142 files changed, 659 insertions, 318 deletions
diff --git a/.mailmap b/.mailmap
index c7b10caecc4e..4757d361fd33 100644
--- a/.mailmap
+++ b/.mailmap
@@ -15,6 +15,7 @@ Adriana Reus <adi.reus@gmail.com> <adriana.reus@intel.com>
 Alan Cox <alan@lxorguk.ukuu.org.uk>
 Alan Cox <root@hraefn.swansea.linux.org.uk>
 Aleksey Gorelov <aleksey_gorelov@phoenix.com>
+Aleksandar Markovic <aleksandar.markovic@mips.com> <aleksandar.markovic@imgtec.com>
 Al Viro <viro@ftp.linux.org.uk>
 Al Viro <viro@zenIV.linux.org.uk>
 Andreas Herrmann <aherrman@de.ibm.com>
@@ -43,6 +44,7 @@ Corey Minyard <minyard@acm.org>
 Damian Hobson-Garcia <dhobsong@igel.co.jp>
 David Brownell <david-b@pacbell.net>
 David Woodhouse <dwmw2@shinybook.infradead.org>
+Deng-Cheng Zhu <dengcheng.zhu@mips.com> <dengcheng.zhu@imgtec.com>
 Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
 Domen Puncer <domen@coderock.org>
 Douglas Gilbert <dougg@torque.net>
@@ -100,6 +102,7 @@ Leonid I Ananiev <leonid.i.ananiev@intel.com>
 Linas Vepstas <linas@austin.ibm.com>
 Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@web.de>
 Linus Lüssing <linus.luessing@c0d3.blue> <linus.luessing@ascom.ch>
+Marcin Nowakowski <marcin.nowakowski@mips.com> <marcin.nowakowski@imgtec.com>
 Mark Brown <broonie@sirena.org.uk>
 Martin Kepplinger <martink@posteo.de> <martin.kepplinger@theobroma-systems.com>
 Martin Kepplinger <martink@posteo.de> <martin.kepplinger@ginzinger.com>
@@ -114,9 +117,11 @@ Mauro Carvalho Chehab <mchehab@kernel.org> <mchehab@s-opensource.com>
 Matt Ranostay <mranostay@gmail.com> Matthew Ranostay <mranostay@embeddedalley.com>
 Matt Ranostay <mranostay@gmail.com> <matt.ranostay@intel.com>
 Matt Ranostay <matt.ranostay@konsulko.com> <matt@ranostay.consulting>
+Matt Redfearn <matt.redfearn@mips.com> <matt.redfearn@imgtec.com>
 Mayuresh Janorkar <mayur@ti.com>
 Michael Buesch <m@bues.ch>
 Michel Dänzer <michel@tungstengraphics.com>
+Miodrag Dinic <miodrag.dinic@mips.com> <miodrag.dinic@imgtec.com>
 Mitesh shah <mshah@teja.com>
 Mohit Kumar <mohit.kumar@st.com> <mohit.kumar.dhaka@gmail.com>
 Morten Welinder <terra@gnome.org>
@@ -127,6 +132,7 @@ Mythri P K <mythripk@ti.com>
 Nguyen Anh Quynh <aquynh@gmail.com>
 Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
 Patrick Mochel <mochel@digitalimplant.org>
+Paul Burton <paul.burton@mips.com> <paul.burton@imgtec.com>
 Peter A Jonsson <pj@ludd.ltu.se>
 Peter Oruba <peter@oruba.de>
 Peter Oruba <peter.oruba@amd.com>
diff --git a/Documentation/ABI/testing/sysfs-class-remoteproc b/Documentation/ABI/testing/sysfs-class-remoteproc
index d188afebc8ba..c3afe9fab646 100644
--- a/Documentation/ABI/testing/sysfs-class-remoteproc
+++ b/Documentation/ABI/testing/sysfs-class-remoteproc
@@ -1,6 +1,6 @@
 What:           /sys/class/remoteproc/.../firmware
 Date:           October 2016
-Contact:        Matt Redfearn <matt.redfearn@imgtec.com>
+Contact:        Matt Redfearn <matt.redfearn@mips.com>
 Description:    Remote processor firmware
                Reports the name of the firmware currently loaded to the
@@ -11,7 +11,7 @@ Description:	Remote processor firmware
 What:           /sys/class/remoteproc/.../state
 Date:           October 2016
-Contact:        Matt Redfearn <matt.redfearn@imgtec.com>
+Contact:        Matt Redfearn <matt.redfearn@mips.com>
 Description:    Remote processor state
                Reports the state of the remote processor, which will be one of:
diff --git a/Documentation/process/kernel-enforcement-statement.rst b/Documentation/process/kernel-enforcement-statement.rst
index 1e23d4227337..b3170671a1df 100644
--- a/Documentation/process/kernel-enforcement-statement.rst
+++ b/Documentation/process/kernel-enforcement-statement.rst
@@ -50,8 +50,9 @@ be stronger.
 Except where noted below, we speak only for ourselves, and not for any company
 we might work for today, have in the past, or will in the future.
+  - Laura Abbott
  - Bjorn Andersson (Linaro)
-  - Andrea Arcangeli (Red Hat)
+  - Andrea Arcangeli
  - Neil Armstrong
  - Jens Axboe
  - Pablo Neira Ayuso
@@ -60,15 +61,17 @@ we might work for today, have in the past, or will in the future.
  - Felipe Balbi
  - Arnd Bergmann
  - Ard Biesheuvel
-  - Paolo Bonzini (Red Hat)
+  - Tim Bird
+  - Paolo Bonzini
  - Christian Borntraeger
  - Mark Brown (Linaro)
  - Paul Burton
  - Javier Martinez Canillas
  - Rob Clark
  - Jonathan Corbet
+  - Dennis Dalessandro
  - Vivien Didelot (Savoir-faire Linux)
-  - Hans de Goede (Red Hat)
+  - Hans de Goede
  - Mel Gorman (SUSE)
  - Sven Eckelmann
  - Alex Elder (Linaro)
@@ -79,6 +82,7 @@ we might work for today, have in the past, or will in the future.
  - Juergen Gross
  - Shawn Guo
  - Ulf Hansson
+  - Stephen Hemminger (Microsoft)
  - Tejun Heo
  - Rob Herring
  - Masami Hiramatsu
@@ -104,18 +108,21 @@ we might work for today, have in the past, or will in the future.
  - Viresh Kumar
  - Aneesh Kumar K.V
  - Julia Lawall
-  - Doug Ledford (Red Hat)
+  - Doug Ledford
  - Chuck Lever (Oracle)
  - Daniel Lezcano
  - Shaohua Li
-  - Xin Long (Red Hat)
+  - Xin Long
  - Tony Luck
+  - Catalin Marinas (Arm Ltd)
  - Mike Marshall
  - Chris Mason
  - Paul E. McKenney
  - David S. Miller
  - Ingo Molnar
  - Kuninori Morimoto
+  - Trond Myklebust
+  - Martin K. Petersen (Oracle)
  - Borislav Petkov
  - Jiri Pirko
  - Josh Poimboeuf
@@ -124,18 +131,20 @@ we might work for today, have in the past, or will in the future.
  - Joerg Roedel
  - Leon Romanovsky
  - Steven Rostedt (VMware)
-  - Ivan Safonov
+  - Frank Rowand
  - Ivan Safonov
  - Anna Schumaker
  - Jes Sorensen
  - K.Y. Srinivasan
  - Heiko Stuebner
  - Jiri Kosina (SUSE)
+  - Willy Tarreau
  - Dmitry Torokhov
  - Linus Torvalds
  - Thierry Reding
  - Rik van Riel
  - Geert Uytterhoeven (Glider bvba)
+  - Eduardo Valentin (Amazon.com)
  - Daniel Vetter
  - Linus Walleij
  - Richard Weinberger
@@ -145,3 +154,4 @@ we might work for today, have in the past, or will in the future.
  - Masahiro Yamada
  - Wei Yongjun
  - Lv Zheng
+  - Marc Zyngier (Arm Ltd)
diff --git a/MAINTAINERS b/MAINTAINERS
index bf1d20695cbf..2f4e462aa4a2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -873,7 +873,7 @@ F:	drivers/android/
 F:      drivers/staging/android/
 ANDROID GOLDFISH RTC DRIVER
-M:      Miodrag Dinic <miodrag.dinic@imgtec.com>
+M:      Miodrag Dinic <miodrag.dinic@mips.com>
 S:      Supported
 F:      Documentation/devicetree/bindings/rtc/google,goldfish-rtc.txt
 F:      drivers/rtc/rtc-goldfish.c
@@ -6733,7 +6733,7 @@ S:	Maintained
 F:      drivers/usb/atm/ueagle-atm.c
 IMGTEC ASCII LCD DRIVER
-M:      Paul Burton <paul.burton@imgtec.com>
+M:      Paul Burton <paul.burton@mips.com>
 S:      Maintained
 F:      Documentation/devicetree/bindings/auxdisplay/img-ascii-lcd.txt
 F:      drivers/auxdisplay/img-ascii-lcd.c
@@ -8993,7 +8993,7 @@ F:	Documentation/mips/
 F:      arch/mips/
 MIPS BOSTON DEVELOPMENT BOARD
-M:      Paul Burton <paul.burton@imgtec.com>
+M:      Paul Burton <paul.burton@mips.com>
 L:      linux-mips@linux-mips.org
 S:      Maintained
 F:      Documentation/devicetree/bindings/clock/img,boston-clock.txt
@@ -9003,7 +9003,7 @@ F:	drivers/clk/imgtec/clk-boston.c
 F:      include/dt-bindings/clock/boston-clock.h
 MIPS GENERIC PLATFORM
-M:      Paul Burton <paul.burton@imgtec.com>
+M:      Paul Burton <paul.burton@mips.com>
 L:      linux-mips@linux-mips.org
 S:      Supported
 F:      arch/mips/generic/
@@ -9019,7 +9019,7 @@ F:	drivers/*/*loongson1*
 F:      drivers/*/*/*loongson1*
 MIPS RINT INSTRUCTION EMULATION
-M:      Aleksandar Markovic <aleksandar.markovic@imgtec.com>
+M:      Aleksandar Markovic <aleksandar.markovic@mips.com>
 L:      linux-mips@linux-mips.org
 S:      Supported
 F:      arch/mips/math-emu/sp_rint.c
@@ -10683,10 +10683,9 @@ S:	Maintained
 F:      drivers/pinctrl/spear/
 PISTACHIO SOC SUPPORT
-M:      James Hartley <james.hartley@imgtec.com>
+M:      James Hartley <james.hartley@sondrel.com>
-M:      Ionela Voinescu <ionela.voinescu@imgtec.com>
 L:      linux-mips@linux-mips.org
-S:      Maintained
+S:      Odd Fixes
 F:      arch/mips/pistachio/
 F:      arch/mips/include/asm/mach-pistachio/
 F:      arch/mips/boot/dts/img/pistachio*
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 817e5cfef83a..36ae4454554c 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -44,10 +44,12 @@ endif
 ifeq ($(CONFIG_CPU_BIG_ENDIAN),y)
 KBUILD_CPPFLAGS += -mbig-endian
+CHECKFLAGS      += -D__ARMEB__
 AS              += -EB
 LD              += -EB
 else
 KBUILD_CPPFLAGS += -mlittle-endian
+CHECKFLAGS      += -D__ARMEL__
 AS              += -EL
 LD              += -EL
 endif
diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
index 7a4c59154361..7d06aa19c3e6 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.S
+++ b/arch/arm/boot/compressed/vmlinux.lds.S
@@ -85,6 +85,15 @@ SECTIONS
  _edata = .;
+  /*
+   * The image_end section appears after any additional loadable sections
+   * that the linker may decide to insert in the binary image.  Having
+   * this symbol allows further debug in the near future.
+   */
+  .image_end (NOLOAD) : {
+    _edata_real = .;
+  }
  _magic_sig = ZIMAGE_MAGIC(0x016f2818);
  _magic_start = ZIMAGE_MAGIC(_start);
  _magic_end = ZIMAGE_MAGIC(_edata);
diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi
index 7225c7ce9a8d..2cb1bcd30976 100644
--- a/arch/arm/boot/dts/armada-375.dtsi
+++ b/arch/arm/boot/dts/armada-375.dtsi
@@ -178,9 +178,9 @@
                                reg = <0x8000 0x1000>;
                                cache-unified;
                                cache-level = <2>;
-                                arm,double-linefill-incr = <1>;
+                                arm,double-linefill-incr = <0>;
                                arm,double-linefill-wrap = <0>;
-                                arm,double-linefill = <1>;
+                                arm,double-linefill = <0>;
                                prefetch-data = <1>;
                        };
diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi
index 4960722aab32..00ff549d4e39 100644
--- a/arch/arm/boot/dts/armada-38x.dtsi
+++ b/arch/arm/boot/dts/armada-38x.dtsi
@@ -143,9 +143,9 @@
                                reg = <0x8000 0x1000>;
                                cache-unified;
                                cache-level = <2>;
-                                arm,double-linefill-incr = <1>;
+                                arm,double-linefill-incr = <0>;
                                arm,double-linefill-wrap = <0>;
-                                arm,double-linefill = <1>;
+                                arm,double-linefill = <0>;
                                prefetch-data = <1>;
                        };
diff --git a/arch/arm/boot/dts/armada-39x.dtsi b/arch/arm/boot/dts/armada-39x.dtsi
index ea657071e278..5218bd2a248d 100644
--- a/arch/arm/boot/dts/armada-39x.dtsi
+++ b/arch/arm/boot/dts/armada-39x.dtsi
@@ -111,9 +111,9 @@
                                reg = <0x8000 0x1000>;
                                cache-unified;
                                cache-level = <2>;
-                                arm,double-linefill-incr = <1>;
+                                arm,double-linefill-incr = <0>;
                                arm,double-linefill-wrap = <0>;
-                                arm,double-linefill = <1>;
+                                arm,double-linefill = <0>;
                                prefetch-data = <1>;
                        };
diff --git a/arch/arm/boot/dts/uniphier-ld4.dtsi b/arch/arm/boot/dts/uniphier-ld4.dtsi
index 79183db5b386..93586faf950f 100644
--- a/arch/arm/boot/dts/uniphier-ld4.dtsi
+++ b/arch/arm/boot/dts/uniphier-ld4.dtsi
@@ -209,7 +209,8 @@
                        interrupts = <0 80 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb0>;
-                        clocks = <&mio_clk 7>, <&mio_clk 8>, <&mio_clk 12>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 8>,
+                                 <&mio_clk 12>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 8>,
                                 <&mio_rst 12>;
                };
@@ -221,7 +222,8 @@
                        interrupts = <0 81 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb1>;
-                        clocks = <&mio_clk 7>, <&mio_clk 9>, <&mio_clk 13>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 9>,
+                                 <&mio_clk 13>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 9>,
                                 <&mio_rst 13>;
                };
@@ -233,7 +235,8 @@
                        interrupts = <0 82 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb2>;
-                        clocks = <&mio_clk 7>, <&mio_clk 10>, <&mio_clk 14>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 10>,
+                                 <&mio_clk 14>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 10>,
                                 <&mio_rst 14>;
                };
diff --git a/arch/arm/boot/dts/uniphier-pro4.dtsi b/arch/arm/boot/dts/uniphier-pro4.dtsi
index b3dbbd9b6e39..2a9bd7f9f5db 100644
--- a/arch/arm/boot/dts/uniphier-pro4.dtsi
+++ b/arch/arm/boot/dts/uniphier-pro4.dtsi
@@ -241,7 +241,8 @@
                        interrupts = <0 80 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb2>;
-                        clocks = <&mio_clk 7>, <&mio_clk 8>, <&mio_clk 12>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 8>,
+                                 <&mio_clk 12>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 8>,
                                 <&mio_rst 12>;
                };
@@ -253,7 +254,8 @@
                        interrupts = <0 81 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb3>;
-                        clocks = <&mio_clk 7>, <&mio_clk 9>, <&mio_clk 13>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 9>,
+                                 <&mio_clk 13>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 9>,
                                 <&mio_rst 13>;
                };
diff --git a/arch/arm/boot/dts/uniphier-sld8.dtsi b/arch/arm/boot/dts/uniphier-sld8.dtsi
index b08390332971..ebd0c3f63e7f 100644
--- a/arch/arm/boot/dts/uniphier-sld8.dtsi
+++ b/arch/arm/boot/dts/uniphier-sld8.dtsi
@@ -209,7 +209,8 @@
                        interrupts = <0 80 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb0>;
-                        clocks = <&mio_clk 7>, <&mio_clk 8>, <&mio_clk 12>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 8>,
+                                 <&mio_clk 12>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 8>,
                                 <&mio_rst 12>;
                };
@@ -221,7 +222,8 @@
                        interrupts = <0 81 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb1>;
-                        clocks = <&mio_clk 7>, <&mio_clk 9>, <&mio_clk 13>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 9>,
+                                 <&mio_clk 13>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 9>,
                                 <&mio_rst 13>;
                };
@@ -233,7 +235,8 @@
                        interrupts = <0 82 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb2>;
-                        clocks = <&mio_clk 7>, <&mio_clk 10>, <&mio_clk 14>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 10>,
+                                 <&mio_clk 14>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 10>,
                                 <&mio_rst 14>;
                };
diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild
index 721ab5ecfb9b..0f2c8a2a8131 100644
--- a/arch/arm/include/asm/Kbuild
+++ b/arch/arm/include/asm/Kbuild
@@ -20,7 +20,6 @@ generic-y += simd.h
 generic-y += sizes.h
 generic-y += timex.h
 generic-y += trace_clock.h
-generic-y += unaligned.h
 generated-y += mach-types.h
 generated-y += unistd-nr.h
diff --git a/arch/arm/include/asm/unaligned.h b/arch/arm/include/asm/unaligned.h
new file mode 100644
index 000000000000..ab905ffcf193
--- /dev/null
+++ b/arch/arm/include/asm/unaligned.h
@@ -0,0 +1,27 @@
+#ifndef __ASM_ARM_UNALIGNED_H
+#define __ASM_ARM_UNALIGNED_H
+/*
+ * We generally want to set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS on ARMv6+,
+ * but we don't want to use linux/unaligned/access_ok.h since that can lead
+ * to traps on unaligned stm/ldm or strd/ldrd.
+ */
+#include <asm/byteorder.h>
+#if defined(__LITTLE_ENDIAN)
+# include <linux/unaligned/le_struct.h>
+# include <linux/unaligned/be_byteshift.h>
+# include <linux/unaligned/generic.h>
+# define get_unaligned  __get_unaligned_le
+# define put_unaligned  __put_unaligned_le
+#elif defined(__BIG_ENDIAN)
+# include <linux/unaligned/be_struct.h>
+# include <linux/unaligned/le_byteshift.h>
+# include <linux/unaligned/generic.h>
+# define get_unaligned  __get_unaligned_be
+# define put_unaligned  __put_unaligned_be
+#else
+# error need to define endianess
+#endif
+#endif /* __ASM_ARM_UNALIGNED_H */
diff --git a/arch/arm/kvm/emulate.c b/arch/arm/kvm/emulate.c
index 0064b86a2c87..30a13647c54c 100644
--- a/arch/arm/kvm/emulate.c
+++ b/arch/arm/kvm/emulate.c
@@ -227,7 +227,7 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu)
        u32 return_offset = (is_thumb) ? 2 : 4;
        kvm_update_psr(vcpu, UND_MODE);
-        *vcpu_reg(vcpu, 14) = *vcpu_pc(vcpu) - return_offset;
+        *vcpu_reg(vcpu, 14) = *vcpu_pc(vcpu) + return_offset;
        /* Branch to exception vector */
        *vcpu_pc(vcpu) = exc_vector_base(vcpu) + vect_offset;
@@ -239,10 +239,8 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu)
 */
 static void inject_abt(struct kvm_vcpu *vcpu, bool is_pabt, unsigned long addr)
 {
-        unsigned long cpsr = *vcpu_cpsr(vcpu);
-        bool is_thumb = (cpsr & PSR_T_BIT);
        u32 vect_offset;
-        u32 return_offset = (is_thumb) ? 4 : 0;
+        u32 return_offset = (is_pabt) ? 4 : 8;
        bool is_lpae;
        kvm_update_psr(vcpu, ABT_MODE);
diff --git a/arch/arm/kvm/hyp/Makefile b/arch/arm/kvm/hyp/Makefile
index 5fca24d52fe6..5638ce0c9524 100644
--- a/arch/arm/kvm/hyp/Makefile
+++ b/arch/arm/kvm/hyp/Makefile
@@ -3,7 +3,7 @@
 # Makefile for Kernel-based Virtual Machine module, HYP part
 #
-ccflags-y += -fno-stack-protector
+ccflags-y += -fno-stack-protector -DDISABLE_BRANCH_PROFILING
 KVM=../../../../virt/kvm
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi
index ee4aff53a5f5..09c429cb6d61 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi
+++ b/arch/arm64/boot/dts/socionext/uniphier-ld11.dtsi
@@ -299,7 +299,8 @@
                        interrupts = <0 243 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb0>;
-                        clocks = <&mio_clk 7>, <&mio_clk 8>, <&mio_clk 12>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 8>,
+                                 <&mio_clk 12>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 8>,
                                 <&mio_rst 12>;
                };
@@ -311,7 +312,8 @@
                        interrupts = <0 244 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb1>;
-                        clocks = <&mio_clk 7>, <&mio_clk 9>, <&mio_clk 13>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 9>,
+                                 <&mio_clk 13>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 9>,
                                 <&mio_rst 13>;
                };
@@ -323,7 +325,8 @@
                        interrupts = <0 245 4>;
                        pinctrl-names = "default";
                        pinctrl-0 = <&pinctrl_usb2>;
-                        clocks = <&mio_clk 7>, <&mio_clk 10>, <&mio_clk 14>;
+                        clocks = <&sys_clk 8>, <&mio_clk 7>, <&mio_clk 10>,
+                                 <&mio_clk 14>;
                        resets = <&sys_rst 8>, <&mio_rst 7>, <&mio_rst 10>,
                                 <&mio_rst 14>;
                };
diff --git a/arch/arm64/kvm/hyp/Makefile b/arch/arm64/kvm/hyp/Makefile
index 7c54d8fde855..f04400d494b7 100644
--- a/arch/arm64/kvm/hyp/Makefile
+++ b/arch/arm64/kvm/hyp/Makefile
@@ -3,7 +3,7 @@
 # Makefile for Kernel-based Virtual Machine module, HYP part
 #
-ccflags-y += -fno-stack-protector
+ccflags-y += -fno-stack-protector -DDISABLE_BRANCH_PROFILING
 KVM=../../../../virt/kvm
diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index da6a8cfa54a0..3556715a774e 100644
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c
@@ -33,12 +33,26 @@
 #define LOWER_EL_AArch64_VECTOR         0x400
 #define LOWER_EL_AArch32_VECTOR         0x600
+/*
+ * Table taken from ARMv8 ARM DDI0487B-B, table G1-10.
+ */
+static const u8 return_offsets[8][2] = {
+        [0] = { 0, 0 },         /* Reset, unused */
+        [1] = { 4, 2 },         /* Undefined */
+        [2] = { 0, 0 },         /* SVC, unused */
+        [3] = { 4, 4 },         /* Prefetch abort */
+        [4] = { 8, 8 },         /* Data abort */
+        [5] = { 0, 0 },         /* HVC, unused */
+        [6] = { 4, 4 },         /* IRQ, unused */
+        [7] = { 4, 4 },         /* FIQ, unused */
+};
 static void prepare_fault32(struct kvm_vcpu *vcpu, u32 mode, u32 vect_offset)
 {
        unsigned long cpsr;
        unsigned long new_spsr_value = *vcpu_cpsr(vcpu);
        bool is_thumb = (new_spsr_value & COMPAT_PSR_T_BIT);
-        u32 return_offset = (is_thumb) ? 4 : 0;
+        u32 return_offset = return_offsets[vect_offset >> 2][is_thumb];
        u32 sctlr = vcpu_cp15(vcpu, c1_SCTLR);
        cpsr = mode | COMPAT_PSR_I_BIT;
diff --git a/arch/mips/generic/Makefile b/arch/mips/generic/Makefile
index 56b3ea565ed9..874967363dbb 100644
--- a/arch/mips/generic/Makefile
+++ b/arch/mips/generic/Makefile
@@ -1,6 +1,6 @@
 #
 # Copyright (C) 2016 Imagination Technologies
-# Author: Paul Burton <paul.burton@imgtec.com>
+# Author: Paul Burton <paul.burton@mips.com>
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/generic/Platform b/arch/mips/generic/Platform
index f5312dfa8184..b51432dd10b6 100644
--- a/arch/mips/generic/Platform
+++ b/arch/mips/generic/Platform
@@ -1,6 +1,6 @@
 #
 # Copyright (C) 2016 Imagination Technologies
-# Author: Paul Burton <paul.burton@imgtec.com>
+# Author: Paul Burton <paul.burton@mips.com>
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/generic/board-ni169445.its.S b/arch/mips/generic/board-ni169445.its.S
index d12e12fe90be..e4cb4f95a8cc 100644
--- a/arch/mips/generic/board-ni169445.its.S
+++ b/arch/mips/generic/board-ni169445.its.S
@@ -1,4 +1,4 @@
-{
+/ {
        images {
                fdt@ni169445 {
                        description = "NI 169445 device tree";
diff --git a/arch/mips/generic/board-sead3.c b/arch/mips/generic/board-sead3.c
index f109a6b9fdd0..10cf93d97346 100644
--- a/arch/mips/generic/board-sead3.c
+++ b/arch/mips/generic/board-sead3.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/generic/init.c b/arch/mips/generic/init.c
index 15a7fb8e2a2e..5ba6fcc26fa7 100644
--- a/arch/mips/generic/init.c
+++ b/arch/mips/generic/init.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -20,7 +20,7 @@
 #include <asm/fw/fw.h>
 #include <asm/irq_cpu.h>
 #include <asm/machine.h>
-#include <asm/mips-cpc.h>
+#include <asm/mips-cps.h>
 #include <asm/prom.h>
 #include <asm/smp-ops.h>
 #include <asm/time.h>
diff --git a/arch/mips/generic/irq.c b/arch/mips/generic/irq.c
index 5322d09dd51b..394f8161e462 100644
--- a/arch/mips/generic/irq.c
+++ b/arch/mips/generic/irq.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/generic/kexec.c b/arch/mips/generic/kexec.c
index e9fb735299e3..1ca409f58929 100644
--- a/arch/mips/generic/kexec.c
+++ b/arch/mips/generic/kexec.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+ * Author: Marcin Nowakowski <marcin.nowakowski@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/generic/proc.c b/arch/mips/generic/proc.c
index 42b33250a4a2..199fb2cc57ee 100644
--- a/arch/mips/generic/proc.c
+++ b/arch/mips/generic/proc.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c
index 6077bca9b364..b408dac722ac 100644
--- a/arch/mips/generic/yamon-dt.c
+++ b/arch/mips/generic/yamon-dt.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/dsemul.h b/arch/mips/include/asm/dsemul.h
index a6e067801f23..b47a97527673 100644
--- a/arch/mips/include/asm/dsemul.h
+++ b/arch/mips/include/asm/dsemul.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/maar.h b/arch/mips/include/asm/maar.h
index e10f78befbd9..1e0da80bba13 100644
--- a/arch/mips/include/asm/maar.h
+++ b/arch/mips/include/asm/maar.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/mach-malta/malta-dtshim.h b/arch/mips/include/asm/mach-malta/malta-dtshim.h
index cfd777663c64..d696a7598ea7 100644
--- a/arch/mips/include/asm/mach-malta/malta-dtshim.h
+++ b/arch/mips/include/asm/mach-malta/malta-dtshim.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/mach-malta/malta-pm.h b/arch/mips/include/asm/mach-malta/malta-pm.h
index c2c2e201013d..347b53dbc88f 100644
--- a/arch/mips/include/asm/mach-malta/malta-pm.h
+++ b/arch/mips/include/asm/mach-malta/malta-pm.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/machine.h b/arch/mips/include/asm/machine.h
index ecb6c7335484..e0d9b373d415 100644
--- a/arch/mips/include/asm/machine.h
+++ b/arch/mips/include/asm/machine.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h
index f6231b91b724..8bc5df49b0e1 100644
--- a/arch/mips/include/asm/mips-cm.h
+++ b/arch/mips/include/asm/mips-cm.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -142,8 +142,8 @@ GCR_ACCESSOR_RO(64, 0x000, config)
 GCR_ACCESSOR_RW(64, 0x008, base)
 #define CM_GCR_BASE_GCRBASE                     GENMASK_ULL(47, 15)
 #define CM_GCR_BASE_CMDEFTGT                    GENMASK(1, 0)
-#define  CM_GCR_BASE_CMDEFTGT_DISABLED          0
+#define  CM_GCR_BASE_CMDEFTGT_MEM               0
-#define  CM_GCR_BASE_CMDEFTGT_MEM               1
+#define  CM_GCR_BASE_CMDEFTGT_RESERVED          1
 #define  CM_GCR_BASE_CMDEFTGT_IOCU0             2
 #define  CM_GCR_BASE_CMDEFTGT_IOCU1             3
diff --git a/arch/mips/include/asm/mips-cpc.h b/arch/mips/include/asm/mips-cpc.h
index f885051a8378..b55e335cfba4 100644
--- a/arch/mips/include/asm/mips-cpc.h
+++ b/arch/mips/include/asm/mips-cpc.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/mips-cps.h b/arch/mips/include/asm/mips-cps.h
index bf02b5070a98..8ad4a85eed0c 100644
--- a/arch/mips/include/asm/mips-cps.h
+++ b/arch/mips/include/asm/mips-cps.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2017 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/mips-gic.h b/arch/mips/include/asm/mips-gic.h
index a2badf572632..558059a8f218 100644
--- a/arch/mips/include/asm/mips-gic.h
+++ b/arch/mips/include/asm/mips-gic.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2017 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/msa.h b/arch/mips/include/asm/msa.h
index 8967b475ab10..b1845102f8f9 100644
--- a/arch/mips/include/asm/msa.h
+++ b/arch/mips/include/asm/msa.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/pm-cps.h b/arch/mips/include/asm/pm-cps.h
index 89d58d80b77b..bb0616967342 100644
--- a/arch/mips/include/asm/pm-cps.h
+++ b/arch/mips/include/asm/pm-cps.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/smp-cps.h b/arch/mips/include/asm/smp-cps.h
index 2ae1f61a4a95..16b4ee3feb98 100644
--- a/arch/mips/include/asm/smp-cps.h
+++ b/arch/mips/include/asm/smp-cps.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index 5d3563c55e0c..2161357cc68f 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -199,6 +199,10 @@
                sll     k0, 3           /* extract cu0 bit */
                .set    noreorder
                bltz    k0, 8f
+                 move   k0, sp
+                .if \docfi
+                .cfi_register sp, k0
+                .endif
 #ifdef CONFIG_EVA
                /*
                 * Flush interAptiv's Return Prediction Stack (RPS) by writing
@@ -225,10 +229,6 @@
                MTC0    k0, CP0_ENTRYHI
 #endif
                .set    reorder
-                 move   k0, sp
-                .if \docfi
-                .cfi_register sp, k0
-                .endif
                /* Called from user mode, new stack. */
                get_saved_sp docfi=\docfi tosp=1
 8:
diff --git a/arch/mips/include/asm/yamon-dt.h b/arch/mips/include/asm/yamon-dt.h
index 485cfe3e45e1..10a073e6877a 100644
--- a/arch/mips/include/asm/yamon-dt.h
+++ b/arch/mips/include/asm/yamon-dt.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/cmpxchg.c b/arch/mips/kernel/cmpxchg.c
index 7730f1d3434f..0b9535bc2c53 100644
--- a/arch/mips/kernel/cmpxchg.c
+++ b/arch/mips/kernel/cmpxchg.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2017 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/cps-vec-ns16550.S b/arch/mips/kernel/cps-vec-ns16550.S
index 6d246ad05638..b37af23a5358 100644
--- a/arch/mips/kernel/cps-vec-ns16550.S
+++ b/arch/mips/kernel/cps-vec-ns16550.S
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/cps-vec.S b/arch/mips/kernel/cps-vec.S
index d173b49f212d..c7ed26029cbb 100644
--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
index 0828d6d963b7..731325a61a78 100644
--- a/arch/mips/kernel/elf.c
+++ b/arch/mips/kernel/elf.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/mips-cm.c b/arch/mips/kernel/mips-cm.c
index e91c8c4e2eb5..dd5567b1e305 100644
--- a/arch/mips/kernel/mips-cm.c
+++ b/arch/mips/kernel/mips-cm.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c
index f66b05ebf637..19c88d770054 100644
--- a/arch/mips/kernel/mips-cpc.c
+++ b/arch/mips/kernel/mips-cpc.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c
index 4655017f2377..9dd624c2fe56 100644
--- a/arch/mips/kernel/pm-cps.c
+++ b/arch/mips/kernel/pm-cps.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/probes-common.h b/arch/mips/kernel/probes-common.h
index dd08e41134b6..d2bf77b18822 100644
--- a/arch/mips/kernel/probes-common.h
+++ b/arch/mips/kernel/probes-common.h
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
+ * Author: Marcin Nowakowski <marcin.nowakowski@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/kernel/relocate.c b/arch/mips/kernel/relocate.c
index 2d1a0c438771..cbf4cc0b0b6c 100644
--- a/arch/mips/kernel/relocate.c
+++ b/arch/mips/kernel/relocate.c
@@ -6,7 +6,7 @@
 * Support for Kernel relocation at boot time
 *
 * Copyright (C) 2015, Imagination Technologies Ltd.
- * Authors: Matt Redfearn (matt.redfearn@imgtec.com)
+ * Authors: Matt Redfearn (matt.redfearn@mips.com)
 */
 #include <asm/bootinfo.h>
 #include <asm/cacheflush.h>
diff --git a/arch/mips/kernel/smp-cmp.c b/arch/mips/kernel/smp-cmp.c
index 05295a4909f1..a2322009cac3 100644
--- a/arch/mips/kernel/smp-cmp.c
+++ b/arch/mips/kernel/smp-cmp.c
@@ -19,7 +19,7 @@
 #undef DEBUG
 #include <linux/kernel.h>
-#include <linux/sched.h>
+#include <linux/sched/task_stack.h>
 #include <linux/smp.h>
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
@@ -50,8 +50,8 @@ static void cmp_init_secondary(void)
 #ifdef CONFIG_MIPS_MT_SMP
        if (cpu_has_mipsmt)
-                c->vpe_id = (read_c0_tcbind() >> TCBIND_CURVPE_SHIFT) &
+                cpu_set_vpe_id(c, (read_c0_tcbind() >> TCBIND_CURVPE_SHIFT) &
-                        TCBIND_CURVPE;
+                                  TCBIND_CURVPE);
 #endif
 }
diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c
index 0063122c85da..ecc1a853f48d 100644
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2013 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -306,7 +306,7 @@ static int cps_boot_secondary(int cpu, struct task_struct *idle)
        int err;
        /* We don't yet support booting CPUs in other clusters */
-        if (cpu_cluster(&cpu_data[cpu]) != cpu_cluster(&current_cpu_data))
+        if (cpu_cluster(&cpu_data[cpu]) != cpu_cluster(&raw_current_cpu_data))
                return -ENOSYS;
        vpe_cfg->pc = (unsigned long)&smp_bootstrap;
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index bbe19b64def5..88be966d3e61 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -42,7 +42,7 @@
 #include <asm/processor.h>
 #include <asm/idle.h>
 #include <asm/r4k-timer.h>
-#include <asm/mips-cpc.h>
+#include <asm/mips-cps.h>
 #include <asm/mmu_context.h>
 #include <asm/time.h>
 #include <asm/setup.h>
@@ -66,6 +66,7 @@ EXPORT_SYMBOL(cpu_sibling_map);
 cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
 EXPORT_SYMBOL(cpu_core_map);
+static DECLARE_COMPLETION(cpu_starting);
 static DECLARE_COMPLETION(cpu_running);
 /*
@@ -374,6 +375,12 @@ asmlinkage void start_secondary(void)
        cpumask_set_cpu(cpu, &cpu_coherent_mask);
        notify_cpu_starting(cpu);
+        /* Notify boot CPU that we're starting & ready to sync counters */
+        complete(&cpu_starting);
+        synchronise_count_slave(cpu);
+        /* The CPU is running and counters synchronised, now mark it online */
        set_cpu_online(cpu, true);
        set_cpu_sibling_map(cpu);
@@ -381,8 +388,11 @@ asmlinkage void start_secondary(void)
        calculate_cpu_foreign_map();
+        /*
+         * Notify boot CPU that we're up & online and it can safely return
+         * from __cpu_up
+         */
        complete(&cpu_running);
-        synchronise_count_slave(cpu);
        /*
         * irq will be enabled in ->smp_finish(), enabling it too early
@@ -445,17 +455,17 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
        if (err)
                return err;
-        /*
+        /* Wait for CPU to start and be ready to sync counters */
-         * We must check for timeout here, as the CPU will not be marked
+        if (!wait_for_completion_timeout(&cpu_starting,
-         * online until the counters are synchronised.
-         */
-        if (!wait_for_completion_timeout(&cpu_running,
                                         msecs_to_jiffies(1000))) {
                pr_crit("CPU%u: failed to start\n", cpu);
                return -EIO;
        }
        synchronise_count_master(cpu);
+        /* Wait for CPU to finish startup & mark itself online before return */
+        wait_for_completion(&cpu_running);
        return 0;
 }
diff --git a/arch/mips/mm/sc-debugfs.c b/arch/mips/mm/sc-debugfs.c
index 7e945e310b44..2e2132d3f5c7 100644
--- a/arch/mips/mm/sc-debugfs.c
+++ b/arch/mips/mm/sc-debugfs.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c
index c28ff53c8da0..cdb5a191b9d5 100644
--- a/arch/mips/mm/uasm-micromips.c
+++ b/arch/mips/mm/uasm-micromips.c
@@ -80,7 +80,7 @@ static const struct insn const insn_table_MM[insn_invalid] = {
        [insn_jr]       = {M(mm_pool32a_op, 0, 0, 0, mm_jalr_op, mm_pool32axf_op), RS},
        [insn_lb]       = {M(mm_lb32_op, 0, 0, 0, 0, 0), RT | RS | SIMM},
        [insn_ld]       = {0, 0},
-        [insn_lh]       = {M(mm_lh32_op, 0, 0, 0, 0, 0), RS | RS | SIMM},
+        [insn_lh]       = {M(mm_lh32_op, 0, 0, 0, 0, 0), RT | RS | SIMM},
        [insn_ll]       = {M(mm_pool32c_op, 0, 0, (mm_ll_func << 1), 0, 0), RS | RT | SIMM},
        [insn_lld]      = {0, 0},
        [insn_lui]      = {M(mm_pool32i_op, mm_lui_op, 0, 0, 0, 0), RS | SIMM},
diff --git a/arch/mips/mti-malta/malta-dt.c b/arch/mips/mti-malta/malta-dt.c
index 4822943100f3..b397117033aa 100644
--- a/arch/mips/mti-malta/malta-dt.c
+++ b/arch/mips/mti-malta/malta-dt.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/mti-malta/malta-dtshim.c b/arch/mips/mti-malta/malta-dtshim.c
index a6699c15277d..7859b6e49863 100644
--- a/arch/mips/mti-malta/malta-dtshim.c
+++ b/arch/mips/mti-malta/malta-dtshim.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/mti-malta/malta-pm.c b/arch/mips/mti-malta/malta-pm.c
index c1e456c01a44..efbd659fb602 100644
--- a/arch/mips/mti-malta/malta-pm.c
+++ b/arch/mips/mti-malta/malta-pm.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
index 01b7a87ea678..962b0259b4b6 100644
--- a/arch/mips/net/ebpf_jit.c
+++ b/arch/mips/net/ebpf_jit.c
@@ -1513,7 +1513,7 @@ ld_skb_common:
                }
                src = ebpf_to_mips_reg(ctx, insn, src_reg_no_fp);
                if (src < 0)
-                        return dst;
+                        return src;
                if (BPF_MODE(insn->code) == BPF_XADD) {
                        switch (BPF_SIZE(insn->code)) {
                        case BPF_W:
diff --git a/arch/mips/pci/pci-generic.c b/arch/mips/pci/pci-generic.c
index dce304dc3d62..676348164027 100644
--- a/arch/mips/pci/pci-generic.c
+++ b/arch/mips/pci/pci-generic.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * pcibios_align_resource taken from arch/arm/kernel/bios32.c.
 *
diff --git a/arch/mips/tools/generic-board-config.sh b/arch/mips/tools/generic-board-config.sh
index 654d652d7fa1..08849f83ef6c 100755
--- a/arch/mips/tools/generic-board-config.sh
+++ b/arch/mips/tools/generic-board-config.sh
@@ -1,7 +1,7 @@
 #!/bin/sh
 #
 # Copyright (C) 2017 Imagination Technologies
-# Author: Paul Burton <paul.burton@imgtec.com>
+# Author: Paul Burton <paul.burton@mips.com>
 #
 # This program is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by the
diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h
index 5482928eea1b..abef812de7f8 100644
--- a/arch/powerpc/include/asm/code-patching.h
+++ b/arch/powerpc/include/asm/code-patching.h
@@ -83,16 +83,8 @@ static inline unsigned long ppc_function_entry(void *func)
         * On PPC64 ABIv1 the function pointer actually points to the
         * function's descriptor. The first entry in the descriptor is the
         * address of the function text.
-         *
-         * However, we may also receive pointer to an assembly symbol. To
-         * detect that, we first check if the function pointer we receive
-         * already points to kernel/module text and we only dereference it
-         * if it doesn't.
         */
-        if (kernel_text_address((unsigned long)func))
+        return ((func_descr_t *)func)->entry;
-                return (unsigned long)func;
-        else
-                return ((func_descr_t *)func)->entry;
 #else
        return (unsigned long)func;
 #endif
diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
index 43ef25156480..3e6c0744c174 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -332,7 +332,7 @@ int fix_alignment(struct pt_regs *regs)
         * when pasting to a co-processor. Furthermore, paste_last is the
         * synchronisation point for preceding copy/paste sequences.
         */
-        if ((instr & 0xfc0006fe) == PPC_INST_COPY)
+        if ((instr & 0xfc0006fe) == (PPC_INST_COPY & 0xfc0006fe))
                return -EIO;
        r = analyse_instr(&op, regs, instr);
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 367494dc67d9..bebc3007a793 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -600,7 +600,12 @@ NOKPROBE_SYMBOL(kprobe_fault_handler);
 unsigned long arch_deref_entry_point(void *entry)
 {
-        return ppc_global_function_entry(entry);
+#ifdef PPC64_ELF_ABI_v1
+        if (!kernel_text_address((unsigned long)entry))
+                return ppc_global_function_entry(entry);
+        else
+#endif
+                return (unsigned long)entry;
 }
 NOKPROBE_SYMBOL(arch_deref_entry_point);
diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
index b3e849c4886e..d304028641a2 100644
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
@@ -360,12 +360,14 @@ void radix__flush_tlb_collapsed_pmd(struct mm_struct *mm, unsigned long addr)
        pid = mm ? mm->context.id : 0;
+        preempt_disable();
        if (unlikely(pid == MMU_NO_CONTEXT))
                goto no_context;
        /* 4k page size, just blow the world */
        if (PAGE_SIZE == 0x1000) {
                radix__flush_all_mm(mm);
+                preempt_enable();
                return;
        }
diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index 88126245881b..36344117c680 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c
@@ -607,6 +607,20 @@ static int ppc_core_imc_cpu_offline(unsigned int cpu)
        if (!cpumask_test_and_clear_cpu(cpu, &core_imc_cpumask))
                return 0;
+        /*
+         * Check whether core_imc is registered. We could end up here
+         * if the cpuhotplug callback registration fails. i.e, callback
+         * invokes the offline path for all sucessfully registered cpus.
+         * At this stage, core_imc pmu will not be registered and we
+         * should return here.
+         *
+         * We return with a zero since this is not an offline failure.
+         * And cpuhp_setup_state() returns the actual failure reason
+         * to the caller, which inturn will call the cleanup routine.
+         */
+        if (!core_imc_pmu->pmu.event_init)
+                return 0;
        /* Find any online cpu in that core except the current "cpu" */
        ncpu = cpumask_any_but(cpu_sibling_mask(cpu), cpu);
@@ -1104,7 +1118,7 @@ static int init_nest_pmu_ref(void)
 static void cleanup_all_core_imc_memory(void)
 {
-        int i, nr_cores = num_present_cpus() / threads_per_core;
+        int i, nr_cores = DIV_ROUND_UP(num_present_cpus(), threads_per_core);
        struct imc_mem_info *ptr = core_imc_pmu->mem_info;
        int size = core_imc_pmu->counter_mem_size;
@@ -1212,7 +1226,7 @@ static int imc_mem_init(struct imc_pmu *pmu_ptr, struct device_node *parent,
                if (!pmu_ptr->pmu.name)
                        return -ENOMEM;
-                nr_cores = num_present_cpus() / threads_per_core;
+                nr_cores = DIV_ROUND_UP(num_present_cpus(), threads_per_core);
                pmu_ptr->mem_info = kcalloc(nr_cores, sizeof(struct imc_mem_info),
                                                                GFP_KERNEL);
diff --git a/arch/tile/Makefile b/arch/tile/Makefile
index 4dc380a519d4..8fa0befba32b 100644
--- a/arch/tile/Makefile
+++ b/arch/tile/Makefile
@@ -51,6 +51,8 @@ else
 BITS := 32
 endif
+CHECKFLAGS      += -m$(BITS)
 head-y          := arch/tile/kernel/head_$(BITS).o
 libs-y          += arch/tile/lib/
diff --git a/arch/tile/kernel/time.c b/arch/tile/kernel/time.c
index 6643ffbc0615..f95d65f3162b 100644
--- a/arch/tile/kernel/time.c
+++ b/arch/tile/kernel/time.c
@@ -162,6 +162,7 @@ static DEFINE_PER_CPU(struct clock_event_device, tile_timer) = {
        .set_next_event = tile_timer_set_next_event,
        .set_state_shutdown = tile_timer_shutdown,
        .set_state_oneshot = tile_timer_shutdown,
+        .set_state_oneshot_stopped = tile_timer_shutdown,
        .tick_resume = tile_timer_shutdown,
 };
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index c60922a66385..236999c54edc 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -22,7 +22,7 @@ obj-y			+= common.o
 obj-y                   += rdrand.o
 obj-y                   += match.o
 obj-y                   += bugs.o
-obj-$(CONFIG_CPU_FREQ)  += aperfmperf.o
+obj-y                   += aperfmperf.o
 obj-$(CONFIG_PROC_FS)   += proc.o
 obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o
diff --git a/arch/x86/kernel/cpu/aperfmperf.c b/arch/x86/kernel/cpu/aperfmperf.c
index 0ee83321a313..957813e0180d 100644
--- a/arch/x86/kernel/cpu/aperfmperf.c
+++ b/arch/x86/kernel/cpu/aperfmperf.c
@@ -42,10 +42,6 @@ static void aperfmperf_snapshot_khz(void *dummy)
        s64 time_delta = ktime_ms_delta(now, s->time);
        unsigned long flags;
-        /* Don't bother re-computing within the cache threshold time. */
-        if (time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
-                return;
        local_irq_save(flags);
        rdmsrl(MSR_IA32_APERF, aperf);
        rdmsrl(MSR_IA32_MPERF, mperf);
@@ -74,6 +70,7 @@ static void aperfmperf_snapshot_khz(void *dummy)
 unsigned int arch_freq_get_on_cpu(int cpu)
 {
+        s64 time_delta;
        unsigned int khz;
        if (!cpu_khz)
@@ -82,6 +79,12 @@ unsigned int arch_freq_get_on_cpu(int cpu)
        if (!static_cpu_has(X86_FEATURE_APERFMPERF))
                return 0;
+        /* Don't bother re-computing within the cache threshold time. */
+        time_delta = ktime_ms_delta(ktime_get(), per_cpu(samples.time, cpu));
+        khz = per_cpu(samples.khz, cpu);
+        if (khz && time_delta < APERFMPERF_CACHE_THRESHOLD_MS)
+                return khz;
        smp_call_function_single(cpu, aperfmperf_snapshot_khz, NULL, 1);
        khz = per_cpu(samples.khz, cpu);
        if (khz)
diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c
index 6b7e17bf0b71..4378a729b933 100644
--- a/arch/x86/kernel/cpu/proc.c
+++ b/arch/x86/kernel/cpu/proc.c
@@ -78,9 +78,11 @@ static int show_cpuinfo(struct seq_file *m, void *v)
                seq_printf(m, "microcode\t: 0x%x\n", c->microcode);
        if (cpu_has(c, X86_FEATURE_TSC)) {
-                unsigned int freq = cpufreq_quick_get(cpu);
+                unsigned int freq = arch_freq_get_on_cpu(cpu);
                if (!freq)
+                        freq = cpufreq_quick_get(cpu);
+                if (!freq)
                        freq = cpu_khz;
                seq_printf(m, "cpu MHz\t\t: %u.%03u\n",
                           freq / 1000, (freq % 1000));
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index d88967659098..5b609e28ce3f 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -79,7 +79,7 @@ static void kvm_get_wallclock(struct timespec *now)
 static int kvm_set_wallclock(const struct timespec *now)
 {
-        return -1;
+        return -ENODEV;
 }
 static u64 kvm_clock_read(void)
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 69c5612be786..36c90d631096 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1992,6 +1992,11 @@ void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event)
                                vcpu->arch.apic_base | MSR_IA32_APICBASE_BSP);
        vcpu->arch.pv_eoi.msr_val = 0;
        apic_update_ppr(apic);
+        if (vcpu->arch.apicv_active) {
+                kvm_x86_ops->apicv_post_state_restore(vcpu);
+                kvm_x86_ops->hwapic_irr_update(vcpu, -1);
+                kvm_x86_ops->hwapic_isr_update(vcpu, -1);
+        }
        vcpu->arch.apic_arb_prio = 0;
        vcpu->arch.apic_attention = 0;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 95a01609d7ee..a6f4f095f8f4 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -5619,9 +5619,6 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event)
        kvm_make_request(KVM_REQ_APIC_PAGE_RELOAD, vcpu);
-        if (kvm_vcpu_apicv_active(vcpu))
-                memset(&vmx->pi_desc, 0, sizeof(struct pi_desc));
        if (vmx->vpid != 0)
                vmcs_write16(VIRTUAL_PROCESSOR_ID, vmx->vpid);
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 25306fa27251..a9020f82eea7 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/drivers/clk/imgtec/clk-boston.c b/drivers/clk/imgtec/clk-boston.c
index f18f10351785..15af423cc0c9 100644
--- a/drivers/clk/imgtec/clk-boston.c
+++ b/drivers/clk/imgtec/clk-boston.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016-2017 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c
index e8248f9185f7..ab393637f7b0 100644
--- a/drivers/clk/ingenic/cgu.c
+++ b/drivers/clk/ingenic/cgu.c
@@ -2,7 +2,7 @@
 * Ingenic SoC CGU driver
 *
 * Copyright (c) 2013-2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/ingenic/cgu.h b/drivers/clk/ingenic/cgu.h
index 09700b2c555d..e78b586536ea 100644
--- a/drivers/clk/ingenic/cgu.h
+++ b/drivers/clk/ingenic/cgu.h
@@ -2,7 +2,7 @@
 * Ingenic SoC CGU driver
 *
 * Copyright (c) 2013-2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/ingenic/jz4740-cgu.c b/drivers/clk/ingenic/jz4740-cgu.c
index 510fe7e0c8f1..32fcc75f6f77 100644
--- a/drivers/clk/ingenic/jz4740-cgu.c
+++ b/drivers/clk/ingenic/jz4740-cgu.c
@@ -2,7 +2,7 @@
 * Ingenic JZ4740 SoC CGU driver
 *
 * Copyright (c) 2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/ingenic/jz4780-cgu.c b/drivers/clk/ingenic/jz4780-cgu.c
index b35d6d9dd5aa..ac3585ed8228 100644
--- a/drivers/clk/ingenic/jz4780-cgu.c
+++ b/drivers/clk/ingenic/jz4780-cgu.c
@@ -2,7 +2,7 @@
 * Ingenic JZ4780 SoC CGU driver
 *
 * Copyright (c) 2013-2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/uniphier/clk-uniphier-sys.c b/drivers/clk/uniphier/clk-uniphier-sys.c
index 0e396f3da526..07f3b91a7daf 100644
--- a/drivers/clk/uniphier/clk-uniphier-sys.c
+++ b/drivers/clk/uniphier/clk-uniphier-sys.c
@@ -233,9 +233,9 @@ const struct uniphier_clk_data uniphier_pxs3_sys_clk_data[] = {
        UNIPHIER_LD20_SYS_CLK_SD,
        UNIPHIER_LD11_SYS_CLK_NAND(2),
        UNIPHIER_LD11_SYS_CLK_EMMC(4),
-        UNIPHIER_CLK_GATE("usb30", 12, NULL, 0x2104, 4),        /* =GIO0 */
+        UNIPHIER_CLK_GATE("usb30", 12, NULL, 0x210c, 4),        /* =GIO0 */
-        UNIPHIER_CLK_GATE("usb31-0", 13, NULL, 0x2104, 5),      /* =GIO1 */
+        UNIPHIER_CLK_GATE("usb31-0", 13, NULL, 0x210c, 5),      /* =GIO1 */
-        UNIPHIER_CLK_GATE("usb31-1", 14, NULL, 0x2104, 6),      /* =GIO1-1 */
+        UNIPHIER_CLK_GATE("usb31-1", 14, NULL, 0x210c, 6),      /* =GIO1-1 */
        UNIPHIER_CLK_GATE("usb30-phy0", 16, NULL, 0x210c, 16),
        UNIPHIER_CLK_GATE("usb30-phy1", 17, NULL, 0x210c, 18),
        UNIPHIER_CLK_GATE("usb30-phy2", 18, NULL, 0x210c, 20),
diff --git a/drivers/cpuidle/cpuidle-cps.c b/drivers/cpuidle/cpuidle-cps.c
index 72b5e47286b4..dac8ff6391fa 100644
--- a/drivers/cpuidle/cpuidle-cps.c
+++ b/drivers/cpuidle/cpuidle-cps.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 2371a92808be..adaa4a964f0c 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -34,13 +34,14 @@ lib-y				:= efi-stub-helper.o gop.o secureboot.o
 lib-$(CONFIG_RESET_ATTACK_MITIGATION) += tpm.o
 # include the stub's generic dependencies from lib/ when building for ARM/arm64
-arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c sort.c
+arm-deps-y := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c
+arm-deps-$(CONFIG_ARM64) += sort.c
 $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
        $(call if_changed_rule,cc_o_c)
 lib-$(CONFIG_EFI_ARMSTUB)       += arm-stub.o fdt.o string.o random.o \
-                                   $(patsubst %.c,lib-%.o,$(arm-deps))
+                                   $(patsubst %.c,lib-%.o,$(arm-deps-y))
 lib-$(CONFIG_ARM)               += arm32-stub.o
 lib-$(CONFIG_ARM64)             += arm64-stub.o
@@ -91,5 +92,4 @@ quiet_cmd_stubcopy = STUBCPY $@
 # explicitly by the decompressor linker script.
 #
 STUBCOPY_FLAGS-$(CONFIG_ARM)    += --rename-section .data=.data.efistub
-STUBCOPY_RM-$(CONFIG_ARM)       += -R ___ksymtab+sort -R ___kcrctab+sort
 STUBCOPY_RELOC-$(CONFIG_ARM)    := R_ARM_ABS
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index a94601d5939e..01a9d78ee415 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -350,7 +350,9 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size,
         * The easiest way to find adjacent regions is to sort the memory map
         * before traversing it.
         */
-        sort(memory_map, map_size / desc_size, desc_size, cmp_mem_desc, NULL);
+        if (IS_ENABLED(CONFIG_ARM64))
+                sort(memory_map, map_size / desc_size, desc_size, cmp_mem_desc,
+                     NULL);
        for (l = 0; l < map_size; l += desc_size, prev = in) {
                u64 paddr, size;
@@ -367,7 +369,8 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size,
                 * a 4k page size kernel to kexec a 64k page size kernel and
                 * vice versa.
                 */
-                if (!regions_are_adjacent(prev, in) ||
+                if ((IS_ENABLED(CONFIG_ARM64) &&
+                     !regions_are_adjacent(prev, in)) ||
                    !regions_have_compatible_memory_type_attrs(prev, in)) {
                        paddr = round_down(in->phys_addr, SZ_64K);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index 430a6b4dfac9..62cd16a23921 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -93,6 +93,10 @@ static int uvd_v6_0_early_init(void *handle)
 {
        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        if (!(adev->flags & AMD_IS_APU) &&
+            (RREG32_SMC(ixCC_HARVEST_FUSES) & CC_HARVEST_FUSES__UVD_DISABLE_MASK))
+                return -ENOENT;
        uvd_v6_0_set_ring_funcs(adev);
        uvd_v6_0_set_irq_funcs(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 90332f55cfba..cf81065e3c5a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -365,15 +365,10 @@ static unsigned vce_v3_0_get_harvest_config(struct amdgpu_device *adev)
 {
        u32 tmp;
-        /* Fiji, Stoney, Polaris10, Polaris11, Polaris12 are single pipe */
        if ((adev->asic_type == CHIP_FIJI) ||
-            (adev->asic_type == CHIP_STONEY) ||
+            (adev->asic_type == CHIP_STONEY))
-            (adev->asic_type == CHIP_POLARIS10) ||
-            (adev->asic_type == CHIP_POLARIS11) ||
-            (adev->asic_type == CHIP_POLARIS12))
                return AMDGPU_VCE_HARVEST_VCE1;
-        /* Tonga and CZ are dual or single pipe */
        if (adev->flags & AMD_IS_APU)
                tmp = (RREG32_SMC(ixVCE_HARVEST_FUSE_MACRO__ADDRESS) &
                       VCE_HARVEST_FUSE_MACRO__MASK) >>
@@ -391,6 +386,11 @@ static unsigned vce_v3_0_get_harvest_config(struct amdgpu_device *adev)
        case 3:
                return AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1;
        default:
+                if ((adev->asic_type == CHIP_POLARIS10) ||
+                    (adev->asic_type == CHIP_POLARIS11) ||
+                    (adev->asic_type == CHIP_POLARIS12))
+                        return AMDGPU_VCE_HARVEST_VCE1;
                return 0;
        }
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 32e857dc507c..dc1faa49687d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2214,8 +2214,10 @@ static void __i915_gem_object_reset_page_iter(struct drm_i915_gem_object *obj)
        struct radix_tree_iter iter;
        void __rcu **slot;
+        rcu_read_lock();
        radix_tree_for_each_slot(slot, &obj->mm.get_page.radix, &iter, 0)
                radix_tree_delete(&obj->mm.get_page.radix, iter.index);
+        rcu_read_unlock();
 }
 void __i915_gem_object_put_pages(struct drm_i915_gem_object *obj,
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 58a2a44f88bd..8afd2ce59b8d 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -104,6 +104,7 @@ static void lut_close(struct i915_gem_context *ctx)
                kmem_cache_free(ctx->i915->luts, lut);
        }
+        rcu_read_lock();
        radix_tree_for_each_slot(slot, &ctx->handles_vma, &iter, 0) {
                struct i915_vma *vma = rcu_dereference_raw(*slot);
                struct drm_i915_gem_object *obj = vma->obj;
@@ -115,6 +116,7 @@ static void lut_close(struct i915_gem_context *ctx)
                __i915_gem_object_release_unless_active(obj);
        }
+        rcu_read_unlock();
 }
 static void i915_gem_context_free(struct i915_gem_context *ctx)
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 92437f455b43..4ac454ae54d7 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -337,6 +337,10 @@ eb_vma_misplaced(const struct drm_i915_gem_exec_object2 *entry,
            (vma->node.start + vma->node.size - 1) >> 32)
                return true;
+        if (flags & __EXEC_OBJECT_NEEDS_MAP &&
+            !i915_vma_is_map_and_fenceable(vma))
+                return true;
        return false;
 }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 5c7828c52d12..5ebdb63330dd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15227,6 +15227,23 @@ void intel_connector_unregister(struct drm_connector *connector)
        intel_panel_destroy_backlight(connector);
 }
+static void intel_hpd_poll_fini(struct drm_device *dev)
+{
+        struct intel_connector *connector;
+        struct drm_connector_list_iter conn_iter;
+        /* First disable polling... */
+        drm_kms_helper_poll_fini(dev);
+        /* Then kill the work that may have been queued by hpd. */
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        for_each_intel_connector_iter(connector, &conn_iter) {
+                if (connector->modeset_retry_work.func)
+                        cancel_work_sync(&connector->modeset_retry_work);
+        }
+        drm_connector_list_iter_end(&conn_iter);
+}
 void intel_modeset_cleanup(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = to_i915(dev);
@@ -15247,7 +15264,7 @@ void intel_modeset_cleanup(struct drm_device *dev)
         * Due to the hpd irq storm handling the hotplug work can re-arm the
         * poll handlers. Hence disable polling after hpd handling is shut down.
         */
-        drm_kms_helper_poll_fini(dev);
+        intel_hpd_poll_fini(dev);
        /* poll work can call into fbdev, hence clean that up afterwards */
        intel_fbdev_fini(dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 203198659ab2..09f274419eea 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -3731,9 +3731,16 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp)
        }
-        /* Read the eDP Display control capabilities registers */
+        /*
-        if ((intel_dp->dpcd[DP_EDP_CONFIGURATION_CAP] & DP_DPCD_DISPLAY_CONTROL_CAPABLE) &&
+         * Read the eDP display control registers.
-            drm_dp_dpcd_read(&intel_dp->aux, DP_EDP_DPCD_REV,
+         *
+         * Do this independent of DP_DPCD_DISPLAY_CONTROL_CAPABLE bit in
+         * DP_EDP_CONFIGURATION_CAP, because some buggy displays do not have it
+         * set, but require eDP 1.4+ detection (e.g. for supported link rates
+         * method). The display control registers should read zero if they're
+         * not supported anyway.
+         */
+        if (drm_dp_dpcd_read(&intel_dp->aux, DP_EDP_DPCD_REV,
                             intel_dp->edp_dpcd, sizeof(intel_dp->edp_dpcd)) ==
                             sizeof(intel_dp->edp_dpcd))
                DRM_DEBUG_KMS("EDP DPCD : %*ph\n", (int) sizeof(intel_dp->edp_dpcd),
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index fa47285918f4..79fbaf78f604 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -496,7 +496,6 @@ struct intel_crtc_scaler_state {
 struct intel_pipe_wm {
        struct intel_wm_level wm[5];
-        struct intel_wm_level raw_wm[5];
        uint32_t linetime;
        bool fbc_wm_enabled;
        bool pipe_enabled;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 0a09f8ff6aff..cb950752c346 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2716,9 +2716,9 @@ static void ilk_compute_wm_level(const struct drm_i915_private *dev_priv,
                                 const struct intel_crtc *intel_crtc,
                                 int level,
                                 struct intel_crtc_state *cstate,
-                                 struct intel_plane_state *pristate,
+                                 const struct intel_plane_state *pristate,
-                                 struct intel_plane_state *sprstate,
+                                 const struct intel_plane_state *sprstate,
-                                 struct intel_plane_state *curstate,
+                                 const struct intel_plane_state *curstate,
                                 struct intel_wm_level *result)
 {
        uint16_t pri_latency = dev_priv->wm.pri_latency[level];
@@ -3038,28 +3038,24 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
        struct intel_pipe_wm *pipe_wm;
        struct drm_device *dev = state->dev;
        const struct drm_i915_private *dev_priv = to_i915(dev);
-        struct intel_plane *intel_plane;
+        struct drm_plane *plane;
-        struct intel_plane_state *pristate = NULL;
+        const struct drm_plane_state *plane_state;
-        struct intel_plane_state *sprstate = NULL;
+        const struct intel_plane_state *pristate = NULL;
-        struct intel_plane_state *curstate = NULL;
+        const struct intel_plane_state *sprstate = NULL;
+        const struct intel_plane_state *curstate = NULL;
        int level, max_level = ilk_wm_max_level(dev_priv), usable_level;
        struct ilk_wm_maximums max;
        pipe_wm = &cstate->wm.ilk.optimal;
-        for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
+        drm_atomic_crtc_state_for_each_plane_state(plane, plane_state, &cstate->base) {
-                struct intel_plane_state *ps;
+                const struct intel_plane_state *ps = to_intel_plane_state(plane_state);
-                ps = intel_atomic_get_existing_plane_state(state,
-                                                           intel_plane);
-                if (!ps)
-                        continue;
-                if (intel_plane->base.type == DRM_PLANE_TYPE_PRIMARY)
+                if (plane->type == DRM_PLANE_TYPE_PRIMARY)
                        pristate = ps;
-                else if (intel_plane->base.type == DRM_PLANE_TYPE_OVERLAY)
+                else if (plane->type == DRM_PLANE_TYPE_OVERLAY)
                        sprstate = ps;
-                else if (intel_plane->base.type == DRM_PLANE_TYPE_CURSOR)
+                else if (plane->type == DRM_PLANE_TYPE_CURSOR)
                        curstate = ps;
        }
@@ -3081,11 +3077,9 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
        if (pipe_wm->sprites_scaled)
                usable_level = 0;
-        ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
-                             pristate, sprstate, curstate, &pipe_wm->raw_wm[0]);
        memset(&pipe_wm->wm, 0, sizeof(pipe_wm->wm));
-        pipe_wm->wm[0] = pipe_wm->raw_wm[0];
+        ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
+                             pristate, sprstate, curstate, &pipe_wm->wm[0]);
        if (IS_HASWELL(dev_priv) || IS_BROADWELL(dev_priv))
                pipe_wm->linetime = hsw_compute_linetime_wm(cstate);
@@ -3095,8 +3089,8 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
        ilk_compute_wm_reg_maximums(dev_priv, 1, &max);
-        for (level = 1; level <= max_level; level++) {
+        for (level = 1; level <= usable_level; level++) {
-                struct intel_wm_level *wm = &pipe_wm->raw_wm[level];
+                struct intel_wm_level *wm = &pipe_wm->wm[level];
                ilk_compute_wm_level(dev_priv, intel_crtc, level, cstate,
                                     pristate, sprstate, curstate, wm);
@@ -3106,13 +3100,10 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
                 * register maximums since such watermarks are
                 * always invalid.
                 */
-                if (level > usable_level)
+                if (!ilk_validate_wm_level(level, &max, wm)) {
-                        continue;
+                        memset(wm, 0, sizeof(*wm));
+                        break;
-                if (ilk_validate_wm_level(level, &max, wm))
+                }
-                        pipe_wm->wm[level] = *wm;
-                else
-                        usable_level = level;
        }
        return 0;
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index e4751f92b342..fb47d46050ec 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -4099,7 +4099,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
 {
        struct nouveau_drm *drm = nouveau_drm(dev);
        struct nv50_disp *disp = nv50_disp(dev);
-        struct drm_plane_state *old_plane_state;
+        struct drm_plane_state *new_plane_state;
        struct drm_plane *plane;
        struct drm_crtc *crtc;
        bool active = false;
@@ -4129,8 +4129,8 @@ nv50_disp_atomic_commit(struct drm_device *dev,
        if (ret)
                goto err_cleanup;
-        for_each_old_plane_in_state(state, plane, old_plane_state, i) {
+        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
-                struct nv50_wndw_atom *asyw = nv50_wndw_atom(old_plane_state);
+                struct nv50_wndw_atom *asyw = nv50_wndw_atom(new_plane_state);
                struct nv50_wndw *wndw = nv50_wndw(plane);
                if (asyw->set.image) {
diff --git a/drivers/input/sparse-keymap.c b/drivers/input/sparse-keymap.c
index bb0349fa64bc..fd03e55768c9 100644
--- a/drivers/input/sparse-keymap.c
+++ b/drivers/input/sparse-keymap.c
@@ -255,6 +255,7 @@ void sparse_keymap_report_entry(struct input_dev *dev, const struct key_entry *k
        case KE_VSW:
                input_report_switch(dev, ke->sw.code, value);
+                input_sync(dev);
                break;
        }
 }
diff --git a/drivers/input/touchscreen/ar1021_i2c.c b/drivers/input/touchscreen/ar1021_i2c.c
index f9dcbd63e598..b35b640fdadf 100644
--- a/drivers/input/touchscreen/ar1021_i2c.c
+++ b/drivers/input/touchscreen/ar1021_i2c.c
@@ -117,6 +117,7 @@ static int ar1021_i2c_probe(struct i2c_client *client,
        input->open = ar1021_i2c_open;
        input->close = ar1021_i2c_close;
+        __set_bit(INPUT_PROP_DIRECT, input->propbit);
        input_set_capability(input, EV_KEY, BTN_TOUCH);
        input_set_abs_params(input, ABS_X, 0, AR1021_MAX_X, 0, 0);
        input_set_abs_params(input, ABS_Y, 0, AR1021_MAX_Y, 0, 0);
diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c
index b283fc90be1e..17a4a7b6cdbb 100644
--- a/drivers/irqchip/irq-mvebu-gicp.c
+++ b/drivers/irqchip/irq-mvebu-gicp.c
@@ -194,6 +194,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev)
                return -ENOMEM;
        gicp->dev = &pdev->dev;
+        spin_lock_init(&gicp->spi_lock);
        gicp->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!gicp->res)
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 860313bd952a..4f2806720c5c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -401,16 +401,37 @@ static u32 dw_mci_prep_stop_abort(struct dw_mci *host, struct mmc_command *cmd)
 static inline void dw_mci_set_cto(struct dw_mci *host)
 {
        unsigned int cto_clks;
+        unsigned int cto_div;
        unsigned int cto_ms;
+        unsigned long irqflags;
        cto_clks = mci_readl(host, TMOUT) & 0xff;
-        cto_ms = DIV_ROUND_UP(cto_clks, host->bus_hz / 1000);
+        cto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
+        if (cto_div == 0)
+                cto_div = 1;
+        cto_ms = DIV_ROUND_UP(MSEC_PER_SEC * cto_clks * cto_div, host->bus_hz);
        /* add a bit spare time */
        cto_ms += 10;
-        mod_timer(&host->cto_timer,
+        /*
-                  jiffies + msecs_to_jiffies(cto_ms) + 1);
+         * The durations we're working with are fairly short so we have to be
+         * extra careful about synchronization here.  Specifically in hardware a
+         * command timeout is _at most_ 5.1 ms, so that means we expect an
+         * interrupt (either command done or timeout) to come rather quickly
+         * after the mci_writel.  ...but just in case we have a long interrupt
+         * latency let's add a bit of paranoia.
+         *
+         * In general we'll assume that at least an interrupt will be asserted
+         * in hardware by the time the cto_timer runs.  ...and if it hasn't
+         * been asserted in hardware by that time then we'll assume it'll never
+         * come.
+         */
+        spin_lock_irqsave(&host->irq_lock, irqflags);
+        if (!test_bit(EVENT_CMD_COMPLETE, &host->pending_events))
+                mod_timer(&host->cto_timer,
+                        jiffies + msecs_to_jiffies(cto_ms) + 1);
+        spin_unlock_irqrestore(&host->irq_lock, irqflags);
 }
 static void dw_mci_start_command(struct dw_mci *host,
@@ -425,11 +446,11 @@ static void dw_mci_start_command(struct dw_mci *host,
        wmb(); /* drain writebuffer */
        dw_mci_wait_while_busy(host, cmd_flags);
+        mci_writel(host, CMD, cmd_flags | SDMMC_CMD_START);
        /* response expected command only */
        if (cmd_flags & SDMMC_CMD_RESP_EXP)
                dw_mci_set_cto(host);
-        mci_writel(host, CMD, cmd_flags | SDMMC_CMD_START);
 }
 static inline void send_stop_abort(struct dw_mci *host, struct mmc_data *data)
@@ -1915,10 +1936,15 @@ static int dw_mci_data_complete(struct dw_mci *host, struct mmc_data *data)
 static void dw_mci_set_drto(struct dw_mci *host)
 {
        unsigned int drto_clks;
+        unsigned int drto_div;
        unsigned int drto_ms;
        drto_clks = mci_readl(host, TMOUT) >> 8;
-        drto_ms = DIV_ROUND_UP(drto_clks, host->bus_hz / 1000);
+        drto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
+        if (drto_div == 0)
+                drto_div = 1;
+        drto_ms = DIV_ROUND_UP(MSEC_PER_SEC * drto_clks * drto_div,
+                               host->bus_hz);
        /* add a bit spare time */
        drto_ms += 10;
@@ -1926,6 +1952,24 @@ static void dw_mci_set_drto(struct dw_mci *host)
        mod_timer(&host->dto_timer, jiffies + msecs_to_jiffies(drto_ms));
 }
+static bool dw_mci_clear_pending_cmd_complete(struct dw_mci *host)
+{
+        if (!test_bit(EVENT_CMD_COMPLETE, &host->pending_events))
+                return false;
+        /*
+         * Really be certain that the timer has stopped.  This is a bit of
+         * paranoia and could only really happen if we had really bad
+         * interrupt latency and the interrupt routine and timeout were
+         * running concurrently so that the del_timer() in the interrupt
+         * handler couldn't run.
+         */
+        WARN_ON(del_timer_sync(&host->cto_timer));
+        clear_bit(EVENT_CMD_COMPLETE, &host->pending_events);
+        return true;
+}
 static void dw_mci_tasklet_func(unsigned long priv)
 {
        struct dw_mci *host = (struct dw_mci *)priv;
@@ -1952,8 +1996,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
                case STATE_SENDING_CMD11:
                case STATE_SENDING_CMD:
-                        if (!test_and_clear_bit(EVENT_CMD_COMPLETE,
+                        if (!dw_mci_clear_pending_cmd_complete(host))
-                                                &host->pending_events))
                                break;
                        cmd = host->cmd;
@@ -2122,8 +2165,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
                        /* fall through */
                case STATE_SENDING_STOP:
-                        if (!test_and_clear_bit(EVENT_CMD_COMPLETE,
+                        if (!dw_mci_clear_pending_cmd_complete(host))
-                                                &host->pending_events))
                                break;
                        /* CMD error in data command */
@@ -2570,6 +2612,8 @@ done:
 static void dw_mci_cmd_interrupt(struct dw_mci *host, u32 status)
 {
+        del_timer(&host->cto_timer);
        if (!host->cmd_status)
                host->cmd_status = status;
@@ -2594,6 +2638,7 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
        struct dw_mci *host = dev_id;
        u32 pending;
        struct dw_mci_slot *slot = host->slot;
+        unsigned long irqflags;
        pending = mci_readl(host, MINTSTS); /* read-only mask reg */
@@ -2601,8 +2646,6 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                /* Check volt switch first, since it can look like an error */
                if ((host->state == STATE_SENDING_CMD11) &&
                    (pending & SDMMC_INT_VOLT_SWITCH)) {
-                        unsigned long irqflags;
                        mci_writel(host, RINTSTS, SDMMC_INT_VOLT_SWITCH);
                        pending &= ~SDMMC_INT_VOLT_SWITCH;
@@ -2618,11 +2661,15 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                }
                if (pending & DW_MCI_CMD_ERROR_FLAGS) {
+                        spin_lock_irqsave(&host->irq_lock, irqflags);
                        del_timer(&host->cto_timer);
                        mci_writel(host, RINTSTS, DW_MCI_CMD_ERROR_FLAGS);
                        host->cmd_status = pending;
                        smp_wmb(); /* drain writebuffer */
                        set_bit(EVENT_CMD_COMPLETE, &host->pending_events);
+                        spin_unlock_irqrestore(&host->irq_lock, irqflags);
                }
                if (pending & DW_MCI_DATA_ERROR_FLAGS) {
@@ -2662,9 +2709,12 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                }
                if (pending & SDMMC_INT_CMD_DONE) {
-                        del_timer(&host->cto_timer);
+                        spin_lock_irqsave(&host->irq_lock, irqflags);
                        mci_writel(host, RINTSTS, SDMMC_INT_CMD_DONE);
                        dw_mci_cmd_interrupt(host, pending);
+                        spin_unlock_irqrestore(&host->irq_lock, irqflags);
                }
                if (pending & SDMMC_INT_CD) {
@@ -2938,7 +2988,35 @@ static void dw_mci_cmd11_timer(unsigned long arg)
 static void dw_mci_cto_timer(unsigned long arg)
 {
        struct dw_mci *host = (struct dw_mci *)arg;
+        unsigned long irqflags;
+        u32 pending;
+        spin_lock_irqsave(&host->irq_lock, irqflags);
+        /*
+         * If somehow we have very bad interrupt latency it's remotely possible
+         * that the timer could fire while the interrupt is still pending or
+         * while the interrupt is midway through running.  Let's be paranoid
+         * and detect those two cases.  Note that this is paranoia is somewhat
+         * justified because in this function we don't actually cancel the
+         * pending command in the controller--we just assume it will never come.
+         */
+        pending = mci_readl(host, MINTSTS); /* read-only mask reg */
+        if (pending & (DW_MCI_CMD_ERROR_FLAGS | SDMMC_INT_CMD_DONE)) {
+                /* The interrupt should fire; no need to act but we can warn */
+                dev_warn(host->dev, "Unexpected interrupt latency\n");
+                goto exit;
+        }
+        if (test_bit(EVENT_CMD_COMPLETE, &host->pending_events)) {
+                /* Presumably interrupt handler couldn't delete the timer */
+                dev_warn(host->dev, "CTO timeout when already completed\n");
+                goto exit;
+        }
+        /*
+         * Continued paranoia to make sure we're in the state we expect.
+         * This paranoia isn't really justified but it seems good to be safe.
+         */
        switch (host->state) {
        case STATE_SENDING_CMD11:
        case STATE_SENDING_CMD:
@@ -2957,6 +3035,9 @@ static void dw_mci_cto_timer(unsigned long arg)
                         host->state);
                break;
        }
+exit:
+        spin_unlock_irqrestore(&host->irq_lock, irqflags);
 }
 static void dw_mci_dto_timer(unsigned long arg)
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 83eec9a8c275..eb441e5e2cd8 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1809,15 +1809,17 @@ static inline void bcm_sysport_mask_all_intrs(struct bcm_sysport_priv *priv)
 static inline void gib_set_pad_extension(struct bcm_sysport_priv *priv)
 {
-        u32 __maybe_unused reg;
+        u32 reg;
-        /* Include Broadcom tag in pad extension */
+        reg = gib_readl(priv, GIB_CONTROL);
+        /* Include Broadcom tag in pad extension and fix up IPG_LENGTH */
        if (netdev_uses_dsa(priv->netdev)) {
-                reg = gib_readl(priv, GIB_CONTROL);
                reg &= ~(GIB_PAD_EXTENSION_MASK << GIB_PAD_EXTENSION_SHIFT);
                reg |= ENET_BRCM_TAG_LEN << GIB_PAD_EXTENSION_SHIFT;
-                gib_writel(priv, reg, GIB_CONTROL);
        }
+        reg &= ~(GIB_IPG_LEN_MASK << GIB_IPG_LEN_SHIFT);
+        reg |= 12 << GIB_IPG_LEN_SHIFT;
+        gib_writel(priv, reg, GIB_CONTROL);
 }
 static int bcm_sysport_open(struct net_device *dev)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 6383695004a5..195eb7e71473 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -168,8 +168,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
        }
        /* Processing RX queues common config */
-        if (of_property_read_u8(rx_node, "snps,rx-queues-to-use",
+        if (of_property_read_u32(rx_node, "snps,rx-queues-to-use",
-                                &plat->rx_queues_to_use))
+                                 &plat->rx_queues_to_use))
                plat->rx_queues_to_use = 1;
        if (of_property_read_bool(rx_node, "snps,rx-sched-sp"))
@@ -191,8 +191,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
                else
                        plat->rx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
-                if (of_property_read_u8(q_node, "snps,map-to-dma-channel",
+                if (of_property_read_u32(q_node, "snps,map-to-dma-channel",
-                                        &plat->rx_queues_cfg[queue].chan))
+                                         &plat->rx_queues_cfg[queue].chan))
                        plat->rx_queues_cfg[queue].chan = queue;
                /* TODO: Dynamic mapping to be included in the future */
@@ -222,8 +222,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
        }
        /* Processing TX queues common config */
-        if (of_property_read_u8(tx_node, "snps,tx-queues-to-use",
+        if (of_property_read_u32(tx_node, "snps,tx-queues-to-use",
-                                &plat->tx_queues_to_use))
+                                 &plat->tx_queues_to_use))
                plat->tx_queues_to_use = 1;
        if (of_property_read_bool(tx_node, "snps,tx-sched-wrr"))
@@ -244,8 +244,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
                if (queue >= plat->tx_queues_to_use)
                        break;
-                if (of_property_read_u8(q_node, "snps,weight",
+                if (of_property_read_u32(q_node, "snps,weight",
-                                        &plat->tx_queues_cfg[queue].weight))
+                                         &plat->tx_queues_cfg[queue].weight))
                        plat->tx_queues_cfg[queue].weight = 0x10 + queue;
                if (of_property_read_bool(q_node, "snps,dcb-algorithm")) {
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 9b243e6f3008..7dc3bcac3506 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1165,7 +1165,7 @@ static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
        frh->family = family;
        frh->action = FR_ACT_TO_TBL;
-        if (nla_put_u32(skb, FRA_L3MDEV, 1))
+        if (nla_put_u8(skb, FRA_L3MDEV, 1))
                goto nla_put_failure;
        if (nla_put_u32(skb, FRA_PRIORITY, FIB_RULE_PREF))
diff --git a/drivers/power/reset/piix4-poweroff.c b/drivers/power/reset/piix4-poweroff.c
index bacfc95783f0..20ce3ff5e039 100644
--- a/drivers/power/reset/piix4-poweroff.c
+++ b/drivers/power/reset/piix4-poweroff.c
@@ -1,6 +1,6 @@
 /*
 * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -109,5 +109,5 @@ static struct pci_driver piix4_poweroff_driver = {
 };
 module_pci_driver(piix4_poweroff_driver);
-MODULE_AUTHOR("Paul Burton <paul.burton@imgtec.com>");
+MODULE_AUTHOR("Paul Burton <paul.burton@mips.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 3bd956d3bc5d..dce42a416876 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3212,6 +3212,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                ql_log(ql_log_fatal, base_vha, 0x00ed,
                    "Failed to start DPC thread.\n");
                ret = PTR_ERR(ha->dpc_thread);
+                ha->dpc_thread = NULL;
                goto probe_failed;
        }
        ql_dbg(ql_dbg_init, base_vha, 0x00ee,
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 59073e9f01a4..ed113ea17aff 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -842,9 +842,12 @@ static int hugetlbfs_error_remove_page(struct address_space *mapping,
                                struct page *page)
 {
        struct inode *inode = mapping->host;
+        pgoff_t index = page->index;
        remove_huge_page(page);
-        hugetlb_fix_reserve_counts(inode);
+        if (unlikely(hugetlb_unreserve_pages(inode, index, index + 1, 1)))
+                hugetlb_fix_reserve_counts(inode);
        return 0;
 }
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index a177eae3aa1a..addd7c5f2d3e 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -7304,13 +7304,24 @@ out:
 static int ocfs2_trim_extent(struct super_block *sb,
                             struct ocfs2_group_desc *gd,
-                             u32 start, u32 count)
+                             u64 group, u32 start, u32 count)
 {
        u64 discard, bcount;
+        struct ocfs2_super *osb = OCFS2_SB(sb);
        bcount = ocfs2_clusters_to_blocks(sb, count);
-        discard = le64_to_cpu(gd->bg_blkno) +
+        discard = ocfs2_clusters_to_blocks(sb, start);
-                        ocfs2_clusters_to_blocks(sb, start);
+        /*
+         * For the first cluster group, the gd->bg_blkno is not at the start
+         * of the group, but at an offset from the start. If we add it while
+         * calculating discard for first group, we will wrongly start fstrim a
+         * few blocks after the desried start block and the range can cross
+         * over into the next cluster group. So, add it only if this is not
+         * the first cluster group.
+         */
+        if (group != osb->first_cluster_group_blkno)
+                discard += le64_to_cpu(gd->bg_blkno);
        trace_ocfs2_trim_extent(sb, (unsigned long long)discard, bcount);
@@ -7318,7 +7329,7 @@ static int ocfs2_trim_extent(struct super_block *sb,
 }
 static int ocfs2_trim_group(struct super_block *sb,
-                            struct ocfs2_group_desc *gd,
+                            struct ocfs2_group_desc *gd, u64 group,
                            u32 start, u32 max, u32 minbits)
 {
        int ret = 0, count = 0, next;
@@ -7337,7 +7348,7 @@ static int ocfs2_trim_group(struct super_block *sb,
                next = ocfs2_find_next_bit(bitmap, max, start);
                if ((next - start) >= minbits) {
-                        ret = ocfs2_trim_extent(sb, gd,
+                        ret = ocfs2_trim_extent(sb, gd, group,
                                                start, next - start);
                        if (ret < 0) {
                                mlog_errno(ret);
@@ -7435,7 +7446,8 @@ int ocfs2_trim_fs(struct super_block *sb, struct fstrim_range *range)
                }
                gd = (struct ocfs2_group_desc *)gd_bh->b_data;
-                cnt = ocfs2_trim_group(sb, gd, first_bit, last_bit, minlen);
+                cnt = ocfs2_trim_group(sb, gd, group,
+                                       first_bit, last_bit, minlen);
                brelse(gd_bh);
                gd_bh = NULL;
                if (cnt < 0) {
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 280282b05bc7..6744bd706ecf 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1311,13 +1311,15 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
                pmd_t pmd = *pmdp;
                struct page *page = NULL;
-                if ((vma->vm_flags & VM_SOFTDIRTY) || pmd_soft_dirty(pmd))
+                if (vma->vm_flags & VM_SOFTDIRTY)
                        flags |= PM_SOFT_DIRTY;
                if (pmd_present(pmd)) {
                        page = pmd_page(pmd);
                        flags |= PM_PRESENT;
+                        if (pmd_soft_dirty(pmd))
+                                flags |= PM_SOFT_DIRTY;
                        if (pm->show_pfn)
                                frame = pmd_pfn(pmd) +
                                        ((addr & ~PMD_MASK) >> PAGE_SHIFT);
@@ -1329,6 +1331,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end,
                        frame = swp_type(entry) |
                                (swp_offset(entry) << MAX_SWAPFILES_SHIFT);
                        flags |= PM_SWAP;
+                        if (pmd_swp_soft_dirty(pmd))
+                                flags |= PM_SOFT_DIRTY;
                        VM_BUG_ON(!is_pmd_migration_entry(pmd));
                        page = migration_entry_to_page(entry);
                }
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index fd8697aa4f73..202710420d6d 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -191,13 +191,13 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
        asm("%c0:\n\t"                                                  \
            ".pushsection .discard.reachable\n\t"                       \
            ".long %c0b - .\n\t"                                        \
-            ".popsection\n\t" : : "i" (__LINE__));                      \
+            ".popsection\n\t" : : "i" (__COUNTER__));                   \
 })
 #define annotate_unreachable() ({                                       \
        asm("%c0:\n\t"                                                  \
            ".pushsection .discard.unreachable\n\t"                     \
            ".long %c0b - .\n\t"                                        \
-            ".popsection\n\t" : : "i" (__LINE__));                      \
+            ".popsection\n\t" : : "i" (__COUNTER__));                   \
 })
 #define ASM_UNREACHABLE                                                 \
        "999:\n\t"                                                      \
diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
index 108739ff9223..32feac5bbd75 100644
--- a/include/linux/stmmac.h
+++ b/include/linux/stmmac.h
@@ -126,14 +126,14 @@ struct stmmac_axi {
 struct stmmac_rxq_cfg {
        u8 mode_to_use;
-        u8 chan;
+        u32 chan;
        u8 pkt_route;
        bool use_prio;
        u32 prio;
 };
 struct stmmac_txq_cfg {
-        u8 weight;
+        u32 weight;
        u8 mode_to_use;
        /* Credit Base Shaper parameters */
        u32 send_slope;
@@ -168,8 +168,8 @@ struct plat_stmmacenet_data {
        int unicast_filter_entries;
        int tx_fifo_size;
        int rx_fifo_size;
-        u8 rx_queues_to_use;
+        u32 rx_queues_to_use;
-        u8 tx_queues_to_use;
+        u32 tx_queues_to_use;
        u8 rx_sched_algorithm;
        u8 tx_sched_algorithm;
        struct stmmac_rxq_cfg rx_queues_cfg[MTL_MAX_RX_QUEUES];
diff --git a/include/linux/swap.h b/include/linux/swap.h
index b489bd77bbdc..f02fb5db8914 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -266,6 +266,10 @@ struct swap_info_struct {
                                         * both locks need hold, hold swap_lock
                                         * first.
                                         */
+        spinlock_t cont_lock;           /*
+                                         * protect swap count continuation page
+                                         * list.
+                                         */
        struct work_struct discard_work; /* discard worker */
        struct swap_cluster_list discard_clusters; /* discard clusters list */
 };
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 97a908ac424d..1e6df0eb058f 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -14,6 +14,7 @@
 struct tcf_idrinfo {
        spinlock_t      lock;
        struct idr      action_idr;
+        struct net      *net;
 };
 struct tc_action_ops;
@@ -105,7 +106,7 @@ struct tc_action_net {
 static inline
 int tc_action_net_init(struct tc_action_net *tn,
-                       const struct tc_action_ops *ops)
+                       const struct tc_action_ops *ops, struct net *net)
 {
        int err = 0;
@@ -113,6 +114,7 @@ int tc_action_net_init(struct tc_action_net *tn,
        if (!tn->idrinfo)
                return -ENOMEM;
        tn->ops = ops;
+        tn->idrinfo->net = net;
        spin_lock_init(&tn->idrinfo->lock);
        idr_init(&tn->idrinfo->action_idr);
        return err;
@@ -123,7 +125,9 @@ void tcf_idrinfo_destroy(const struct tc_action_ops *ops,
 static inline void tc_action_net_exit(struct tc_action_net *tn)
 {
+        rtnl_lock();
        tcf_idrinfo_destroy(tn->ops, tn->idrinfo);
+        rtnl_unlock();
        kfree(tn->idrinfo);
 }
diff --git a/kernel/futex.c b/kernel/futex.c
index 0d638f008bb1..76ed5921117a 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -903,11 +903,27 @@ void exit_pi_state_list(struct task_struct *curr)
         */
        raw_spin_lock_irq(&curr->pi_lock);
        while (!list_empty(head)) {
                next = head->next;
                pi_state = list_entry(next, struct futex_pi_state, list);
                key = pi_state->key;
                hb = hash_futex(&key);
+                /*
+                 * We can race against put_pi_state() removing itself from the
+                 * list (a waiter going away). put_pi_state() will first
+                 * decrement the reference count and then modify the list, so
+                 * its possible to see the list entry but fail this reference
+                 * acquire.
+                 *
+                 * In that case; drop the locks to let put_pi_state() make
+                 * progress and retry the loop.
+                 */
+                if (!atomic_inc_not_zero(&pi_state->refcount)) {
+                        raw_spin_unlock_irq(&curr->pi_lock);
+                        cpu_relax();
+                        raw_spin_lock_irq(&curr->pi_lock);
+                        continue;
+                }
                raw_spin_unlock_irq(&curr->pi_lock);
                spin_lock(&hb->lock);
@@ -918,8 +934,10 @@ void exit_pi_state_list(struct task_struct *curr)
                 * task still owns the PI-state:
                 */
                if (head->next != next) {
+                        /* retain curr->pi_lock for the loop invariant */
                        raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
                        spin_unlock(&hb->lock);
+                        put_pi_state(pi_state);
                        continue;
                }
@@ -927,9 +945,8 @@ void exit_pi_state_list(struct task_struct *curr)
                WARN_ON(list_empty(&pi_state->list));
                list_del_init(&pi_state->list);
                pi_state->owner = NULL;
-                raw_spin_unlock(&curr->pi_lock);
-                get_pi_state(pi_state);
+                raw_spin_unlock(&curr->pi_lock);
                raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
                spin_unlock(&hb->lock);
diff --git a/kernel/watchdog_hld.c b/kernel/watchdog_hld.c
index 4583feb66393..e449a23e9d59 100644
--- a/kernel/watchdog_hld.c
+++ b/kernel/watchdog_hld.c
@@ -13,6 +13,7 @@
 #define pr_fmt(fmt) "NMI watchdog: " fmt
 #include <linux/nmi.h>
+#include <linux/atomic.h>
 #include <linux/module.h>
 #include <linux/sched/debug.h>
@@ -22,10 +23,11 @@
 static DEFINE_PER_CPU(bool, hard_watchdog_warn);
 static DEFINE_PER_CPU(bool, watchdog_nmi_touch);
 static DEFINE_PER_CPU(struct perf_event *, watchdog_ev);
+static DEFINE_PER_CPU(struct perf_event *, dead_event);
 static struct cpumask dead_events_mask;
 static unsigned long hardlockup_allcpu_dumped;
-static unsigned int watchdog_cpus;
+static atomic_t watchdog_cpus = ATOMIC_INIT(0);
 void arch_touch_nmi_watchdog(void)
 {
@@ -189,7 +191,8 @@ void hardlockup_detector_perf_enable(void)
        if (hardlockup_detector_event_create())
                return;
-        if (!watchdog_cpus++)
+        /* use original value for check */
+        if (!atomic_fetch_inc(&watchdog_cpus))
                pr_info("Enabled. Permanently consumes one hw-PMU counter.\n");
        perf_event_enable(this_cpu_read(watchdog_ev));
@@ -204,8 +207,10 @@ void hardlockup_detector_perf_disable(void)
        if (event) {
                perf_event_disable(event);
+                this_cpu_write(watchdog_ev, NULL);
+                this_cpu_write(dead_event, event);
                cpumask_set_cpu(smp_processor_id(), &dead_events_mask);
-                watchdog_cpus--;
+                atomic_dec(&watchdog_cpus);
        }
 }
@@ -219,7 +224,7 @@ void hardlockup_detector_perf_cleanup(void)
        int cpu;
        for_each_cpu(cpu, &dead_events_mask) {
-                struct perf_event *event = per_cpu(watchdog_ev, cpu);
+                struct perf_event *event = per_cpu(dead_event, cpu);
                /*
                 * Required because for_each_cpu() reports  unconditionally
@@ -227,7 +232,7 @@ void hardlockup_detector_perf_cleanup(void)
                 */
                if (event)
                        perf_event_release_kernel(event);
-                per_cpu(watchdog_ev, cpu) = NULL;
+                per_cpu(dead_event, cpu) = NULL;
        }
        cpumask_clear(&dead_events_mask);
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 269b5df58543..1981ed697dab 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -941,6 +941,9 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                                pmd = pmd_swp_mksoft_dirty(pmd);
                        set_pmd_at(src_mm, addr, src_pmd, pmd);
                }
+                add_mm_counter(dst_mm, MM_ANONPAGES, HPAGE_PMD_NR);
+                atomic_long_inc(&dst_mm->nr_ptes);
+                pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable);
                set_pmd_at(dst_mm, addr, dst_pmd, pmd);
                ret = 0;
                goto out_unlock;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 424b0ef08a60..2d2ff5e8bf2b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3984,6 +3984,9 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
                            unsigned long src_addr,
                            struct page **pagep)
 {
+        struct address_space *mapping;
+        pgoff_t idx;
+        unsigned long size;
        int vm_shared = dst_vma->vm_flags & VM_SHARED;
        struct hstate *h = hstate_vma(dst_vma);
        pte_t _dst_pte;
@@ -4021,13 +4024,24 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
        __SetPageUptodate(page);
        set_page_huge_active(page);
+        mapping = dst_vma->vm_file->f_mapping;
+        idx = vma_hugecache_offset(h, dst_vma, dst_addr);
        /*
         * If shared, add to page cache
         */
        if (vm_shared) {
-                struct address_space *mapping = dst_vma->vm_file->f_mapping;
+                size = i_size_read(mapping->host) >> huge_page_shift(h);
-                pgoff_t idx = vma_hugecache_offset(h, dst_vma, dst_addr);
+                ret = -EFAULT;
+                if (idx >= size)
+                        goto out_release_nounlock;
+                /*
+                 * Serialization between remove_inode_hugepages() and
+                 * huge_add_to_page_cache() below happens through the
+                 * hugetlb_fault_mutex_table that here must be hold by
+                 * the caller.
+                 */
                ret = huge_add_to_page_cache(page, mapping, idx);
                if (ret)
                        goto out_release_nounlock;
@@ -4036,6 +4050,20 @@ int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm,
        ptl = huge_pte_lockptr(h, dst_mm, dst_pte);
        spin_lock(ptl);
+        /*
+         * Recheck the i_size after holding PT lock to make sure not
+         * to leave any page mapped (as page_mapped()) beyond the end
+         * of the i_size (remove_inode_hugepages() is strict about
+         * enforcing that). If we bail out here, we'll also leave a
+         * page in the radix tree in the vm_shared case beyond the end
+         * of the i_size, but remove_inode_hugepages() will take care
+         * of it as soon as we drop the hugetlb_fault_mutex_table.
+         */
+        size = i_size_read(mapping->host) >> huge_page_shift(h);
+        ret = -EFAULT;
+        if (idx >= size)
+                goto out_release_unlock;
        ret = -EEXIST;
        if (!huge_pte_none(huge_ptep_get(dst_pte)))
                goto out_release_unlock;
diff --git a/mm/swapfile.c b/mm/swapfile.c
index bf91dc9e7a79..e47a21e64764 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2869,6 +2869,7 @@ static struct swap_info_struct *alloc_swap_info(void)
        p->flags = SWP_USED;
        spin_unlock(&swap_lock);
        spin_lock_init(&p->lock);
+        spin_lock_init(&p->cont_lock);
        return p;
 }
@@ -3545,6 +3546,7 @@ int add_swap_count_continuation(swp_entry_t entry, gfp_t gfp_mask)
        head = vmalloc_to_page(si->swap_map + offset);
        offset &= ~PAGE_MASK;
+        spin_lock(&si->cont_lock);
        /*
         * Page allocation does not initialize the page's lru field,
         * but it does always reset its private field.
@@ -3564,7 +3566,7 @@ int add_swap_count_continuation(swp_entry_t entry, gfp_t gfp_mask)
                 * a continuation page, free our allocation and use this one.
                 */
                if (!(count & COUNT_CONTINUED))
-                        goto out;
+                        goto out_unlock_cont;
                map = kmap_atomic(list_page) + offset;
                count = *map;
@@ -3575,11 +3577,13 @@ int add_swap_count_continuation(swp_entry_t entry, gfp_t gfp_mask)
                 * free our allocation and use this one.
                 */
                if ((count & ~COUNT_CONTINUED) != SWAP_CONT_MAX)
-                        goto out;
+                        goto out_unlock_cont;
        }
        list_add_tail(&page->lru, &head->lru);
        page = NULL;                    /* now it's attached, don't free it */
+out_unlock_cont:
+        spin_unlock(&si->cont_lock);
 out:
        unlock_cluster(ci);
        spin_unlock(&si->lock);
@@ -3604,6 +3608,7 @@ static bool swap_count_continued(struct swap_info_struct *si,
        struct page *head;
        struct page *page;
        unsigned char *map;
+        bool ret;
        head = vmalloc_to_page(si->swap_map + offset);
        if (page_private(head) != SWP_CONTINUED) {
@@ -3611,6 +3616,7 @@ static bool swap_count_continued(struct swap_info_struct *si,
                return false;           /* need to add count continuation */
        }
+        spin_lock(&si->cont_lock);
        offset &= ~PAGE_MASK;
        page = list_entry(head->lru.next, struct page, lru);
        map = kmap_atomic(page) + offset;
@@ -3631,8 +3637,10 @@ static bool swap_count_continued(struct swap_info_struct *si,
                if (*map == SWAP_CONT_MAX) {
                        kunmap_atomic(map);
                        page = list_entry(page->lru.next, struct page, lru);
-                        if (page == head)
+                        if (page == head) {
-                                return false;   /* add count continuation */
+                                ret = false;    /* add count continuation */
+                                goto out;
+                        }
                        map = kmap_atomic(page) + offset;
 init_map:               *map = 0;               /* we didn't zero the page */
                }
@@ -3645,7 +3653,7 @@ init_map:		*map = 0;		/* we didn't zero the page */
                        kunmap_atomic(map);
                        page = list_entry(page->lru.prev, struct page, lru);
                }
-                return true;                    /* incremented */
+                ret = true;                     /* incremented */
        } else {                                /* decrementing */
                /*
@@ -3671,8 +3679,11 @@ init_map:		*map = 0;		/* we didn't zero the page */
                        kunmap_atomic(map);
                        page = list_entry(page->lru.prev, struct page, lru);
                }
-                return count == COUNT_CONTINUED;
+                ret = count == COUNT_CONTINUED;
        }
+out:
+        spin_unlock(&si->cont_lock);
+        return ret;
 }
 /*
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 57a5d48acee8..01ed22139ac2 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1365,8 +1365,6 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
            nla_put_in_addr(skb, RTA_PREFSRC, fi->fib_prefsrc))
                goto nla_put_failure;
        if (fi->fib_nhs == 1) {
-                struct in_device *in_dev;
                if (fi->fib_nh->nh_gw &&
                    nla_put_in_addr(skb, RTA_GATEWAY, fi->fib_nh->nh_gw))
                        goto nla_put_failure;
@@ -1374,10 +1372,14 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
                    nla_put_u32(skb, RTA_OIF, fi->fib_nh->nh_oif))
                        goto nla_put_failure;
                if (fi->fib_nh->nh_flags & RTNH_F_LINKDOWN) {
-                        in_dev = __in_dev_get_rtnl(fi->fib_nh->nh_dev);
+                        struct in_device *in_dev;
+                        rcu_read_lock();
+                        in_dev = __in_dev_get_rcu(fi->fib_nh->nh_dev);
                        if (in_dev &&
                            IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev))
                                rtm->rtm_flags |= RTNH_F_DEAD;
+                        rcu_read_unlock();
                }
                if (fi->fib_nh->nh_flags & RTNH_F_OFFLOAD)
                        rtm->rtm_flags |= RTNH_F_OFFLOAD;
@@ -1400,18 +1402,20 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event,
                        goto nla_put_failure;
                for_nexthops(fi) {
-                        struct in_device *in_dev;
                        rtnh = nla_reserve_nohdr(skb, sizeof(*rtnh));
                        if (!rtnh)
                                goto nla_put_failure;
                        rtnh->rtnh_flags = nh->nh_flags & 0xFF;
                        if (nh->nh_flags & RTNH_F_LINKDOWN) {
-                                in_dev = __in_dev_get_rtnl(nh->nh_dev);
+                                struct in_device *in_dev;
+                                rcu_read_lock();
+                                in_dev = __in_dev_get_rcu(nh->nh_dev);
                                if (in_dev &&
                                    IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev))
                                        rtnh->rtnh_flags |= RTNH_F_DEAD;
+                                rcu_read_unlock();
                        }
                        rtnh->rtnh_hops = nh->nh_weight - 1;
                        rtnh->rtnh_ifindex = nh->nh_oif;
diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c
index eeacbdaf7cdf..5cd06ba3535d 100644
--- a/net/ipv4/netfilter/nf_reject_ipv4.c
+++ b/net/ipv4/netfilter/nf_reject_ipv4.c
@@ -132,6 +132,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook)
        if (ip_route_me_harder(net, nskb, RTN_UNSPEC))
                goto free_nskb;
+        niph = ip_hdr(nskb);
        /* "Never happens" */
        if (nskb->len > dst_mtu(skb_dst(nskb)))
                goto free_nskb;
diff --git a/net/ipv4/tcp_nv.c b/net/ipv4/tcp_nv.c
index 1ff73982e28c..125fc1450b01 100644
--- a/net/ipv4/tcp_nv.c
+++ b/net/ipv4/tcp_nv.c
@@ -252,7 +252,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)
        /* rate in 100's bits per second */
        rate64 = ((u64)sample->in_flight) * 8000000;
-        rate = (u32)div64_u64(rate64, (u64)(avg_rtt * 100));
+        rate = (u32)div64_u64(rate64, (u64)(avg_rtt ?: 1) * 100);
        /* Remember the maximum rate seen during this RTT
         * Note: It may be more than one RTT. This function should be
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 823003eef3a2..478909f4694d 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3180,13 +3180,8 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst,
        th->source = htons(ireq->ir_num);
        th->dest = ireq->ir_rmt_port;
        skb->mark = ireq->ir_mark;
-        /* Setting of flags are superfluous here for callers (and ECE is
+        skb->ip_summed = CHECKSUM_PARTIAL;
-         * not even correctly set)
+        th->seq = htonl(tcp_rsk(req)->snt_isn);
-         */
-        tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn,
-                             TCPHDR_SYN | TCPHDR_ACK);
-        th->seq = htonl(TCP_SKB_CB(skb)->seq);
        /* XXX data is queued and acked as is. No buffer/window check */
        th->ack_seq = htonl(tcp_rsk(req)->rcv_nxt);
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 0fa01d772c5e..9c0d5a7ce5f9 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -643,7 +643,6 @@ nft_hash_select_ops(const struct nft_ctx *ctx, const struct nft_set_desc *desc,
 {
        if (desc->size) {
                switch (desc->klen) {
-                case 2:
                case 4:
                        return &nft_hash_fast_ops;
                default:
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index da6fa82c98a8..ca2ff0b3123f 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -78,6 +78,7 @@ static void tcf_idr_remove(struct tcf_idrinfo *idrinfo, struct tc_action *p)
        spin_lock_bh(&idrinfo->lock);
        idr_remove_ext(&idrinfo->action_idr, p->tcfa_index);
        spin_unlock_bh(&idrinfo->lock);
+        put_net(idrinfo->net);
        gen_kill_estimator(&p->tcfa_rate_est);
        free_tcf(p);
 }
@@ -86,6 +87,8 @@ int __tcf_idr_release(struct tc_action *p, bool bind, bool strict)
 {
        int ret = 0;
+        ASSERT_RTNL();
        if (p) {
                if (bind)
                        p->tcfa_bindcnt--;
@@ -334,6 +337,7 @@ err3:
        p->idrinfo = idrinfo;
        p->ops = ops;
        INIT_LIST_HEAD(&p->list);
+        get_net(idrinfo->net);
        *a = p;
        return 0;
 }
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index c0c707eb2c96..9bce8cc84cbb 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -398,7 +398,7 @@ static __net_init int bpf_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, bpf_net_id);
-        return tc_action_net_init(tn, &act_bpf_ops);
+        return tc_action_net_init(tn, &act_bpf_ops, net);
 }
 static void __net_exit bpf_exit_net(struct net *net)
diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c
index 10b7a8855a6c..34e52d01a5dd 100644
--- a/net/sched/act_connmark.c
+++ b/net/sched/act_connmark.c
@@ -206,7 +206,7 @@ static __net_init int connmark_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, connmark_net_id);
-        return tc_action_net_init(tn, &act_connmark_ops);
+        return tc_action_net_init(tn, &act_connmark_ops, net);
 }
 static void __net_exit connmark_exit_net(struct net *net)
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 1c40caadcff9..35171df2ebef 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -626,7 +626,7 @@ static __net_init int csum_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, csum_net_id);
-        return tc_action_net_init(tn, &act_csum_ops);
+        return tc_action_net_init(tn, &act_csum_ops, net);
 }
 static void __net_exit csum_exit_net(struct net *net)
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index e29a48ef7fc3..ef7f7f39d26d 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -232,7 +232,7 @@ static __net_init int gact_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, gact_net_id);
-        return tc_action_net_init(tn, &act_gact_ops);
+        return tc_action_net_init(tn, &act_gact_ops, net);
 }
 static void __net_exit gact_exit_net(struct net *net)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 8ccd35825b6b..f65e4b5058e0 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -818,7 +818,7 @@ static __net_init int ife_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ife_net_id);
-        return tc_action_net_init(tn, &act_ife_ops);
+        return tc_action_net_init(tn, &act_ife_ops, net);
 }
 static void __net_exit ife_exit_net(struct net *net)
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index d9e399a7e3d5..dbdf3b2470d5 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -334,7 +334,7 @@ static __net_init int ipt_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, ipt_net_id);
-        return tc_action_net_init(tn, &act_ipt_ops);
+        return tc_action_net_init(tn, &act_ipt_ops, net);
 }
 static void __net_exit ipt_exit_net(struct net *net)
@@ -384,7 +384,7 @@ static __net_init int xt_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, xt_net_id);
-        return tc_action_net_init(tn, &act_xt_ops);
+        return tc_action_net_init(tn, &act_xt_ops, net);
 }
 static void __net_exit xt_exit_net(struct net *net)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 416627c66f08..84759cfd5a33 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -343,7 +343,7 @@ static __net_init int mirred_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, mirred_net_id);
-        return tc_action_net_init(tn, &act_mirred_ops);
+        return tc_action_net_init(tn, &act_mirred_ops, net);
 }
 static void __net_exit mirred_exit_net(struct net *net)
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index c365d01b99c8..7eeaaf9217b6 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -307,7 +307,7 @@ static __net_init int nat_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, nat_net_id);
-        return tc_action_net_init(tn, &act_nat_ops);
+        return tc_action_net_init(tn, &act_nat_ops, net);
 }
 static void __net_exit nat_exit_net(struct net *net)
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 491fe5deb09e..b3d82c334a5f 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -450,7 +450,7 @@ static __net_init int pedit_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, pedit_net_id);
-        return tc_action_net_init(tn, &act_pedit_ops);
+        return tc_action_net_init(tn, &act_pedit_ops, net);
 }
 static void __net_exit pedit_exit_net(struct net *net)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 3bb2ebf9e9ae..9ec42b26e4b9 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -331,7 +331,7 @@ static __net_init int police_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, police_net_id);
-        return tc_action_net_init(tn, &act_police_ops);
+        return tc_action_net_init(tn, &act_police_ops, net);
 }
 static void __net_exit police_exit_net(struct net *net)
diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
index 8b5abcd2f32f..e69a1e3a39bf 100644
--- a/net/sched/act_sample.c
+++ b/net/sched/act_sample.c
@@ -240,7 +240,7 @@ static __net_init int sample_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, sample_net_id);
-        return tc_action_net_init(tn, &act_sample_ops);
+        return tc_action_net_init(tn, &act_sample_ops, net);
 }
 static void __net_exit sample_exit_net(struct net *net)
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index e7b57e5071a3..a8d0ea95f894 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -201,7 +201,7 @@ static __net_init int simp_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, simp_net_id);
-        return tc_action_net_init(tn, &act_simp_ops);
+        return tc_action_net_init(tn, &act_simp_ops, net);
 }
 static void __net_exit simp_exit_net(struct net *net)
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 59949d61f20d..fbac62472e09 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -238,7 +238,7 @@ static __net_init int skbedit_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, skbedit_net_id);
-        return tc_action_net_init(tn, &act_skbedit_ops);
+        return tc_action_net_init(tn, &act_skbedit_ops, net);
 }
 static void __net_exit skbedit_exit_net(struct net *net)
diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c
index b642ad3d39dd..8e12d8897d2f 100644
--- a/net/sched/act_skbmod.c
+++ b/net/sched/act_skbmod.c
@@ -263,7 +263,7 @@ static __net_init int skbmod_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, skbmod_net_id);
-        return tc_action_net_init(tn, &act_skbmod_ops);
+        return tc_action_net_init(tn, &act_skbmod_ops, net);
 }
 static void __net_exit skbmod_exit_net(struct net *net)
diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c
index 30c96274c638..c33faa373cf2 100644
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -322,7 +322,7 @@ static __net_init int tunnel_key_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, tunnel_key_net_id);
-        return tc_action_net_init(tn, &act_tunnel_key_ops);
+        return tc_action_net_init(tn, &act_tunnel_key_ops, net);
 }
 static void __net_exit tunnel_key_exit_net(struct net *net)
diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c
index 16eb067a8d8f..115fc33cc6d8 100644
--- a/net/sched/act_vlan.c
+++ b/net/sched/act_vlan.c
@@ -269,7 +269,7 @@ static __net_init int vlan_init_net(struct net *net)
 {
        struct tc_action_net *tn = net_generic(net, vlan_net_id);
-        return tc_action_net_init(tn, &act_vlan_ops);
+        return tc_action_net_init(tn, &act_vlan_ops, net);
 }
 static void __net_exit vlan_exit_net(struct net *net)
diff --git a/tools/objtool/arch/x86/insn/gen-insn-attr-x86.awk b/tools/objtool/arch/x86/insn/gen-insn-attr-x86.awk
index a3d2c62fd805..b02a36b2c14f 100644
--- a/tools/objtool/arch/x86/insn/gen-insn-attr-x86.awk
+++ b/tools/objtool/arch/x86/insn/gen-insn-attr-x86.awk
@@ -1,4 +1,5 @@
 #!/bin/awk -f
+# SPDX-License-Identifier: GPL-2.0
 # gen-insn-attr-x86.awk: Instruction attribute table generator
 # Written by Masami Hiramatsu <mhiramat@redhat.com>
 #
diff --git a/usr/Makefile b/usr/Makefile
index 34a9fcd0f537..237a028693ce 100644
--- a/usr/Makefile
+++ b/usr/Makefile
@@ -8,6 +8,7 @@ PHONY += klibcdirs
 suffix_y = $(subst $\",,$(CONFIG_INITRAMFS_COMPRESSION))
 datafile_y = initramfs_data.cpio$(suffix_y)
+datafile_d_y = .$(datafile_y).d
 AFLAGS_initramfs_data.o += -DINITRAMFS_IMAGE="usr/$(datafile_y)"
@@ -30,12 +31,12 @@ ramfs-args  := \
        $(if $(CONFIG_INITRAMFS_ROOT_UID), -u $(CONFIG_INITRAMFS_ROOT_UID)) \
        $(if $(CONFIG_INITRAMFS_ROOT_GID), -g $(CONFIG_INITRAMFS_ROOT_GID))
-# .initramfs_data.cpio.d is used to identify all files included
+# $(datafile_d_y) is used to identify all files included
 # in initramfs and to detect if any files are added/removed.
 # Removed files are identified by directory timestamp being updated
 # The dependency list is generated by gen_initramfs.sh -l
-ifneq ($(wildcard $(obj)/.initramfs_data.cpio.d),)
+ifneq ($(wildcard $(obj)/$(datafile_d_y)),)
-        include $(obj)/.initramfs_data.cpio.d
+        include $(obj)/$(datafile_d_y)
 endif
 quiet_cmd_initfs = GEN     $@
@@ -53,5 +54,5 @@ $(deps_initramfs): klibcdirs
 # 3) If gen_init_cpio are newer than initramfs_data.cpio
 # 4) arguments to gen_initramfs.sh changes
 $(obj)/$(datafile_y): $(obj)/gen_init_cpio $(deps_initramfs) klibcdirs
-        $(Q)$(initramfs) -l $(ramfs-input) > $(obj)/.initramfs_data.cpio.d
+        $(Q)$(initramfs) -l $(ramfs-input) > $(obj)/$(datafile_d_y)
        $(call if_changed,initfs)
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index b9f68e4add71..95cba0799828 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -1326,21 +1326,12 @@ static void teardown_hyp_mode(void)
 {
        int cpu;
-        if (is_kernel_in_hyp_mode())
-                return;
        free_hyp_pgds();
        for_each_possible_cpu(cpu)
                free_page(per_cpu(kvm_arm_hyp_stack_page, cpu));
        hyp_cpu_pm_exit();
 }
-static int init_vhe_mode(void)
-{
-        kvm_info("VHE mode initialized successfully\n");
-        return 0;
-}
 /**
 * Inits Hyp-mode on all online CPUs
 */
@@ -1421,8 +1412,6 @@ static int init_hyp_mode(void)
                }
        }
-        kvm_info("Hyp mode initialized successfully\n");
        return 0;
 out_err:
@@ -1456,6 +1445,7 @@ int kvm_arch_init(void *opaque)
 {
        int err;
        int ret, cpu;
+        bool in_hyp_mode;
        if (!is_hyp_mode_available()) {
                kvm_err("HYP mode not available\n");
@@ -1474,21 +1464,28 @@ int kvm_arch_init(void *opaque)
        if (err)
                return err;
-        if (is_kernel_in_hyp_mode())
+        in_hyp_mode = is_kernel_in_hyp_mode();
-                err = init_vhe_mode();
-        else
+        if (!in_hyp_mode) {
                err = init_hyp_mode();
-        if (err)
+                if (err)
-                goto out_err;
+                        goto out_err;
+        }
        err = init_subsystems();
        if (err)
                goto out_hyp;
+        if (in_hyp_mode)
+                kvm_info("VHE mode initialized successfully\n");
+        else
+                kvm_info("Hyp mode initialized successfully\n");
        return 0;
 out_hyp:
-        teardown_hyp_mode();
+        if (!in_hyp_mode)
+                teardown_hyp_mode();
 out_err:
        teardown_common_resources();
        return err;
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index f51c1e1b3f70..547f12dc4d54 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -1466,6 +1466,16 @@ static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its,
 {
        mutex_lock(&its->cmd_lock);
+        /*
+         * It is UNPREDICTABLE to enable the ITS if any of the CBASER or
+         * device/collection BASER are invalid
+         */
+        if (!its->enabled && (val & GITS_CTLR_ENABLE) &&
+                (!(its->baser_device_table & GITS_BASER_VALID) ||
+                 !(its->baser_coll_table & GITS_BASER_VALID) ||
+                 !(its->cbaser & GITS_CBASER_VALID)))
+                goto out;
        its->enabled = !!(val & GITS_CTLR_ENABLE);
        /*
@@ -1474,6 +1484,7 @@ static void vgic_mmio_write_its_ctlr(struct kvm *kvm, struct vgic_its *its,
         */
        vgic_its_process_commands(kvm, its);
+out:
        mutex_unlock(&its->cmd_lock);
 }
@@ -1801,37 +1812,33 @@ typedef int (*entry_fn_t)(struct vgic_its *its, u32 id, void *entry,
 static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz,
                          int start_id, entry_fn_t fn, void *opaque)
 {
-        void *entry = kzalloc(esz, GFP_KERNEL);
        struct kvm *kvm = its->dev->kvm;
        unsigned long len = size;
        int id = start_id;
        gpa_t gpa = base;
+        char entry[esz];
        int ret;
+        memset(entry, 0, esz);
        while (len > 0) {
                int next_offset;
                size_t byte_offset;
                ret = kvm_read_guest(kvm, gpa, entry, esz);
                if (ret)
-                        goto out;
+                        return ret;
                next_offset = fn(its, id, entry, opaque);
-                if (next_offset <= 0) {
+                if (next_offset <= 0)
-                        ret = next_offset;
+                        return next_offset;
-                        goto out;
-                }
                byte_offset = next_offset * esz;
                id += next_offset;
                gpa += byte_offset;
                len -= byte_offset;
        }
-        ret =  1;
+        return 1;
-out:
-        kfree(entry);
-        return ret;
 }
 /**
@@ -1940,6 +1947,14 @@ static int vgic_its_save_itt(struct vgic_its *its, struct its_device *device)
        return 0;
 }
+/**
+ * vgic_its_restore_itt - restore the ITT of a device
+ *
+ * @its: its handle
+ * @dev: device handle
+ *
+ * Return 0 on success, < 0 on error
+ */
 static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev)
 {
        const struct vgic_its_abi *abi = vgic_its_get_abi(its);
@@ -1951,6 +1966,10 @@ static int vgic_its_restore_itt(struct vgic_its *its, struct its_device *dev)
        ret = scan_its_table(its, base, max_size, ite_esz, 0,
                             vgic_its_restore_ite, dev);
+        /* scan_its_table returns +1 if all ITEs are invalid */
+        if (ret > 0)
+                ret = 0;
        return ret;
 }
@@ -2048,11 +2067,12 @@ static int vgic_its_device_cmp(void *priv, struct list_head *a,
 static int vgic_its_save_device_tables(struct vgic_its *its)
 {
        const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+        u64 baser = its->baser_device_table;
        struct its_device *dev;
        int dte_esz = abi->dte_esz;
-        u64 baser;
-        baser = its->baser_device_table;
+        if (!(baser & GITS_BASER_VALID))
+                return 0;
        list_sort(NULL, &its->device_list, vgic_its_device_cmp);
@@ -2107,10 +2127,7 @@ static int handle_l1_dte(struct vgic_its *its, u32 id, void *addr,
        ret = scan_its_table(its, gpa, SZ_64K, dte_esz,
                             l2_start_id, vgic_its_restore_dte, NULL);
-        if (ret <= 0)
+        return ret;
-                return ret;
-        return 1;
 }
 /**
@@ -2140,8 +2157,9 @@ static int vgic_its_restore_device_tables(struct vgic_its *its)
                                     vgic_its_restore_dte, NULL);
        }
+        /* scan_its_table returns +1 if all entries are invalid */
        if (ret > 0)
-                ret = -EINVAL;
+                ret = 0;
        return ret;
 }
@@ -2198,17 +2216,17 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz)
 static int vgic_its_save_collection_table(struct vgic_its *its)
 {
        const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+        u64 baser = its->baser_coll_table;
+        gpa_t gpa = BASER_ADDRESS(baser);
        struct its_collection *collection;
        u64 val;
-        gpa_t gpa;
        size_t max_size, filled = 0;
        int ret, cte_esz = abi->cte_esz;
-        gpa = BASER_ADDRESS(its->baser_coll_table);
+        if (!(baser & GITS_BASER_VALID))
-        if (!gpa)
                return 0;
-        max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K;
+        max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K;
        list_for_each_entry(collection, &its->collection_list, coll_list) {
                ret = vgic_its_save_cte(its, collection, gpa, cte_esz);
@@ -2239,17 +2257,18 @@ static int vgic_its_save_collection_table(struct vgic_its *its)
 static int vgic_its_restore_collection_table(struct vgic_its *its)
 {
        const struct vgic_its_abi *abi = vgic_its_get_abi(its);
+        u64 baser = its->baser_coll_table;
        int cte_esz = abi->cte_esz;
        size_t max_size, read = 0;
        gpa_t gpa;
        int ret;
-        if (!(its->baser_coll_table & GITS_BASER_VALID))
+        if (!(baser & GITS_BASER_VALID))
                return 0;
-        gpa = BASER_ADDRESS(its->baser_coll_table);
+        gpa = BASER_ADDRESS(baser);
-        max_size = GITS_BASER_NR_PAGES(its->baser_coll_table) * SZ_64K;
+        max_size = GITS_BASER_NR_PAGES(baser) * SZ_64K;
        while (read < max_size) {
                ret = vgic_its_restore_cte(its, gpa, cte_esz);
@@ -2258,6 +2277,10 @@ static int vgic_its_restore_collection_table(struct vgic_its *its)
                gpa += cte_esz;
                read += cte_esz;
        }
+        if (ret > 0)
+                return 0;
        return ret;
 }