp && ar_op == htons(ARPOP_REPLY))
+                is_garp =
+                        /* IPv4 over IEEE 1394 doesn't provide target
+                         * hardware address field in its ARP payload.
+                         */
+                        tha &&
+                        !memcmp(tha, sha, dev->addr_len);
+
+        if (is_garp) {
+                *addr_type = inet_addr_type_dev_table(net, dev, sip);
+                if (*addr_type != RTN_UNICAST)
+                        is_garp = false;
+        }
+        return is_garp;
+}
+
 /*
  *      Process an arp request.
  */
@@ -653,6 +679,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
         unsigned char *arp_ptr;
         struct rtable *rt;
         unsigned char *sha;
+        unsigned char *tha = NULL;
         __be32 sip, tip;
         u16 dev_type = dev->type;
         int addr_type;
@@ -724,6 +751,7 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
                 break;
 #endif
         default:
+                tha = arp_ptr;
                 arp_ptr += dev->addr_len;
         }
         memcpy(&tip, arp_ptr, 4);
@@ -835,19 +863,25 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
 
         n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
 
-        if (IN_DEV_ARP_ACCEPT(in_dev)) {
-                unsigned int addr_type = inet_addr_type_dev_table(net, dev, sip);
+        addr_type = -1;
+        if (n || IN_DEV_ARP_ACCEPT(in_dev)) {
+                is_garp = arp_is_garp(net, dev, &addr_type, arp->ar_op,
+                                      sip, tip, sha, tha);
+        }
 
+        if (IN_DEV_ARP_ACCEPT(in_dev)) {
                 /* Unsolicited ARP is not accepted by default.
                    It is possible, that this option should be enabled for some
                    devices (strip is candidate)
                  */
-                is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip &&
-                          addr_type == RTN_UNICAST;
-
                 if (!n &&
-                    ((arp->ar_op == htons(ARPOP_REPLY)  &&
-                                addr_type == RTN_UNICAST) || is_garp))
+                    (is_garp ||
+                     (arp->ar_op == htons(ARPOP_REPLY) &&
+                      (addr_type == RTN_UNICAST ||
+                       (addr_type < 0 &&
+                        /* postpone calculation to as late as possible */
+                        inet_addr_type_dev_table(net, dev, sip) ==
+                                RTN_UNICAST)))))
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
 
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 65cc02bd82bc..93322f895eab 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -248,6 +248,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         u8 *tail;
         u8 *vaddr;
         int nfrags;
+        int esph_offset;
         struct page *page;
         struct sk_buff *trailer;
         int tailen = esp->tailen;
@@ -313,11 +314,13 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
         }
 
 cow:
+        esph_offset = (unsigned char *)esp->esph - skb_transport_header(skb);
+
         nfrags = skb_cow_data(skb, tailen, &trailer);
         if (nfrags < 0)
                 goto out;
         tail = skb_tail_pointer(trailer);
-        esp->esph = ip_esp_hdr(skb);
+        esp->esph = (struct ip_esp_hdr *)(skb_transport_header(skb) + esph_offset);
 
 skip_cow:
         esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 39bd1edee676..83e3ed258467 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -763,7 +763,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
         unsigned int e = 0, s_e;
         struct fib_table *tb;
         struct hlist_head *head;
-        int dumped = 0;
+        int dumped = 0, err;
 
         if (nlmsg_len(cb->nlh) >= sizeof(struct rtmsg) &&
             ((struct rtmsg *) nlmsg_data(cb->nlh))->rtm_flags & RTM_F_CLONED)
@@ -783,20 +783,27 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                         if (dumped)
                                 memset(&cb->args[2], 0, sizeof(cb->args) -
                                                  2 * sizeof(cb->args[0]));
-                        if (fib_table_dump(tb, skb, cb) < 0)
-                                goto out;
+                        err = fib_table_dump(tb, skb, cb);
+                        if (err < 0) {
+                                if (likely(skb->len))
+                                        goto out;
+
+                                goto out_err;
+                        }
                         dumped = 1;
 next:
                         e++;
                 }
         }
 out:
+        err = skb->len;
+out_err:
         rcu_read_unlock();
 
         cb->args[1] = e;
         cb->args[0] = h;
 
-        return skb->len;
+        return err;
 }
 
 /* Prepare and feed intra-kernel routing request.
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index da449ddb8cc1..ad9ad4aab5da 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -203,6 +203,7 @@ static void rt_fibinfo_free_cpus(struct rtable __rcu * __percpu *rtp)
 static void free_fib_info_rcu(struct rcu_head *head)
 {
         struct fib_info *fi = container_of(head, struct fib_info, rcu);
+        struct dst_metrics *m;
 
         change_nexthops(fi) {
                 if (nexthop_nh->nh_dev)
@@ -213,8 +214,9 @@ static void free_fib_info_rcu(struct rcu_head *head)
                 rt_fibinfo_free(&nexthop_nh->nh_rth_input);
         } endfor_nexthops(fi);
 
-        if (fi->fib_metrics != (u32 *) dst_default_metrics)
-                kfree(fi->fib_metrics);
+        m = fi->fib_metrics;
+        if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt))
+                kfree(m);
         kfree(fi);
 }
 
@@ -971,11 +973,11 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
                         val = 255;
                 if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
                         return -EINVAL;
-                fi->fib_metrics[type - 1] = val;
+                fi->fib_metrics->metrics[type - 1] = val;
         }
 
         if (ecn_ca)
-                fi->fib_metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
+                fi->fib_metrics->metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
 
         return 0;
 }
@@ -1033,11 +1035,12 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
                 goto failure;
         fib_info_cnt++;
         if (cfg->fc_mx) {
-                fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+                fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
                 if (!fi->fib_metrics)
                         goto failure;
+                atomic_set(&fi->fib_metrics->refcnt, 1);
         } else
-                fi->fib_metrics = (u32 *) dst_default_metrics;
+                fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
 
         fi->fib_net = net;
         fi->fib_protocol = cfg->fc_protocol;
@@ -1238,7 +1241,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
         if (fi->fib_priority &&
             nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority))
                 goto nla_put_failure;
-        if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0)
+        if (rtnetlink_put_metrics(skb, fi->fib_metrics->metrics) < 0)
                 goto nla_put_failure;
 
         if (fi->fib_prefsrc &&
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 1201409ba1dc..51182ff2b441 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1983,6 +1983,8 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
 
         /* rcu_read_lock is hold by caller */
         hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
+                int err;
+
                 if (i < s_i) {
                         i++;
                         continue;
@@ -1993,17 +1995,14 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb,
                         continue;
                 }
 
-                if (fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
-                                  cb->nlh->nlmsg_seq,
-                                  RTM_NEWROUTE,
-                                  tb->tb_id,
-                                  fa->fa_type,
-                                  xkey,
-                                  KEYLENGTH - fa->fa_slen,
-                                  fa->fa_tos,
-                                  fa->fa_info, NLM_F_MULTI) < 0) {
+                err = fib_dump_info(skb, NETLINK_CB(cb->skb).portid,
+                                    cb->nlh->nlmsg_seq, RTM_NEWROUTE,
+                                    tb->tb_id, fa->fa_type,
+                                    xkey, KEYLENGTH - fa->fa_slen,
+                                    fa->fa_tos, fa->fa_info, NLM_F_MULTI);
+                if (err < 0) {
                         cb->args[4] = i;
-                        return -1;
+                        return err;
                 }
                 i++;
         }
@@ -2025,10 +2024,13 @@ int fib_table_dump(struct fib_table *tb, struct sk_buff *skb,
         t_key key = cb->args[3];
 
         while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
-                if (fn_trie_dump_leaf(l, tb, skb, cb) < 0) {
+                int err;
+
+                err = fn_trie_dump_leaf(l, tb, skb, cb);
+                if (err < 0) {
                         cb->args[3] = key;
                         cb->args[2] = count;
-                        return -1;
+                        return err;
                 }
 
                 ++count;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 3a02d52ed50e..551de4d023a8 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1980,6 +1980,20 @@ int ip_mr_input(struct sk_buff *skb)
         struct net *net = dev_net(skb->dev);
         int local = skb_rtable(skb)->rt_flags & RTCF_LOCAL;
         struct mr_table *mrt;
+        struct net_device *dev;
+
+        /* skb->dev passed in is the loX master dev for vrfs.
+         * As there are no vifs associated with loopback devices,
+         * get the proper interface that does have a vif associated with it.
+         */
+        dev = skb->dev;
+        if (netif_is_l3_master(skb->dev)) {
+                dev = dev_get_by_index_rcu(net, IPCB(skb)->iif);
+                if (!dev) {
+                        kfree_skb(skb);
+                        return -ENODEV;
+                }
+        }
 
         /* Packet is looped back after forward, it should not be
          * forwarded second time, but still can be delivered locally.
@@ -2017,7 +2031,7 @@ int ip_mr_input(struct sk_buff *skb)
         /* already under rcu_read_lock() */
         cache = ipmr_cache_find(mrt, ip_hdr(skb)->saddr, ip_hdr(skb)->daddr);
         if (!cache) {
-                int vif = ipmr_find_vif(mrt, skb->dev);
+                int vif = ipmr_find_vif(mrt, dev);
 
                 if (vif >= 0)
                         cache = ipmr_cache_find_any(mrt, ip_hdr(skb)->daddr,
@@ -2037,7 +2051,7 @@ int ip_mr_input(struct sk_buff *skb)
                 }
 
                 read_lock(&mrt_lock);
-                vif = ipmr_find_vif(mrt, skb->dev);
+                vif = ipmr_find_vif(mrt, dev);
                 if (vif >= 0) {
                         int err2 = ipmr_cache_unresolved(mrt, vif, skb);
                         read_unlock(&mrt_lock);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 655d9eebe43e..6883b3d4ba8f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1385,8 +1385,12 @@ static void rt_add_uncached_list(struct rtable *rt)
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
 {
+        struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst);
         struct rtable *rt = (struct rtable *) dst;
 
+        if (p != &dst_default_metrics && atomic_dec_and_test(&p->refcnt))
+                kfree(p);
+
         if (!list_empty(&rt->rt_uncached)) {
                 struct uncached_list *ul = rt->rt_uncached_list;
 
@@ -1438,7 +1442,11 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
                         rt->rt_gateway = nh->nh_gw;
                         rt->rt_uses_gateway = 1;
                 }
-                dst_init_metrics(&rt->dst, fi->fib_metrics, true);
+                dst_init_metrics(&rt->dst, fi->fib_metrics->metrics, true);
+                if (fi->fib_metrics != &dst_default_metrics) {
+                        rt->dst._metrics |= DST_METRICS_REFCOUNTED;
+                        atomic_inc(&fi->fib_metrics->refcnt);
+                }
 #ifdef CONFIG_IP_ROUTE_CLASSID
                 rt->dst.tclassid = nh->nh_tclassid;
 #endif
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1e4c76d2b827..59792d283ff8 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1084,9 +1084,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_sock *inet = inet_sk(sk);
+        struct sockaddr *uaddr = msg->msg_name;
         int err, flags;
 
-        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
+        if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+            (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+             uaddr->sa_family == AF_UNSPEC))
                 return -EOPNOTSUPP;
         if (tp->fastopen_req)
                 return -EALREADY; /* Another Fast Open is in progress */
@@ -1108,7 +1111,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg,
                 }
         }
         flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
-        err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+        err = __inet_stream_connect(sk->sk_socket, uaddr,
                                     msg->msg_namelen, flags, 1);
         /* fastopen_req could already be freed in __inet_stream_connect
          * if the connection times out or gets rst
@@ -2320,6 +2323,10 @@ int tcp_disconnect(struct sock *sk, int flags)
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
+        /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+         * issue in __tcp_select_window()
+         */
+        icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
         tcp_init_send_head(sk);
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5a3ad09e2786..174d4376baa5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1179,13 +1179,14 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
                  */
                 if (pkt_len > mss) {
                         unsigned int new_len = (pkt_len / mss) * mss;
-                        if (!in_sack && new_len < pkt_len) {
+                        if (!in_sack && new_len < pkt_len)
                                 new_len += mss;
-                                if (new_len >= skb->len)
-                                        return 0;
-                        }
                         pkt_len = new_len;
                 }
+
+                if (pkt_len >= skb->len && !in_sack)
+                        return 0;
+
                 err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
                 if (err < 0)
                         return err;
@@ -3189,7 +3190,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         int delta;
 
                         /* Non-retransmitted hole got filled? That's reordering */
-                        if (reord < prior_fackets)
+                        if (reord < prior_fackets && reord <= tp->fackets_out)
                                 tcp_update_reordering(sk, tp->fackets_out - reord, 0);
 
                         delta = tcp_is_fack(tp) ? pkts_acked :
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ea6e4cff9faf..1d6219bf2d6b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1612,7 +1612,7 @@ static void udp_v4_rehash(struct sock *sk)
         udp_lib_rehash(sk, new_hash);
 }
 
-int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
@@ -1657,7 +1657,7 @@ EXPORT_SYMBOL(udp_encap_enable);
  * Note that in the success and error cases, the skb is assumed to
  * have either been requeued or freed.
  */
-int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct udp_sock *up = udp_sk(sk);
         int is_udplite = IS_UDPLITE(sk);
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index feb50a16398d..a8cf8c6fb60c 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -25,7 +25,6 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                 int flags, int *addr_len);
 int udp_sendpage(struct sock *sk, struct page *page, int offset, size_t size,
                  int flags);
-int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udp_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8d297a79b568..6a4fb1e629fb 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1022,7 +1022,10 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
         INIT_HLIST_NODE(&ifa->addr_lst);
         ifa->scope = scope;
         ifa->prefix_len = pfxlen;
-        ifa->flags = flags | IFA_F_TENTATIVE;
+        ifa->flags = flags;
+        /* No need to add the TENTATIVE flag for addresses with NODAD */
+        if (!(flags & IFA_F_NODAD))
+                ifa->flags |= IFA_F_TENTATIVE;
         ifa->valid_lft = valid_lft;
         ifa->prefered_lft = prefered_lft;
         ifa->cstamp = ifa->tstamp = jiffies;
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 8d128ba79b66..0c5b4caa1949 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -537,11 +537,10 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev)
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
 
-        dsfield = ipv4_get_dsfield(iph);
-
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
-                                          & IPV6_TCLASS_MASK;
+                dsfield = ipv4_get_dsfield(iph);
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                 fl6.flowi6_mark = skb->mark;
         else
@@ -598,9 +597,11 @@ static inline int ip6gre_xmit_ipv6(struct sk_buff *skb, struct net_device *dev)
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
 
-        dsfield = ipv6_get_dsfield(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
+                dsfield = ipv6_get_dsfield(ipv6h);
+        else
+                dsfield = ip6_tclass(t->parms.flowinfo);
+
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                 fl6.flowlabel |= ip6_flowlabel(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 93e58a5e1837..280268f1dd7b 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -63,7 +63,6 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         const struct net_offload *ops;
         int proto;
         struct frag_hdr *fptr;
-        unsigned int unfrag_ip6hlen;
         unsigned int payload_len;
         u8 *prevhdr;
         int offset = 0;
@@ -116,8 +115,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                 skb->network_header = (u8 *)ipv6h - skb->head;
 
                 if (udpfrag) {
-                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
-                        fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);
+                        int err = ip6_find_1stfragopt(skb, &prevhdr);
+                        if (err < 0)
+                                return ERR_PTR(err);
+                        fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
                         fptr->frag_off = htons(offset);
                         if (skb->next)
                                 fptr->frag_off |= htons(IP6_MF);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 58f6288e9ba5..bf8a58a1c32d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -597,7 +597,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
         int ptr, offset = 0, err = 0;
         u8 *prevhdr, nexthdr = 0;
 
-        hlen = ip6_find_1stfragopt(skb, &prevhdr);
+        err = ip6_find_1stfragopt(skb, &prevhdr);
+        if (err < 0)
+                goto fail;
+        hlen = err;
         nexthdr = *prevhdr;
 
         mtu = ip6_skb_dst_mtu(skb);
@@ -1463,6 +1466,11 @@ alloc_new_skb:
                          */
                         alloclen += sizeof(struct frag_hdr);
 
+                        copy = datalen - transhdrlen - fraggap;
+                        if (copy < 0) {
+                                err = -EINVAL;
+                                goto error;
+                        }
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len,
@@ -1512,13 +1520,9 @@ alloc_new_skb:
                                 data += fraggap;
                                 pskb_trim_unique(skb_prev, maxfraglen);
                         }
-                        copy = datalen - transhdrlen - fraggap;
-
-                        if (copy < 0) {
-                                err = -EINVAL;
-                                kfree_skb(skb);
-                                goto error;
-                        } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+                        if (copy > 0 &&
+                            getfrag(from, data + transhdrlen, offset,
+                                    copy, fraggap, skb) < 0) {
                                 err = -EFAULT;
                                 kfree_skb(skb);
                                 goto error;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 6eb2ae507500..7ae6c503f1ca 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1196,7 +1196,7 @@ route_lookup:
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
-        ip6_flow_hdr(ipv6h, INET_ECN_encapsulate(0, dsfield),
+        ip6_flow_hdr(ipv6h, dsfield,
                      ip6_make_flowlabel(net, skb, fl6->flowlabel, true, fl6));
         ipv6h->hop_limit = hop_limit;
         ipv6h->nexthdr = proto;
@@ -1231,8 +1231,6 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (tproto != IPPROTO_IPIP && tproto != 0)
                 return -1;
 
-        dsfield = ipv4_get_dsfield(iph);
-
         if (t->parms.collect_md) {
                 struct ip_tunnel_info *tun_info;
                 const struct ip_tunnel_key *key;
@@ -1246,6 +1244,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPIP;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
+                dsfield = ip6_tclass(key->label);
         } else {
                 if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                         encap_limit = t->parms.encap_limit;
@@ -1254,8 +1253,9 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPIP;
 
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
-                                         & IPV6_TCLASS_MASK;
+                        dsfield = ipv4_get_dsfield(iph);
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
                         fl6.flowi6_mark = skb->mark;
                 else
@@ -1267,6 +1267,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                 return -1;
 
+        dsfield = INET_ECN_encapsulate(dsfield, ipv4_get_dsfield(iph));
+
         skb_set_inner_ipproto(skb, IPPROTO_IPIP);
 
         err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
@@ -1300,8 +1302,6 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
             ip6_tnl_addr_conflict(t, ipv6h))
                 return -1;
 
-        dsfield = ipv6_get_dsfield(ipv6h);
-
         if (t->parms.collect_md) {
                 struct ip_tunnel_info *tun_info;
                 const struct ip_tunnel_key *key;
@@ -1315,6 +1315,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPV6;
                 fl6.daddr = key->u.ipv6.dst;
                 fl6.flowlabel = key->label;
+                dsfield = ip6_tclass(key->label);
         } else {
                 offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
                 /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */
@@ -1337,7 +1338,9 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 fl6.flowi6_proto = IPPROTO_IPV6;
 
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
-                        fl6.flowlabel |= (*(__be32 *)ipv6h & IPV6_TCLASS_MASK);
+                        dsfield = ipv6_get_dsfield(ipv6h);
+                else
+                        dsfield = ip6_tclass(t->parms.flowinfo);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                         fl6.flowlabel |= ip6_flowlabel(ipv6h);
                 if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
@@ -1351,6 +1354,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
                 return -1;
 
+        dsfield = INET_ECN_encapsulate(dsfield, ipv6_get_dsfield(ipv6h));
+
         skb_set_inner_ipproto(skb, IPPROTO_IPV6);
 
         err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index cd4252346a32..e9065b8d3af8 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -79,14 +79,13 @@ EXPORT_SYMBOL(ipv6_select_ident);
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
         u16 offset = sizeof(struct ipv6hdr);
-        struct ipv6_opt_hdr *exthdr =
-                                (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
         unsigned int packet_len = skb_tail_pointer(skb) -
                 skb_network_header(skb);
         int found_rhdr = 0;
         *nexthdr = &ipv6_hdr(skb)->nexthdr;
 
-        while (offset + 1 <= packet_len) {
+        while (offset <= packet_len) {
+                struct ipv6_opt_hdr *exthdr;
 
                 switch (**nexthdr) {
 
@@ -107,13 +106,16 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
                         return offset;
                 }
 
-                offset += ipv6_optlen(exthdr);
-                *nexthdr = &exthdr->nexthdr;
+                if (offset + sizeof(struct ipv6_opt_hdr) > packet_len)
+                        return -EINVAL;
+
                 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
                                                  offset);
+                offset += ipv6_optlen(exthdr);
+                *nexthdr = &exthdr->nexthdr;
         }
 
-        return offset;
+        return -EINVAL;
 }
 EXPORT_SYMBOL(ip6_find_1stfragopt);
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 7a8237acd210..4f4310a36a04 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1062,6 +1062,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
                 newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
 
+                newnp->ipv6_mc_list = NULL;
                 newnp->ipv6_ac_list = NULL;
                 newnp->ipv6_fl_list = NULL;
                 newnp->pktoptions  = NULL;
@@ -1131,6 +1132,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
            First: no IPv4 options.
          */
         newinet->inet_opt = NULL;
+        newnp->ipv6_mc_list = NULL;
         newnp->ipv6_ac_list = NULL;
         newnp->ipv6_fl_list = NULL;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 04862abfe4ec..06ec39b79609 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -526,7 +526,7 @@ out:
         return;
 }
 
-int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
@@ -569,7 +569,7 @@ void udpv6_encap_enable(void)
 }
 EXPORT_SYMBOL(udpv6_encap_enable);
 
-int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+static int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         struct udp_sock *up = udp_sk(sk);
         int is_udplite = IS_UDPLITE(sk);
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index e78bdc76dcc3..f180b3d85e31 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -26,7 +26,6 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len);
 int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                   int flags, int *addr_len);
-int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udpv6_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index ac858c480f2f..a2267f80febb 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
         u8 frag_hdr_sz = sizeof(struct frag_hdr);
         __wsum csum;
         int tnl_hlen;
+        int err;
 
         mss = skb_shinfo(skb)->gso_size;
         if (unlikely(skb->len <= mss))
@@ -90,7 +91,10 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 /* Find the unfragmentable header and shift it left by frag_hdr_sz
                  * bytes to insert fragment header.
                  */
-                unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                err = ip6_find_1stfragopt(skb, &prevhdr);
+                if (err < 0)
+                        return ERR_PTR(err);
+                unfrag_ip6hlen = err;
                 nexthdr = *prevhdr;
                 *prevhdr = NEXTHDR_FRAGMENT;
                 unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) +
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c1950bb14735..512dc43d0ce6 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3285,7 +3285,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
                 p += pol->sadb_x_policy_len*8;
                 sec_ctx = (struct sadb_x_sec_ctx *)p;
                 if (len < pol->sadb_x_policy_len*8 +
-                    sec_ctx->sadb_x_sec_len) {
+                    sec_ctx->sadb_x_sec_len*8) {
                         *dir = -EINVAL;
                         goto out;
                 }
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 8364fe5b59e4..c38d16f22d2a 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -311,6 +311,8 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
         int rc = -EINVAL;
 
         dprintk("%s: binding %02X\n", __func__, addr->sllc_sap);
+
+        lock_sock(sk);
         if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr)))
                 goto out;
         rc = -EAFNOSUPPORT;
@@ -382,6 +384,7 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
 out_put:
         llc_sap_put(sap);
 out:
+        release_sock(sk);
         return rc;
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 35f4c7d7a500..1f75280ba26c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2492,7 +2492,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
                 if (is_multicast_ether_addr(hdr->addr1)) {
                         mpp_addr = hdr->addr3;
                         proxied_addr = mesh_hdr->eaddr1;
-                } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+                } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+                            MESH_FLAGS_AE_A5_A6) {
                         /* has_a4 already checked in ieee80211_rx_mesh_check */
                         mpp_addr = hdr->addr4;
                         proxied_addr = mesh_hdr->eaddr2;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d2d7bdf1d510..ad99c1ceea6f 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -849,10 +849,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
 {
         unsigned int verdict = NF_DROP;
 
-        if (IP_VS_FWD_METHOD(cp) != 0) {
-                pr_err("shouldn't reach here, because the box is on the "
-                       "half connection in the tun/dr module.\n");
-        }
+        if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                goto ignore_cp;
 
         /* Ensure the checksum is correct */
         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
@@ -886,6 +884,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
                 ip_vs_notrack(skb);
         else
                 ip_vs_update_conntrack(skb, cp, 0);
+
+ignore_cp:
         verdict = NF_ACCEPT;
 
 out:
@@ -1385,8 +1385,11 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
          */
         cp = pp->conn_out_get(ipvs, af, skb, &iph);
 
-        if (likely(cp))
+        if (likely(cp)) {
+                if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                        goto ignore_cp;
                 return handle_response(af, skb, pd, cp, &iph, hooknum);
+        }
 
         /* Check for real-server-started requests */
         if (atomic_read(&ipvs->conn_out_counter)) {
@@ -1444,9 +1447,15 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
                         }
                 }
         }
+
+out:
         IP_VS_DBG_PKT(12, af, pp, skb, iph.off,
                       "ip_vs_out: packet continues traversal as normal");
         return NF_ACCEPT;
+
+ignore_cp:
+        __ip_vs_conn_put(cp);
+        goto out;
 }
 
 /*
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 3a60efa7799b..7f6100ca63be 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -174,6 +174,10 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 #endif
         if (h != NULL && !try_module_get(h->me))
                 h = NULL;
+        if (h != NULL && !refcount_inc_not_zero(&h->refcnt)) {
+                module_put(h->me);
+                h = NULL;
+        }
 
         rcu_read_unlock();
 
@@ -181,6 +185,13 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get);
 
+void nf_conntrack_helper_put(struct nf_conntrack_helper *helper)
+{
+        refcount_dec(&helper->refcnt);
+        module_put(helper->me);
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_helper_put);
+
 struct nf_conn_help *
 nf_ct_helper_ext_add(struct nf_conn *ct,
                      struct nf_conntrack_helper *helper, gfp_t gfp)
@@ -417,6 +428,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
                         }
                 }
         }
+        refcount_set(&me->refcnt, 1);
         hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]);
         nf_ct_helper_count++;
 out:
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dcf561b5c97a..9799a50bc604 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -1007,9 +1009,8 @@ static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
 
 static int
 ctnetlink_parse_tuple(const struct nlattr * const cda[],
-                      struct nf_conntrack_tuple *tuple,
-                      enum ctattr_type type, u_int8_t l3num,
-                      struct nf_conntrack_zone *zone)
+                      struct nf_conntrack_tuple *tuple, u32 type,
+                      u_int8_t l3num, struct nf_conntrack_zone *zone)
 {
         struct nlattr *tb[CTA_TUPLE_MAX+1];
         int err;
@@ -1828,6 +1829,8 @@ ctnetlink_create_conntrack(struct net *net,
         nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
         nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
         nf_ct_labels_ext_add(ct);
+        nfct_seqadj_ext_add(ct);
+        nfct_synproxy_ext_add(ct);
 
         /* we must add conntrack extensions before confirmation. */
         ct->status |= IPS_CONFIRMED;
@@ -2447,7 +2450,7 @@ static struct nfnl_ct_hook ctnetlink_glue_hook = {
 
 static int ctnetlink_exp_dump_tuple(struct sk_buff *skb,
                                     const struct nf_conntrack_tuple *tuple,
-                                    enum ctattr_expect type)
+                                    u32 type)
 {
         struct nlattr *nest_parms;
 
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b48d6b5aae8a..ef0be325a0c6 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -409,6 +409,10 @@ nf_nat_setup_info(struct nf_conn *ct,
 {
         struct nf_conntrack_tuple curr_tuple, new_tuple;
 
+        /* Can't setup nat info for confirmed ct. */
+        if (nf_ct_is_confirmed(ct))
+                return NF_ACCEPT;
+
         NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
                      maniptype == NF_NAT_MANIP_DST);
         BUG_ON(nf_nat_initialized(ct, maniptype));
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 559225029740..da314be0c048 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3367,35 +3367,50 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
         return nf_tables_fill_setelem(args->skb, set, elem);
 }
 
+struct nft_set_dump_ctx {
+        const struct nft_set    *set;
+        struct nft_ctx          ctx;
+};
+
 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct nft_set_dump_ctx *dump_ctx = cb->data;
         struct net *net = sock_net(skb->sk);
-        u8 genmask = nft_genmask_cur(net);
+        struct nft_af_info *afi;
+        struct nft_table *table;
         struct nft_set *set;
         struct nft_set_dump_args args;
-        struct nft_ctx ctx;
-        struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
+        bool set_found = false;
         struct nfgenmsg *nfmsg;
         struct nlmsghdr *nlh;
         struct nlattr *nest;
         u32 portid, seq;
-        int event, err;
+        int event;
 
-        err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
-                          NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy,
-                          NULL);
-        if (err < 0)
-                return err;
+        rcu_read_lock();
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
+                if (afi != dump_ctx->ctx.afi)
+                        continue;
 
-        err = nft_ctx_init_from_elemattr(&ctx, net, cb->skb, cb->nlh,
-                                         (void *)nla, genmask);
-        if (err < 0)
-                return err;
+                list_for_each_entry_rcu(table, &afi->tables, list) {
+                        if (table != dump_ctx->ctx.table)
+                                continue;
 
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
-                                   genmask);
-        if (IS_ERR(set))
-                return PTR_ERR(set);
+                        list_for_each_entry_rcu(set, &table->sets, list) {
+                                if (set == dump_ctx->set) {
+                                        set_found = true;
+                                        break;
+                                }
+                        }
+                        break;
+                }
+                break;
+        }
+
+        if (!set_found) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
 
         event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
         portid = NETLINK_CB(cb->skb).portid;
@@ -3407,11 +3422,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
                 goto nla_put_failure;
 
         nfmsg = nlmsg_data(nlh);
-        nfmsg->nfgen_family = ctx.afi->family;
+        nfmsg->nfgen_family = afi->family;
         nfmsg->version      = NFNETLINK_V0;
-        nfmsg->res_id       = htons(ctx.net->nft.base_seq & 0xffff);
+        nfmsg->res_id       = htons(net->nft.base_seq & 0xffff);
 
-        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
+        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
                 goto nla_put_failure;
         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
                 goto nla_put_failure;
@@ -3422,12 +3437,13 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 
         args.cb                 = cb;
         args.skb                = skb;
-        args.iter.genmask       = nft_genmask_cur(ctx.net);
+        args.iter.genmask       = nft_genmask_cur(net);
         args.iter.skip          = cb->args[0];
         args.iter.count         = 0;
         args.iter.err           = 0;
         args.iter.fn            = nf_tables_dump_setelem;
-        set->ops->walk(&ctx, set, &args.iter);
+        set->ops->walk(&dump_ctx->ctx, set, &args.iter);
+        rcu_read_unlock();
 
         nla_nest_end(skb, nest);
         nlmsg_end(skb, nlh);
@@ -3441,9 +3457,16 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         return skb->len;
 
 nla_put_failure:
+        rcu_read_unlock();
         return -ENOSPC;
 }
 
+static int nf_tables_dump_set_done(struct netlink_callback *cb)
+{
+        kfree(cb->data);
+        return 0;
+}
+
 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
                                 const struct nlattr * const nla[])
@@ -3465,7 +3488,18 @@ static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
                         .dump = nf_tables_dump_set,
+                        .done = nf_tables_dump_set_done,
                 };
+                struct nft_set_dump_ctx *dump_ctx;
+
+                dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
+                if (!dump_ctx)
+                        return -ENOMEM;
+
+                dump_ctx->set = set;
+                dump_ctx->ctx = ctx;
+
+                c.data = dump_ctx;
                 return netlink_dump_start(nlsk, skb, nlh, &c);
         }
         return -EOPNOTSUPP;
@@ -3593,9 +3627,9 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 {
         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
 
-        nft_data_uninit(nft_set_ext_key(ext), NFT_DATA_VALUE);
+        nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
-                nft_data_uninit(nft_set_ext_data(ext), set->dtype);
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
         if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
                 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
@@ -3604,6 +3638,18 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 }
 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
 
+/* Only called from commit path, nft_set_elem_deactivate() already deals with
+ * the refcounting from the preparation phase.
+ */
+static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
+{
+        struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
+                nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+        kfree(elem);
+}
+
 static int nft_setelem_parse_flags(const struct nft_set *set,
                                    const struct nlattr *attr, u32 *flags)
 {
@@ -3815,9 +3861,9 @@ err4:
         kfree(elem.priv);
 err3:
         if (nla[NFTA_SET_ELEM_DATA] != NULL)
-                nft_data_uninit(&data, d2.type);
+                nft_data_release(&data, d2.type);
 err2:
-        nft_data_uninit(&elem.key.val, d1.type);
+        nft_data_release(&elem.key.val, d1.type);
 err1:
         return err;
 }
@@ -3862,6 +3908,53 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
         return err;
 }
 
+/**
+ *      nft_data_hold - hold a nft_data item
+ *
+ *      @data: struct nft_data to release
+ *      @type: type of data
+ *
+ *      Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
+ *      NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
+ *      NFT_GOTO verdicts. This function must be called on active data objects
+ *      from the second phase of the commit protocol.
+ */
+static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
+{
+        if (type == NFT_DATA_VERDICT) {
+                switch (data->verdict.code) {
+                case NFT_JUMP:
+                case NFT_GOTO:
+                        data->verdict.chain->use++;
+                        break;
+                }
+        }
+}
+
+static void nft_set_elem_activate(const struct net *net,
+                                  const struct nft_set *set,
+                                  struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_hold(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use++;
+}
+
+static void nft_set_elem_deactivate(const struct net *net,
+                                    const struct nft_set *set,
+                                    struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use--;
+}
+
 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
                            const struct nlattr *attr)
 {
@@ -3927,6 +4020,8 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
         kfree(elem.priv);
         elem.priv = priv;
 
+        nft_set_elem_deactivate(ctx->net, set, &elem);
+
         nft_trans_elem(trans) = elem;
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
         return 0;
@@ -3936,7 +4031,7 @@ err4:
 err3:
         kfree(elem.priv);
 err2:
-        nft_data_uninit(&elem.key.val, desc.type);
+        nft_data_release(&elem.key.val, desc.type);
 err1:
         return err;
 }
@@ -4743,8 +4838,8 @@ static void nf_tables_commit_release(struct nft_trans *trans)
                 nft_set_destroy(nft_trans_set(trans));
                 break;
         case NFT_MSG_DELSETELEM:
-                nft_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv, true);
+                nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
+                                           nft_trans_elem(trans).priv);
                 break;
         case NFT_MSG_DELOBJ:
                 nft_obj_destroy(nft_trans_obj(trans));
@@ -4979,6 +5074,7 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
                 case NFT_MSG_DELSETELEM:
                         te = (struct nft_trans_elem *)trans->data;
 
+                        nft_set_elem_activate(net, te->set, &te->elem);
                         te->set->ops->activate(net, te->set, &te->elem);
                         te->set->ndeact--;
 
@@ -5464,7 +5560,7 @@ int nft_data_init(const struct nft_ctx *ctx,
 EXPORT_SYMBOL_GPL(nft_data_init);
 
 /**
- *      nft_data_uninit - release a nft_data item
+ *      nft_data_release - release a nft_data item
  *
  *      @data: struct nft_data to release
  *      @type: type of data
@@ -5472,7 +5568,7 @@ EXPORT_SYMBOL_GPL(nft_data_init);
  *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
  *      all others need to be released by calling this function.
  */
-void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
+void nft_data_release(const struct nft_data *data, enum nft_data_types type)
 {
         if (type < NFT_DATA_VERDICT)
                 return;
@@ -5483,7 +5579,7 @@ void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
                 WARN_ON(1);
         }
 }
-EXPORT_SYMBOL_GPL(nft_data_uninit);
+EXPORT_SYMBOL_GPL(nft_data_release);
 
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
                   enum nft_data_types type, unsigned int len)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 950bf6eadc65..be678a323598 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -686,6 +686,7 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                 tuple_set = true;
         }
 
+        ret = -ENOENT;
         list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
                 cur = &nlcth->helper;
                 j++;
@@ -699,16 +700,20 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                      tuple.dst.protonum != cur->tuple.dst.protonum))
                         continue;
 
-                found = true;
-                nf_conntrack_helper_unregister(cur);
-                kfree(cur->expect_policy);
+                if (refcount_dec_if_one(&cur->refcnt)) {
+                        found = true;
+                        nf_conntrack_helper_unregister(cur);
+                        kfree(cur->expect_policy);
 
-                list_del(&nlcth->list);
-                kfree(nlcth);
+                        list_del(&nlcth->list);
+                        kfree(nlcth);
+                } else {
+                        ret = -EBUSY;
+                }
         }
 
         /* Make sure we return success if we flush and there is no helpers */
-        return (found || j == 0) ? 0 : -ENOENT;
+        return (found || j == 0) ? 0 : ret;
 }
 
 static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index 877d9acd91ef..fff8073e2a56 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -83,17 +83,26 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
                             tb[NFTA_BITWISE_MASK]);
         if (err < 0)
                 return err;
-        if (d1.len != priv->len)
-                return -EINVAL;
+        if (d1.len != priv->len) {
+                err = -EINVAL;
+                goto err1;
+        }
 
         err = nft_data_init(NULL, &priv->xor, sizeof(priv->xor), &d2,
                             tb[NFTA_BITWISE_XOR]);
         if (err < 0)
-                return err;
-        if (d2.len != priv->len)
-                return -EINVAL;
+                goto err1;
+        if (d2.len != priv->len) {
+                err = -EINVAL;
+                goto err2;
+        }
 
         return 0;
+err2:
+        nft_data_release(&priv->xor, d2.type);
+err1:
+        nft_data_release(&priv->mask, d1.type);
+        return err;
 }
 
 static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index 2b96effeadc1..c2945eb3397c 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -201,10 +201,18 @@ nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
         if (err < 0)
                 return ERR_PTR(err);
 
+        if (desc.type != NFT_DATA_VALUE) {
+                err = -EINVAL;
+                goto err1;
+        }
+
         if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)
                 return &nft_cmp_fast_ops;
-        else
-                return &nft_cmp_ops;
+
+        return &nft_cmp_ops;
+err1:
+        nft_data_release(&data, desc.type);
+        return ERR_PTR(-EINVAL);
 }
 
 struct nft_expr_type nft_cmp_type __read_mostly = {
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index a34ceb38fc55..1678e9e75e8e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -826,9 +826,9 @@ static void nft_ct_helper_obj_destroy(struct nft_object *obj)
         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 
         if (priv->helper4)
-                module_put(priv->helper4->me);
+                nf_conntrack_helper_put(priv->helper4);
         if (priv->helper6)
-                module_put(priv->helper6->me);
+                nf_conntrack_helper_put(priv->helper6);
 }
 
 static void nft_ct_helper_obj_eval(struct nft_object *obj,
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 728baf88295a..4717d7796927 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -65,7 +65,7 @@ static int nft_immediate_init(const struct nft_ctx *ctx,
         return 0;
 
 err1:
-        nft_data_uninit(&priv->data, desc.type);
+        nft_data_release(&priv->data, desc.type);
         return err;
 }
 
@@ -73,7 +73,8 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
                                   const struct nft_expr *expr)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
-        return nft_data_uninit(&priv->data, nft_dreg_to_type(priv->dreg));
+
+        return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
 }
 
 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index 9edc74eedc10..cedb96c3619f 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -102,9 +102,9 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
         priv->len = desc_from.len;
         return 0;
 err2:
-        nft_data_uninit(&priv->data_to, desc_to.type);
+        nft_data_release(&priv->data_to, desc_to.type);
 err1:
-        nft_data_uninit(&priv->data_from, desc_from.type);
+        nft_data_release(&priv->data_from, desc_from.type);
         return err;
 }
 
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 8ec086b6b56b..3d3a6df4ce70 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -222,7 +222,7 @@ static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set,
         struct nft_set_elem elem;
         int err;
 
-        err = rhashtable_walk_init(&priv->ht, &hti, GFP_KERNEL);
+        err = rhashtable_walk_init(&priv->ht, &hti, GFP_ATOMIC);
         iter->err = err;
         if (err)
                 return;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8876b7da6884..1770c1d9b37f 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -283,28 +283,30 @@ static int xt_obj_to_user(u16 __user *psize, u16 size,
                        &U->u.user.revision, K->u.kernel.TYPE->revision)
 
 int xt_data_to_user(void __user *dst, const void *src,
-                    int usersize, int size)
+                    int usersize, int size, int aligned_size)
 {
         usersize = usersize ? : size;
         if (copy_to_user(dst, src, usersize))
                 return -EFAULT;
-        if (usersize != size && clear_user(dst + usersize, size - usersize))
+        if (usersize != aligned_size &&
+            clear_user(dst + usersize, aligned_size - usersize))
                 return -EFAULT;
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(xt_data_to_user);
 
-#define XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                             \
+#define XT_DATA_TO_USER(U, K, TYPE)                                     \
         xt_data_to_user(U->data, K->data,                               \
                         K->u.kernel.TYPE->usersize,                     \
-                        C_SIZE ? : K->u.kernel.TYPE->TYPE##size)
+                        K->u.kernel.TYPE->TYPE##size,                   \
+                        XT_ALIGN(K->u.kernel.TYPE->TYPE##size))
 
 int xt_match_to_user(const struct xt_entry_match *m,
                      struct xt_entry_match __user *u)
 {
         return XT_OBJ_TO_USER(u, m, match, 0) ||
-               XT_DATA_TO_USER(u, m, match, 0);
+               XT_DATA_TO_USER(u, m, match);
 }
 EXPORT_SYMBOL_GPL(xt_match_to_user);
 
@@ -312,7 +314,7 @@ int xt_target_to_user(const struct xt_entry_target *t,
                       struct xt_entry_target __user *u)
 {
         return XT_OBJ_TO_USER(u, t, target, 0) ||
-               XT_DATA_TO_USER(u, t, target, 0);
+               XT_DATA_TO_USER(u, t, target);
 }
 EXPORT_SYMBOL_GPL(xt_target_to_user);
 
@@ -611,6 +613,12 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 }
 EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
 
+#define COMPAT_XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                      \
+        xt_data_to_user(U->data, K->data,                               \
+                        K->u.kernel.TYPE->usersize,                     \
+                        C_SIZE,                                         \
+                        COMPAT_XT_ALIGN(C_SIZE))
+
 int xt_compat_match_to_user(const struct xt_entry_match *m,
                             void __user **dstptr, unsigned int *size)
 {
@@ -626,7 +634,7 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,
                 if (match->compat_to_user((void __user *)cm->data, m->data))
                         return -EFAULT;
         } else {
-                if (XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
+                if (COMPAT_XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
                         return -EFAULT;
         }
 
@@ -972,7 +980,7 @@ int xt_compat_target_to_user(const struct xt_entry_target *t,
                 if (target->compat_to_user((void __user *)ct->data, t->data))
                         return -EFAULT;
         } else {
-                if (XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
+                if (COMPAT_XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
                         return -EFAULT;
         }
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index bb7ad82dcd56..623ef37de886 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -96,7 +96,7 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
 
         help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
         if (help == NULL) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                 return -ENOMEM;
         }
 
@@ -263,7 +263,7 @@ out:
 err4:
         help = nfct_help(ct);
         if (help)
-                module_put(help->helper->me);
+                nf_conntrack_helper_put(help->helper);
 err3:
         nf_ct_tmpl_free(ct);
 err2:
@@ -346,7 +346,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
         if (ct) {
                 help = nfct_help(ct);
                 if (help)
-                        module_put(help->helper->me);
+                        nf_conntrack_helper_put(help->helper);
 
                 nf_ct_netns_put(par->net, par->family);
 
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index bf602e33c40a..08679ebb3068 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1123,7 +1123,7 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
 
         help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
         if (!help) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                 return -ENOMEM;
         }
 
@@ -1584,7 +1584,7 @@ void ovs_ct_free_action(const struct nlattr *a)
 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
 {
         if (ct_info->helper)
-                module_put(ct_info->helper->me);
+                nf_conntrack_helper_put(ct_info->helper);
         if (ct_info->ct)
                 nf_ct_tmpl_free(ct_info->ct);
 }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f4001763134d..e3eeed19cc7a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2658,13 +2658,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
         }
 
-        sockc.tsflags = po->sk.sk_tsflags;
-        if (msg->msg_controllen) {
-                err = sock_cmsg_send(&po->sk, msg, &sockc);
-                if (unlikely(err))
-                        goto out;
-        }
-
         err = -ENXIO;
         if (unlikely(dev == NULL))
                 goto out;
@@ -2672,6 +2665,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         if (unlikely(!(dev->flags & IFF_UP)))
                 goto out_put;
 
+        sockc.tsflags = po->sk.sk_tsflags;
+        if (msg->msg_controllen) {
+                err = sock_cmsg_send(&po->sk, msg, &sockc);
+                if (unlikely(err))
+                        goto out_put;
+        }
+
         if (po->sk.sk_socket->type == SOCK_RAW)
                 reserve = dev->hard_header_len;
         size_max = po->tx_ring.frame_size
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index dee469fed967..51859b8edd7e 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -203,7 +203,6 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
 
         *arg = (unsigned long) head;
         rcu_assign_pointer(tp->root, new);
-        call_rcu(&head->rcu, mall_destroy_rcu);
         return 0;
 
 err_replace_hw_filter:
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index bbe57d57b67f..e88342fde1bc 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1831,6 +1831,12 @@ static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
         if (!qdisc_dev(root))
                 return 0;
 
+        if (tcm->tcm_parent) {
+                q = qdisc_match_from_root(root, TC_H_MAJ(tcm->tcm_parent));
+                if (q && tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
+                        return -1;
+                return 0;
+        }
         hash_for_each(qdisc_dev(root)->qdisc_hash, b, q, hash) {
                 if (tc_dump_tclass_qdisc(q, skb, tcm, cb, t_p, s_t) < 0)
                         return -1;
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index a9708da28eb5..95238284c422 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1176,7 +1176,9 @@ void sctp_assoc_update(struct sctp_association *asoc,
 
                 asoc->ctsn_ack_point = asoc->next_tsn - 1;
                 asoc->adv_peer_ack_point = asoc->ctsn_ack_point;
-                if (!asoc->stream) {
+
+                if (sctp_state(asoc, COOKIE_WAIT)) {
+                        sctp_stream_free(asoc->stream);
                         asoc->stream = new->stream;
                         new->stream = NULL;
                 }
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 0e06a278d2a9..ba9ad32fc447 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -473,15 +473,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
                              struct sctp_association **app,
                              struct sctp_transport **tpp)
 {
+        struct sctp_init_chunk *chunkhdr, _chunkhdr;
         union sctp_addr saddr;
         union sctp_addr daddr;
         struct sctp_af *af;
         struct sock *sk = NULL;
         struct sctp_association *asoc;
         struct sctp_transport *transport = NULL;
-        struct sctp_init_chunk *chunkhdr;
         __u32 vtag = ntohl(sctphdr->vtag);
-        int len = skb->len - ((void *)sctphdr - (void *)skb->data);
 
         *app = NULL; *tpp = NULL;
 
@@ -516,13 +515,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb,
          * discard the packet.
          */
         if (vtag == 0) {
-                chunkhdr = (void *)sctphdr + sizeof(struct sctphdr);
-                if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t)
-                          + sizeof(__be32) ||
+                /* chunk header + first 4 octects of init header */
+                chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) +
+                                              sizeof(struct sctphdr),
+                                              sizeof(struct sctp_chunkhdr) +
+                                              sizeof(__be32), &_chunkhdr);
+                if (!chunkhdr ||
                     chunkhdr->chunk_hdr.type != SCTP_CID_INIT ||
-                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) {
+                    ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag)
                         goto out;
-                }
+
         } else if (vtag != asoc->c.peer_vtag) {
                 goto out;
         }
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 961ee59f696a..f5b45b8b8b16 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -240,12 +240,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
         struct sctp_bind_addr *bp;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sctp_sockaddr_entry *laddr;
-        union sctp_addr *baddr = NULL;
         union sctp_addr *daddr = &t->ipaddr;
         union sctp_addr dst_saddr;
         struct in6_addr *final_p, final;
         __u8 matchlen = 0;
-        __u8 bmatchlen;
         sctp_scope_t scope;
 
         memset(fl6, 0, sizeof(struct flowi6));
@@ -312,23 +310,37 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
          */
         rcu_read_lock();
         list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                if (!laddr->valid)
+                struct dst_entry *bdst;
+                __u8 bmatchlen;
+
+                if (!laddr->valid ||
+                    laddr->state != SCTP_ADDR_SRC ||
+                    laddr->a.sa.sa_family != AF_INET6 ||
+                    scope > sctp_scope(&laddr->a))
                         continue;
-                if ((laddr->state == SCTP_ADDR_SRC) &&
-                    (laddr->a.sa.sa_family == AF_INET6) &&
-                    (scope <= sctp_scope(&laddr->a))) {
-                        bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
-                        if (!baddr || (matchlen < bmatchlen)) {
-                                baddr = &laddr->a;
-                                matchlen = bmatchlen;
-                        }
-                }
-        }
-        if (baddr) {
-                fl6->saddr = baddr->v6.sin6_addr;
-                fl6->fl6_sport = baddr->v6.sin6_port;
+
+                fl6->saddr = laddr->a.v6.sin6_addr;
+                fl6->fl6_sport = laddr->a.v6.sin6_port;
                 final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
-                dst = ip6_dst_lookup_flow(sk, fl6, final_p);
+                bdst = ip6_dst_lookup_flow(sk, fl6, final_p);
+
+                if (!IS_ERR(bdst) &&
+                    ipv6_chk_addr(dev_net(bdst->dev),
+                                  &laddr->a.v6.sin6_addr, bdst->dev, 1)) {
+                        if (!IS_ERR_OR_NULL(dst))
+                                dst_release(dst);
+                        dst = bdst;
+                        break;
+                }
+
+                bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
+                if (matchlen > bmatchlen)
+                        continue;
+
+                if (!IS_ERR_OR_NULL(dst))
+                        dst_release(dst);
+                dst = bdst;
+                matchlen = bmatchlen;
         }
         rcu_read_unlock();
 
@@ -665,6 +677,9 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
         newnp = inet6_sk(newsk);
 
         memcpy(newnp, np, sizeof(struct ipv6_pinfo));
+        newnp->ipv6_mc_list = NULL;
+        newnp->ipv6_ac_list = NULL;
+        newnp->ipv6_fl_list = NULL;
 
         rcu_read_lock();
         opt = rcu_dereference(np->opt);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 8a08f13469c4..92e332e17391 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2454,16 +2454,11 @@ int sctp_process_init(struct sctp_association *asoc, struct sctp_chunk *chunk,
          * stream sequence number shall be set to 0.
          */
 
-        /* Allocate storage for the negotiated streams if it is not a temporary
-         * association.
-         */
-        if (!asoc->temp) {
-                if (sctp_stream_init(asoc, gfp))
-                        goto clean_up;
+        if (sctp_stream_init(asoc, gfp))
+                goto clean_up;
 
-                if (sctp_assoc_set_id(asoc, gfp))
-                        goto clean_up;
-        }
+        if (!asoc->temp && sctp_assoc_set_id(asoc, gfp))
+                goto clean_up;
 
         /* ADDIP Section 4.1 ASCONF Chunk Procedures
          *
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 4f5e6cfc7f60..f863b5573e42 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -2088,6 +2088,9 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
                 }
         }
 
+        /* Set temp so that it won't be added into hashtable */
+        new_asoc->temp = 1;
+
         /* Compare the tie_tag in cookie with the verification tag of
          * current association.
          */
diff --git a/net/smc/Kconfig b/net/smc/Kconfig
index c717ef0896aa..33954852f3f8 100644
--- a/net/smc/Kconfig
+++ b/net/smc/Kconfig
@@ -8,6 +8,10 @@ config SMC
           The Linux implementation of the SMC-R solution is designed as
           a separate socket family SMC.
 
+          Warning: SMC will expose all memory for remote reads and writes
+          once a connection is established.  Don't enable this option except
+          for tightly controlled lab environment.
+
           Select this option if you want to run SMC socket applications
 
 config SMC_DIAG
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index e41f594a1e1d..03ec058d18df 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -204,7 +204,7 @@ int smc_clc_send_confirm(struct smc_sock *smc)
         memcpy(&cclc.lcl.mac, &link->smcibdev->mac[link->ibport - 1], ETH_ALEN);
         hton24(cclc.qpn, link->roce_qp->qp_num);
         cclc.rmb_rkey =
-                htonl(conn->rmb_desc->mr_rx[SMC_SINGLE_LINK]->rkey);
+                htonl(conn->rmb_desc->rkey[SMC_SINGLE_LINK]);
         cclc.conn_idx = 1; /* for now: 1 RMB = 1 RMBE */
         cclc.rmbe_alert_token = htonl(conn->alert_token_local);
         cclc.qp_mtu = min(link->path_mtu, link->peer_mtu);
@@ -256,7 +256,7 @@ int smc_clc_send_accept(struct smc_sock *new_smc, int srv_first_contact)
         memcpy(&aclc.lcl.mac, link->smcibdev->mac[link->ibport - 1], ETH_ALEN);
         hton24(aclc.qpn, link->roce_qp->qp_num);
         aclc.rmb_rkey =
-                htonl(conn->rmb_desc->mr_rx[SMC_SINGLE_LINK]->rkey);
+                htonl(conn->rmb_desc->rkey[SMC_SINGLE_LINK]);
         aclc.conn_idx = 1;                      /* as long as 1 RMB = 1 RMBE */
         aclc.rmbe_alert_token = htonl(conn->alert_token_local);
         aclc.qp_mtu = link->path_mtu;
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index 65020e93ff21..3ac09a629ea1 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -613,19 +613,8 @@ int smc_rmb_create(struct smc_sock *smc)
                         rmb_desc = NULL;
                         continue; /* if mapping failed, try smaller one */
                 }
-                rc = smc_ib_get_memory_region(lgr->lnk[SMC_SINGLE_LINK].roce_pd,
-                                              IB_ACCESS_REMOTE_WRITE |
-                                              IB_ACCESS_LOCAL_WRITE,
-                                             &rmb_desc->mr_rx[SMC_SINGLE_LINK]);
-                if (rc) {
-                        smc_ib_buf_unmap(lgr->lnk[SMC_SINGLE_LINK].smcibdev,
-                                         tmp_bufsize, rmb_desc,
-                                         DMA_FROM_DEVICE);
-                        kfree(rmb_desc->cpu_addr);
-                        kfree(rmb_desc);
-                        rmb_desc = NULL;
-                        continue;
-                }
+                rmb_desc->rkey[SMC_SINGLE_LINK] =
+                        lgr->lnk[SMC_SINGLE_LINK].roce_pd->unsafe_global_rkey;
                 rmb_desc->used = 1;
                 write_lock_bh(&lgr->rmbs_lock);
                 list_add(&rmb_desc->list,
@@ -668,6 +657,7 @@ int smc_rmb_rtoken_handling(struct smc_connection *conn,
 
         for (i = 0; i < SMC_RMBS_PER_LGR_MAX; i++) {
                 if ((lgr->rtokens[i][SMC_SINGLE_LINK].rkey == rkey) &&
+                    (lgr->rtokens[i][SMC_SINGLE_LINK].dma_addr == dma_addr) &&
                     test_bit(i, lgr->rtokens_used_mask)) {
                         conn->rtoken_idx = i;
                         return 0;
diff --git a/net/smc/smc_core.h b/net/smc/smc_core.h
index 27eb38056a27..b013cb43a327 100644
--- a/net/smc/smc_core.h
+++ b/net/smc/smc_core.h
@@ -93,7 +93,7 @@ struct smc_buf_desc {
         u64                     dma_addr[SMC_LINKS_PER_LGR_MAX];
                                                 /* mapped address of buffer */
         void                    *cpu_addr;      /* virtual address of buffer */
-        struct ib_mr            *mr_rx[SMC_LINKS_PER_LGR_MAX];
+        u32                     rkey[SMC_LINKS_PER_LGR_MAX];
                                                 /* for rmb only:
                                                  * rkey provided to peer
                                                  */
diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c
index cb69ab977cd7..b31715505a35 100644
--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -37,24 +37,6 @@ u8 local_systemid[SMC_SYSTEMID_LEN] = SMC_LOCAL_SYSTEMID_RESET;	/* unique system
                                                                  * identifier
                                                                  */
 
-int smc_ib_get_memory_region(struct ib_pd *pd, int access_flags,
-                             struct ib_mr **mr)
-{
-        int rc;
-
-        if (*mr)
-                return 0; /* already done */
-
-        /* obtain unique key -
-         * next invocation of get_dma_mr returns a different key!
-         */
-        *mr = pd->device->get_dma_mr(pd, access_flags);
-        rc = PTR_ERR_OR_ZERO(*mr);
-        if (IS_ERR(*mr))
-                *mr = NULL;
-        return rc;
-}
-
 static int smc_ib_modify_qp_init(struct smc_link *lnk)
 {
         struct ib_qp_attr qp_attr;
@@ -210,7 +192,8 @@ int smc_ib_create_protection_domain(struct smc_link *lnk)
 {
         int rc;
 
-        lnk->roce_pd = ib_alloc_pd(lnk->smcibdev->ibdev, 0);
+        lnk->roce_pd = ib_alloc_pd(lnk->smcibdev->ibdev,
+                                   IB_PD_UNSAFE_GLOBAL_RKEY);
         rc = PTR_ERR_OR_ZERO(lnk->roce_pd);
         if (IS_ERR(lnk->roce_pd))
                 lnk->roce_pd = NULL;
diff --git a/net/smc/smc_ib.h b/net/smc/smc_ib.h
index 7e1f0e24d177..b567152a526d 100644
--- a/net/smc/smc_ib.h
+++ b/net/smc/smc_ib.h
@@ -61,8 +61,6 @@ void smc_ib_dealloc_protection_domain(struct smc_link *lnk);
 int smc_ib_create_protection_domain(struct smc_link *lnk);
 void smc_ib_destroy_queue_pair(struct smc_link *lnk);
 int smc_ib_create_queue_pair(struct smc_link *lnk);
-int smc_ib_get_memory_region(struct ib_pd *pd, int access_flags,
-                             struct ib_mr **mr);
 int smc_ib_ready_link(struct smc_link *lnk);
 int smc_ib_modify_qp_rts(struct smc_link *lnk);
 int smc_ib_modify_qp_reset(struct smc_link *lnk);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 0d4f2f455a7c..1b92b72e812f 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -362,25 +362,25 @@ static int tipc_sk_sock_err(struct socket *sock, long *timeout)
         return 0;
 }
 
-#define tipc_wait_for_cond(sock_, timeout_, condition_)                 \
-({                                                                      \
-        int rc_ = 0;                                                    \
-        int done_ = 0;                                                  \
-                                                                        \
-        while (!(condition_) && !done_) {                               \
-                struct sock *sk_ = sock->sk;                            \
-                DEFINE_WAIT_FUNC(wait_, woken_wake_function);           \
-                                                                        \
-                rc_ = tipc_sk_sock_err(sock_, timeout_);                \
-                if (rc_)                                                \
-                        break;                                          \
-                prepare_to_wait(sk_sleep(sk_), &wait_,                  \
-                                TASK_INTERRUPTIBLE);                    \
-                done_ = sk_wait_event(sk_, timeout_,                    \
-                                      (condition_), &wait_);            \
-                remove_wait_queue(sk_sleep(sk_), &wait_);               \
-        }                                                               \
-        rc_;                                                            \
+#define tipc_wait_for_cond(sock_, timeo_, condition_)                          \
+({                                                                             \
+        struct sock *sk_;                                                      \
+        int rc_;                                                               \
+                                                                               \
+        while ((rc_ = !(condition_))) {                                        \
+                DEFINE_WAIT_FUNC(wait_, woken_wake_function);                  \
+                sk_ = (sock_)->sk;                                             \
+                rc_ = tipc_sk_sock_err((sock_), timeo_);                       \
+                if (rc_)                                                       \
+                        break;                                                 \
+                prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE);    \
+                release_sock(sk_);                                             \
+                *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \
+                sched_annotate_sleep();                                        \
+                lock_sock(sk_);                                                \
+                remove_wait_queue(sk_sleep(sk_), &wait_);                      \
+        }                                                                      \
+        rc_;                                                                   \
 })
 
 /**
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 6f7f6757ceef..dfc8c51e4d74 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1540,8 +1540,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
         long timeout;
         int err;
         struct vsock_transport_send_notify_data send_data;
-
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
         sk = sock->sk;
         vsk = vsock_sk(sk);
@@ -1584,11 +1583,10 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
         if (err < 0)
                 goto out;
 
-
         while (total_written < len) {
                 ssize_t written;
 
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+                add_wait_queue(sk_sleep(sk), &wait);
                 while (vsock_stream_has_space(vsk) == 0 &&
                        sk->sk_err == 0 &&
                        !(sk->sk_shutdown & SEND_SHUTDOWN) &&
@@ -1597,33 +1595,30 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
                         /* Don't wait for non-blocking sockets. */
                         if (timeout == 0) {
                                 err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
 
                         err = transport->notify_send_pre_block(vsk, &send_data);
                         if (err < 0) {
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
 
                         release_sock(sk);
-                        timeout = schedule_timeout(timeout);
+                        timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
                         lock_sock(sk);
                         if (signal_pending(current)) {
                                 err = sock_intr_errno(timeout);
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         } else if (timeout == 0) {
                                 err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
-
-                        prepare_to_wait(sk_sleep(sk), &wait,
-                                        TASK_INTERRUPTIBLE);
                 }
-                finish_wait(sk_sleep(sk), &wait);
+                remove_wait_queue(sk_sleep(sk), &wait);
 
                 /* These checks occur both as part of and after the loop
                  * conditional since we need to check before and after
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 14d5f0c8c45f..9f0901f3e42b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -322,9 +322,9 @@ cfg80211_find_sched_scan_req(struct cfg80211_registered_device *rdev, u64 reqid)
 {
         struct cfg80211_sched_scan_request *pos;
 
-        ASSERT_RTNL();
+        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
 
-        list_for_each_entry(pos, &rdev->sched_scan_req_list, list) {
+        list_for_each_entry_rcu(pos, &rdev->sched_scan_req_list, list) {
                 if (pos->reqid == reqid)
                         return pos;
         }
@@ -398,13 +398,13 @@ void cfg80211_sched_scan_results(struct wiphy *wiphy, u64 reqid)
         trace_cfg80211_sched_scan_results(wiphy, reqid);
         /* ignore if we're not scanning */
 
-        rtnl_lock();
+        rcu_read_lock();
         request = cfg80211_find_sched_scan_req(rdev, reqid);
         if (request) {
                 request->report_results = true;
                 queue_work(cfg80211_wq, &rdev->sched_scan_res_wk);
         }
-        rtnl_unlock();
+        rcu_read_unlock();
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_results);
 
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 7198373e2920..4992f1025c9d 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -454,6 +454,8 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
         if (iftype == NL80211_IFTYPE_MESH_POINT)
                 skb_copy_bits(skb, hdrlen, &mesh_flags, 1);
 
+        mesh_flags &= MESH_FLAGS_AE;
+
         switch (hdr->frame_control &
                 cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
         case cpu_to_le16(IEEE80211_FCTL_TODS):
@@ -469,9 +471,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                              iftype != NL80211_IFTYPE_STATION))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                 return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6) {
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
                                 skb_copy_bits(skb, hdrlen +
                                         offsetof(struct ieee80211s_hdr, eaddr1),
                                         tmp.h_dest, 2 * ETH_ALEN);
@@ -487,9 +489,9 @@ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
                      ether_addr_equal(tmp.h_source, addr)))
                         return -1;
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
-                        if (mesh_flags & MESH_FLAGS_AE_A5_A6)
+                        if (mesh_flags == MESH_FLAGS_AE_A5_A6)
                                 return -1;
-                        if (mesh_flags & MESH_FLAGS_AE_A4)
+                        if (mesh_flags == MESH_FLAGS_AE_A4)
                                 skb_copy_bits(skb, hdrlen +
                                         offsetof(struct ieee80211s_hdr, eaddr1),
                                         tmp.h_source, ETH_ALEN);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 8b911c29860e..5a1a98df3499 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1791,32 +1791,40 @@ void x25_kill_by_neigh(struct x25_neigh *nb)
 
 static int __init x25_init(void)
 {
-        int rc = proto_register(&x25_proto, 0);
+        int rc;
 
-        if (rc != 0)
+        rc = proto_register(&x25_proto, 0);
+        if (rc)
                 goto out;
 
         rc = sock_register(&x25_family_ops);
-        if (rc != 0)
+        if (rc)
                 goto out_proto;
 
         dev_add_pack(&x25_packet_type);
 
         rc = register_netdevice_notifier(&x25_dev_notifier);
-        if (rc != 0)
+        if (rc)
                 goto out_sock;
 
-        pr_info("Linux Version 0.2\n");
+        rc = x25_register_sysctl();
+        if (rc)
+                goto out_dev;
 
-        x25_register_sysctl();
         rc = x25_proc_init();
-        if (rc != 0)
-                goto out_dev;
+        if (rc)
+                goto out_sysctl;
+
+        pr_info("Linux Version 0.2\n");
+
 out:
         return rc;
+out_sysctl:
+        x25_unregister_sysctl();
 out_dev:
         unregister_netdevice_notifier(&x25_dev_notifier);
 out_sock:
+        dev_remove_pack(&x25_packet_type);
         sock_unregister(AF_X25);
 out_proto:
         proto_unregister(&x25_proto);
diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
index a06dfe143c67..ba078c85f0a1 100644
--- a/net/x25/sysctl_net_x25.c
+++ b/net/x25/sysctl_net_x25.c
@@ -73,9 +73,12 @@ static struct ctl_table x25_table[] = {
         { },
 };
 
-void __init x25_register_sysctl(void)
+int __init x25_register_sysctl(void)
 {
         x25_table_header = register_net_sysctl(&init_net, "net/x25", x25_table);
+        if (!x25_table_header)
+                return -ENOMEM;
+        return 0;
 }
 
 void x25_unregister_sysctl(void)
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index 8ec8a3fcf8d4..574e6f32f94f 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -170,7 +170,7 @@ static int xfrm_dev_feat_change(struct net_device *dev)
 
 static int xfrm_dev_down(struct net_device *dev)
 {
-        if (dev->hw_features & NETIF_F_HW_ESP)
+        if (dev->features & NETIF_F_HW_ESP)
                 xfrm_dev_state_flush(dev_net(dev), dev, true);
 
         xfrm_garbage_collect(dev_net(dev));
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b00a1d5a7f52..ed4e52d95172 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1797,43 +1797,6 @@ free_dst:
         goto out;
 }
 
-#ifdef CONFIG_XFRM_SUB_POLICY
-static int xfrm_dst_alloc_copy(void **target, const void *src, int size)
-{
-        if (!*target) {
-                *target = kmalloc(size, GFP_ATOMIC);
-                if (!*target)
-                        return -ENOMEM;
-        }
-
-        memcpy(*target, src, size);
-        return 0;
-}
-#endif
-
-static int xfrm_dst_update_parent(struct dst_entry *dst,
-                                  const struct xfrm_selector *sel)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->partner),
-                                   sel, sizeof(*sel));
-#else
-        return 0;
-#endif
-}
-
-static int xfrm_dst_update_origin(struct dst_entry *dst,
-                                  const struct flowi *fl)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
-        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
-        return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
-#else
-        return 0;
-#endif
-}
-
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,
                                 struct xfrm_policy **pols,
                                 int *num_pols, int *num_xfrms)
@@ -1905,16 +1868,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
 
         xdst = (struct xfrm_dst *)dst;
         xdst->num_xfrms = err;
-        if (num_pols > 1)
-                err = xfrm_dst_update_parent(dst, &pols[1]->selector);
-        else
-                err = xfrm_dst_update_origin(dst, fl);
-        if (unlikely(err)) {
-                dst_free(dst);
-                XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
-                return ERR_PTR(err);
-        }
-
         xdst->num_pols = num_pols;
         memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
         xdst->policy_genid = atomic_read(&pols[0]->genid);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index fc3c5aa38754..2e291bc5f1fc 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1383,6 +1383,8 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
         x->curlft.add_time = orig->curlft.add_time;
         x->km.state = orig->km.state;
         x->km.seq = orig->km.seq;
+        x->replay = orig->replay;
+        x->preplay = orig->preplay;
 
         return x;
 
diff --git a/samples/bpf/cookie_uid_helper_example.c b/samples/bpf/cookie_uid_helper_example.c
index b08ab4e88929..9d751e209f31 100644
--- a/samples/bpf/cookie_uid_helper_example.c
+++ b/samples/bpf/cookie_uid_helper_example.c
@@ -306,7 +306,9 @@ int main(int argc, char *argv[])
         prog_attach_iptables(argv[2]);
         if (cfg_test_traffic) {
                 if (signal(SIGINT, finish) == SIG_ERR)
-                        error(1, errno, "register handler failed");
+                        error(1, errno, "register SIGINT handler failed");
+                if (signal(SIGTERM, finish) == SIG_ERR)
+                        error(1, errno, "register SIGTERM handler failed");
                 while (!test_finish) {
                         print_table();
                         printf("\n");
diff --git a/samples/bpf/offwaketime_user.c b/samples/bpf/offwaketime_user.c
index 9cce2a66bd66..512f87a5fd20 100644
--- a/samples/bpf/offwaketime_user.c
+++ b/samples/bpf/offwaketime_user.c
@@ -100,6 +100,7 @@ int main(int argc, char **argv)
         setrlimit(RLIMIT_MEMLOCK, &r);
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         if (load_kallsyms()) {
                 printf("failed to process /proc/kallsyms\n");
diff --git a/samples/bpf/sampleip_user.c b/samples/bpf/sampleip_user.c
index be59d7dcbdde..4ed690b907ff 100644
--- a/samples/bpf/sampleip_user.c
+++ b/samples/bpf/sampleip_user.c
@@ -180,6 +180,7 @@ int main(int argc, char **argv)
                 return 1;
         }
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         /* do sampling */
         printf("Sampling at %d Hertz for %d seconds. Ctrl-C also ends.\n",
diff --git a/samples/bpf/trace_event_user.c b/samples/bpf/trace_event_user.c
index 0c5561d193a4..fa4336423da5 100644
--- a/samples/bpf/trace_event_user.c
+++ b/samples/bpf/trace_event_user.c
@@ -192,6 +192,7 @@ int main(int argc, char **argv)
         setrlimit(RLIMIT_MEMLOCK, &r);
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         if (load_kallsyms()) {
                 printf("failed to process /proc/kallsyms\n");
diff --git a/samples/bpf/tracex2_user.c b/samples/bpf/tracex2_user.c
index 7fee0f1ba9a3..7321a3f253c9 100644
--- a/samples/bpf/tracex2_user.c
+++ b/samples/bpf/tracex2_user.c
@@ -127,6 +127,7 @@ int main(int ac, char **argv)
         }
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         /* start 'ping' in the background to have some kfree_skb events */
         f = popen("ping -c5 localhost", "r");
diff --git a/samples/bpf/xdp1_user.c b/samples/bpf/xdp1_user.c
index 378850c70eb8..2431c0321b71 100644
--- a/samples/bpf/xdp1_user.c
+++ b/samples/bpf/xdp1_user.c
@@ -62,13 +62,14 @@ static void usage(const char *prog)
         fprintf(stderr,
                 "usage: %s [OPTS] IFINDEX\n\n"
                 "OPTS:\n"
-                "    -S    use skb-mode\n",
+                "    -S    use skb-mode\n"
+                "    -N    enforce native mode\n",
                 prog);
 }
 
 int main(int argc, char **argv)
 {
-        const char *optstr = "S";
+        const char *optstr = "SN";
         char filename[256];
         int opt;
 
@@ -77,6 +78,9 @@ int main(int argc, char **argv)
                 case 'S':
                         xdp_flags |= XDP_FLAGS_SKB_MODE;
                         break;
+                case 'N':
+                        xdp_flags |= XDP_FLAGS_DRV_MODE;
+                        break;
                 default:
                         usage(basename(argv[0]));
                         return 1;
@@ -102,6 +106,7 @@ int main(int argc, char **argv)
         }
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         if (set_link_xdp_fd(ifindex, prog_fd[0], xdp_flags) < 0) {
                 printf("link set xdp fd failed\n");
diff --git a/samples/bpf/xdp_tx_iptunnel_user.c b/samples/bpf/xdp_tx_iptunnel_user.c
index 92b8bde9337c..715cd12eaca5 100644
--- a/samples/bpf/xdp_tx_iptunnel_user.c
+++ b/samples/bpf/xdp_tx_iptunnel_user.c
@@ -79,6 +79,8 @@ static void usage(const char *cmd)
         printf("    -m <dest-MAC> Used in sending the IP Tunneled pkt\n");
         printf("    -T <stop-after-X-seconds> Default: 0 (forever)\n");
         printf("    -P <IP-Protocol> Default is TCP\n");
+        printf("    -S use skb-mode\n");
+        printf("    -N enforce native mode\n");
         printf("    -h Display this help\n");
 }
 
@@ -138,7 +140,7 @@ int main(int argc, char **argv)
 {
         unsigned char opt_flags[256] = {};
         unsigned int kill_after_s = 0;
-        const char *optstr = "i:a:p:s:d:m:T:P:Sh";
+        const char *optstr = "i:a:p:s:d:m:T:P:SNh";
         int min_port = 0, max_port = 0;
         struct iptnl_info tnl = {};
         struct rlimit r = {RLIM_INFINITY, RLIM_INFINITY};
@@ -206,6 +208,9 @@ int main(int argc, char **argv)
                 case 'S':
                         xdp_flags |= XDP_FLAGS_SKB_MODE;
                         break;
+                case 'N':
+                        xdp_flags |= XDP_FLAGS_DRV_MODE;
+                        break;
                 default:
                         usage(argv[0]);
                         return 1;
@@ -239,6 +244,7 @@ int main(int argc, char **argv)
         }
 
         signal(SIGINT, int_exit);
+        signal(SIGTERM, int_exit);
 
         while (min_port <= max_port) {
                 vip.dport = htons(min_port++);
diff --git a/scripts/Makefile.headersinst b/scripts/Makefile.headersinst
index 6ba97a1f9c5a..ce753a408c56 100644
--- a/scripts/Makefile.headersinst
+++ b/scripts/Makefile.headersinst
@@ -8,6 +8,29 @@
 #
 # ==========================================================================
 
+PHONY := __headers
+__headers:
+
+include scripts/Kbuild.include
+
+srcdir        := $(srctree)/$(obj)
+subdirs       := $(patsubst $(srcdir)/%/.,%,$(wildcard $(srcdir)/*/.))
+# caller may set destination dir (when installing to asm/)
+_dst          := $(if $(dst),$(dst),$(obj))
+
+# Recursion
+__headers: $(subdirs)
+
+.PHONY: $(subdirs)
+$(subdirs):
+        $(Q)$(MAKE) $(hdr-inst)=$(obj)/$@ dst=$(_dst)/$@
+
+# Skip header install/check for include/uapi and arch/$(hdr-arch)/include/uapi.
+# We have only sub-directories there.
+skip-inst := $(if $(filter %/uapi,$(obj)),1)
+
+ifeq ($(skip-inst),)
+
 # generated header directory
 gen := $(if $(gen),$(gen),$(subst include/,include/generated/,$(obj)))
 
@@ -15,21 +38,14 @@ gen := $(if $(gen),$(gen),$(subst include/,include/generated/,$(obj)))
 kbuild-file := $(srctree)/$(obj)/Kbuild
 -include $(kbuild-file)
 
-# called may set destination dir (when installing to asm/)
-_dst := $(if $(dst),$(dst),$(obj))
-
 old-kbuild-file := $(srctree)/$(subst uapi/,,$(obj))/Kbuild
 ifneq ($(wildcard $(old-kbuild-file)),)
 include $(old-kbuild-file)
 endif
 
-include scripts/Kbuild.include
-
 installdir    := $(INSTALL_HDR_PATH)/$(subst uapi/,,$(_dst))
 
-srcdir        := $(srctree)/$(obj)
 gendir        := $(objtree)/$(gen)
-subdirs       := $(patsubst $(srcdir)/%/.,%,$(wildcard $(srcdir)/*/.))
 header-files  := $(notdir $(wildcard $(srcdir)/*.h))
 header-files  += $(notdir $(wildcard $(srcdir)/*.agh))
 header-files  := $(filter-out $(no-export-headers), $(header-files))
@@ -88,11 +104,9 @@ quiet_cmd_check = CHECK   $(printdir) ($(words $(all-files)) files)
                   $(PERL) $< $(INSTALL_HDR_PATH)/include $(SRCARCH); \
                   touch $@
 
-PHONY += __headersinst __headerscheck
-
 ifndef HDRCHECK
 # Rules for installing headers
-__headersinst: $(subdirs) $(install-file)
+__headers: $(install-file)
         @:
 
 targets += $(install-file)
@@ -104,7 +118,7 @@ $(install-file): scripts/headers_install.sh \
         $(call if_changed,install)
 
 else
-__headerscheck: $(subdirs) $(check-file)
+__headers: $(check-file)
         @:
 
 targets += $(check-file)
@@ -113,11 +127,6 @@ $(check-file): scripts/headers_check.pl $(output-files) FORCE
 
 endif
 
-# Recursion
-.PHONY: $(subdirs)
-$(subdirs):
-        $(Q)$(MAKE) $(hdr-inst)=$(obj)/$@ dst=$(_dst)/$@
-
 targets := $(wildcard $(sort $(targets)))
 cmd_files := $(wildcard \
              $(foreach f,$(targets),$(dir $(f)).$(notdir $(f)).cmd))
@@ -126,6 +135,8 @@ ifneq ($(cmd_files),)
         include $(cmd_files)
 endif
 
+endif # skip-inst
+
 .PHONY: $(PHONY)
 PHONY += FORCE
 FORCE: ;
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 6dc1eda13b8e..58c05e5d9870 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -175,7 +175,7 @@ ld_flags       = $(LDFLAGS) $(ldflags-y)
 
 dtc_cpp_flags  = -Wp,-MD,$(depfile).pre.tmp -nostdinc                    \
                  -I$(srctree)/arch/$(SRCARCH)/boot/dts                   \
-                 -I$(srctree)/arch/$(SRCARCH)/boot/dts/include           \
+                 -I$(srctree)/scripts/dtc/include-prefixes               \
                  -I$(srctree)/drivers/of/testcase-data                   \
                  -undef -D__DTS__
 
diff --git a/scripts/dtc/checks.c b/scripts/dtc/checks.c
index 5adfc8f52b4f..4b72b530c84f 100644
--- a/scripts/dtc/checks.c
+++ b/scripts/dtc/checks.c
@@ -873,7 +873,7 @@ static void check_simple_bus_reg(struct check *c, struct dt_info *dti, struct no
         while (size--)
                 reg = (reg << 32) | fdt32_to_cpu(*(cells++));
 
-        snprintf(unit_addr, sizeof(unit_addr), "%lx", reg);
+        snprintf(unit_addr, sizeof(unit_addr), "%zx", reg);
         if (!streq(unitname, unit_addr))
                 FAIL(c, dti, "Node %s simple-bus unit address format error, expected \"%s\"",
                      node->fullpath, unit_addr);
diff --git a/scripts/dtc/include-prefixes/arc b/scripts/dtc/include-prefixes/arc
new file mode 120000
index 000000000000..5d21b5a69a11
--- /dev/null
+++ b/scripts/dtc/include-prefixes/arc
@@ -0,0 +1 @@
+../../../arch/arc/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/arm b/scripts/dtc/include-prefixes/arm
new file mode 120000
index 000000000000..eb14d4515a57
--- /dev/null
+++ b/scripts/dtc/include-prefixes/arm
@@ -0,0 +1 @@
+../../../arch/arm/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/arm64 b/scripts/dtc/include-prefixes/arm64
new file mode 120000
index 000000000000..275c42c21d71
--- /dev/null
+++ b/scripts/dtc/include-prefixes/arm64
@@ -0,0 +1 @@
+../../../arch/arm64/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/c6x b/scripts/dtc/include-prefixes/c6x
new file mode 120000
index 000000000000..49ded4cae2be
--- /dev/null
+++ b/scripts/dtc/include-prefixes/c6x
@@ -0,0 +1 @@
+../../../arch/c6x/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/cris b/scripts/dtc/include-prefixes/cris
new file mode 120000
index 000000000000..736d998ba506
--- /dev/null
+++ b/scripts/dtc/include-prefixes/cris
@@ -0,0 +1 @@
+../../../arch/cris/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/dt-bindings b/scripts/dtc/include-prefixes/dt-bindings
new file mode 120000
index 000000000000..04fdbb3af016
--- /dev/null
+++ b/scripts/dtc/include-prefixes/dt-bindings
@@ -0,0 +1 @@
+../../../include/dt-bindings
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/h8300 b/scripts/dtc/include-prefixes/h8300
new file mode 120000
index 000000000000..3bdaa332c54c
--- /dev/null
+++ b/scripts/dtc/include-prefixes/h8300
@@ -0,0 +1 @@
+../../../arch/h8300/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/metag b/scripts/dtc/include-prefixes/metag
new file mode 120000
index 000000000000..87a3c847db8f
--- /dev/null
+++ b/scripts/dtc/include-prefixes/metag
@@ -0,0 +1 @@
+../../../arch/metag/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/microblaze b/scripts/dtc/include-prefixes/microblaze
new file mode 120000
index 000000000000..d9830330a21d
--- /dev/null
+++ b/scripts/dtc/include-prefixes/microblaze
@@ -0,0 +1 @@
+../../../arch/microblaze/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/mips b/scripts/dtc/include-prefixes/mips
new file mode 120000
index 000000000000..ae8d4948dc8d
--- /dev/null
+++ b/scripts/dtc/include-prefixes/mips
@@ -0,0 +1 @@
+../../../arch/mips/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/nios2 b/scripts/dtc/include-prefixes/nios2
new file mode 120000
index 000000000000..51772336d13f
--- /dev/null
+++ b/scripts/dtc/include-prefixes/nios2
@@ -0,0 +1 @@
+../../../arch/nios2/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/openrisc b/scripts/dtc/include-prefixes/openrisc
new file mode 120000
index 000000000000..71c3bc75c560
--- /dev/null
+++ b/scripts/dtc/include-prefixes/openrisc
@@ -0,0 +1 @@
+../../../arch/openrisc/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/powerpc b/scripts/dtc/include-prefixes/powerpc
new file mode 120000
index 000000000000..7cd6ec16e899
--- /dev/null
+++ b/scripts/dtc/include-prefixes/powerpc
@@ -0,0 +1 @@
+../../../arch/powerpc/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/sh b/scripts/dtc/include-prefixes/sh
new file mode 120000
index 000000000000..67d37808c599
--- /dev/null
+++ b/scripts/dtc/include-prefixes/sh
@@ -0,0 +1 @@
+../../../arch/sh/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/xtensa b/scripts/dtc/include-prefixes/xtensa
new file mode 120000
index 000000000000..d1eaf6ec7a2b
--- /dev/null
+++ b/scripts/dtc/include-prefixes/xtensa
@@ -0,0 +1 @@
+../../../arch/xtensa/boot/dts
\ No newline at end of file
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 58df440013c5..918e45268915 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2328,6 +2328,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
         SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
         SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+        SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
@@ -2342,6 +2343,7 @@ static const struct hda_model_fixup alc882_fixup_models[] = {
         {.id = ALC883_FIXUP_ACER_EAPD, .name = "acer-aspire"},
         {.id = ALC882_FIXUP_INV_DMIC, .name = "inv-dmic"},
         {.id = ALC882_FIXUP_NO_PRIMARY_HP, .name = "no-primary-hp"},
+        {.id = ALC1220_FIXUP_GB_DUAL_CODECS, .name = "dual-codecs"},
         {}
 };
 
@@ -6014,6 +6016,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
         {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
         {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
         {.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
+        {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
         {}
 };
 #define ALC225_STANDARD_PINS \
@@ -6465,8 +6468,11 @@ static int patch_alc269(struct hda_codec *codec)
                 break;
         case 0x10ec0225:
         case 0x10ec0295:
+                spec->codec_variant = ALC269_TYPE_ALC225;
+                break;
         case 0x10ec0299:
                 spec->codec_variant = ALC269_TYPE_ALC225;
+                spec->gen.mixer_nid = 0; /* no loopback on ALC299 */
                 break;
         case 0x10ec0234:
         case 0x10ec0274:
@@ -7338,6 +7344,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = {
         {.id = ALC662_FIXUP_ASUS_MODE8, .name = "asus-mode8"},
         {.id = ALC662_FIXUP_INV_DMIC, .name = "inv-dmic"},
         {.id = ALC668_FIXUP_DELL_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
+        {.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
         {}
 };
 
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index faa3d38bac0b..6cefdf6c0b75 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1559,6 +1559,8 @@ static const struct snd_pci_quirk stac9200_fixup_tbl[] = {
                       "Dell Inspiron 1501", STAC_9200_DELL_M26),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f6,
                       "unknown Dell", STAC_9200_DELL_M26),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0201,
+                      "Dell Latitude D430", STAC_9200_DELL_M22),
         /* Panasonic */
         SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_9200_PANASONIC),
         /* Gateway machines needs EAPD to be set on resume */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 01eff6ce6401..d7b0b0a3a2db 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1364,7 +1364,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
         /* Amanero Combo384 USB interface with native DSD support */
         case USB_ID(0x16d0, 0x071a):
                 if (fp->altsetting == 2) {
-                        switch (chip->dev->descriptor.bcdDevice) {
+                        switch (le16_to_cpu(chip->dev->descriptor.bcdDevice)) {
                         case 0x199:
                                 return SNDRV_PCM_FMTBIT_DSD_U32_LE;
                         case 0x19b:
diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c
index 664b7fe206d6..b11d3920b9a5 100644
--- a/sound/x86/intel_hdmi_audio.c
+++ b/sound/x86/intel_hdmi_audio.c
@@ -1809,10 +1809,6 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev)
         pdata->notify_pending = false;
         spin_unlock_irq(&pdata->lpe_audio_slock);
 
-        /* runtime PM isn't enabled as default, since it won't save much on
-         * BYT/CHT devices; user who want the runtime PM should adjust the
-         * power/ontrol and power/autosuspend_delay_ms sysfs entries instead
-         */
         pm_runtime_use_autosuspend(&pdev->dev);
         pm_runtime_mark_last_busy(&pdev->dev);
         pm_runtime_set_active(&pdev->dev);
diff --git a/tools/arch/arm/include/uapi/asm/kvm.h b/tools/arch/arm/include/uapi/asm/kvm.h
index 6ebd3e6a1fd1..5e3c673fa3f4 100644
--- a/tools/arch/arm/include/uapi/asm/kvm.h
+++ b/tools/arch/arm/include/uapi/asm/kvm.h
@@ -27,6 +27,8 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_READONLY_MEM
 
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 #define KVM_REG_SIZE(id)                                                \
         (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
 
@@ -114,6 +116,8 @@ struct kvm_debug_exit_arch {
 };
 
 struct kvm_sync_regs {
+        /* Used with KVM_CAP_ARM_USER_IRQ */
+        __u64 device_irq_level;
 };
 
 struct kvm_arch_memory_slot {
@@ -192,13 +196,17 @@ struct kvm_arch_memory_slot {
 #define KVM_DEV_ARM_VGIC_GRP_REDIST_REGS 5
 #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
 #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
+#define KVM_DEV_ARM_VGIC_GRP_ITS_REGS   8
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT  10
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
                         (0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INTID_MASK 0x3ff
 #define VGIC_LEVEL_INFO_LINE_LEVEL      0
 
-#define   KVM_DEV_ARM_VGIC_CTRL_INIT    0
+#define   KVM_DEV_ARM_VGIC_CTRL_INIT            0
+#define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
+#define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
+#define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
 
 /* KVM_IRQ_LINE irq field index values */
 #define KVM_ARM_IRQ_TYPE_SHIFT          24
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index c2860358ae3e..70eea2ecc663 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -39,6 +39,8 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_READONLY_MEM
 
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 #define KVM_REG_SIZE(id)                                                \
         (1U << (((id) & KVM_REG_SIZE_MASK) >> KVM_REG_SIZE_SHIFT))
 
@@ -143,6 +145,8 @@ struct kvm_debug_exit_arch {
 #define KVM_GUESTDBG_USE_HW             (1 << 17)
 
 struct kvm_sync_regs {
+        /* Used with KVM_CAP_ARM_USER_IRQ */
+        __u64 device_irq_level;
 };
 
 struct kvm_arch_memory_slot {
@@ -212,13 +216,17 @@ struct kvm_arch_memory_slot {
 #define KVM_DEV_ARM_VGIC_GRP_REDIST_REGS 5
 #define KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS 6
 #define KVM_DEV_ARM_VGIC_GRP_LEVEL_INFO  7
+#define KVM_DEV_ARM_VGIC_GRP_ITS_REGS 8
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT  10
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_MASK \
                         (0x3fffffULL << KVM_DEV_ARM_VGIC_LINE_LEVEL_INFO_SHIFT)
 #define KVM_DEV_ARM_VGIC_LINE_LEVEL_INTID_MASK  0x3ff
 #define VGIC_LEVEL_INFO_LINE_LEVEL      0
 
-#define   KVM_DEV_ARM_VGIC_CTRL_INIT    0
+#define   KVM_DEV_ARM_VGIC_CTRL_INIT            0
+#define   KVM_DEV_ARM_ITS_SAVE_TABLES           1
+#define   KVM_DEV_ARM_ITS_RESTORE_TABLES        2
+#define   KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES  3
 
 /* Device Control API on vcpu fd */
 #define KVM_ARM_VCPU_PMU_V3_CTRL        0
diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h
index 4edbe4bb0e8b..07fbeb927834 100644
--- a/tools/arch/powerpc/include/uapi/asm/kvm.h
+++ b/tools/arch/powerpc/include/uapi/asm/kvm.h
@@ -29,6 +29,9 @@
 #define __KVM_HAVE_IRQ_LINE
 #define __KVM_HAVE_GUEST_DEBUG
 
+/* Not always available, but if it is, this is the correct offset.  */
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+
 struct kvm_regs {
         __u64 pc;
         __u64 cr;
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 7f4fd65e9208..3dd2a1d308dd 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -26,6 +26,8 @@
 #define KVM_DEV_FLIC_ADAPTER_REGISTER   6
 #define KVM_DEV_FLIC_ADAPTER_MODIFY     7
 #define KVM_DEV_FLIC_CLEAR_IO_IRQ       8
+#define KVM_DEV_FLIC_AISM               9
+#define KVM_DEV_FLIC_AIRQ_INJECT        10
 /*
  * We can have up to 4*64k pending subchannels + 8 adapter interrupts,
  * as well as up  to ASYNC_PF_PER_VCPU*KVM_MAX_VCPUS pfault done interrupts.
@@ -41,7 +43,14 @@ struct kvm_s390_io_adapter {
         __u8 isc;
         __u8 maskable;
         __u8 swap;
-        __u8 pad;
+        __u8 flags;
+};
+
+#define KVM_S390_ADAPTER_SUPPRESSIBLE 0x01
+
+struct kvm_s390_ais_req {
+        __u8 isc;
+        __u16 mode;
 };
 
 #define KVM_S390_IO_ADAPTER_MASK 1
@@ -110,6 +119,7 @@ struct kvm_s390_vm_cpu_machine {
 #define KVM_S390_VM_CPU_FEAT_CMMA       10
 #define KVM_S390_VM_CPU_FEAT_PFMFI      11
 #define KVM_S390_VM_CPU_FEAT_SIGPIF     12
+#define KVM_S390_VM_CPU_FEAT_KSS        13
 struct kvm_s390_vm_cpu_feat {
         __u64 feat[16];
 };
@@ -198,6 +208,10 @@ struct kvm_guest_debug_arch {
 #define KVM_SYNC_VRS    (1UL << 6)
 #define KVM_SYNC_RICCB  (1UL << 7)
 #define KVM_SYNC_FPRS   (1UL << 8)
+#define KVM_SYNC_GSCB   (1UL << 9)
+/* length and alignment of the sdnx as a power of two */
+#define SDNXC 8
+#define SDNXL (1UL << SDNXC)
 /* definition of registers in kvm_run */
 struct kvm_sync_regs {
         __u64 prefix;   /* prefix register */
@@ -218,8 +232,16 @@ struct kvm_sync_regs {
         };
         __u8  reserved[512];    /* for future vector expansion */
         __u32 fpc;              /* valid on KVM_SYNC_VRS or KVM_SYNC_FPRS */
-        __u8 padding[52];       /* riccb needs to be 64byte aligned */
+        __u8 padding1[52];      /* riccb needs to be 64byte aligned */
         __u8 riccb[64];         /* runtime instrumentation controls block */
+        __u8 padding2[192];     /* sdnx needs to be 256byte aligned */
+        union {
+                __u8 sdnx[SDNXL];  /* state description annex */
+                struct {
+                        __u64 reserved1[2];
+                        __u64 gscb[4];
+                };
+        };
 };
 
 #define KVM_REG_S390_TODPR      (KVM_REG_S390 | KVM_REG_SIZE_U32 | 0x1)
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 0fe00446f9ca..2701e5f8145b 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -202,6 +202,8 @@
 #define X86_FEATURE_AVX512_4VNNIW (7*32+16) /* AVX-512 Neural Network Instructions */
 #define X86_FEATURE_AVX512_4FMAPS (7*32+17) /* AVX-512 Multiply Accumulation Single precision */
 
+#define X86_FEATURE_MBA         ( 7*32+18) /* Memory Bandwidth Allocation */
+
 /* Virtualization flags: Linux defined, word 8 */
 #define X86_FEATURE_TPR_SHADOW  ( 8*32+ 0) /* Intel TPR Shadow */
 #define X86_FEATURE_VNMI        ( 8*32+ 1) /* Intel Virtual NMI */
diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h
index 85599ad4d024..5dff775af7cd 100644
--- a/tools/arch/x86/include/asm/disabled-features.h
+++ b/tools/arch/x86/include/asm/disabled-features.h
@@ -36,6 +36,12 @@
 # define DISABLE_OSPKE          (1<<(X86_FEATURE_OSPKE & 31))
 #endif /* CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS */
 
+#ifdef CONFIG_X86_5LEVEL
+# define DISABLE_LA57   0
+#else
+# define DISABLE_LA57   (1<<(X86_FEATURE_LA57 & 31))
+#endif
+
 /*
  * Make sure to add features to the correct mask
  */
@@ -55,7 +61,7 @@
 #define DISABLED_MASK13 0
 #define DISABLED_MASK14 0
 #define DISABLED_MASK15 0
-#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE)
+#define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57)
 #define DISABLED_MASK17 0
 #define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h
index fac9a5c0abe9..d91ba04dd007 100644
--- a/tools/arch/x86/include/asm/required-features.h
+++ b/tools/arch/x86/include/asm/required-features.h
@@ -53,6 +53,12 @@
 # define NEED_MOVBE     0
 #endif
 
+#ifdef CONFIG_X86_5LEVEL
+# define NEED_LA57      (1<<(X86_FEATURE_LA57 & 31))
+#else
+# define NEED_LA57      0
+#endif
+
 #ifdef CONFIG_X86_64
 #ifdef CONFIG_PARAVIRT
 /* Paravirtualized systems may not have PSE or PGE available */
@@ -98,7 +104,7 @@
 #define REQUIRED_MASK13 0
 #define REQUIRED_MASK14 0
 #define REQUIRED_MASK15 0
-#define REQUIRED_MASK16 0
+#define REQUIRED_MASK16 (NEED_LA57)
 #define REQUIRED_MASK17 0
 #define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
diff --git a/tools/arch/x86/include/uapi/asm/kvm.h b/tools/arch/x86/include/uapi/asm/kvm.h
index 739c0c594022..c2824d02ba37 100644
--- a/tools/arch/x86/include/uapi/asm/kvm.h
+++ b/tools/arch/x86/include/uapi/asm/kvm.h
@@ -9,6 +9,9 @@
 #include <linux/types.h>
 #include <linux/ioctl.h>
 
+#define KVM_PIO_PAGE_OFFSET 1
+#define KVM_COALESCED_MMIO_PAGE_OFFSET 2
+
 #define DE_VECTOR 0
 #define DB_VECTOR 1
 #define BP_VECTOR 3
diff --git a/tools/arch/x86/include/uapi/asm/vmx.h b/tools/arch/x86/include/uapi/asm/vmx.h
index 14458658e988..690a2dcf4078 100644
--- a/tools/arch/x86/include/uapi/asm/vmx.h
+++ b/tools/arch/x86/include/uapi/asm/vmx.h
@@ -76,7 +76,11 @@
 #define EXIT_REASON_WBINVD              54
 #define EXIT_REASON_XSETBV              55
 #define EXIT_REASON_APIC_WRITE          56
+#define EXIT_REASON_RDRAND              57
 #define EXIT_REASON_INVPCID             58
+#define EXIT_REASON_VMFUNC              59
+#define EXIT_REASON_ENCLS               60
+#define EXIT_REASON_RDSEED              61
 #define EXIT_REASON_PML_FULL            62
 #define EXIT_REASON_XSAVES              63
 #define EXIT_REASON_XRSTORS             64
@@ -90,6 +94,7 @@
         { EXIT_REASON_TASK_SWITCH,           "TASK_SWITCH" }, \
         { EXIT_REASON_CPUID,                 "CPUID" }, \
         { EXIT_REASON_HLT,                   "HLT" }, \
+        { EXIT_REASON_INVD,                  "INVD" }, \
         { EXIT_REASON_INVLPG,                "INVLPG" }, \
         { EXIT_REASON_RDPMC,                 "RDPMC" }, \
         { EXIT_REASON_RDTSC,                 "RDTSC" }, \
@@ -108,6 +113,8 @@
         { EXIT_REASON_IO_INSTRUCTION,        "IO_INSTRUCTION" }, \
         { EXIT_REASON_MSR_READ,              "MSR_READ" }, \
         { EXIT_REASON_MSR_WRITE,             "MSR_WRITE" }, \
+        { EXIT_REASON_INVALID_STATE,         "INVALID_STATE" }, \
+        { EXIT_REASON_MSR_LOAD_FAIL,         "MSR_LOAD_FAIL" }, \
         { EXIT_REASON_MWAIT_INSTRUCTION,     "MWAIT_INSTRUCTION" }, \
         { EXIT_REASON_MONITOR_TRAP_FLAG,     "MONITOR_TRAP_FLAG" }, \
         { EXIT_REASON_MONITOR_INSTRUCTION,   "MONITOR_INSTRUCTION" }, \
@@ -115,20 +122,24 @@
         { EXIT_REASON_MCE_DURING_VMENTRY,    "MCE_DURING_VMENTRY" }, \
         { EXIT_REASON_TPR_BELOW_THRESHOLD,   "TPR_BELOW_THRESHOLD" }, \
         { EXIT_REASON_APIC_ACCESS,           "APIC_ACCESS" }, \
-        { EXIT_REASON_GDTR_IDTR,             "GDTR_IDTR" }, \
-        { EXIT_REASON_LDTR_TR,               "LDTR_TR" }, \
+        { EXIT_REASON_EOI_INDUCED,           "EOI_INDUCED" }, \
+        { EXIT_REASON_GDTR_IDTR,             "GDTR_IDTR" }, \
+        { EXIT_REASON_LDTR_TR,               "LDTR_TR" }, \
         { EXIT_REASON_EPT_VIOLATION,         "EPT_VIOLATION" }, \
         { EXIT_REASON_EPT_MISCONFIG,         "EPT_MISCONFIG" }, \
         { EXIT_REASON_INVEPT,                "INVEPT" }, \
+        { EXIT_REASON_RDTSCP,                "RDTSCP" }, \
         { EXIT_REASON_PREEMPTION_TIMER,      "PREEMPTION_TIMER" }, \
+        { EXIT_REASON_INVVPID,               "INVVPID" }, \
         { EXIT_REASON_WBINVD,                "WBINVD" }, \
+        { EXIT_REASON_XSETBV,                "XSETBV" }, \
         { EXIT_REASON_APIC_WRITE,            "APIC_WRITE" }, \
-        { EXIT_REASON_EOI_INDUCED,           "EOI_INDUCED" }, \
-        { EXIT_REASON_INVALID_STATE,         "INVALID_STATE" }, \
-        { EXIT_REASON_MSR_LOAD_FAIL,         "MSR_LOAD_FAIL" }, \
-        { EXIT_REASON_INVD,                  "INVD" }, \
-        { EXIT_REASON_INVVPID,               "INVVPID" }, \
+        { EXIT_REASON_RDRAND,                "RDRAND" }, \
         { EXIT_REASON_INVPCID,               "INVPCID" }, \
+        { EXIT_REASON_VMFUNC,                "VMFUNC" }, \
+        { EXIT_REASON_ENCLS,                 "ENCLS" }, \
+        { EXIT_REASON_RDSEED,                "RDSEED" }, \
+        { EXIT_REASON_PML_FULL,              "PML_FULL" }, \
         { EXIT_REASON_XSAVES,                "XSAVES" }, \
         { EXIT_REASON_XRSTORS,               "XRSTORS" }
 
diff --git a/tools/build/feature/test-bpf.c b/tools/build/feature/test-bpf.c
index ebc6dceddb58..7598361ef1f1 100644
--- a/tools/build/feature/test-bpf.c
+++ b/tools/build/feature/test-bpf.c
@@ -29,6 +29,7 @@ int main(void)
         attr.log_size = 0;
         attr.log_level = 0;
         attr.kern_version = 0;
+        attr.prog_flags = 0;
 
         /*
          * Test existence of __NR_bpf and BPF_PROG_LOAD.
diff --git a/tools/include/linux/filter.h b/tools/include/linux/filter.h
index 390d7c9685fd..4ce25d43e8e3 100644
--- a/tools/include/linux/filter.h
+++ b/tools/include/linux/filter.h
@@ -208,6 +208,16 @@
                 .off   = OFF,                                   \
                 .imm   = IMM })
 
+/* Unconditional jumps, goto pc + off16 */
+
+#define BPF_JMP_A(OFF)                                          \
+        ((struct bpf_insn) {                                    \
+                .code  = BPF_JMP | BPF_JA,                      \
+                .dst_reg = 0,                                   \
+                .src_reg = 0,                                   \
+                .off   = OFF,                                   \
+                .imm   = 0 })
+
 /* Function call */
 
 #define BPF_EMIT_CALL(FUNC)                                     \
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index e553529929f6..94dfa9def355 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -132,6 +132,13 @@ enum bpf_attach_type {
  */
 #define BPF_F_ALLOW_OVERRIDE    (1U << 0)
 
+/* If BPF_F_STRICT_ALIGNMENT is used in BPF_PROG_LOAD command, the
+ * verifier will perform strict alignment checking as if the kernel
+ * has been built with CONFIG_EFFICIENT_UNALIGNED_ACCESS not set,
+ * and NET_IP_ALIGN defined to 2.
+ */
+#define BPF_F_STRICT_ALIGNMENT  (1U << 0)
+
 #define BPF_PSEUDO_MAP_FD       1
 
 /* flags for BPF_MAP_UPDATE_ELEM command */
@@ -177,6 +184,7 @@ union bpf_attr {
                 __u32           log_size;       /* size of user buffer */
                 __aligned_u64   log_buf;        /* user supplied buffer */
                 __u32           kern_version;   /* checked when prog_type=kprobe */
+                __u32           prog_flags;
         };
 
         struct { /* anonymous struct used by BPF_OBJ_* commands */
@@ -481,8 +489,7 @@ union bpf_attr {
  * u32 bpf_get_socket_uid(skb)
  *     Get the owner uid of the socket stored inside sk_buff.
  *     @skb: pointer to skb
- *     Return: uid of the socket owner on success or 0 if the socket pointer
- *     inside sk_buff is NULL
+ *     Return: uid of the socket owner on success or overflowuid if failed.
  */
 #define __BPF_FUNC_MAPPER(FN)           \
         FN(unspec),                     \
diff --git a/tools/include/uapi/linux/stat.h b/tools/include/uapi/linux/stat.h
index d538897b8e08..17b10304c393 100644
--- a/tools/include/uapi/linux/stat.h
+++ b/tools/include/uapi/linux/stat.h
@@ -48,17 +48,13 @@
  * tv_sec holds the number of seconds before (negative) or after (positive)
  * 00:00:00 1st January 1970 UTC.
  *
- * tv_nsec holds a number of nanoseconds before (0..-999,999,999 if tv_sec is
- * negative) or after (0..999,999,999 if tv_sec is positive) the tv_sec time.
- *
- * Note that if both tv_sec and tv_nsec are non-zero, then the two values must
- * either be both positive or both negative.
+ * tv_nsec holds a number of nanoseconds (0..999,999,999) after the tv_sec time.
  *
  * __reserved is held in case we need a yet finer resolution.
  */
 struct statx_timestamp {
         __s64   tv_sec;
-        __s32   tv_nsec;
+        __u32   tv_nsec;
         __s32   __reserved;
 };
 
diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c
index 4fe444b8092e..6e178987af8e 100644
--- a/tools/lib/bpf/bpf.c
+++ b/tools/lib/bpf/bpf.c
@@ -117,6 +117,28 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
         return sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
 }
 
+int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+                       size_t insns_cnt, int strict_alignment,
+                       const char *license, __u32 kern_version,
+                       char *log_buf, size_t log_buf_sz)
+{
+        union bpf_attr attr;
+
+        bzero(&attr, sizeof(attr));
+        attr.prog_type = type;
+        attr.insn_cnt = (__u32)insns_cnt;
+        attr.insns = ptr_to_u64(insns);
+        attr.license = ptr_to_u64(license);
+        attr.log_buf = ptr_to_u64(log_buf);
+        attr.log_size = log_buf_sz;
+        attr.log_level = 2;
+        log_buf[0] = 0;
+        attr.kern_version = kern_version;
+        attr.prog_flags = strict_alignment ? BPF_F_STRICT_ALIGNMENT : 0;
+
+        return sys_bpf(BPF_PROG_LOAD, &attr, sizeof(attr));
+}
+
 int bpf_map_update_elem(int fd, const void *key, const void *value,
                         __u64 flags)
 {
diff --git a/tools/lib/bpf/bpf.h b/tools/lib/bpf/bpf.h
index edb4daeff7a5..972bd8333eb7 100644
--- a/tools/lib/bpf/bpf.h
+++ b/tools/lib/bpf/bpf.h
@@ -35,6 +35,10 @@ int bpf_load_program(enum bpf_prog_type type, const struct bpf_insn *insns,
                      size_t insns_cnt, const char *license,
                      __u32 kern_version, char *log_buf,
                      size_t log_buf_sz);
+int bpf_verify_program(enum bpf_prog_type type, const struct bpf_insn *insns,
+                       size_t insns_cnt, int strict_alignment,
+                       const char *license, __u32 kern_version,
+                       char *log_buf, size_t log_buf_sz);
 
 int bpf_map_update_elem(int fd, const void *key, const void *value,
                         __u64 flags);
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index cb0eda3925e6..3517e204a2b3 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -311,6 +311,10 @@ include::itrace.txt[]
         Set the maximum number of program blocks to print with brstackasm for
         each sample.
 
+--inline::
+        If a callgraph address belongs to an inlined function, the inline stack
+        will be printed. Each entry has function name and file/line.
+
 SEE ALSO
 --------
 linkperf:perf-record[1], linkperf:perf-script-perl[1],
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index d05aec491cff..4761b0d7fcb5 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -2494,6 +2494,8 @@ int cmd_script(int argc, const char **argv)
                         "Enable kernel symbol demangling"),
         OPT_STRING(0, "time", &script.time_str, "str",
                    "Time span of interest (start,stop)"),
+        OPT_BOOLEAN(0, "inline", &symbol_conf.inline_name,
+                    "Show inline function"),
         OPT_END()
         };
         const char * const script_subcommands[] = { "record", "report", NULL };
diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 59addd52d9cd..ddb2c6fbdf91 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -210,6 +210,8 @@ static int __hpp__sort_acc(struct hist_entry *a, struct hist_entry *b,
                         return 0;
 
                 ret = b->callchain->max_depth - a->callchain->max_depth;
+                if (callchain_param.order == ORDER_CALLER)
+                        ret = -ret;
         }
         return ret;
 }
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 81fc29ac798f..b4204b43ed58 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -621,14 +621,19 @@ enum match_result {
 static enum match_result match_chain_srcline(struct callchain_cursor_node *node,
                                              struct callchain_list *cnode)
 {
-        char *left = get_srcline(cnode->ms.map->dso,
+        char *left = NULL;
+        char *right = NULL;
+        enum match_result ret = MATCH_EQ;
+        int cmp;
+
+        if (cnode->ms.map)
+                left = get_srcline(cnode->ms.map->dso,
                                  map__rip_2objdump(cnode->ms.map, cnode->ip),
                                  cnode->ms.sym, true, false);
-        char *right = get_srcline(node->map->dso,
+        if (node->map)
+                right = get_srcline(node->map->dso,
                                   map__rip_2objdump(node->map, node->ip),
                                   node->sym, true, false);
-        enum match_result ret = MATCH_EQ;
-        int cmp;
 
         if (left && right)
                 cmp = strcmp(left, right);
diff --git a/tools/perf/util/evsel_fprintf.c b/tools/perf/util/evsel_fprintf.c
index e415aee6a245..583f3a602506 100644
--- a/tools/perf/util/evsel_fprintf.c
+++ b/tools/perf/util/evsel_fprintf.c
@@ -7,6 +7,7 @@
 #include "map.h"
 #include "strlist.h"
 #include "symbol.h"
+#include "srcline.h"
 
 static int comma_fprintf(FILE *fp, bool *first, const char *fmt, ...)
 {
@@ -168,6 +169,38 @@ int sample__fprintf_callchain(struct perf_sample *sample, int left_alignment,
                         if (!print_oneline)
                                 printed += fprintf(fp, "\n");
 
+                        if (symbol_conf.inline_name && node->map) {
+                                struct inline_node *inode;
+
+                                addr = map__rip_2objdump(node->map, node->ip),
+                                inode = dso__parse_addr_inlines(node->map->dso, addr);
+
+                                if (inode) {
+                                        struct inline_list *ilist;
+
+                                        list_for_each_entry(ilist, &inode->val, list) {
+                                                if (print_arrow)
+                                                        printed += fprintf(fp, " <-");
+
+                                                /* IP is same, just skip it */
+                                                if (print_ip)
+                                                        printed += fprintf(fp, "%c%16s",
+                                                                           s, "");
+                                                if (print_sym)
+                                                        printed += fprintf(fp, " %s",
+                                                                           ilist->funcname);
+                                                if (print_srcline)
+                                                        printed += fprintf(fp, "\n  %s:%d",
+                                                                           ilist->filename,
+                                                                           ilist->line_nr);
+                                                if (!print_oneline)
+                                                        printed += fprintf(fp, "\n");
+                                        }
+
+                                        inline_node__delete(inode);
+                                }
+                        }
+
                         if (symbol_conf.bt_stop_list &&
                             node->sym &&
                             strlist__has_entry(symbol_conf.bt_stop_list,
diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index df051a52393c..ebc88a74e67b 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -56,7 +56,10 @@ static int inline_list__append(char *filename, char *funcname, int line_nr,
                 }
         }
 
-        list_add_tail(&ilist->list, &node->val);
+        if (callchain_param.order == ORDER_CALLEE)
+                list_add_tail(&ilist->list, &node->val);
+        else
+                list_add(&ilist->list, &node->val);
 
         return 0;
 }
@@ -200,12 +203,14 @@ static void addr2line_cleanup(struct a2l_data *a2l)
 
 #define MAX_INLINE_NEST 1024
 
-static void inline_list__reverse(struct inline_node *node)
+static int inline_list__append_dso_a2l(struct dso *dso,
+                                       struct inline_node *node)
 {
-        struct inline_list *ilist, *n;
+        struct a2l_data *a2l = dso->a2l;
+        char *funcname = a2l->funcname ? strdup(a2l->funcname) : NULL;
+        char *filename = a2l->filename ? strdup(a2l->filename) : NULL;
 
-        list_for_each_entry_safe_reverse(ilist, n, &node->val, list)
-                list_move_tail(&ilist->list, &node->val);
+        return inline_list__append(filename, funcname, a2l->line, node, dso);
 }
 
 static int addr2line(const char *dso_name, u64 addr,
@@ -230,36 +235,36 @@ static int addr2line(const char *dso_name, u64 addr,
 
         bfd_map_over_sections(a2l->abfd, find_address_in_section, a2l);
 
-        if (a2l->found && unwind_inlines) {
+        if (!a2l->found)
+                return 0;
+
+        if (unwind_inlines) {
                 int cnt = 0;
 
+                if (node && inline_list__append_dso_a2l(dso, node))
+                        return 0;
+
                 while (bfd_find_inliner_info(a2l->abfd, &a2l->filename,
                                              &a2l->funcname, &a2l->line) &&
                        cnt++ < MAX_INLINE_NEST) {
 
                         if (node != NULL) {
-                                if (inline_list__append(strdup(a2l->filename),
-                                                        strdup(a2l->funcname),
-                                                        a2l->line, node,
-                                                        dso) != 0)
+                                if (inline_list__append_dso_a2l(dso, node))
                                         return 0;
+                                // found at least one inline frame
+                                ret = 1;
                         }
                 }
+        }
 
-                if ((node != NULL) &&
-                    (callchain_param.order != ORDER_CALLEE)) {
-                        inline_list__reverse(node);
-                }
+        if (file) {
+                *file = a2l->filename ? strdup(a2l->filename) : NULL;
+                ret = *file ? 1 : 0;
         }
 
-        if (a2l->found && a2l->filename) {
-                *file = strdup(a2l->filename);
+        if (line)
                 *line = a2l->line;
 
-                if (*file)
-                        ret = 1;
-        }
-
         return ret;
 }
 
@@ -278,8 +283,6 @@ void dso__free_a2l(struct dso *dso)
 static struct inline_node *addr2inlines(const char *dso_name, u64 addr,
         struct dso *dso)
 {
-        char *file = NULL;
-        unsigned int line = 0;
         struct inline_node *node;
 
         node = zalloc(sizeof(*node));
@@ -291,7 +294,7 @@ static struct inline_node *addr2inlines(const char *dso_name, u64 addr,
         INIT_LIST_HEAD(&node->val);
         node->addr = addr;
 
-        if (!addr2line(dso_name, addr, &file, &line, dso, TRUE, node))
+        if (!addr2line(dso_name, addr, NULL, NULL, dso, TRUE, node))
                 goto out_free_inline_node;
 
         if (list_empty(&node->val))
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index f90e11a555b2..943a06291587 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -168,12 +168,16 @@ frame_callback(Dwfl_Frame *state, void *arg)
 {
         struct unwind_info *ui = arg;
         Dwarf_Addr pc;
+        bool isactivation;
 
-        if (!dwfl_frame_pc(state, &pc, NULL)) {
+        if (!dwfl_frame_pc(state, &pc, &isactivation)) {
                 pr_err("%s", dwfl_errmsg(-1));
                 return DWARF_CB_ABORT;
         }
 
+        if (!isactivation)
+                --pc;
+
         return entry(pc, ui) || !(--ui->max_stack) ?
                DWARF_CB_ABORT : DWARF_CB_OK;
 }
diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
index f8455bed6e65..672c2ada9357 100644
--- a/tools/perf/util/unwind-libunwind-local.c
+++ b/tools/perf/util/unwind-libunwind-local.c
@@ -692,6 +692,17 @@ static int get_entries(struct unwind_info *ui, unwind_entry_cb_t cb,
 
                 while (!ret && (unw_step(&c) > 0) && i < max_stack) {
                         unw_get_reg(&c, UNW_REG_IP, &ips[i]);
+
+                        /*
+                         * Decrement the IP for any non-activation frames.
+                         * this is required to properly find the srcline
+                         * for caller frames.
+                         * See also the documentation for dwfl_frame_pc(),
+                         * which this code tries to replicate.
+                         */
+                        if (unw_is_signal_frame(&c) <= 0)
+                                --ips[i];
+
                         ++i;
                 }
 
diff --git a/tools/power/acpi/.gitignore b/tools/power/acpi/.gitignore
new file mode 100644
index 000000000000..cba3d994995c
--- /dev/null
+++ b/tools/power/acpi/.gitignore
@@ -0,0 +1,4 @@
+acpidbg
+acpidump
+ec
+include
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 91edd0566237..f389b02d43a0 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -11,7 +11,8 @@ endif
 CFLAGS += -Wall -O2 -I$(APIDIR) -I$(LIBDIR) -I$(GENDIR) $(GENFLAGS) -I../../../include
 LDLIBS += -lcap -lelf
 
-TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test_progs
+TEST_GEN_PROGS = test_verifier test_tag test_maps test_lru_map test_lpm_map test_progs \
+        test_align
 
 TEST_GEN_FILES = test_pkt_access.o test_xdp.o test_l4lb.o test_tcp_estats.o
 
@@ -34,6 +35,7 @@ $(BPFOBJ): force
 CLANG ?= clang
 
 %.o: %.c
-        $(CLANG) -I. -I../../../include/uapi -I../../../../samples/bpf/ \
+        $(CLANG) -I. -I./include/uapi -I../../../include/uapi \
+                -I../../../../samples/bpf/ \
                 -Wno-compare-distinct-pointer-types \
                 -O2 -target bpf -c $< -o $@
diff --git a/tools/testing/selftests/bpf/include/uapi/linux/types.h b/tools/testing/selftests/bpf/include/uapi/linux/types.h
new file mode 100644
index 000000000000..51841848fbfe
--- /dev/null
+++ b/tools/testing/selftests/bpf/include/uapi/linux/types.h
@@ -0,0 +1,22 @@
+#ifndef _UAPI_LINUX_TYPES_H
+#define _UAPI_LINUX_TYPES_H
+
+#include <asm-generic/int-ll64.h>
+
+/* copied from linux:include/uapi/linux/types.h */
+#define __bitwise
+typedef __u16 __bitwise __le16;
+typedef __u16 __bitwise __be16;
+typedef __u32 __bitwise __le32;
+typedef __u32 __bitwise __be32;
+typedef __u64 __bitwise __le64;
+typedef __u64 __bitwise __be64;
+
+typedef __u16 __bitwise __sum16;
+typedef __u32 __bitwise __wsum;
+
+#define __aligned_u64 __u64 __attribute__((aligned(8)))
+#define __aligned_be64 __be64 __attribute__((aligned(8)))
+#define __aligned_le64 __le64 __attribute__((aligned(8)))
+
+#endif /* _UAPI_LINUX_TYPES_H */
diff --git a/tools/testing/selftests/bpf/test_align.c b/tools/testing/selftests/bpf/test_align.c
new file mode 100644
index 000000000000..9644d4e069de
--- /dev/null
+++ b/tools/testing/selftests/bpf/test_align.c
@@ -0,0 +1,453 @@
+#include <asm/types.h>
+#include <linux/types.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <errno.h>
+#include <string.h>
+#include <stddef.h>
+#include <stdbool.h>
+
+#include <linux/unistd.h>
+#include <linux/filter.h>
+#include <linux/bpf_perf_event.h>
+#include <linux/bpf.h>
+
+#include <bpf/bpf.h>
+
+#include "../../../include/linux/filter.h"
+
+#ifndef ARRAY_SIZE
+# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+#endif
+
+#define MAX_INSNS       512
+#define MAX_MATCHES     16
+
+struct bpf_align_test {
+        const char *descr;
+        struct bpf_insn insns[MAX_INSNS];
+        enum {
+                UNDEF,
+                ACCEPT,
+                REJECT
+        } result;
+        enum bpf_prog_type prog_type;
+        const char *matches[MAX_MATCHES];
+};
+
+static struct bpf_align_test tests[] = {
+        {
+                .descr = "mov",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 2),
+                        BPF_MOV64_IMM(BPF_REG_3, 4),
+                        BPF_MOV64_IMM(BPF_REG_3, 8),
+                        BPF_MOV64_IMM(BPF_REG_3, 16),
+                        BPF_MOV64_IMM(BPF_REG_3, 32),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm2,min_value=2,max_value=2,min_align=2 R10=fp",
+                        "2: R1=ctx R3=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "3: R1=ctx R3=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "4: R1=ctx R3=imm16,min_value=16,max_value=16,min_align=16 R10=fp",
+                        "5: R1=ctx R3=imm32,min_value=32,max_value=32,min_align=32 R10=fp",
+                },
+        },
+        {
+                .descr = "shift",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_3, 4),
+                        BPF_MOV64_IMM(BPF_REG_4, 32),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R10=fp",
+                        "2: R1=ctx R3=imm2,min_value=2,max_value=2,min_align=2 R10=fp",
+                        "3: R1=ctx R3=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "4: R1=ctx R3=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "5: R1=ctx R3=imm16,min_value=16,max_value=16,min_align=16 R10=fp",
+                        "6: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R10=fp",
+                        "7: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm32,min_value=32,max_value=32,min_align=32 R10=fp",
+                        "8: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm16,min_value=16,max_value=16,min_align=16 R10=fp",
+                        "9: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "10: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "11: R1=ctx R3=imm1,min_value=1,max_value=1,min_align=1 R4=imm2,min_value=2,max_value=2,min_align=2 R10=fp",
+                },
+        },
+        {
+                .descr = "addsub",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_3, 2),
+                        BPF_MOV64_IMM(BPF_REG_4, 8),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm4,min_value=4,max_value=4,min_align=4 R10=fp",
+                        "2: R1=ctx R3=imm8,min_value=8,max_value=8,min_align=4 R10=fp",
+                        "3: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R10=fp",
+                        "4: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R4=imm8,min_value=8,max_value=8,min_align=8 R10=fp",
+                        "5: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R4=imm12,min_value=12,max_value=12,min_align=4 R10=fp",
+                        "6: R1=ctx R3=imm10,min_value=10,max_value=10,min_align=2 R4=imm14,min_value=14,max_value=14,min_align=2 R10=fp",
+                },
+        },
+        {
+                .descr = "mul",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_3, 7),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, 2),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_3, 4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "1: R1=ctx R3=imm7,min_value=7,max_value=7,min_align=1 R10=fp",
+                        "2: R1=ctx R3=imm7,min_value=7,max_value=7,min_align=1 R10=fp",
+                        "3: R1=ctx R3=imm14,min_value=14,max_value=14,min_align=2 R10=fp",
+                        "4: R1=ctx R3=imm56,min_value=56,max_value=56,min_align=4 R10=fp",
+                },
+        },
+
+#define PREP_PKT_POINTERS \
+        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, \
+                    offsetof(struct __sk_buff, data)), \
+        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, \
+                    offsetof(struct __sk_buff, data_end))
+
+#define LOAD_UNKNOWN(DST_REG) \
+        PREP_PKT_POINTERS, \
+        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2), \
+        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 8), \
+        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_0, 1), \
+        BPF_EXIT_INSN(), \
+        BPF_LDX_MEM(BPF_B, DST_REG, BPF_REG_2, 0)
+
+        {
+                .descr = "unknown shift",
+                .insns = {
+                        LOAD_UNKNOWN(BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_3, 1),
+                        LOAD_UNKNOWN(BPF_REG_4),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 5),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_ALU64_IMM(BPF_RSH, BPF_REG_4, 1),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "7: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R10=fp",
+                        "8: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv55,min_align=2 R10=fp",
+                        "9: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv54,min_align=4 R10=fp",
+                        "10: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv53,min_align=8 R10=fp",
+                        "11: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv52,min_align=16 R10=fp",
+                        "18: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv56 R10=fp",
+                        "19: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv51,min_align=32 R10=fp",
+                        "20: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv52,min_align=16 R10=fp",
+                        "21: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv53,min_align=8 R10=fp",
+                        "22: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv54,min_align=4 R10=fp",
+                        "23: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv55,min_align=2 R10=fp",
+                },
+        },
+        {
+                .descr = "unknown mul",
+                .insns = {
+                        LOAD_UNKNOWN(BPF_REG_3),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 1),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 2),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 4),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_3),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 8),
+                        BPF_ALU64_IMM(BPF_MUL, BPF_REG_4, 2),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "7: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R10=fp",
+                        "8: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "9: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv55,min_align=1 R10=fp",
+                        "10: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "11: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv54,min_align=2 R10=fp",
+                        "12: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "13: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv53,min_align=4 R10=fp",
+                        "14: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv56 R10=fp",
+                        "15: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv52,min_align=8 R10=fp",
+                        "16: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=inv56 R4=inv50,min_align=8 R10=fp"
+                },
+        },
+        {
+                .descr = "packet const offset",
+                .insns = {
+                        PREP_PKT_POINTERS,
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+
+                        /* Skip over ethernet header.  */
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 0),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 1),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 2),
+                        BPF_LDX_MEM(BPF_B, BPF_REG_4, BPF_REG_5, 3),
+                        BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_5, 0),
+                        BPF_LDX_MEM(BPF_H, BPF_REG_4, BPF_REG_5, 2),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        "4: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R5=pkt(id=0,off=0,r=0) R10=fp",
+                        "5: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R5=pkt(id=0,off=14,r=0) R10=fp",
+                        "6: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=0) R3=pkt_end R4=pkt(id=0,off=14,r=0) R5=pkt(id=0,off=14,r=0) R10=fp",
+                        "10: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=18) R3=pkt_end R4=inv56 R5=pkt(id=0,off=14,r=18) R10=fp",
+                        "14: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=18) R3=pkt_end R4=inv48 R5=pkt(id=0,off=14,r=18) R10=fp",
+                        "15: R0=imm0,min_value=0,max_value=0,min_align=2147483648 R1=ctx R2=pkt(id=0,off=0,r=18) R3=pkt_end R4=inv48 R5=pkt(id=0,off=14,r=18) R10=fp",
+                },
+        },
+        {
+                .descr = "packet variable offset",
+                .insns = {
+                        LOAD_UNKNOWN(BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_6, 2),
+
+                        /* First, add a constant to the R5 packet pointer,
+                         * then a variable with a known alignment.
+                         */
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        /* Now, test in the other direction.  Adding first
+                         * the variable offset to R5, then the constant.
+                         */
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        /* Test multiple accumulations of unknown values
+                         * into a packet pointer.
+                         */
+                        BPF_MOV64_REG(BPF_REG_5, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 14),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_5, 4),
+                        BPF_ALU64_REG(BPF_ADD, BPF_REG_5, BPF_REG_6),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_5),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 4),
+                        BPF_JMP_REG(BPF_JGE, BPF_REG_3, BPF_REG_4, 1),
+                        BPF_EXIT_INSN(),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_4, BPF_REG_5, 0),
+
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .matches = {
+                        /* Calculated offset in R6 has unknown value, but known
+                         * alignment of 4.
+                         */
+                        "8: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R6=inv54,min_align=4 R10=fp",
+
+                        /* Offset is added to packet pointer R5, resulting in known
+                         * auxiliary alignment and offset.
+                         */
+                        "11: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R5=pkt(id=1,off=0,r=0),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* At the time the word size load is performed from R5,
+                         * it's total offset is NET_IP_ALIGN + reg->off (0) +
+                         * reg->aux_off (14) which is 16.  Then the variable
+                         * offset is considered using reg->aux_off_align which
+                         * is 4 and meets the load's requirements.
+                         */
+                        "15: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=pkt(id=1,off=4,r=4),aux_off=14,aux_off_align=4 R5=pkt(id=1,off=0,r=4),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+
+                        /* Variable offset is added to R5 packet pointer,
+                         * resulting in auxiliary alignment of 4.
+                         */
+                        "18: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off=14,aux_off_align=4 R5=pkt(id=2,off=0,r=0),aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* Constant offset is added to R5, resulting in
+                         * reg->off of 14.
+                         */
+                        "19: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off=14,aux_off_align=4 R5=pkt(id=2,off=14,r=0),aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* At the time the word size load is performed from R5,
+                         * it's total offset is NET_IP_ALIGN + reg->off (14) which
+                         * is 16.  Then the variable offset is considered using
+                         * reg->aux_off_align which is 4 and meets the load's
+                         * requirements.
+                         */
+                        "23: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=pkt(id=2,off=18,r=18),aux_off_align=4 R5=pkt(id=2,off=14,r=18),aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+
+                        /* Constant offset is added to R5 packet pointer,
+                         * resulting in reg->off value of 14.
+                         */
+                        "26: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=0,off=14,r=8) R6=inv54,min_align=4 R10=fp",
+                        /* Variable offset is added to R5, resulting in an
+                         * auxiliary offset of 14, and an auxiliary alignment of 4.
+                         */
+                        "27: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=3,off=0,r=0),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                        /* Constant is added to R5 again, setting reg->off to 4. */
+                        "28: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=3,off=4,r=0),aux_off=14,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                        /* And once more we add a variable, which causes an accumulation
+                         * of reg->off into reg->aux_off_align, with resulting value of
+                         * 18.  The auxiliary alignment stays at 4.
+                         */
+                        "29: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=inv,aux_off_align=4 R5=pkt(id=4,off=0,r=0),aux_off=18,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                        /* At the time the word size load is performed from R5,
+                         * it's total offset is NET_IP_ALIGN + reg->off (0) +
+                         * reg->aux_off (18) which is 20.  Then the variable offset
+                         * is considered using reg->aux_off_align which is 4 and meets
+                         * the load's requirements.
+                         */
+                        "33: R0=pkt(id=0,off=8,r=8) R1=ctx R2=pkt(id=0,off=0,r=8) R3=pkt_end R4=pkt(id=4,off=4,r=4),aux_off=18,aux_off_align=4 R5=pkt(id=4,off=0,r=4),aux_off=18,aux_off_align=4 R6=inv54,min_align=4 R10=fp",
+                },
+        },
+};
+
+static int probe_filter_length(const struct bpf_insn *fp)
+{
+        int len;
+
+        for (len = MAX_INSNS - 1; len > 0; --len)
+                if (fp[len].code != 0 || fp[len].imm != 0)
+                        break;
+        return len + 1;
+}
+
+static char bpf_vlog[32768];
+
+static int do_test_single(struct bpf_align_test *test)
+{
+        struct bpf_insn *prog = test->insns;
+        int prog_type = test->prog_type;
+        int prog_len, i;
+        int fd_prog;
+        int ret;
+
+        prog_len = probe_filter_length(prog);
+        fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+                                     prog, prog_len, 1, "GPL", 0,
+                                     bpf_vlog, sizeof(bpf_vlog));
+        if (fd_prog < 0) {
+                printf("Failed to load program.\n");
+                printf("%s", bpf_vlog);
+                ret = 1;
+        } else {
+                ret = 0;
+                for (i = 0; i < MAX_MATCHES; i++) {
+                        const char *t, *m = test->matches[i];
+
+                        if (!m)
+                                break;
+                        t = strstr(bpf_vlog, m);
+                        if (!t) {
+                                printf("Failed to find match: %s\n", m);
+                                ret = 1;
+                                printf("%s", bpf_vlog);
+                                break;
+                        }
+                }
+                close(fd_prog);
+        }
+        return ret;
+}
+
+static int do_test(unsigned int from, unsigned int to)
+{
+        int all_pass = 0;
+        int all_fail = 0;
+        unsigned int i;
+
+        for (i = from; i < to; i++) {
+                struct bpf_align_test *test = &tests[i];
+                int fail;
+
+                printf("Test %3d: %s ... ",
+                       i, test->descr);
+                fail = do_test_single(test);
+                if (fail) {
+                        all_fail++;
+                        printf("FAIL\n");
+                } else {
+                        all_pass++;
+                        printf("PASS\n");
+                }
+        }
+        printf("Results: %d pass %d fail\n",
+               all_pass, all_fail);
+        return 0;
+}
+
+int main(int argc, char **argv)
+{
+        unsigned int from = 0, to = ARRAY_SIZE(tests);
+
+        if (argc == 3) {
+                unsigned int l = atoi(argv[argc - 2]);
+                unsigned int u = atoi(argv[argc - 1]);
+
+                if (l < to && u < to) {
+                        from = l;
+                        to   = u + 1;
+                }
+        } else if (argc == 2) {
+                unsigned int t = atoi(argv[argc - 1]);
+
+                if (t < to) {
+                        from = t;
+                        to   = t + 1;
+                }
+        }
+        return do_test(from, to);
+}
diff --git a/tools/testing/selftests/bpf/test_pkt_access.c b/tools/testing/selftests/bpf/test_pkt_access.c
index 39387bb7e08c..6e11ba11709e 100644
--- a/tools/testing/selftests/bpf/test_pkt_access.c
+++ b/tools/testing/selftests/bpf/test_pkt_access.c
@@ -5,6 +5,7 @@
  * License as published by the Free Software Foundation.
  */
 #include <stddef.h>
+#include <string.h>
 #include <linux/bpf.h>
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 3773562056da..cabb19b1e371 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -49,6 +49,7 @@
 #define MAX_NR_MAPS     4
 
 #define F_NEEDS_EFFICIENT_UNALIGNED_ACCESS      (1 << 0)
+#define F_LOAD_WITH_STRICT_ALIGNMENT            (1 << 1)
 
 struct bpf_test {
         const char *descr;
@@ -2615,6 +2616,30 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS,
         },
         {
+                "direct packet access: test17 (pruning, alignment)",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+                                    offsetof(struct __sk_buff, data_end)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 14),
+                        BPF_JMP_IMM(BPF_JGT, BPF_REG_7, 1, 4),
+                        BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 1),
+                        BPF_STX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, -4),
+                        BPF_MOV64_IMM(BPF_REG_0, 0),
+                        BPF_EXIT_INSN(),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 1),
+                        BPF_JMP_A(-6),
+                },
+                .errstr = "misaligned packet access off 2+15+-4 size 4",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+                .flags = F_LOAD_WITH_STRICT_ALIGNMENT,
+        },
+        {
                 "helper access to packet: test1, valid packet_ptr range",
                 .insns = {
                         BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
@@ -3341,6 +3366,70 @@ static struct bpf_test tests[] = {
                 .prog_type = BPF_PROG_TYPE_SCHED_CLS
         },
         {
+                "alu ops on ptr_to_map_value_or_null, 1",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, -2),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_4, 2),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
+                "alu ops on ptr_to_map_value_or_null, 2",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_AND, BPF_REG_4, -1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
+                "alu ops on ptr_to_map_value_or_null, 3",
+                .insns = {
+                        BPF_MOV64_IMM(BPF_REG_1, 10),
+                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                        BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+                        BPF_LD_MAP_FD(BPF_REG_1, 0),
+                        BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
+                                     BPF_FUNC_map_lookup_elem),
+                        BPF_MOV64_REG(BPF_REG_4, BPF_REG_0),
+                        BPF_ALU64_IMM(BPF_LSH, BPF_REG_4, 1),
+                        BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 1),
+                        BPF_ST_MEM(BPF_DW, BPF_REG_4, 0, 0),
+                        BPF_EXIT_INSN(),
+                },
+                .fixup_map1 = { 4 },
+                .errstr = "R4 invalid mem access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS
+        },
+        {
                 "invalid memory access with multiple map_lookup_elem calls",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_1, 10),
@@ -4937,7 +5026,149 @@ static struct bpf_test tests[] = {
                 .fixup_map_in_map = { 3 },
                 .errstr = "R1 type=map_value_or_null expected=map_ptr",
                 .result = REJECT,
-        }
+        },
+        {
+                "ld_abs: check calling conv, r1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_1, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_3, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R3 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_4, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R4 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_5, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R5 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_abs: check calling conv, r7",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_7, 0),
+                        BPF_LD_ABS(BPF_W, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "ld_ind: check calling conv, r1",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_1, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_1, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R1 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r2",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_2, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_2, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R2 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r3",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_3, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_3, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_3),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R3 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r4",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_4, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_4, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_4),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R4 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r5",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_5, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_5, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_5),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "R5 !read_ok",
+                .result = REJECT,
+        },
+        {
+                "ld_ind: check calling conv, r7",
+                .insns = {
+                        BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
+                        BPF_MOV64_IMM(BPF_REG_7, 1),
+                        BPF_LD_IND(BPF_W, BPF_REG_7, -0x200000),
+                        BPF_MOV64_REG(BPF_REG_0, BPF_REG_7),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)
@@ -5059,9 +5290,9 @@ static void do_test_single(struct bpf_test *test, bool unpriv,
 
         do_test_fixup(test, prog, map_fds);
 
-        fd_prog = bpf_load_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
-                                   prog, prog_len, "GPL", 0, bpf_vlog,
-                                   sizeof(bpf_vlog));
+        fd_prog = bpf_verify_program(prog_type ? : BPF_PROG_TYPE_SOCKET_FILTER,
+                                     prog, prog_len, test->flags & F_LOAD_WITH_STRICT_ALIGNMENT,
+                                     "GPL", 0, bpf_vlog, sizeof(bpf_vlog));
 
         expected_ret = unpriv && test->result_unpriv != UNDEF ?
                        test->result_unpriv : test->result;
diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest
index 32e6211e1c6e..717581145cfc 100755
--- a/tools/testing/selftests/ftrace/ftracetest
+++ b/tools/testing/selftests/ftrace/ftracetest
@@ -58,7 +58,7 @@ parse_opts() { # opts
     ;;
     --verbose|-v|-vv)
       VERBOSE=$((VERBOSE + 1))
-      [ $1 == '-vv' ] && VERBOSE=$((VERBOSE + 1))
+      [ $1 = '-vv' ] && VERBOSE=$((VERBOSE + 1))
       shift 1
     ;;
     --debug|-d)
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
index 07bb3e5930b4..aa31368851c9 100644
--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
@@ -48,7 +48,7 @@ test_event_enabled() {
     e=`cat $EVENT_ENABLE`
     if [ "$e" != $val ]; then
         echo "Expected $val but found $e"
-        exit -1
+        exit 1
     fi
 }
 
diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions
index 9aec6fcb7729..f2019b37370d 100644
--- a/tools/testing/selftests/ftrace/test.d/functions
+++ b/tools/testing/selftests/ftrace/test.d/functions
@@ -34,10 +34,10 @@ reset_ftrace_filter() { # reset all triggers in set_ftrace_filter
     echo > set_ftrace_filter
     grep -v '^#' set_ftrace_filter | while read t; do
         tr=`echo $t | cut -d: -f2`
-        if [ "$tr" == "" ]; then
+        if [ "$tr" = "" ]; then
             continue
         fi
-        if [ $tr == "enable_event" -o $tr == "disable_event" ]; then
+        if [ $tr = "enable_event" -o $tr = "disable_event" ]; then
             tr=`echo $t | cut -d: -f1-4`
             limit=`echo $t | cut -d: -f5`
         else
diff --git a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
index 4c5a061a5b4e..c73db7863adb 100644
--- a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+++ b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
@@ -75,9 +75,13 @@ rmdir foo
 if [ -d foo ]; then
         fail "foo still exists"
 fi
-exit 0
-
 
+mkdir foo
+echo "schedule:enable_event:sched:sched_switch" > foo/set_ftrace_filter
+rmdir foo
+if [ -d foo ]; then
+        fail "foo still exists"
+fi
 
 
 instance_slam() {
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
new file mode 100644
index 000000000000..f4d1ff785d67
--- /dev/null
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc
@@ -0,0 +1,21 @@
+#!/bin/sh
+# description: Register/unregister many kprobe events
+
+# ftrace fentry skip size depends on the machine architecture.
+# Currently HAVE_KPROBES_ON_FTRACE defined on x86 and powerpc
+case `uname -m` in
+  x86_64|i[3456]86) OFFS=5;;
+  ppc*) OFFS=4;;
+  *) OFFS=0;;
+esac
+
+echo "Setup up to 256 kprobes"
+grep t /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \
+head -n 256 | while read i; do echo p ${i}+${OFFS} ; done > kprobe_events ||:
+
+echo 1 > events/kprobes/enable
+echo 0 > events/kprobes/enable
+echo > kprobe_events
+echo "Waiting for unoptimizing & freeing"
+sleep 5
+echo "Done"
diff --git a/tools/testing/selftests/powerpc/tm/.gitignore b/tools/testing/selftests/powerpc/tm/.gitignore
index 427621792229..2f1f7b013293 100644
--- a/tools/testing/selftests/powerpc/tm/.gitignore
+++ b/tools/testing/selftests/powerpc/tm/.gitignore
@@ -11,3 +11,4 @@ tm-signal-context-chk-fpu
 tm-signal-context-chk-gpr
 tm-signal-context-chk-vmx
 tm-signal-context-chk-vsx
+tm-vmx-unavail
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index 5576ee6a51f2..958c11c14acd 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -2,7 +2,8 @@ SIGNAL_CONTEXT_CHK_TESTS := tm-signal-context-chk-gpr tm-signal-context-chk-fpu
         tm-signal-context-chk-vmx tm-signal-context-chk-vsx
 
 TEST_GEN_PROGS := tm-resched-dscr tm-syscall tm-signal-msr-resv tm-signal-stack \
-        tm-vmxcopy tm-fork tm-tar tm-tmspr $(SIGNAL_CONTEXT_CHK_TESTS)
+        tm-vmxcopy tm-fork tm-tar tm-tmspr tm-vmx-unavail \
+        $(SIGNAL_CONTEXT_CHK_TESTS)
 
 include ../../lib.mk
 
@@ -13,6 +14,7 @@ CFLAGS += -mhtm
 $(OUTPUT)/tm-syscall: tm-syscall-asm.S
 $(OUTPUT)/tm-syscall: CFLAGS += -I../../../../../usr/include
 $(OUTPUT)/tm-tmspr: CFLAGS += -pthread
+$(OUTPUT)/tm-vmx-unavail: CFLAGS += -pthread -m64
 
 SIGNAL_CONTEXT_CHK_TESTS := $(patsubst %,$(OUTPUT)/%,$(SIGNAL_CONTEXT_CHK_TESTS))
 $(SIGNAL_CONTEXT_CHK_TESTS): tm-signal.S
diff --git a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
index d9c49f41515e..e79ccd6aada1 100644
--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
@@ -42,12 +42,12 @@ int test_body(void)
         printf("Check DSCR TM context switch: ");
         fflush(stdout);
         for (;;) {
-                rv = 1;
                 asm __volatile__ (
                         /* set a known value into the DSCR */
                         "ld      3, %[dscr1];"
                         "mtspr   %[sprn_dscr], 3;"
 
+                        "li      %[rv], 1;"
                         /* start and suspend a transaction */
                         "tbegin.;"
                         "beq     1f;"
diff --git a/tools/testing/selftests/powerpc/tm/tm-vmx-unavail.c b/tools/testing/selftests/powerpc/tm/tm-vmx-unavail.c
new file mode 100644
index 000000000000..137185ba4937
--- /dev/null
+++ b/tools/testing/selftests/powerpc/tm/tm-vmx-unavail.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2017, Michael Neuling, IBM Corp.
+ * Licensed under GPLv2.
+ * Original: Breno Leitao <brenohl@br.ibm.com> &
+ *           Gustavo Bueno Romero <gromero@br.ibm.com>
+ * Edited: Michael Neuling
+ *
+ * Force VMX unavailable during a transaction and see if it corrupts
+ * the checkpointed VMX register state after the abort.
+ */
+
+#include <inttypes.h>
+#include <htmintrin.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <pthread.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#include <pthread.h>
+
+#include "tm.h"
+#include "utils.h"
+
+int passed;
+
+void *worker(void *unused)
+{
+        __int128 vmx0;
+        uint64_t texasr;
+
+        asm goto (
+                "li       3, 1;"  /* Stick non-zero value in VMX0 */
+                "std      3, 0(%[vmx0_ptr]);"
+                "lvx      0, 0, %[vmx0_ptr];"
+
+                /* Wait here a bit so we get scheduled out 255 times */
+                "lis      3, 0x3fff;"
+                "1: ;"
+                "addi     3, 3, -1;"
+                "cmpdi    3, 0;"
+                "bne      1b;"
+
+                /* Kernel will hopefully turn VMX off now */
+
+                "tbegin. ;"
+                "beq      failure;"
+
+                /* Cause VMX unavail. Any VMX instruction */
+                "vaddcuw  0,0,0;"
+
+                "tend. ;"
+                "b        %l[success];"
+
+                /* Check VMX0 sanity after abort */
+                "failure: ;"
+                "lvx       1,  0, %[vmx0_ptr];"
+                "vcmpequb. 2,  0, 1;"
+                "bc        4, 24, %l[value_mismatch];"
+                "b        %l[value_match];"
+                :
+                : [vmx0_ptr] "r"(&vmx0)
+                : "r3"
+                : success, value_match, value_mismatch
+                );
+
+        /* HTM aborted and VMX0 is corrupted */
+value_mismatch:
+        texasr = __builtin_get_texasr();
+
+        printf("\n\n==============\n\n");
+        printf("Failure with error: %lx\n",   _TEXASR_FAILURE_CODE(texasr));
+        printf("Summary error     : %lx\n",   _TEXASR_FAILURE_SUMMARY(texasr));
+        printf("TFIAR exact       : %lx\n\n", _TEXASR_TFIAR_EXACT(texasr));
+
+        passed = 0;
+        return NULL;
+
+        /* HTM aborted but VMX0 is correct */
+value_match:
+//      printf("!");
+        return NULL;
+
+success:
+//      printf(".");
+        return NULL;
+}
+
+int tm_vmx_unavail_test()
+{
+        int threads;
+        pthread_t *thread;
+
+        SKIP_IF(!have_htm());
+
+        passed = 1;
+
+        threads = sysconf(_SC_NPROCESSORS_ONLN) * 4;
+        thread = malloc(sizeof(pthread_t)*threads);
+        if (!thread)
+                return EXIT_FAILURE;
+
+        for (uint64_t i = 0; i < threads; i++)
+                pthread_create(&thread[i], NULL, &worker, NULL);
+
+        for (uint64_t i = 0; i < threads; i++)
+                pthread_join(thread[i], NULL);
+
+        free(thread);
+
+        return passed ? EXIT_SUCCESS : EXIT_FAILURE;
+}
+
+
+int main(int argc, char **argv)
+{
+        return test_harness(tm_vmx_unavail_test, "tm_vmx_unavail_test");
+}
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index bce6037cf01d..32c3295929b0 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -22,7 +22,7 @@
 #include <asm/kvm_hyp.h>
 
 #define vtr_to_max_lr_idx(v)            ((v) & 0xf)
-#define vtr_to_nr_pri_bits(v)           (((u32)(v) >> 29) + 1)
+#define vtr_to_nr_pre_bits(v)           (((u32)(v) >> 26) + 1)
 
 static u64 __hyp_text __gic_v3_get_lr(unsigned int lr)
 {
@@ -135,13 +135,13 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
 
         if (used_lrs) {
                 int i;
-                u32 nr_pri_bits;
+                u32 nr_pre_bits;
 
                 cpu_if->vgic_elrsr = read_gicreg(ICH_ELSR_EL2);
 
                 write_gicreg(0, ICH_HCR_EL2);
                 val = read_gicreg(ICH_VTR_EL2);
-                nr_pri_bits = vtr_to_nr_pri_bits(val);
+                nr_pre_bits = vtr_to_nr_pre_bits(val);
 
                 for (i = 0; i < used_lrs; i++) {
                         if (cpu_if->vgic_elrsr & (1 << i))
@@ -152,7 +152,7 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
                         __gic_v3_set_lr(0, i);
                 }
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         cpu_if->vgic_ap0r[3] = read_gicreg(ICH_AP0R3_EL2);
                         cpu_if->vgic_ap0r[2] = read_gicreg(ICH_AP0R2_EL2);
@@ -162,7 +162,7 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
                         cpu_if->vgic_ap0r[0] = read_gicreg(ICH_AP0R0_EL2);
                 }
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         cpu_if->vgic_ap1r[3] = read_gicreg(ICH_AP1R3_EL2);
                         cpu_if->vgic_ap1r[2] = read_gicreg(ICH_AP1R2_EL2);
@@ -198,7 +198,7 @@ void __hyp_text __vgic_v3_restore_state(struct kvm_vcpu *vcpu)
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
         u64 used_lrs = vcpu->arch.vgic_cpu.used_lrs;
         u64 val;
-        u32 nr_pri_bits;
+        u32 nr_pre_bits;
         int i;
 
         /*
@@ -217,12 +217,12 @@ void __hyp_text __vgic_v3_restore_state(struct kvm_vcpu *vcpu)
         }
 
         val = read_gicreg(ICH_VTR_EL2);
-        nr_pri_bits = vtr_to_nr_pri_bits(val);
+        nr_pre_bits = vtr_to_nr_pre_bits(val);
 
         if (used_lrs) {
                 write_gicreg(cpu_if->vgic_hcr, ICH_HCR_EL2);
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         write_gicreg(cpu_if->vgic_ap0r[3], ICH_AP0R3_EL2);
                         write_gicreg(cpu_if->vgic_ap0r[2], ICH_AP0R2_EL2);
@@ -232,7 +232,7 @@ void __hyp_text __vgic_v3_restore_state(struct kvm_vcpu *vcpu)
                         write_gicreg(cpu_if->vgic_ap0r[0], ICH_AP0R0_EL2);
                 }
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         write_gicreg(cpu_if->vgic_ap1r[3], ICH_AP1R3_EL2);
                         write_gicreg(cpu_if->vgic_ap1r[2], ICH_AP1R2_EL2);
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 313ee646480f..a2d63247d1bb 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -295,6 +295,13 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
         assert_spin_locked(&kvm->mmu_lock);
         pgd = kvm->arch.pgd + stage2_pgd_index(addr);
         do {
+                /*
+                 * Make sure the page table is still active, as another thread
+                 * could have possibly freed the page table, while we released
+                 * the lock.
+                 */
+                if (!READ_ONCE(kvm->arch.pgd))
+                        break;
                 next = stage2_pgd_addr_end(addr, end);
                 if (!stage2_pgd_none(*pgd))
                         unmap_stage2_puds(kvm, pgd, addr, next);
@@ -829,22 +836,22 @@ void stage2_unmap_vm(struct kvm *kvm)
  * Walks the level-1 page table pointed to by kvm->arch.pgd and frees all
  * underlying level-2 and level-3 tables before freeing the actual level-1 table
  * and setting the struct pointer to NULL.
- *
- * Note we don't need locking here as this is only called when the VM is
- * destroyed, which can only be done once.
  */
 void kvm_free_stage2_pgd(struct kvm *kvm)
 {
-        if (kvm->arch.pgd == NULL)
-                return;
+        void *pgd = NULL;
 
         spin_lock(&kvm->mmu_lock);
-        unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+        if (kvm->arch.pgd) {
+                unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+                pgd = READ_ONCE(kvm->arch.pgd);
+                kvm->arch.pgd = NULL;
+        }
         spin_unlock(&kvm->mmu_lock);
 
         /* Free the HW pgd, one page at a time */
-        free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE);
-        kvm->arch.pgd = NULL;
+        if (pgd)
+                free_pages_exact(pgd, S2_PGD_SIZE);
 }
 
 static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,
@@ -1170,11 +1177,13 @@ static void stage2_wp_range(struct kvm *kvm, phys_addr_t addr, phys_addr_t end)
                  * large. Otherwise, we may see kernel panics with
                  * CONFIG_DETECT_HUNG_TASK, CONFIG_LOCKUP_DETECTOR,
                  * CONFIG_LOCKDEP. Additionally, holding the lock too long
-                 * will also starve other vCPUs.
+                 * will also starve other vCPUs. We have to also make sure
+                 * that the page tables are not freed while we released
+                 * the lock.
                  */
-                if (need_resched() || spin_needbreak(&kvm->mmu_lock))
-                        cond_resched_lock(&kvm->mmu_lock);
-
+                cond_resched_lock(&kvm->mmu_lock);
+                if (!READ_ONCE(kvm->arch.pgd))
+                        break;
                 next = stage2_pgd_addr_end(addr, end);
                 if (stage2_pgd_present(*pgd))
                         stage2_wp_puds(pgd, addr, next);
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index dc68e2e424ab..3a0b8999f011 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -242,8 +242,11 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
          * If we are creating a VCPU with a GICv3 we must also register the
          * KVM io device for the redistributor that belongs to this VCPU.
          */
-        if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
+        if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
+                mutex_lock(&vcpu->kvm->lock);
                 ret = vgic_register_redist_iodev(vcpu);
+                mutex_unlock(&vcpu->kvm->lock);
+        }
         return ret;
 }
 
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c
index 99da1a207c19..201d5e2e973d 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c
@@ -586,7 +586,7 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
         if (!vgic_v3_check_base(kvm))
                 return -EINVAL;
 
-        rd_base = vgic->vgic_redist_base + kvm_vcpu_get_idx(vcpu) * SZ_64K * 2;
+        rd_base = vgic->vgic_redist_base + vgic->vgic_redist_free_offset;
         sgi_base = rd_base + SZ_64K;
 
         kvm_iodevice_init(&rd_dev->dev, &kvm_io_gic_ops);
@@ -614,11 +614,15 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
         mutex_lock(&kvm->slots_lock);
         ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, sgi_base,
                                       SZ_64K, &sgi_dev->dev);
-        mutex_unlock(&kvm->slots_lock);
-        if (ret)
+        if (ret) {
                 kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS,
                                           &rd_dev->dev);
+                goto out;
+        }
 
+        vgic->vgic_redist_free_offset += 2 * SZ_64K;
+out:
+        mutex_unlock(&kvm->slots_lock);
         return ret;
 }
 
@@ -644,10 +648,12 @@ static int vgic_register_all_redist_iodevs(struct kvm *kvm)
 
         if (ret) {
                 /* The current c failed, so we start with the previous one. */
+                mutex_lock(&kvm->slots_lock);
                 for (c--; c >= 0; c--) {
                         vcpu = kvm_get_vcpu(kvm, c);
                         vgic_unregister_redist_iodev(vcpu);
                 }
+                mutex_unlock(&kvm->slots_lock);
         }
 
         return ret;
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index a65757aab6d3..504b4bd0d651 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -149,6 +149,13 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
         if (irq->hw) {
                 val |= GICH_LR_HW;
                 val |= irq->hwintid << GICH_LR_PHYSID_CPUID_SHIFT;
+                /*
+                 * Never set pending+active on a HW interrupt, as the
+                 * pending state is kept at the physical distributor
+                 * level.
+                 */
+                if (irq->active && irq_is_pending(irq))
+                        val &= ~GICH_LR_PENDING_BIT;
         } else {
                 if (irq->config == VGIC_CONFIG_LEVEL)
                         val |= GICH_LR_EOI;
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 8fa737edde6f..6fe3f003636a 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -127,6 +127,13 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
         if (irq->hw) {
                 val |= ICH_LR_HW;
                 val |= ((u64)irq->hwintid) << ICH_LR_PHYS_ID_SHIFT;
+                /*
+                 * Never set pending+active on a HW interrupt, as the
+                 * pending state is kept at the physical distributor
+                 * level.
+                 */
+                if (irq->active && irq_is_pending(irq))
+                        val &= ~ICH_LR_PENDING_BIT;
         } else {
                 if (irq->config == VGIC_CONFIG_LEVEL)
                         val |= ICH_LR_EOI;