49 files changed, 292 insertions, 134 deletions

diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 2736e25e9dc6..d50a7b6ccddd 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -710,6 +710,8 @@ static DEFINE_RAW_SPINLOCK(c3_lock);
 static void acpi_idle_enter_bm(struct acpi_processor *pr,
                                struct acpi_processor_cx *cx, bool timer_bc)
 {
+        acpi_unlazy_tlb(smp_processor_id());
+
         /*
          * Must be done before busmaster disable as we might need to
          * access HPET !
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 6804ddab3052..8082871b409a 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -160,6 +160,14 @@ static int __init init_nvs_nosave(const struct dmi_system_id *d)
         return 0;
 }
 
+static bool acpi_sleep_no_lps0;
+
+static int __init init_no_lps0(const struct dmi_system_id *d)
+{
+        acpi_sleep_no_lps0 = true;
+        return 0;
+}
+
 static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
         {
         .callback = init_old_suspend_ordering,
@@ -343,6 +351,19 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = {
                 DMI_MATCH(DMI_PRODUCT_NAME, "80E3"),
                 },
         },
+        /*
+         * https://bugzilla.kernel.org/show_bug.cgi?id=196907
+         * Some Dell XPS13 9360 cannot do suspend-to-idle using the Low Power
+         * S0 Idle firmware interface.
+         */
+        {
+        .callback = init_no_lps0,
+        .ident = "Dell XPS13 9360",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
+                },
+        },
         {},
 };
 
@@ -485,6 +506,7 @@ static void acpi_pm_end(void)
 }
 #else /* !CONFIG_ACPI_SLEEP */
 #define acpi_target_sleep_state ACPI_STATE_S0
+#define acpi_sleep_no_lps0      (false)
 static inline void acpi_sleep_dmi_check(void) {}
 #endif /* CONFIG_ACPI_SLEEP */
 
@@ -863,6 +885,12 @@ static int lps0_device_attach(struct acpi_device *adev,
         if (lps0_device_handle)
                 return 0;
 
+        if (acpi_sleep_no_lps0) {
+                acpi_handle_info(adev->handle,
+                                 "Low Power S0 Idle interface disabled\n");
+                return 0;
+        }
+
         if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0))
                 return 0;
 
diff --git a/drivers/auxdisplay/img-ascii-lcd.c b/drivers/auxdisplay/img-ascii-lcd.c
index 25306fa27251..a9020f82eea7 100644
--- a/drivers/auxdisplay/img-ascii-lcd.c
+++ b/drivers/auxdisplay/img-ascii-lcd.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index b640ad8a6d20..adc877dfef5c 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -2692,7 +2692,7 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request)
          * from the parent.
          */
         page_count = (u32)calc_pages_for(0, length);
-        pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+        pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
         if (IS_ERR(pages)) {
                 result = PTR_ERR(pages);
                 pages = NULL;
@@ -2827,7 +2827,7 @@ static int rbd_img_obj_exists_submit(struct rbd_obj_request *obj_request)
          */
         size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32);
         page_count = (u32)calc_pages_for(0, size);
-        pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
+        pages = ceph_alloc_page_vector(page_count, GFP_NOIO);
         if (IS_ERR(pages)) {
                 ret = PTR_ERR(pages);
                 goto fail_stat_request;
diff --git a/drivers/clk/imgtec/clk-boston.c b/drivers/clk/imgtec/clk-boston.c
index f18f10351785..15af423cc0c9 100644
--- a/drivers/clk/imgtec/clk-boston.c
+++ b/drivers/clk/imgtec/clk-boston.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2016-2017 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c
index e8248f9185f7..ab393637f7b0 100644
--- a/drivers/clk/ingenic/cgu.c
+++ b/drivers/clk/ingenic/cgu.c
@@ -2,7 +2,7 @@
  * Ingenic SoC CGU driver
  *
  * Copyright (c) 2013-2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/ingenic/cgu.h b/drivers/clk/ingenic/cgu.h
index 09700b2c555d..e78b586536ea 100644
--- a/drivers/clk/ingenic/cgu.h
+++ b/drivers/clk/ingenic/cgu.h
@@ -2,7 +2,7 @@
  * Ingenic SoC CGU driver
  *
  * Copyright (c) 2013-2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/ingenic/jz4740-cgu.c b/drivers/clk/ingenic/jz4740-cgu.c
index 510fe7e0c8f1..32fcc75f6f77 100644
--- a/drivers/clk/ingenic/jz4740-cgu.c
+++ b/drivers/clk/ingenic/jz4740-cgu.c
@@ -2,7 +2,7 @@
  * Ingenic JZ4740 SoC CGU driver
  *
  * Copyright (c) 2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/ingenic/jz4780-cgu.c b/drivers/clk/ingenic/jz4780-cgu.c
index b35d6d9dd5aa..ac3585ed8228 100644
--- a/drivers/clk/ingenic/jz4780-cgu.c
+++ b/drivers/clk/ingenic/jz4780-cgu.c
@@ -2,7 +2,7 @@
  * Ingenic JZ4780 SoC CGU driver
  *
  * Copyright (c) 2013-2015 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
diff --git a/drivers/clk/uniphier/clk-uniphier-sys.c b/drivers/clk/uniphier/clk-uniphier-sys.c
index 0e396f3da526..07f3b91a7daf 100644
--- a/drivers/clk/uniphier/clk-uniphier-sys.c
+++ b/drivers/clk/uniphier/clk-uniphier-sys.c
@@ -233,9 +233,9 @@ const struct uniphier_clk_data uniphier_pxs3_sys_clk_data[] = {
         UNIPHIER_LD20_SYS_CLK_SD,
         UNIPHIER_LD11_SYS_CLK_NAND(2),
         UNIPHIER_LD11_SYS_CLK_EMMC(4),
-        UNIPHIER_CLK_GATE("usb30", 12, NULL, 0x2104, 4),        /* =GIO0 */
-        UNIPHIER_CLK_GATE("usb31-0", 13, NULL, 0x2104, 5),      /* =GIO1 */
-        UNIPHIER_CLK_GATE("usb31-1", 14, NULL, 0x2104, 6),      /* =GIO1-1 */
+        UNIPHIER_CLK_GATE("usb30", 12, NULL, 0x210c, 4),        /* =GIO0 */
+        UNIPHIER_CLK_GATE("usb31-0", 13, NULL, 0x210c, 5),      /* =GIO1 */
+        UNIPHIER_CLK_GATE("usb31-1", 14, NULL, 0x210c, 6),      /* =GIO1-1 */
         UNIPHIER_CLK_GATE("usb30-phy0", 16, NULL, 0x210c, 16),
         UNIPHIER_CLK_GATE("usb30-phy1", 17, NULL, 0x210c, 18),
         UNIPHIER_CLK_GATE("usb30-phy2", 18, NULL, 0x210c, 20),
diff --git a/drivers/cpuidle/cpuidle-cps.c b/drivers/cpuidle/cpuidle-cps.c
index 72b5e47286b4..dac8ff6391fa 100644
--- a/drivers/cpuidle/cpuidle-cps.c
+++ b/drivers/cpuidle/cpuidle-cps.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2014 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index 2371a92808be..adaa4a964f0c 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -34,13 +34,14 @@ lib-y				:= efi-stub-helper.o gop.o secureboot.o
 lib-$(CONFIG_RESET_ATTACK_MITIGATION) += tpm.o
 
 # include the stub's generic dependencies from lib/ when building for ARM/arm64
-arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c sort.c
+arm-deps-y := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c
+arm-deps-$(CONFIG_ARM64) += sort.c
 
 $(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
         $(call if_changed_rule,cc_o_c)
 
 lib-$(CONFIG_EFI_ARMSTUB)       += arm-stub.o fdt.o string.o random.o \
-                                   $(patsubst %.c,lib-%.o,$(arm-deps))
+                                   $(patsubst %.c,lib-%.o,$(arm-deps-y))
 
 lib-$(CONFIG_ARM)               += arm32-stub.o
 lib-$(CONFIG_ARM64)             += arm64-stub.o
@@ -91,5 +92,4 @@ quiet_cmd_stubcopy = STUBCPY $@
 # explicitly by the decompressor linker script.
 #
 STUBCOPY_FLAGS-$(CONFIG_ARM)    += --rename-section .data=.data.efistub
-STUBCOPY_RM-$(CONFIG_ARM)       += -R ___ksymtab+sort -R ___kcrctab+sort
 STUBCOPY_RELOC-$(CONFIG_ARM)    := R_ARM_ABS
diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index a94601d5939e..01a9d78ee415 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -350,7 +350,9 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size,
          * The easiest way to find adjacent regions is to sort the memory map
          * before traversing it.
          */
-        sort(memory_map, map_size / desc_size, desc_size, cmp_mem_desc, NULL);
+        if (IS_ENABLED(CONFIG_ARM64))
+                sort(memory_map, map_size / desc_size, desc_size, cmp_mem_desc,
+                     NULL);
 
         for (l = 0; l < map_size; l += desc_size, prev = in) {
                 u64 paddr, size;
@@ -367,7 +369,8 @@ void efi_get_virtmap(efi_memory_desc_t *memory_map, unsigned long map_size,
                  * a 4k page size kernel to kexec a 64k page size kernel and
                  * vice versa.
                  */
-                if (!regions_are_adjacent(prev, in) ||
+                if ((IS_ENABLED(CONFIG_ARM64) &&
+                     !regions_are_adjacent(prev, in)) ||
                     !regions_have_compatible_memory_type_attrs(prev, in)) {
 
                         paddr = round_down(in->phys_addr, SZ_64K);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index 430a6b4dfac9..62cd16a23921 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -93,6 +93,10 @@ static int uvd_v6_0_early_init(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->flags & AMD_IS_APU) &&
+            (RREG32_SMC(ixCC_HARVEST_FUSES) & CC_HARVEST_FUSES__UVD_DISABLE_MASK))
+                return -ENOENT;
+
         uvd_v6_0_set_ring_funcs(adev);
         uvd_v6_0_set_irq_funcs(adev);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index 90332f55cfba..cf81065e3c5a 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -365,15 +365,10 @@ static unsigned vce_v3_0_get_harvest_config(struct amdgpu_device *adev)
 {
         u32 tmp;
 
-        /* Fiji, Stoney, Polaris10, Polaris11, Polaris12 are single pipe */
         if ((adev->asic_type == CHIP_FIJI) ||
-            (adev->asic_type == CHIP_STONEY) ||
-            (adev->asic_type == CHIP_POLARIS10) ||
-            (adev->asic_type == CHIP_POLARIS11) ||
-            (adev->asic_type == CHIP_POLARIS12))
+            (adev->asic_type == CHIP_STONEY))
                 return AMDGPU_VCE_HARVEST_VCE1;
 
-        /* Tonga and CZ are dual or single pipe */
         if (adev->flags & AMD_IS_APU)
                 tmp = (RREG32_SMC(ixVCE_HARVEST_FUSE_MACRO__ADDRESS) &
                        VCE_HARVEST_FUSE_MACRO__MASK) >>
@@ -391,6 +386,11 @@ static unsigned vce_v3_0_get_harvest_config(struct amdgpu_device *adev)
         case 3:
                 return AMDGPU_VCE_HARVEST_VCE0 | AMDGPU_VCE_HARVEST_VCE1;
         default:
+                if ((adev->asic_type == CHIP_POLARIS10) ||
+                    (adev->asic_type == CHIP_POLARIS11) ||
+                    (adev->asic_type == CHIP_POLARIS12))
+                        return AMDGPU_VCE_HARVEST_VCE1;
+
                 return 0;
         }
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 32e857dc507c..dc1faa49687d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2214,8 +2214,10 @@ static void __i915_gem_object_reset_page_iter(struct drm_i915_gem_object *obj)
         struct radix_tree_iter iter;
         void __rcu **slot;
 
+        rcu_read_lock();
         radix_tree_for_each_slot(slot, &obj->mm.get_page.radix, &iter, 0)
                 radix_tree_delete(&obj->mm.get_page.radix, iter.index);
+        rcu_read_unlock();
 }
 
 void __i915_gem_object_put_pages(struct drm_i915_gem_object *obj,
diff --git a/drivers/gpu/drm/i915/i915_gem_context.c b/drivers/gpu/drm/i915/i915_gem_context.c
index 58a2a44f88bd..8afd2ce59b8d 100644
--- a/drivers/gpu/drm/i915/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/i915_gem_context.c
@@ -104,6 +104,7 @@ static void lut_close(struct i915_gem_context *ctx)
                 kmem_cache_free(ctx->i915->luts, lut);
         }
 
+        rcu_read_lock();
         radix_tree_for_each_slot(slot, &ctx->handles_vma, &iter, 0) {
                 struct i915_vma *vma = rcu_dereference_raw(*slot);
                 struct drm_i915_gem_object *obj = vma->obj;
@@ -115,6 +116,7 @@ static void lut_close(struct i915_gem_context *ctx)
 
                 __i915_gem_object_release_unless_active(obj);
         }
+        rcu_read_unlock();
 }
 
 static void i915_gem_context_free(struct i915_gem_context *ctx)
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 92437f455b43..83876a1c8d98 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -337,6 +337,10 @@ eb_vma_misplaced(const struct drm_i915_gem_exec_object2 *entry,
             (vma->node.start + vma->node.size - 1) >> 32)
                 return true;
 
+        if (flags & __EXEC_OBJECT_NEEDS_MAP &&
+            !i915_vma_is_map_and_fenceable(vma))
+                return true;
+
         return false;
 }
 
@@ -2090,6 +2094,11 @@ get_fence_array(struct drm_i915_gem_execbuffer2 *args,
                         goto err;
                 }
 
+                if (fence.flags & __I915_EXEC_FENCE_UNKNOWN_FLAGS) {
+                        err = -EINVAL;
+                        goto err;
+                }
+
                 syncobj = drm_syncobj_find(file, fence.handle);
                 if (!syncobj) {
                         DRM_DEBUG("Invalid syncobj handle provided\n");
@@ -2097,6 +2106,9 @@ get_fence_array(struct drm_i915_gem_execbuffer2 *args,
                         goto err;
                 }
 
+                BUILD_BUG_ON(~(ARCH_KMALLOC_MINALIGN - 1) &
+                             ~__I915_EXEC_FENCE_UNKNOWN_FLAGS);
+
                 fences[n] = ptr_pack_bits(syncobj, fence.flags, 2);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index e2410eb5d96e..ad524cb0f6fc 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -832,10 +832,14 @@ static void gen8_ppgtt_clear_4lvl(struct i915_address_space *vm,
         }
 }
 
-struct sgt_dma {
+static inline struct sgt_dma {
         struct scatterlist *sg;
         dma_addr_t dma, max;
-};
+} sgt_dma(struct i915_vma *vma) {
+        struct scatterlist *sg = vma->pages->sgl;
+        dma_addr_t addr = sg_dma_address(sg);
+        return (struct sgt_dma) { sg, addr, addr + sg->length };
+}
 
 struct gen8_insert_pte {
         u16 pml4e;
@@ -916,11 +920,7 @@ static void gen8_ppgtt_insert_3lvl(struct i915_address_space *vm,
                                    u32 unused)
 {
         struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm);
-        struct sgt_dma iter = {
-                .sg = vma->pages->sgl,
-                .dma = sg_dma_address(iter.sg),
-                .max = iter.dma + iter.sg->length,
-        };
+        struct sgt_dma iter = sgt_dma(vma);
         struct gen8_insert_pte idx = gen8_insert_pte(vma->node.start);
 
         gen8_ppgtt_insert_pte_entries(ppgtt, &ppgtt->pdp, &iter, &idx,
@@ -933,11 +933,7 @@ static void gen8_ppgtt_insert_4lvl(struct i915_address_space *vm,
                                    u32 unused)
 {
         struct i915_hw_ppgtt *ppgtt = i915_vm_to_ppgtt(vm);
-        struct sgt_dma iter = {
-                .sg = vma->pages->sgl,
-                .dma = sg_dma_address(iter.sg),
-                .max = iter.dma + iter.sg->length,
-        };
+        struct sgt_dma iter = sgt_dma(vma);
         struct i915_page_directory_pointer **pdps = ppgtt->pml4.pdps;
         struct gen8_insert_pte idx = gen8_insert_pte(vma->node.start);
 
@@ -1632,13 +1628,10 @@ static void gen6_ppgtt_insert_entries(struct i915_address_space *vm,
         unsigned act_pt = first_entry / GEN6_PTES;
         unsigned act_pte = first_entry % GEN6_PTES;
         const u32 pte_encode = vm->pte_encode(0, cache_level, flags);
-        struct sgt_dma iter;
+        struct sgt_dma iter = sgt_dma(vma);
         gen6_pte_t *vaddr;
 
         vaddr = kmap_atomic_px(ppgtt->pd.page_table[act_pt]);
-        iter.sg = vma->pages->sgl;
-        iter.dma = sg_dma_address(iter.sg);
-        iter.max = iter.dma + iter.sg->length;
         do {
                 vaddr[act_pte] = pte_encode | GEN6_PTE_ADDR_ENCODE(iter.dma);
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 5c7828c52d12..5ebdb63330dd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -15227,6 +15227,23 @@ void intel_connector_unregister(struct drm_connector *connector)
         intel_panel_destroy_backlight(connector);
 }
 
+static void intel_hpd_poll_fini(struct drm_device *dev)
+{
+        struct intel_connector *connector;
+        struct drm_connector_list_iter conn_iter;
+
+        /* First disable polling... */
+        drm_kms_helper_poll_fini(dev);
+
+        /* Then kill the work that may have been queued by hpd. */
+        drm_connector_list_iter_begin(dev, &conn_iter);
+        for_each_intel_connector_iter(connector, &conn_iter) {
+                if (connector->modeset_retry_work.func)
+                        cancel_work_sync(&connector->modeset_retry_work);
+        }
+        drm_connector_list_iter_end(&conn_iter);
+}
+
 void intel_modeset_cleanup(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = to_i915(dev);
@@ -15247,7 +15264,7 @@ void intel_modeset_cleanup(struct drm_device *dev)
          * Due to the hpd irq storm handling the hotplug work can re-arm the
          * poll handlers. Hence disable polling after hpd handling is shut down.
          */
-        drm_kms_helper_poll_fini(dev);
+        intel_hpd_poll_fini(dev);
 
         /* poll work can call into fbdev, hence clean that up afterwards */
         intel_fbdev_fini(dev_priv);
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 203198659ab2..09f274419eea 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -3731,9 +3731,16 @@ intel_edp_init_dpcd(struct intel_dp *intel_dp)
 
         }
 
-        /* Read the eDP Display control capabilities registers */
-        if ((intel_dp->dpcd[DP_EDP_CONFIGURATION_CAP] & DP_DPCD_DISPLAY_CONTROL_CAPABLE) &&
-            drm_dp_dpcd_read(&intel_dp->aux, DP_EDP_DPCD_REV,
+        /*
+         * Read the eDP display control registers.
+         *
+         * Do this independent of DP_DPCD_DISPLAY_CONTROL_CAPABLE bit in
+         * DP_EDP_CONFIGURATION_CAP, because some buggy displays do not have it
+         * set, but require eDP 1.4+ detection (e.g. for supported link rates
+         * method). The display control registers should read zero if they're
+         * not supported anyway.
+         */
+        if (drm_dp_dpcd_read(&intel_dp->aux, DP_EDP_DPCD_REV,
                              intel_dp->edp_dpcd, sizeof(intel_dp->edp_dpcd)) ==
                              sizeof(intel_dp->edp_dpcd))
                 DRM_DEBUG_KMS("EDP DPCD : %*ph\n", (int) sizeof(intel_dp->edp_dpcd),
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index fa47285918f4..79fbaf78f604 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -496,7 +496,6 @@ struct intel_crtc_scaler_state {
 
 struct intel_pipe_wm {
         struct intel_wm_level wm[5];
-        struct intel_wm_level raw_wm[5];
         uint32_t linetime;
         bool fbc_wm_enabled;
         bool pipe_enabled;
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 0a09f8ff6aff..cb950752c346 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2716,9 +2716,9 @@ static void ilk_compute_wm_level(const struct drm_i915_private *dev_priv,
                                  const struct intel_crtc *intel_crtc,
                                  int level,
                                  struct intel_crtc_state *cstate,
-                                 struct intel_plane_state *pristate,
-                                 struct intel_plane_state *sprstate,
-                                 struct intel_plane_state *curstate,
+                                 const struct intel_plane_state *pristate,
+                                 const struct intel_plane_state *sprstate,
+                                 const struct intel_plane_state *curstate,
                                  struct intel_wm_level *result)
 {
         uint16_t pri_latency = dev_priv->wm.pri_latency[level];
@@ -3038,28 +3038,24 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
         struct intel_pipe_wm *pipe_wm;
         struct drm_device *dev = state->dev;
         const struct drm_i915_private *dev_priv = to_i915(dev);
-        struct intel_plane *intel_plane;
-        struct intel_plane_state *pristate = NULL;
-        struct intel_plane_state *sprstate = NULL;
-        struct intel_plane_state *curstate = NULL;
+        struct drm_plane *plane;
+        const struct drm_plane_state *plane_state;
+        const struct intel_plane_state *pristate = NULL;
+        const struct intel_plane_state *sprstate = NULL;
+        const struct intel_plane_state *curstate = NULL;
         int level, max_level = ilk_wm_max_level(dev_priv), usable_level;
         struct ilk_wm_maximums max;
 
         pipe_wm = &cstate->wm.ilk.optimal;
 
-        for_each_intel_plane_on_crtc(dev, intel_crtc, intel_plane) {
-                struct intel_plane_state *ps;
-
-                ps = intel_atomic_get_existing_plane_state(state,
-                                                           intel_plane);
-                if (!ps)
-                        continue;
+        drm_atomic_crtc_state_for_each_plane_state(plane, plane_state, &cstate->base) {
+                const struct intel_plane_state *ps = to_intel_plane_state(plane_state);
 
-                if (intel_plane->base.type == DRM_PLANE_TYPE_PRIMARY)
+                if (plane->type == DRM_PLANE_TYPE_PRIMARY)
                         pristate = ps;
-                else if (intel_plane->base.type == DRM_PLANE_TYPE_OVERLAY)
+                else if (plane->type == DRM_PLANE_TYPE_OVERLAY)
                         sprstate = ps;
-                else if (intel_plane->base.type == DRM_PLANE_TYPE_CURSOR)
+                else if (plane->type == DRM_PLANE_TYPE_CURSOR)
                         curstate = ps;
         }
 
@@ -3081,11 +3077,9 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
         if (pipe_wm->sprites_scaled)
                 usable_level = 0;
 
-        ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
-                             pristate, sprstate, curstate, &pipe_wm->raw_wm[0]);
-
         memset(&pipe_wm->wm, 0, sizeof(pipe_wm->wm));
-        pipe_wm->wm[0] = pipe_wm->raw_wm[0];
+        ilk_compute_wm_level(dev_priv, intel_crtc, 0, cstate,
+                             pristate, sprstate, curstate, &pipe_wm->wm[0]);
 
         if (IS_HASWELL(dev_priv) || IS_BROADWELL(dev_priv))
                 pipe_wm->linetime = hsw_compute_linetime_wm(cstate);
@@ -3095,8 +3089,8 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
 
         ilk_compute_wm_reg_maximums(dev_priv, 1, &max);
 
-        for (level = 1; level <= max_level; level++) {
-                struct intel_wm_level *wm = &pipe_wm->raw_wm[level];
+        for (level = 1; level <= usable_level; level++) {
+                struct intel_wm_level *wm = &pipe_wm->wm[level];
 
                 ilk_compute_wm_level(dev_priv, intel_crtc, level, cstate,
                                      pristate, sprstate, curstate, wm);
@@ -3106,13 +3100,10 @@ static int ilk_compute_pipe_wm(struct intel_crtc_state *cstate)
                  * register maximums since such watermarks are
                  * always invalid.
                  */
-                if (level > usable_level)
-                        continue;
-
-                if (ilk_validate_wm_level(level, &max, wm))
-                        pipe_wm->wm[level] = *wm;
-                else
-                        usable_level = level;
+                if (!ilk_validate_wm_level(level, &max, wm)) {
+                        memset(wm, 0, sizeof(*wm));
+                        break;
+                }
         }
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index e4751f92b342..fb47d46050ec 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -4099,7 +4099,7 @@ nv50_disp_atomic_commit(struct drm_device *dev,
 {
         struct nouveau_drm *drm = nouveau_drm(dev);
         struct nv50_disp *disp = nv50_disp(dev);
-        struct drm_plane_state *old_plane_state;
+        struct drm_plane_state *new_plane_state;
         struct drm_plane *plane;
         struct drm_crtc *crtc;
         bool active = false;
@@ -4129,8 +4129,8 @@ nv50_disp_atomic_commit(struct drm_device *dev,
         if (ret)
                 goto err_cleanup;
 
-        for_each_old_plane_in_state(state, plane, old_plane_state, i) {
-                struct nv50_wndw_atom *asyw = nv50_wndw_atom(old_plane_state);
+        for_each_new_plane_in_state(state, plane, new_plane_state, i) {
+                struct nv50_wndw_atom *asyw = nv50_wndw_atom(new_plane_state);
                 struct nv50_wndw *wndw = nv50_wndw(plane);
 
                 if (asyw->set.image) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index e84fee3ec4f3..184340d486c3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -721,7 +721,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                  * allocation taken by fbdev
                  */
                 if (!(dev_priv->capabilities & SVGA_CAP_3D))
-                        mem_size *= 2;
+                        mem_size *= 3;
 
                 dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE;
                 dev_priv->prim_bb_mem =
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index 3bbad22b3748..d6b1c509ae01 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -224,7 +224,7 @@ out:
         return ret;
 }
 
-static struct dma_fence_ops vmw_fence_ops = {
+static const struct dma_fence_ops vmw_fence_ops = {
         .get_driver_name = vmw_fence_get_driver_name,
         .get_timeline_name = vmw_fence_get_timeline_name,
         .enable_signaling = vmw_fence_enable_signaling,
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index a7355ab3bb22..6ff0be8cbdc9 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -867,11 +867,16 @@ static void msf_from_bcd(struct atapi_msf *msf)
 int cdrom_check_status(ide_drive_t *drive, struct request_sense *sense)
 {
         struct cdrom_info *info = drive->driver_data;
-        struct cdrom_device_info *cdi = &info->devinfo;
+        struct cdrom_device_info *cdi;
         unsigned char cmd[BLK_MAX_CDB];
 
         ide_debug_log(IDE_DBG_FUNC, "enter");
 
+        if (!info)
+                return -EIO;
+
+        cdi = &info->devinfo;
+
         memset(cmd, 0, BLK_MAX_CDB);
         cmd[0] = GPCMD_TEST_UNIT_READY;
 
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 5dc7ea4b6bc4..f0b06b14e782 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -913,15 +913,16 @@ static __cpuidle int intel_idle(struct cpuidle_device *dev,
         struct cpuidle_state *state = &drv->states[index];
         unsigned long eax = flg2MWAIT(state->flags);
         unsigned int cstate;
+        int cpu = smp_processor_id();
 
         cstate = (((eax) >> MWAIT_SUBSTATE_SIZE) & MWAIT_CSTATE_MASK) + 1;
 
         /*
-         * NB: if CPUIDLE_FLAG_TLB_FLUSHED is set, this idle transition
-         * will probably flush the TLB.  It's not guaranteed to flush
-         * the TLB, though, so it's not clear that we can do anything
-         * useful with this knowledge.
+         * leave_mm() to avoid costly and often unnecessary wakeups
+         * for flushing the user TLB's associated with the active mm.
          */
+        if (state->flags & CPUIDLE_FLAG_TLB_FLUSHED)
+                leave_mm(cpu);
 
         if (!(lapic_timer_reliable_states & (1 << (cstate))))
                 tick_broadcast_enter();
diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
index 6d6b092e2da9..d6135900da64 100644
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -1258,6 +1258,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
         { "ELAN0605", 0 },
         { "ELAN0609", 0 },
         { "ELAN060B", 0 },
+        { "ELAN060C", 0 },
         { "ELAN0611", 0 },
         { "ELAN1000", 0 },
         { }
diff --git a/drivers/input/rmi4/rmi_smbus.c b/drivers/input/rmi4/rmi_smbus.c
index 225025a0940c..b6ccf39c6a7b 100644
--- a/drivers/input/rmi4/rmi_smbus.c
+++ b/drivers/input/rmi4/rmi_smbus.c
@@ -312,7 +312,7 @@ static int rmi_smb_probe(struct i2c_client *client,
         rmi_smb->xport.dev = &client->dev;
         rmi_smb->xport.pdata = *pdata;
         rmi_smb->xport.pdata.irq = client->irq;
-        rmi_smb->xport.proto_name = "smb2";
+        rmi_smb->xport.proto_name = "smb";
         rmi_smb->xport.ops = &rmi_smb_ops;
 
         smbus_version = rmi_smb_get_version(rmi_smb);
@@ -322,7 +322,7 @@ static int rmi_smb_probe(struct i2c_client *client,
         rmi_dbg(RMI_DEBUG_XPORT, &client->dev, "Smbus version is %d",
                 smbus_version);
 
-        if (smbus_version != 2) {
+        if (smbus_version != 2 && smbus_version != 3) {
                 dev_err(&client->dev, "Unrecognized SMB version %d\n",
                                 smbus_version);
                 return -ENODEV;
diff --git a/drivers/input/sparse-keymap.c b/drivers/input/sparse-keymap.c
index bb0349fa64bc..fd03e55768c9 100644
--- a/drivers/input/sparse-keymap.c
+++ b/drivers/input/sparse-keymap.c
@@ -255,6 +255,7 @@ void sparse_keymap_report_entry(struct input_dev *dev, const struct key_entry *k
 
         case KE_VSW:
                 input_report_switch(dev, ke->sw.code, value);
+                input_sync(dev);
                 break;
         }
 }
diff --git a/drivers/input/touchscreen/ar1021_i2c.c b/drivers/input/touchscreen/ar1021_i2c.c
index f9dcbd63e598..b35b640fdadf 100644
--- a/drivers/input/touchscreen/ar1021_i2c.c
+++ b/drivers/input/touchscreen/ar1021_i2c.c
@@ -117,6 +117,7 @@ static int ar1021_i2c_probe(struct i2c_client *client,
         input->open = ar1021_i2c_open;
         input->close = ar1021_i2c_close;
 
+        __set_bit(INPUT_PROP_DIRECT, input->propbit);
         input_set_capability(input, EV_KEY, BTN_TOUCH);
         input_set_abs_params(input, ABS_X, 0, AR1021_MAX_X, 0, 0);
         input_set_abs_params(input, ABS_Y, 0, AR1021_MAX_Y, 0, 0);
diff --git a/drivers/input/touchscreen/tsc200x-core.c b/drivers/input/touchscreen/tsc200x-core.c
index 88ea5e1b72ae..abf27578beb1 100644
--- a/drivers/input/touchscreen/tsc200x-core.c
+++ b/drivers/input/touchscreen/tsc200x-core.c
@@ -531,6 +531,7 @@ int tsc200x_probe(struct device *dev, int irq, const struct input_id *tsc_id,
 
         input_set_drvdata(input_dev, ts);
 
+        __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
         input_set_capability(input_dev, EV_KEY, BTN_TOUCH);
 
         input_set_abs_params(input_dev, ABS_X,
diff --git a/drivers/irqchip/irq-mvebu-gicp.c b/drivers/irqchip/irq-mvebu-gicp.c
index b283fc90be1e..17a4a7b6cdbb 100644
--- a/drivers/irqchip/irq-mvebu-gicp.c
+++ b/drivers/irqchip/irq-mvebu-gicp.c
@@ -194,6 +194,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         gicp->dev = &pdev->dev;
+        spin_lock_init(&gicp->spi_lock);
 
         gicp->res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!gicp->res)
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 860313bd952a..4f2806720c5c 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -401,16 +401,37 @@ static u32 dw_mci_prep_stop_abort(struct dw_mci *host, struct mmc_command *cmd)
 static inline void dw_mci_set_cto(struct dw_mci *host)
 {
         unsigned int cto_clks;
+        unsigned int cto_div;
         unsigned int cto_ms;
+        unsigned long irqflags;
 
         cto_clks = mci_readl(host, TMOUT) & 0xff;
-        cto_ms = DIV_ROUND_UP(cto_clks, host->bus_hz / 1000);
+        cto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
+        if (cto_div == 0)
+                cto_div = 1;
+        cto_ms = DIV_ROUND_UP(MSEC_PER_SEC * cto_clks * cto_div, host->bus_hz);
 
         /* add a bit spare time */
         cto_ms += 10;
 
-        mod_timer(&host->cto_timer,
-                  jiffies + msecs_to_jiffies(cto_ms) + 1);
+        /*
+         * The durations we're working with are fairly short so we have to be
+         * extra careful about synchronization here.  Specifically in hardware a
+         * command timeout is _at most_ 5.1 ms, so that means we expect an
+         * interrupt (either command done or timeout) to come rather quickly
+         * after the mci_writel.  ...but just in case we have a long interrupt
+         * latency let's add a bit of paranoia.
+         *
+         * In general we'll assume that at least an interrupt will be asserted
+         * in hardware by the time the cto_timer runs.  ...and if it hasn't
+         * been asserted in hardware by that time then we'll assume it'll never
+         * come.
+         */
+        spin_lock_irqsave(&host->irq_lock, irqflags);
+        if (!test_bit(EVENT_CMD_COMPLETE, &host->pending_events))
+                mod_timer(&host->cto_timer,
+                        jiffies + msecs_to_jiffies(cto_ms) + 1);
+        spin_unlock_irqrestore(&host->irq_lock, irqflags);
 }
 
 static void dw_mci_start_command(struct dw_mci *host,
@@ -425,11 +446,11 @@ static void dw_mci_start_command(struct dw_mci *host,
         wmb(); /* drain writebuffer */
         dw_mci_wait_while_busy(host, cmd_flags);
 
+        mci_writel(host, CMD, cmd_flags | SDMMC_CMD_START);
+
         /* response expected command only */
         if (cmd_flags & SDMMC_CMD_RESP_EXP)
                 dw_mci_set_cto(host);
-
-        mci_writel(host, CMD, cmd_flags | SDMMC_CMD_START);
 }
 
 static inline void send_stop_abort(struct dw_mci *host, struct mmc_data *data)
@@ -1915,10 +1936,15 @@ static int dw_mci_data_complete(struct dw_mci *host, struct mmc_data *data)
 static void dw_mci_set_drto(struct dw_mci *host)
 {
         unsigned int drto_clks;
+        unsigned int drto_div;
         unsigned int drto_ms;
 
         drto_clks = mci_readl(host, TMOUT) >> 8;
-        drto_ms = DIV_ROUND_UP(drto_clks, host->bus_hz / 1000);
+        drto_div = (mci_readl(host, CLKDIV) & 0xff) * 2;
+        if (drto_div == 0)
+                drto_div = 1;
+        drto_ms = DIV_ROUND_UP(MSEC_PER_SEC * drto_clks * drto_div,
+                               host->bus_hz);
 
         /* add a bit spare time */
         drto_ms += 10;
@@ -1926,6 +1952,24 @@ static void dw_mci_set_drto(struct dw_mci *host)
         mod_timer(&host->dto_timer, jiffies + msecs_to_jiffies(drto_ms));
 }
 
+static bool dw_mci_clear_pending_cmd_complete(struct dw_mci *host)
+{
+        if (!test_bit(EVENT_CMD_COMPLETE, &host->pending_events))
+                return false;
+
+        /*
+         * Really be certain that the timer has stopped.  This is a bit of
+         * paranoia and could only really happen if we had really bad
+         * interrupt latency and the interrupt routine and timeout were
+         * running concurrently so that the del_timer() in the interrupt
+         * handler couldn't run.
+         */
+        WARN_ON(del_timer_sync(&host->cto_timer));
+        clear_bit(EVENT_CMD_COMPLETE, &host->pending_events);
+
+        return true;
+}
+
 static void dw_mci_tasklet_func(unsigned long priv)
 {
         struct dw_mci *host = (struct dw_mci *)priv;
@@ -1952,8 +1996,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
 
                 case STATE_SENDING_CMD11:
                 case STATE_SENDING_CMD:
-                        if (!test_and_clear_bit(EVENT_CMD_COMPLETE,
-                                                &host->pending_events))
+                        if (!dw_mci_clear_pending_cmd_complete(host))
                                 break;
 
                         cmd = host->cmd;
@@ -2122,8 +2165,7 @@ static void dw_mci_tasklet_func(unsigned long priv)
                         /* fall through */
 
                 case STATE_SENDING_STOP:
-                        if (!test_and_clear_bit(EVENT_CMD_COMPLETE,
-                                                &host->pending_events))
+                        if (!dw_mci_clear_pending_cmd_complete(host))
                                 break;
 
                         /* CMD error in data command */
@@ -2570,6 +2612,8 @@ done:
 
 static void dw_mci_cmd_interrupt(struct dw_mci *host, u32 status)
 {
+        del_timer(&host->cto_timer);
+
         if (!host->cmd_status)
                 host->cmd_status = status;
 
@@ -2594,6 +2638,7 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
         struct dw_mci *host = dev_id;
         u32 pending;
         struct dw_mci_slot *slot = host->slot;
+        unsigned long irqflags;
 
         pending = mci_readl(host, MINTSTS); /* read-only mask reg */
 
@@ -2601,8 +2646,6 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                 /* Check volt switch first, since it can look like an error */
                 if ((host->state == STATE_SENDING_CMD11) &&
                     (pending & SDMMC_INT_VOLT_SWITCH)) {
-                        unsigned long irqflags;
-
                         mci_writel(host, RINTSTS, SDMMC_INT_VOLT_SWITCH);
                         pending &= ~SDMMC_INT_VOLT_SWITCH;
 
@@ -2618,11 +2661,15 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                 }
 
                 if (pending & DW_MCI_CMD_ERROR_FLAGS) {
+                        spin_lock_irqsave(&host->irq_lock, irqflags);
+
                         del_timer(&host->cto_timer);
                         mci_writel(host, RINTSTS, DW_MCI_CMD_ERROR_FLAGS);
                         host->cmd_status = pending;
                         smp_wmb(); /* drain writebuffer */
                         set_bit(EVENT_CMD_COMPLETE, &host->pending_events);
+
+                        spin_unlock_irqrestore(&host->irq_lock, irqflags);
                 }
 
                 if (pending & DW_MCI_DATA_ERROR_FLAGS) {
@@ -2662,9 +2709,12 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id)
                 }
 
                 if (pending & SDMMC_INT_CMD_DONE) {
-                        del_timer(&host->cto_timer);
+                        spin_lock_irqsave(&host->irq_lock, irqflags);
+
                         mci_writel(host, RINTSTS, SDMMC_INT_CMD_DONE);
                         dw_mci_cmd_interrupt(host, pending);
+
+                        spin_unlock_irqrestore(&host->irq_lock, irqflags);
                 }
 
                 if (pending & SDMMC_INT_CD) {
@@ -2938,7 +2988,35 @@ static void dw_mci_cmd11_timer(unsigned long arg)
 static void dw_mci_cto_timer(unsigned long arg)
 {
         struct dw_mci *host = (struct dw_mci *)arg;
+        unsigned long irqflags;
+        u32 pending;
 
+        spin_lock_irqsave(&host->irq_lock, irqflags);
+
+        /*
+         * If somehow we have very bad interrupt latency it's remotely possible
+         * that the timer could fire while the interrupt is still pending or
+         * while the interrupt is midway through running.  Let's be paranoid
+         * and detect those two cases.  Note that this is paranoia is somewhat
+         * justified because in this function we don't actually cancel the
+         * pending command in the controller--we just assume it will never come.
+         */
+        pending = mci_readl(host, MINTSTS); /* read-only mask reg */
+        if (pending & (DW_MCI_CMD_ERROR_FLAGS | SDMMC_INT_CMD_DONE)) {
+                /* The interrupt should fire; no need to act but we can warn */
+                dev_warn(host->dev, "Unexpected interrupt latency\n");
+                goto exit;
+        }
+        if (test_bit(EVENT_CMD_COMPLETE, &host->pending_events)) {
+                /* Presumably interrupt handler couldn't delete the timer */
+                dev_warn(host->dev, "CTO timeout when already completed\n");
+                goto exit;
+        }
+
+        /*
+         * Continued paranoia to make sure we're in the state we expect.
+         * This paranoia isn't really justified but it seems good to be safe.
+         */
         switch (host->state) {
         case STATE_SENDING_CMD11:
         case STATE_SENDING_CMD:
@@ -2957,6 +3035,9 @@ static void dw_mci_cto_timer(unsigned long arg)
                          host->state);
                 break;
         }
+
+exit:
+        spin_unlock_irqrestore(&host->irq_lock, irqflags);
 }
 
 static void dw_mci_dto_timer(unsigned long arg)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c99dc59d729b..b2db581131b2 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2042,6 +2042,7 @@ static int bond_miimon_inspect(struct bonding *bond)
 
         bond_for_each_slave_rcu(bond, slave, iter) {
                 slave->new_link = BOND_LINK_NOCHANGE;
+                slave->link_new_state = slave->link;
 
                 link_state = bond_check_dev_link(bond, slave->dev, 0);
 
@@ -3253,7 +3254,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb)
         hash ^= (hash >> 16);
         hash ^= (hash >> 8);
 
-        return hash;
+        return hash >> 1;
 }
 
 /*-------------------------- Device entry points ----------------------------*/
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 83eec9a8c275..eb441e5e2cd8 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1809,15 +1809,17 @@ static inline void bcm_sysport_mask_all_intrs(struct bcm_sysport_priv *priv)
 
 static inline void gib_set_pad_extension(struct bcm_sysport_priv *priv)
 {
-        u32 __maybe_unused reg;
+        u32 reg;
 
-        /* Include Broadcom tag in pad extension */
+        reg = gib_readl(priv, GIB_CONTROL);
+        /* Include Broadcom tag in pad extension and fix up IPG_LENGTH */
         if (netdev_uses_dsa(priv->netdev)) {
-                reg = gib_readl(priv, GIB_CONTROL);
                 reg &= ~(GIB_PAD_EXTENSION_MASK << GIB_PAD_EXTENSION_SHIFT);
                 reg |= ENET_BRCM_TAG_LEN << GIB_PAD_EXTENSION_SHIFT;
-                gib_writel(priv, reg, GIB_CONTROL);
         }
+        reg &= ~(GIB_IPG_LEN_MASK << GIB_IPG_LEN_SHIFT);
+        reg |= 12 << GIB_IPG_LEN_SHIFT;
+        gib_writel(priv, reg, GIB_CONTROL);
 }
 
 static int bcm_sysport_open(struct net_device *dev)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
index f2d623a7aee0..123e2c1b65f5 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_version.h
@@ -37,7 +37,7 @@
 
 #define T4FW_VERSION_MAJOR 0x01
 #define T4FW_VERSION_MINOR 0x10
-#define T4FW_VERSION_MICRO 0x2D
+#define T4FW_VERSION_MICRO 0x3F
 #define T4FW_VERSION_BUILD 0x00
 
 #define T4FW_MIN_VERSION_MAJOR 0x01
@@ -46,7 +46,7 @@
 
 #define T5FW_VERSION_MAJOR 0x01
 #define T5FW_VERSION_MINOR 0x10
-#define T5FW_VERSION_MICRO 0x2D
+#define T5FW_VERSION_MICRO 0x3F
 #define T5FW_VERSION_BUILD 0x00
 
 #define T5FW_MIN_VERSION_MAJOR 0x00
@@ -55,7 +55,7 @@
 
 #define T6FW_VERSION_MAJOR 0x01
 #define T6FW_VERSION_MINOR 0x10
-#define T6FW_VERSION_MICRO 0x2D
+#define T6FW_VERSION_MICRO 0x3F
 #define T6FW_VERSION_BUILD 0x00
 
 #define T6FW_MIN_VERSION_MAJOR 0x00
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index a37af5813f33..fcf9ba5eb8d1 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -6747,6 +6747,9 @@ static int mvpp2_irqs_init(struct mvpp2_port *port)
         for (i = 0; i < port->nqvecs; i++) {
                 struct mvpp2_queue_vector *qv = port->qvecs + i;
 
+                if (qv->type == MVPP2_QUEUE_VECTOR_PRIVATE)
+                        irq_set_status_flags(qv->irq, IRQ_NO_BALANCING);
+
                 err = request_irq(qv->irq, mvpp2_isr, 0, port->dev->name, qv);
                 if (err)
                         goto err;
@@ -6776,6 +6779,7 @@ static void mvpp2_irqs_deinit(struct mvpp2_port *port)
                 struct mvpp2_queue_vector *qv = port->qvecs + i;
 
                 irq_set_affinity_hint(qv->irq, NULL);
+                irq_clear_status_flags(qv->irq, IRQ_NO_BALANCING);
                 free_irq(qv->irq, qv);
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 850cdc980ab5..4837045ffba3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -365,21 +365,24 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv,
                                     struct mlx5e_l2_hash_node *hn)
 {
         u8 action = hn->action;
+        u8 mac_addr[ETH_ALEN];
         int l2_err = 0;
 
+        ether_addr_copy(mac_addr, hn->ai.addr);
+
         switch (action) {
         case MLX5E_ACTION_ADD:
                 mlx5e_add_l2_flow_rule(priv, &hn->ai, MLX5E_FULLMATCH);
-                if (!is_multicast_ether_addr(hn->ai.addr)) {
-                        l2_err = mlx5_mpfs_add_mac(priv->mdev, hn->ai.addr);
+                if (!is_multicast_ether_addr(mac_addr)) {
+                        l2_err = mlx5_mpfs_add_mac(priv->mdev, mac_addr);
                         hn->mpfs = !l2_err;
                 }
                 hn->action = MLX5E_ACTION_NONE;
                 break;
 
         case MLX5E_ACTION_DEL:
-                if (!is_multicast_ether_addr(hn->ai.addr) && hn->mpfs)
-                        l2_err = mlx5_mpfs_del_mac(priv->mdev, hn->ai.addr);
+                if (!is_multicast_ether_addr(mac_addr) && hn->mpfs)
+                        l2_err = mlx5_mpfs_del_mac(priv->mdev, mac_addr);
                 mlx5e_del_l2_flow_rule(priv, &hn->ai);
                 mlx5e_del_l2_from_hash(hn);
                 break;
@@ -387,7 +390,7 @@ static void mlx5e_execute_l2_action(struct mlx5e_priv *priv,
 
         if (l2_err)
                 netdev_warn(priv->netdev, "MPFS, failed to %s mac %pM, err(%d)\n",
-                            action == MLX5E_ACTION_ADD ? "add" : "del", hn->ai.addr, l2_err);
+                            action == MLX5E_ACTION_ADD ? "add" : "del", mac_addr, l2_err);
 }
 
 static void mlx5e_sync_netdev_addr(struct mlx5e_priv *priv)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 6383695004a5..195eb7e71473 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -168,8 +168,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
         }
 
         /* Processing RX queues common config */
-        if (of_property_read_u8(rx_node, "snps,rx-queues-to-use",
-                                &plat->rx_queues_to_use))
+        if (of_property_read_u32(rx_node, "snps,rx-queues-to-use",
+                                 &plat->rx_queues_to_use))
                 plat->rx_queues_to_use = 1;
 
         if (of_property_read_bool(rx_node, "snps,rx-sched-sp"))
@@ -191,8 +191,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
                 else
                         plat->rx_queues_cfg[queue].mode_to_use = MTL_QUEUE_DCB;
 
-                if (of_property_read_u8(q_node, "snps,map-to-dma-channel",
-                                        &plat->rx_queues_cfg[queue].chan))
+                if (of_property_read_u32(q_node, "snps,map-to-dma-channel",
+                                         &plat->rx_queues_cfg[queue].chan))
                         plat->rx_queues_cfg[queue].chan = queue;
                 /* TODO: Dynamic mapping to be included in the future */
 
@@ -222,8 +222,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
         }
 
         /* Processing TX queues common config */
-        if (of_property_read_u8(tx_node, "snps,tx-queues-to-use",
-                                &plat->tx_queues_to_use))
+        if (of_property_read_u32(tx_node, "snps,tx-queues-to-use",
+                                 &plat->tx_queues_to_use))
                 plat->tx_queues_to_use = 1;
 
         if (of_property_read_bool(tx_node, "snps,tx-sched-wrr"))
@@ -244,8 +244,8 @@ static void stmmac_mtl_setup(struct platform_device *pdev,
                 if (queue >= plat->tx_queues_to_use)
                         break;
 
-                if (of_property_read_u8(q_node, "snps,weight",
-                                        &plat->tx_queues_cfg[queue].weight))
+                if (of_property_read_u32(q_node, "snps,weight",
+                                         &plat->tx_queues_cfg[queue].weight))
                         plat->tx_queues_cfg[queue].weight = 0x10 + queue;
 
                 if (of_property_read_bool(q_node, "snps,dcb-algorithm")) {
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index b2ff88e69a81..3d4f7959dabb 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -626,7 +626,7 @@ static int asix_suspend(struct usb_interface *intf, pm_message_t message)
         struct usbnet *dev = usb_get_intfdata(intf);
         struct asix_common_private *priv = dev->driver_priv;
 
-        if (priv->suspend)
+        if (priv && priv->suspend)
                 priv->suspend(dev);
 
         return usbnet_suspend(intf, message);
@@ -678,7 +678,7 @@ static int asix_resume(struct usb_interface *intf)
         struct usbnet *dev = usb_get_intfdata(intf);
         struct asix_common_private *priv = dev->driver_priv;
 
-        if (priv->resume)
+        if (priv && priv->resume)
                 priv->resume(dev);
 
         return usbnet_resume(intf);
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 3e7a3ac3a362..05dca3e5c93d 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -230,7 +230,7 @@ skip:
                         goto bad_desc;
         }
 
-        if (header.usb_cdc_ether_desc) {
+        if (header.usb_cdc_ether_desc && info->ether->wMaxSegmentSize) {
                 dev->hard_mtu = le16_to_cpu(info->ether->wMaxSegmentSize);
                 /* because of Zaurus, we may be ignoring the host
                  * side link address we were given.
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 8c3733608271..8d4a6f7cba61 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -499,6 +499,7 @@ static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                 return 1;
         }
         if (rawip) {
+                skb_reset_mac_header(skb);
                 skb->dev = dev->net; /* normally set by eth_type_trans */
                 skb->protocol = proto;
                 return 1;
@@ -681,7 +682,7 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
         }
 
         /* errors aren't fatal - we can live with the dynamic address */
-        if (cdc_ether) {
+        if (cdc_ether && cdc_ether->wMaxSegmentSize) {
                 dev->hard_mtu = le16_to_cpu(cdc_ether->wMaxSegmentSize);
                 usbnet_get_ethernet_addr(dev, cdc_ether->iMACAddress);
         }
diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
index 9b243e6f3008..7dc3bcac3506 100644
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -1165,7 +1165,7 @@ static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
         frh->family = family;
         frh->action = FR_ACT_TO_TBL;
 
-        if (nla_put_u32(skb, FRA_L3MDEV, 1))
+        if (nla_put_u8(skb, FRA_L3MDEV, 1))
                 goto nla_put_failure;
 
         if (nla_put_u32(skb, FRA_PRIORITY, FIB_RULE_PREF))
diff --git a/drivers/power/reset/piix4-poweroff.c b/drivers/power/reset/piix4-poweroff.c
index bacfc95783f0..20ce3ff5e039 100644
--- a/drivers/power/reset/piix4-poweroff.c
+++ b/drivers/power/reset/piix4-poweroff.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2016 Imagination Technologies
- * Author: Paul Burton <paul.burton@imgtec.com>
+ * Author: Paul Burton <paul.burton@mips.com>
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -109,5 +109,5 @@ static struct pci_driver piix4_poweroff_driver = {
 };
 
 module_pci_driver(piix4_poweroff_driver);
-MODULE_AUTHOR("Paul Burton <paul.burton@imgtec.com>");
+MODULE_AUTHOR("Paul Burton <paul.burton@mips.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 3bd956d3bc5d..dce42a416876 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3212,6 +3212,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 ql_log(ql_log_fatal, base_vha, 0x00ed,
                     "Failed to start DPC thread.\n");
                 ret = PTR_ERR(ha->dpc_thread);
+                ha->dpc_thread = NULL;
                 goto probe_failed;
         }
         ql_dbg(ql_dbg_init, base_vha, 0x00ee,
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ad3ea24f0885..bcc1694cebcd 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -2685,7 +2685,6 @@ scsi_device_set_state(struct scsi_device *sdev, enum scsi_device_state state)
 
         }
         sdev->sdev_state = state;
-        sysfs_notify(&sdev->sdev_gendev.kobj, NULL, "state");
         return 0;
 
  illegal:
@@ -3109,7 +3108,6 @@ int scsi_internal_device_unblock_nowait(struct scsi_device *sdev,
         case SDEV_BLOCK:
         case SDEV_TRANSPORT_OFFLINE:
                 sdev->sdev_state = new_state;
-                sysfs_notify(&sdev->sdev_gendev.kobj, NULL, "state");
                 break;
         case SDEV_CREATED_BLOCK:
                 if (new_state == SDEV_TRANSPORT_OFFLINE ||
@@ -3117,7 +3115,6 @@ int scsi_internal_device_unblock_nowait(struct scsi_device *sdev,
                         sdev->sdev_state = new_state;
                 else
                         sdev->sdev_state = SDEV_CREATED;
-                sysfs_notify(&sdev->sdev_gendev.kobj, NULL, "state");
                 break;
         case SDEV_CANCEL:
         case SDEV_OFFLINE:
diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index 4f6f01cf9968..36f6190931bc 100644
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -556,11 +556,8 @@ int srp_reconnect_rport(struct srp_rport *rport)
                  */
                 shost_for_each_device(sdev, shost) {
                         mutex_lock(&sdev->state_mutex);
-                        if (sdev->sdev_state == SDEV_OFFLINE) {
+                        if (sdev->sdev_state == SDEV_OFFLINE)
                                 sdev->sdev_state = SDEV_RUNNING;
-                                sysfs_notify(&sdev->sdev_gendev.kobj,
-                                             NULL, "state");
-                        }
                         mutex_unlock(&sdev->state_mutex);
                 }
         } else if (rport->state == SRP_RPORT_RUNNING) {