diff --git a/Documentation/kbuild/kbuild.txt b/Documentation/kbuild/kbuild.txt
index ac2363ea05c5..82afdb7f0816 100644
--- a/Documentation/kbuild/kbuild.txt
+++ b/Documentation/kbuild/kbuild.txt
@@ -152,15 +152,6 @@ stripped after they are installed.  If INSTALL_MOD_STRIP 
is '1', then
 the default option --strip-debug will be used.  Otherwise,
 INSTALL_MOD_STRIP value will be used as the options to the strip command.
 
-INSTALL_FW_PATH
---------------------------------------------------
-INSTALL_FW_PATH specifies where to install the firmware blobs.
-The default value is:
-
-    $(INSTALL_MOD_PATH)/lib/firmware
-
-The value can be overridden in which case the default value is ignored.
-
 INSTALL_HDR_PATH
 --------------------------------------------------
 INSTALL_HDR_PATH specifies where to install user space headers when
diff --git a/Makefile b/Makefile
index 0700feaaa6cf..acbb0e3d29c9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 55
+SUBLEVEL = 56
 EXTRAVERSION =
 NAME = Petit Gorille
 
diff --git a/arch/arm64/include/asm/simd.h b/arch/arm64/include/asm/simd.h
index fa8b3fe932e6..6495cc51246f 100644
--- a/arch/arm64/include/asm/simd.h
+++ b/arch/arm64/include/asm/simd.h
@@ -29,20 +29,15 @@ DECLARE_PER_CPU(bool, kernel_neon_busy);
 static __must_check inline bool may_use_simd(void)
 {
        /*
-        * The raw_cpu_read() is racy if called with preemption enabled.
-        * This is not a bug: kernel_neon_busy is only set when
-        * preemption is disabled, so we cannot migrate to another CPU
-        * while it is set, nor can we migrate to a CPU where it is set.
-        * So, if we find it clear on some CPU then we're guaranteed to
-        * find it clear on any CPU we could migrate to.
-        *
-        * If we are in between kernel_neon_begin()...kernel_neon_end(),
-        * the flag will be set, but preemption is also disabled, so we
-        * can't migrate to another CPU and spuriously see it become
-        * false.
+        * kernel_neon_busy is only set while preemption is disabled,
+        * and is clear whenever preemption is enabled. Since
+        * this_cpu_read() is atomic w.r.t. preemption, kernel_neon_busy
+        * cannot change under our feet -- if it's set we cannot be
+        * migrated, and if it's clear we cannot be migrated to a CPU
+        * where it is set.
         */
        return !in_irq() && !irqs_disabled() && !in_nmi() &&
-               !raw_cpu_read(kernel_neon_busy);
+               !this_cpu_read(kernel_neon_busy);
 }
 
 #else /* ! CONFIG_KERNEL_MODE_NEON */
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index e1ddb94a6522..e8d772a2597d 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -29,6 +29,7 @@
 #include <linux/kallsyms.h>
 #include <linux/random.h>
 #include <linux/prctl.h>
+#include <linux/nmi.h>
 
 #include <asm/asm.h>
 #include <asm/bootinfo.h>
@@ -655,28 +656,42 @@ unsigned long arch_align_stack(unsigned long sp)
        return sp & ALMASK;
 }
 
-static void arch_dump_stack(void *info)
+static DEFINE_PER_CPU(call_single_data_t, backtrace_csd);
+static struct cpumask backtrace_csd_busy;
+
+static void handle_backtrace(void *info)
 {
-       struct pt_regs *regs;
+       nmi_cpu_backtrace(get_irq_regs());
+       cpumask_clear_cpu(smp_processor_id(), &backtrace_csd_busy);
+}
 
-       regs = get_irq_regs();
+static void raise_backtrace(cpumask_t *mask)
+{
+       call_single_data_t *csd;
+       int cpu;
 
-       if (regs)
-               show_regs(regs);
+       for_each_cpu(cpu, mask) {
+               /*
+                * If we previously sent an IPI to the target CPU & it hasn't
+                * cleared its bit in the busy cpumask then it didn't handle
+                * our previous IPI & it's not safe for us to reuse the
+                * call_single_data_t.
+                */
+               if (cpumask_test_and_set_cpu(cpu, &backtrace_csd_busy)) {
+                       pr_warn("Unable to send backtrace IPI to CPU%u - 
perhaps it hung?\n",
+                               cpu);
+                       continue;
+               }
 
-       dump_stack();
+               csd = &per_cpu(backtrace_csd, cpu);
+               csd->func = handle_backtrace;
+               smp_call_function_single_async(cpu, csd);
+       }
 }
 
 void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self)
 {
-       long this_cpu = get_cpu();
-
-       if (cpumask_test_cpu(this_cpu, mask) && !exclude_self)
-               dump_stack();
-
-       smp_call_function_many(mask, arch_dump_stack, NULL, 1);
-
-       put_cpu();
+       nmi_trigger_cpumask_backtrace(mask, exclude_self, raise_backtrace);
 }
 
 int mips_get_process_fp_mode(struct task_struct *task)
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 5669d3b8bd38..583aed906933 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -351,6 +351,7 @@ static void __show_regs(const struct pt_regs *regs)
 void show_regs(struct pt_regs *regs)
 {
        __show_regs((struct pt_regs *)regs);
+       dump_stack();
 }
 
 void show_registers(struct pt_regs *regs)
diff --git a/arch/mips/mm/ioremap.c b/arch/mips/mm/ioremap.c
index 1986e09fb457..1601d90b087b 100644
--- a/arch/mips/mm/ioremap.c
+++ b/arch/mips/mm/ioremap.c
@@ -9,6 +9,7 @@
 #include <linux/export.h>
 #include <asm/addrspace.h>
 #include <asm/byteorder.h>
+#include <linux/ioport.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
@@ -98,6 +99,20 @@ static int remap_area_pages(unsigned long address, 
phys_addr_t phys_addr,
        return error;
 }
 
+static int __ioremap_check_ram(unsigned long start_pfn, unsigned long nr_pages,
+                              void *arg)
+{
+       unsigned long i;
+
+       for (i = 0; i < nr_pages; i++) {
+               if (pfn_valid(start_pfn + i) &&
+                   !PageReserved(pfn_to_page(start_pfn + i)))
+                       return 1;
+       }
+
+       return 0;
+}
+
 /*
  * Generic mapping function (not visible outside):
  */
@@ -116,8 +131,8 @@ static int remap_area_pages(unsigned long address, 
phys_addr_t phys_addr,
 
 void __iomem * __ioremap(phys_addr_t phys_addr, phys_addr_t size, unsigned 
long flags)
 {
+       unsigned long offset, pfn, last_pfn;
        struct vm_struct * area;
-       unsigned long offset;
        phys_addr_t last_addr;
        void * addr;
 
@@ -137,18 +152,16 @@ void __iomem * __ioremap(phys_addr_t phys_addr, 
phys_addr_t size, unsigned long
                return (void __iomem *) CKSEG1ADDR(phys_addr);
 
        /*
-        * Don't allow anybody to remap normal RAM that we're using..
+        * Don't allow anybody to remap RAM that may be allocated by the page
+        * allocator, since that could lead to races & data clobbering.
         */
-       if (phys_addr < virt_to_phys(high_memory)) {
-               char *t_addr, *t_end;
-               struct page *page;
-
-               t_addr = __va(phys_addr);
-               t_end = t_addr + (size - 1);
-
-               for(page = virt_to_page(t_addr); page <= virt_to_page(t_end); 
page++)
-                       if(!PageReserved(page))
-                               return NULL;
+       pfn = PFN_DOWN(phys_addr);
+       last_pfn = PFN_DOWN(last_addr);
+       if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL,
+                                 __ioremap_check_ram) == 1) {
+               WARN_ONCE(1, "ioremap on RAM at %pa - %pa\n",
+                         &phys_addr, &last_addr);
+               return NULL;
        }
 
        /*
diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile
index 5f07333bb224..9c903a420cda 100644
--- a/arch/x86/crypto/Makefile
+++ b/arch/x86/crypto/Makefile
@@ -15,7 +15,6 @@ obj-$(CONFIG_CRYPTO_GLUE_HELPER_X86) += glue_helper.o
 
 obj-$(CONFIG_CRYPTO_AES_586) += aes-i586.o
 obj-$(CONFIG_CRYPTO_TWOFISH_586) += twofish-i586.o
-obj-$(CONFIG_CRYPTO_SALSA20_586) += salsa20-i586.o
 obj-$(CONFIG_CRYPTO_SERPENT_SSE2_586) += serpent-sse2-i586.o
 
 obj-$(CONFIG_CRYPTO_AES_X86_64) += aes-x86_64.o
@@ -24,7 +23,6 @@ obj-$(CONFIG_CRYPTO_CAMELLIA_X86_64) += camellia-x86_64.o
 obj-$(CONFIG_CRYPTO_BLOWFISH_X86_64) += blowfish-x86_64.o
 obj-$(CONFIG_CRYPTO_TWOFISH_X86_64) += twofish-x86_64.o
 obj-$(CONFIG_CRYPTO_TWOFISH_X86_64_3WAY) += twofish-x86_64-3way.o
-obj-$(CONFIG_CRYPTO_SALSA20_X86_64) += salsa20-x86_64.o
 obj-$(CONFIG_CRYPTO_CHACHA20_X86_64) += chacha20-x86_64.o
 obj-$(CONFIG_CRYPTO_SERPENT_SSE2_X86_64) += serpent-sse2-x86_64.o
 obj-$(CONFIG_CRYPTO_AES_NI_INTEL) += aesni-intel.o
@@ -59,7 +57,6 @@ endif
 
 aes-i586-y := aes-i586-asm_32.o aes_glue.o
 twofish-i586-y := twofish-i586-asm_32.o twofish_glue.o
-salsa20-i586-y := salsa20-i586-asm_32.o salsa20_glue.o
 serpent-sse2-i586-y := serpent-sse2-i586-asm_32.o serpent_sse2_glue.o
 
 aes-x86_64-y := aes-x86_64-asm_64.o aes_glue.o
@@ -68,7 +65,6 @@ camellia-x86_64-y := camellia-x86_64-asm_64.o camellia_glue.o
 blowfish-x86_64-y := blowfish-x86_64-asm_64.o blowfish_glue.o
 twofish-x86_64-y := twofish-x86_64-asm_64.o twofish_glue.o
 twofish-x86_64-3way-y := twofish-x86_64-asm_64-3way.o twofish_glue_3way.o
-salsa20-x86_64-y := salsa20-x86_64-asm_64.o salsa20_glue.o
 chacha20-x86_64-y := chacha20-ssse3-x86_64.o chacha20_glue.o
 serpent-sse2-x86_64-y := serpent-sse2-x86_64-asm_64.o serpent_sse2_glue.o
 
diff --git a/arch/x86/crypto/salsa20-i586-asm_32.S 
b/arch/x86/crypto/salsa20-i586-asm_32.S
deleted file mode 100644
index 329452b8f794..000000000000
--- a/arch/x86/crypto/salsa20-i586-asm_32.S
+++ /dev/null
@@ -1,1114 +0,0 @@
-# salsa20_pm.s version 20051229
-# D. J. Bernstein
-# Public domain.
-
-#include <linux/linkage.h>
-
-.text
-
-# enter salsa20_encrypt_bytes
-ENTRY(salsa20_encrypt_bytes)
-       mov     %esp,%eax
-       and     $31,%eax
-       add     $256,%eax
-       sub     %eax,%esp
-       # eax_stack = eax
-       movl    %eax,80(%esp)
-       # ebx_stack = ebx
-       movl    %ebx,84(%esp)
-       # esi_stack = esi
-       movl    %esi,88(%esp)
-       # edi_stack = edi
-       movl    %edi,92(%esp)
-       # ebp_stack = ebp
-       movl    %ebp,96(%esp)
-       # x = arg1
-       movl    4(%esp,%eax),%edx
-       # m = arg2
-       movl    8(%esp,%eax),%esi
-       # out = arg3
-       movl    12(%esp,%eax),%edi
-       # bytes = arg4
-       movl    16(%esp,%eax),%ebx
-       # bytes -= 0
-       sub     $0,%ebx
-       # goto done if unsigned<=
-       jbe     ._done
-._start:
-       # in0 = *(uint32 *) (x + 0)
-       movl    0(%edx),%eax
-       # in1 = *(uint32 *) (x + 4)
-       movl    4(%edx),%ecx
-       # in2 = *(uint32 *) (x + 8)
-       movl    8(%edx),%ebp
-       # j0 = in0
-       movl    %eax,164(%esp)
-       # in3 = *(uint32 *) (x + 12)
-       movl    12(%edx),%eax
-       # j1 = in1
-       movl    %ecx,168(%esp)
-       # in4 = *(uint32 *) (x + 16)
-       movl    16(%edx),%ecx
-       # j2 = in2
-       movl    %ebp,172(%esp)
-       # in5 = *(uint32 *) (x + 20)
-       movl    20(%edx),%ebp
-       # j3 = in3
-       movl    %eax,176(%esp)
-       # in6 = *(uint32 *) (x + 24)
-       movl    24(%edx),%eax
-       # j4 = in4
-       movl    %ecx,180(%esp)
-       # in7 = *(uint32 *) (x + 28)
-       movl    28(%edx),%ecx
-       # j5 = in5
-       movl    %ebp,184(%esp)
-       # in8 = *(uint32 *) (x + 32)
-       movl    32(%edx),%ebp
-       # j6 = in6
-       movl    %eax,188(%esp)
-       # in9 = *(uint32 *) (x + 36)
-       movl    36(%edx),%eax
-       # j7 = in7
-       movl    %ecx,192(%esp)
-       # in10 = *(uint32 *) (x + 40)
-       movl    40(%edx),%ecx
-       # j8 = in8
-       movl    %ebp,196(%esp)
-       # in11 = *(uint32 *) (x + 44)
-       movl    44(%edx),%ebp
-       # j9 = in9
-       movl    %eax,200(%esp)
-       # in12 = *(uint32 *) (x + 48)
-       movl    48(%edx),%eax
-       # j10 = in10
-       movl    %ecx,204(%esp)
-       # in13 = *(uint32 *) (x + 52)
-       movl    52(%edx),%ecx
-       # j11 = in11
-       movl    %ebp,208(%esp)
-       # in14 = *(uint32 *) (x + 56)
-       movl    56(%edx),%ebp
-       # j12 = in12
-       movl    %eax,212(%esp)
-       # in15 = *(uint32 *) (x + 60)
-       movl    60(%edx),%eax
-       # j13 = in13
-       movl    %ecx,216(%esp)
-       # j14 = in14
-       movl    %ebp,220(%esp)
-       # j15 = in15
-       movl    %eax,224(%esp)
-       # x_backup = x
-       movl    %edx,64(%esp)
-._bytesatleast1:
-       #   bytes - 64
-       cmp     $64,%ebx
-       #   goto nocopy if unsigned>=
-       jae     ._nocopy
-       #     ctarget = out
-       movl    %edi,228(%esp)
-       #     out = &tmp
-       leal    0(%esp),%edi
-       #     i = bytes
-       mov     %ebx,%ecx
-       #     while (i) { *out++ = *m++; --i }
-       rep     movsb
-       #     out = &tmp
-       leal    0(%esp),%edi
-       #     m = &tmp
-       leal    0(%esp),%esi
-._nocopy:
-       #   out_backup = out
-       movl    %edi,72(%esp)
-       #   m_backup = m
-       movl    %esi,68(%esp)
-       #   bytes_backup = bytes
-       movl    %ebx,76(%esp)
-       #   in0 = j0
-       movl    164(%esp),%eax
-       #   in1 = j1
-       movl    168(%esp),%ecx
-       #   in2 = j2
-       movl    172(%esp),%edx
-       #   in3 = j3
-       movl    176(%esp),%ebx
-       #   x0 = in0
-       movl    %eax,100(%esp)
-       #   x1 = in1
-       movl    %ecx,104(%esp)
-       #   x2 = in2
-       movl    %edx,108(%esp)
-       #   x3 = in3
-       movl    %ebx,112(%esp)
-       #   in4 = j4
-       movl    180(%esp),%eax
-       #   in5 = j5
-       movl    184(%esp),%ecx
-       #   in6 = j6
-       movl    188(%esp),%edx
-       #   in7 = j7
-       movl    192(%esp),%ebx
-       #   x4 = in4
-       movl    %eax,116(%esp)
-       #   x5 = in5
-       movl    %ecx,120(%esp)
-       #   x6 = in6
-       movl    %edx,124(%esp)
-       #   x7 = in7
-       movl    %ebx,128(%esp)
-       #   in8 = j8
-       movl    196(%esp),%eax
-       #   in9 = j9
-       movl    200(%esp),%ecx
-       #   in10 = j10
-       movl    204(%esp),%edx
-       #   in11 = j11
-       movl    208(%esp),%ebx
-       #   x8 = in8
-       movl    %eax,132(%esp)
-       #   x9 = in9
-       movl    %ecx,136(%esp)
-       #   x10 = in10
-       movl    %edx,140(%esp)
-       #   x11 = in11
-       movl    %ebx,144(%esp)
-       #   in12 = j12
-       movl    212(%esp),%eax
-       #   in13 = j13
-       movl    216(%esp),%ecx
-       #   in14 = j14
-       movl    220(%esp),%edx
-       #   in15 = j15
-       movl    224(%esp),%ebx
-       #   x12 = in12
-       movl    %eax,148(%esp)
-       #   x13 = in13
-       movl    %ecx,152(%esp)
-       #   x14 = in14
-       movl    %edx,156(%esp)
-       #   x15 = in15
-       movl    %ebx,160(%esp)
-       #   i = 20
-       mov     $20,%ebp
-       # p = x0
-       movl    100(%esp),%eax
-       # s = x5
-       movl    120(%esp),%ecx
-       # t = x10
-       movl    140(%esp),%edx
-       # w = x15
-       movl    160(%esp),%ebx
-._mainloop:
-       # x0 = p
-       movl    %eax,100(%esp)
-       #                               x10 = t
-       movl    %edx,140(%esp)
-       # p += x12
-       addl    148(%esp),%eax
-       #               x5 = s
-       movl    %ecx,120(%esp)
-       #                               t += x6
-       addl    124(%esp),%edx
-       #                                               x15 = w
-       movl    %ebx,160(%esp)
-       #               r = x1
-       movl    104(%esp),%esi
-       #               r += s
-       add     %ecx,%esi
-       #                                               v = x11
-       movl    144(%esp),%edi
-       #                                               v += w
-       add     %ebx,%edi
-       # p <<<= 7
-       rol     $7,%eax
-       # p ^= x4
-       xorl    116(%esp),%eax
-       #                               t <<<= 7
-       rol     $7,%edx
-       #                               t ^= x14
-       xorl    156(%esp),%edx
-       #               r <<<= 7
-       rol     $7,%esi
-       #               r ^= x9
-       xorl    136(%esp),%esi
-       #                                               v <<<= 7
-       rol     $7,%edi
-       #                                               v ^= x3
-       xorl    112(%esp),%edi
-       # x4 = p
-       movl    %eax,116(%esp)
-       #                               x14 = t
-       movl    %edx,156(%esp)
-       # p += x0
-       addl    100(%esp),%eax
-       #               x9 = r
-       movl    %esi,136(%esp)
-       #                               t += x10
-       addl    140(%esp),%edx
-       #                                               x3 = v
-       movl    %edi,112(%esp)
-       # p <<<= 9
-       rol     $9,%eax
-       # p ^= x8
-       xorl    132(%esp),%eax
-       #                               t <<<= 9
-       rol     $9,%edx
-       #                               t ^= x2
-       xorl    108(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 9
-       rol     $9,%ecx
-       #               s ^= x13
-       xorl    152(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 9
-       rol     $9,%ebx
-       #                                               w ^= x7
-       xorl    128(%esp),%ebx
-       # x8 = p
-       movl    %eax,132(%esp)
-       #                               x2 = t
-       movl    %edx,108(%esp)
-       # p += x4
-       addl    116(%esp),%eax
-       #               x13 = s
-       movl    %ecx,152(%esp)
-       #                               t += x14
-       addl    156(%esp),%edx
-       #                                               x7 = w
-       movl    %ebx,128(%esp)
-       # p <<<= 13
-       rol     $13,%eax
-       # p ^= x12
-       xorl    148(%esp),%eax
-       #                               t <<<= 13
-       rol     $13,%edx
-       #                               t ^= x6
-       xorl    124(%esp),%edx
-       #               r += s
-       add     %ecx,%esi
-       #               r <<<= 13
-       rol     $13,%esi
-       #               r ^= x1
-       xorl    104(%esp),%esi
-       #                                               v += w
-       add     %ebx,%edi
-       #                                               v <<<= 13
-       rol     $13,%edi
-       #                                               v ^= x11
-       xorl    144(%esp),%edi
-       # x12 = p
-       movl    %eax,148(%esp)
-       #                               x6 = t
-       movl    %edx,124(%esp)
-       # p += x8
-       addl    132(%esp),%eax
-       #               x1 = r
-       movl    %esi,104(%esp)
-       #                               t += x2
-       addl    108(%esp),%edx
-       #                                               x11 = v
-       movl    %edi,144(%esp)
-       # p <<<= 18
-       rol     $18,%eax
-       # p ^= x0
-       xorl    100(%esp),%eax
-       #                               t <<<= 18
-       rol     $18,%edx
-       #                               t ^= x10
-       xorl    140(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 18
-       rol     $18,%ecx
-       #               s ^= x5
-       xorl    120(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 18
-       rol     $18,%ebx
-       #                                               w ^= x15
-       xorl    160(%esp),%ebx
-       # x0 = p
-       movl    %eax,100(%esp)
-       #                               x10 = t
-       movl    %edx,140(%esp)
-       # p += x3
-       addl    112(%esp),%eax
-       # p <<<= 7
-       rol     $7,%eax
-       #               x5 = s
-       movl    %ecx,120(%esp)
-       #                               t += x9
-       addl    136(%esp),%edx
-       #                                               x15 = w
-       movl    %ebx,160(%esp)
-       #               r = x4
-       movl    116(%esp),%esi
-       #               r += s
-       add     %ecx,%esi
-       #                                               v = x14
-       movl    156(%esp),%edi
-       #                                               v += w
-       add     %ebx,%edi
-       # p ^= x1
-       xorl    104(%esp),%eax
-       #                               t <<<= 7
-       rol     $7,%edx
-       #                               t ^= x11
-       xorl    144(%esp),%edx
-       #               r <<<= 7
-       rol     $7,%esi
-       #               r ^= x6
-       xorl    124(%esp),%esi
-       #                                               v <<<= 7
-       rol     $7,%edi
-       #                                               v ^= x12
-       xorl    148(%esp),%edi
-       # x1 = p
-       movl    %eax,104(%esp)
-       #                               x11 = t
-       movl    %edx,144(%esp)
-       # p += x0
-       addl    100(%esp),%eax
-       #               x6 = r
-       movl    %esi,124(%esp)
-       #                               t += x10
-       addl    140(%esp),%edx
-       #                                               x12 = v
-       movl    %edi,148(%esp)
-       # p <<<= 9
-       rol     $9,%eax
-       # p ^= x2
-       xorl    108(%esp),%eax
-       #                               t <<<= 9
-       rol     $9,%edx
-       #                               t ^= x8
-       xorl    132(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 9
-       rol     $9,%ecx
-       #               s ^= x7
-       xorl    128(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 9
-       rol     $9,%ebx
-       #                                               w ^= x13
-       xorl    152(%esp),%ebx
-       # x2 = p
-       movl    %eax,108(%esp)
-       #                               x8 = t
-       movl    %edx,132(%esp)
-       # p += x1
-       addl    104(%esp),%eax
-       #               x7 = s
-       movl    %ecx,128(%esp)
-       #                               t += x11
-       addl    144(%esp),%edx
-       #                                               x13 = w
-       movl    %ebx,152(%esp)
-       # p <<<= 13
-       rol     $13,%eax
-       # p ^= x3
-       xorl    112(%esp),%eax
-       #                               t <<<= 13
-       rol     $13,%edx
-       #                               t ^= x9
-       xorl    136(%esp),%edx
-       #               r += s
-       add     %ecx,%esi
-       #               r <<<= 13
-       rol     $13,%esi
-       #               r ^= x4
-       xorl    116(%esp),%esi
-       #                                               v += w
-       add     %ebx,%edi
-       #                                               v <<<= 13
-       rol     $13,%edi
-       #                                               v ^= x14
-       xorl    156(%esp),%edi
-       # x3 = p
-       movl    %eax,112(%esp)
-       #                               x9 = t
-       movl    %edx,136(%esp)
-       # p += x2
-       addl    108(%esp),%eax
-       #               x4 = r
-       movl    %esi,116(%esp)
-       #                               t += x8
-       addl    132(%esp),%edx
-       #                                               x14 = v
-       movl    %edi,156(%esp)
-       # p <<<= 18
-       rol     $18,%eax
-       # p ^= x0
-       xorl    100(%esp),%eax
-       #                               t <<<= 18
-       rol     $18,%edx
-       #                               t ^= x10
-       xorl    140(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 18
-       rol     $18,%ecx
-       #               s ^= x5
-       xorl    120(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 18
-       rol     $18,%ebx
-       #                                               w ^= x15
-       xorl    160(%esp),%ebx
-       # x0 = p
-       movl    %eax,100(%esp)
-       #                               x10 = t
-       movl    %edx,140(%esp)
-       # p += x12
-       addl    148(%esp),%eax
-       #               x5 = s
-       movl    %ecx,120(%esp)
-       #                               t += x6
-       addl    124(%esp),%edx
-       #                                               x15 = w
-       movl    %ebx,160(%esp)
-       #               r = x1
-       movl    104(%esp),%esi
-       #               r += s
-       add     %ecx,%esi
-       #                                               v = x11
-       movl    144(%esp),%edi
-       #                                               v += w
-       add     %ebx,%edi
-       # p <<<= 7
-       rol     $7,%eax
-       # p ^= x4
-       xorl    116(%esp),%eax
-       #                               t <<<= 7
-       rol     $7,%edx
-       #                               t ^= x14
-       xorl    156(%esp),%edx
-       #               r <<<= 7
-       rol     $7,%esi
-       #               r ^= x9
-       xorl    136(%esp),%esi
-       #                                               v <<<= 7
-       rol     $7,%edi
-       #                                               v ^= x3
-       xorl    112(%esp),%edi
-       # x4 = p
-       movl    %eax,116(%esp)
-       #                               x14 = t
-       movl    %edx,156(%esp)
-       # p += x0
-       addl    100(%esp),%eax
-       #               x9 = r
-       movl    %esi,136(%esp)
-       #                               t += x10
-       addl    140(%esp),%edx
-       #                                               x3 = v
-       movl    %edi,112(%esp)
-       # p <<<= 9
-       rol     $9,%eax
-       # p ^= x8
-       xorl    132(%esp),%eax
-       #                               t <<<= 9
-       rol     $9,%edx
-       #                               t ^= x2
-       xorl    108(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 9
-       rol     $9,%ecx
-       #               s ^= x13
-       xorl    152(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 9
-       rol     $9,%ebx
-       #                                               w ^= x7
-       xorl    128(%esp),%ebx
-       # x8 = p
-       movl    %eax,132(%esp)
-       #                               x2 = t
-       movl    %edx,108(%esp)
-       # p += x4
-       addl    116(%esp),%eax
-       #               x13 = s
-       movl    %ecx,152(%esp)
-       #                               t += x14
-       addl    156(%esp),%edx
-       #                                               x7 = w
-       movl    %ebx,128(%esp)
-       # p <<<= 13
-       rol     $13,%eax
-       # p ^= x12
-       xorl    148(%esp),%eax
-       #                               t <<<= 13
-       rol     $13,%edx
-       #                               t ^= x6
-       xorl    124(%esp),%edx
-       #               r += s
-       add     %ecx,%esi
-       #               r <<<= 13
-       rol     $13,%esi
-       #               r ^= x1
-       xorl    104(%esp),%esi
-       #                                               v += w
-       add     %ebx,%edi
-       #                                               v <<<= 13
-       rol     $13,%edi
-       #                                               v ^= x11
-       xorl    144(%esp),%edi
-       # x12 = p
-       movl    %eax,148(%esp)
-       #                               x6 = t
-       movl    %edx,124(%esp)
-       # p += x8
-       addl    132(%esp),%eax
-       #               x1 = r
-       movl    %esi,104(%esp)
-       #                               t += x2
-       addl    108(%esp),%edx
-       #                                               x11 = v
-       movl    %edi,144(%esp)
-       # p <<<= 18
-       rol     $18,%eax
-       # p ^= x0
-       xorl    100(%esp),%eax
-       #                               t <<<= 18
-       rol     $18,%edx
-       #                               t ^= x10
-       xorl    140(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 18
-       rol     $18,%ecx
-       #               s ^= x5
-       xorl    120(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 18
-       rol     $18,%ebx
-       #                                               w ^= x15
-       xorl    160(%esp),%ebx
-       # x0 = p
-       movl    %eax,100(%esp)
-       #                               x10 = t
-       movl    %edx,140(%esp)
-       # p += x3
-       addl    112(%esp),%eax
-       # p <<<= 7
-       rol     $7,%eax
-       #               x5 = s
-       movl    %ecx,120(%esp)
-       #                               t += x9
-       addl    136(%esp),%edx
-       #                                               x15 = w
-       movl    %ebx,160(%esp)
-       #               r = x4
-       movl    116(%esp),%esi
-       #               r += s
-       add     %ecx,%esi
-       #                                               v = x14
-       movl    156(%esp),%edi
-       #                                               v += w
-       add     %ebx,%edi
-       # p ^= x1
-       xorl    104(%esp),%eax
-       #                               t <<<= 7
-       rol     $7,%edx
-       #                               t ^= x11
-       xorl    144(%esp),%edx
-       #               r <<<= 7
-       rol     $7,%esi
-       #               r ^= x6
-       xorl    124(%esp),%esi
-       #                                               v <<<= 7
-       rol     $7,%edi
-       #                                               v ^= x12
-       xorl    148(%esp),%edi
-       # x1 = p
-       movl    %eax,104(%esp)
-       #                               x11 = t
-       movl    %edx,144(%esp)
-       # p += x0
-       addl    100(%esp),%eax
-       #               x6 = r
-       movl    %esi,124(%esp)
-       #                               t += x10
-       addl    140(%esp),%edx
-       #                                               x12 = v
-       movl    %edi,148(%esp)
-       # p <<<= 9
-       rol     $9,%eax
-       # p ^= x2
-       xorl    108(%esp),%eax
-       #                               t <<<= 9
-       rol     $9,%edx
-       #                               t ^= x8
-       xorl    132(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 9
-       rol     $9,%ecx
-       #               s ^= x7
-       xorl    128(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 9
-       rol     $9,%ebx
-       #                                               w ^= x13
-       xorl    152(%esp),%ebx
-       # x2 = p
-       movl    %eax,108(%esp)
-       #                               x8 = t
-       movl    %edx,132(%esp)
-       # p += x1
-       addl    104(%esp),%eax
-       #               x7 = s
-       movl    %ecx,128(%esp)
-       #                               t += x11
-       addl    144(%esp),%edx
-       #                                               x13 = w
-       movl    %ebx,152(%esp)
-       # p <<<= 13
-       rol     $13,%eax
-       # p ^= x3
-       xorl    112(%esp),%eax
-       #                               t <<<= 13
-       rol     $13,%edx
-       #                               t ^= x9
-       xorl    136(%esp),%edx
-       #               r += s
-       add     %ecx,%esi
-       #               r <<<= 13
-       rol     $13,%esi
-       #               r ^= x4
-       xorl    116(%esp),%esi
-       #                                               v += w
-       add     %ebx,%edi
-       #                                               v <<<= 13
-       rol     $13,%edi
-       #                                               v ^= x14
-       xorl    156(%esp),%edi
-       # x3 = p
-       movl    %eax,112(%esp)
-       #                               x9 = t
-       movl    %edx,136(%esp)
-       # p += x2
-       addl    108(%esp),%eax
-       #               x4 = r
-       movl    %esi,116(%esp)
-       #                               t += x8
-       addl    132(%esp),%edx
-       #                                               x14 = v
-       movl    %edi,156(%esp)
-       # p <<<= 18
-       rol     $18,%eax
-       # p ^= x0
-       xorl    100(%esp),%eax
-       #                               t <<<= 18
-       rol     $18,%edx
-       #                               t ^= x10
-       xorl    140(%esp),%edx
-       #               s += r
-       add     %esi,%ecx
-       #               s <<<= 18
-       rol     $18,%ecx
-       #               s ^= x5
-       xorl    120(%esp),%ecx
-       #                                               w += v
-       add     %edi,%ebx
-       #                                               w <<<= 18
-       rol     $18,%ebx
-       #                                               w ^= x15
-       xorl    160(%esp),%ebx
-       # i -= 4
-       sub     $4,%ebp
-       # goto mainloop if unsigned >
-       ja      ._mainloop
-       # x0 = p
-       movl    %eax,100(%esp)
-       # x5 = s
-       movl    %ecx,120(%esp)
-       # x10 = t
-       movl    %edx,140(%esp)
-       # x15 = w
-       movl    %ebx,160(%esp)
-       #   out = out_backup
-       movl    72(%esp),%edi
-       #   m = m_backup
-       movl    68(%esp),%esi
-       #   in0 = x0
-       movl    100(%esp),%eax
-       #   in1 = x1
-       movl    104(%esp),%ecx
-       #   in0 += j0
-       addl    164(%esp),%eax
-       #   in1 += j1
-       addl    168(%esp),%ecx
-       #   in0 ^= *(uint32 *) (m + 0)
-       xorl    0(%esi),%eax
-       #   in1 ^= *(uint32 *) (m + 4)
-       xorl    4(%esi),%ecx
-       #   *(uint32 *) (out + 0) = in0
-       movl    %eax,0(%edi)
-       #   *(uint32 *) (out + 4) = in1
-       movl    %ecx,4(%edi)
-       #   in2 = x2
-       movl    108(%esp),%eax
-       #   in3 = x3
-       movl    112(%esp),%ecx
-       #   in2 += j2
-       addl    172(%esp),%eax
-       #   in3 += j3
-       addl    176(%esp),%ecx
-       #   in2 ^= *(uint32 *) (m + 8)
-       xorl    8(%esi),%eax
-       #   in3 ^= *(uint32 *) (m + 12)
-       xorl    12(%esi),%ecx
-       #   *(uint32 *) (out + 8) = in2
-       movl    %eax,8(%edi)
-       #   *(uint32 *) (out + 12) = in3
-       movl    %ecx,12(%edi)
-       #   in4 = x4
-       movl    116(%esp),%eax
-       #   in5 = x5
-       movl    120(%esp),%ecx
-       #   in4 += j4
-       addl    180(%esp),%eax
-       #   in5 += j5
-       addl    184(%esp),%ecx
-       #   in4 ^= *(uint32 *) (m + 16)
-       xorl    16(%esi),%eax
-       #   in5 ^= *(uint32 *) (m + 20)
-       xorl    20(%esi),%ecx
-       #   *(uint32 *) (out + 16) = in4
-       movl    %eax,16(%edi)
-       #   *(uint32 *) (out + 20) = in5
-       movl    %ecx,20(%edi)
-       #   in6 = x6
-       movl    124(%esp),%eax
-       #   in7 = x7
-       movl    128(%esp),%ecx
-       #   in6 += j6
-       addl    188(%esp),%eax
-       #   in7 += j7
-       addl    192(%esp),%ecx
-       #   in6 ^= *(uint32 *) (m + 24)
-       xorl    24(%esi),%eax
-       #   in7 ^= *(uint32 *) (m + 28)
-       xorl    28(%esi),%ecx
-       #   *(uint32 *) (out + 24) = in6
-       movl    %eax,24(%edi)
-       #   *(uint32 *) (out + 28) = in7
-       movl    %ecx,28(%edi)
-       #   in8 = x8
-       movl    132(%esp),%eax
-       #   in9 = x9
-       movl    136(%esp),%ecx
-       #   in8 += j8
-       addl    196(%esp),%eax
-       #   in9 += j9
-       addl    200(%esp),%ecx
-       #   in8 ^= *(uint32 *) (m + 32)
-       xorl    32(%esi),%eax
-       #   in9 ^= *(uint32 *) (m + 36)
-       xorl    36(%esi),%ecx
-       #   *(uint32 *) (out + 32) = in8
-       movl    %eax,32(%edi)
-       #   *(uint32 *) (out + 36) = in9
-       movl    %ecx,36(%edi)
-       #   in10 = x10
-       movl    140(%esp),%eax
-       #   in11 = x11
-       movl    144(%esp),%ecx
-       #   in10 += j10
-       addl    204(%esp),%eax
-       #   in11 += j11
-       addl    208(%esp),%ecx
-       #   in10 ^= *(uint32 *) (m + 40)
-       xorl    40(%esi),%eax
-       #   in11 ^= *(uint32 *) (m + 44)
-       xorl    44(%esi),%ecx
-       #   *(uint32 *) (out + 40) = in10
-       movl    %eax,40(%edi)
-       #   *(uint32 *) (out + 44) = in11
-       movl    %ecx,44(%edi)
-       #   in12 = x12
-       movl    148(%esp),%eax
-       #   in13 = x13
-       movl    152(%esp),%ecx
-       #   in12 += j12
-       addl    212(%esp),%eax
-       #   in13 += j13
-       addl    216(%esp),%ecx
-       #   in12 ^= *(uint32 *) (m + 48)
-       xorl    48(%esi),%eax
-       #   in13 ^= *(uint32 *) (m + 52)
-       xorl    52(%esi),%ecx
-       #   *(uint32 *) (out + 48) = in12
-       movl    %eax,48(%edi)
-       #   *(uint32 *) (out + 52) = in13
-       movl    %ecx,52(%edi)
-       #   in14 = x14
-       movl    156(%esp),%eax
-       #   in15 = x15
-       movl    160(%esp),%ecx
-       #   in14 += j14
-       addl    220(%esp),%eax
-       #   in15 += j15
-       addl    224(%esp),%ecx
-       #   in14 ^= *(uint32 *) (m + 56)
-       xorl    56(%esi),%eax
-       #   in15 ^= *(uint32 *) (m + 60)
-       xorl    60(%esi),%ecx
-       #   *(uint32 *) (out + 56) = in14
-       movl    %eax,56(%edi)
-       #   *(uint32 *) (out + 60) = in15
-       movl    %ecx,60(%edi)
-       #   bytes = bytes_backup
-       movl    76(%esp),%ebx
-       #   in8 = j8
-       movl    196(%esp),%eax
-       #   in9 = j9
-       movl    200(%esp),%ecx
-       #   in8 += 1
-       add     $1,%eax
-       #   in9 += 0 + carry
-       adc     $0,%ecx
-       #   j8 = in8
-       movl    %eax,196(%esp)
-       #   j9 = in9
-       movl    %ecx,200(%esp)
-       #   bytes - 64
-       cmp     $64,%ebx
-       #   goto bytesatleast65 if unsigned>
-       ja      ._bytesatleast65
-       #     goto bytesatleast64 if unsigned>=
-       jae     ._bytesatleast64
-       #       m = out
-       mov     %edi,%esi
-       #       out = ctarget
-       movl    228(%esp),%edi
-       #       i = bytes
-       mov     %ebx,%ecx
-       #       while (i) { *out++ = *m++; --i }
-       rep     movsb
-._bytesatleast64:
-       #     x = x_backup
-       movl    64(%esp),%eax
-       #     in8 = j8
-       movl    196(%esp),%ecx
-       #     in9 = j9
-       movl    200(%esp),%edx
-       #     *(uint32 *) (x + 32) = in8
-       movl    %ecx,32(%eax)
-       #     *(uint32 *) (x + 36) = in9
-       movl    %edx,36(%eax)
-._done:
-       #     eax = eax_stack
-       movl    80(%esp),%eax
-       #     ebx = ebx_stack
-       movl    84(%esp),%ebx
-       #     esi = esi_stack
-       movl    88(%esp),%esi
-       #     edi = edi_stack
-       movl    92(%esp),%edi
-       #     ebp = ebp_stack
-       movl    96(%esp),%ebp
-       #     leave
-       add     %eax,%esp
-       ret
-._bytesatleast65:
-       #   bytes -= 64
-       sub     $64,%ebx
-       #   out += 64
-       add     $64,%edi
-       #   m += 64
-       add     $64,%esi
-       # goto bytesatleast1
-       jmp     ._bytesatleast1
-ENDPROC(salsa20_encrypt_bytes)
-
-# enter salsa20_keysetup
-ENTRY(salsa20_keysetup)
-       mov     %esp,%eax
-       and     $31,%eax
-       add     $256,%eax
-       sub     %eax,%esp
-       #   eax_stack = eax
-       movl    %eax,64(%esp)
-       #   ebx_stack = ebx
-       movl    %ebx,68(%esp)
-       #   esi_stack = esi
-       movl    %esi,72(%esp)
-       #   edi_stack = edi
-       movl    %edi,76(%esp)
-       #   ebp_stack = ebp
-       movl    %ebp,80(%esp)
-       #   k = arg2
-       movl    8(%esp,%eax),%ecx
-       #   kbits = arg3
-       movl    12(%esp,%eax),%edx
-       #   x = arg1
-       movl    4(%esp,%eax),%eax
-       #   in1 = *(uint32 *) (k + 0)
-       movl    0(%ecx),%ebx
-       #   in2 = *(uint32 *) (k + 4)
-       movl    4(%ecx),%esi
-       #   in3 = *(uint32 *) (k + 8)
-       movl    8(%ecx),%edi
-       #   in4 = *(uint32 *) (k + 12)
-       movl    12(%ecx),%ebp
-       #   *(uint32 *) (x + 4) = in1
-       movl    %ebx,4(%eax)
-       #   *(uint32 *) (x + 8) = in2
-       movl    %esi,8(%eax)
-       #   *(uint32 *) (x + 12) = in3
-       movl    %edi,12(%eax)
-       #   *(uint32 *) (x + 16) = in4
-       movl    %ebp,16(%eax)
-       #   kbits - 256
-       cmp     $256,%edx
-       #   goto kbits128 if unsigned<
-       jb      ._kbits128
-._kbits256:
-       #     in11 = *(uint32 *) (k + 16)
-       movl    16(%ecx),%edx
-       #     in12 = *(uint32 *) (k + 20)
-       movl    20(%ecx),%ebx
-       #     in13 = *(uint32 *) (k + 24)
-       movl    24(%ecx),%esi
-       #     in14 = *(uint32 *) (k + 28)
-       movl    28(%ecx),%ecx
-       #     *(uint32 *) (x + 44) = in11
-       movl    %edx,44(%eax)
-       #     *(uint32 *) (x + 48) = in12
-       movl    %ebx,48(%eax)
-       #     *(uint32 *) (x + 52) = in13
-       movl    %esi,52(%eax)
-       #     *(uint32 *) (x + 56) = in14
-       movl    %ecx,56(%eax)
-       #     in0 = 1634760805
-       mov     $1634760805,%ecx
-       #     in5 = 857760878
-       mov     $857760878,%edx
-       #     in10 = 2036477234
-       mov     $2036477234,%ebx
-       #     in15 = 1797285236
-       mov     $1797285236,%esi
-       #     *(uint32 *) (x + 0) = in0
-       movl    %ecx,0(%eax)
-       #     *(uint32 *) (x + 20) = in5
-       movl    %edx,20(%eax)
-       #     *(uint32 *) (x + 40) = in10
-       movl    %ebx,40(%eax)
-       #     *(uint32 *) (x + 60) = in15
-       movl    %esi,60(%eax)
-       #   goto keysetupdone
-       jmp     ._keysetupdone
-._kbits128:
-       #     in11 = *(uint32 *) (k + 0)
-       movl    0(%ecx),%edx
-       #     in12 = *(uint32 *) (k + 4)
-       movl    4(%ecx),%ebx
-       #     in13 = *(uint32 *) (k + 8)
-       movl    8(%ecx),%esi
-       #     in14 = *(uint32 *) (k + 12)
-       movl    12(%ecx),%ecx
-       #     *(uint32 *) (x + 44) = in11
-       movl    %edx,44(%eax)
-       #     *(uint32 *) (x + 48) = in12
-       movl    %ebx,48(%eax)
-       #     *(uint32 *) (x + 52) = in13
-       movl    %esi,52(%eax)
-       #     *(uint32 *) (x + 56) = in14
-       movl    %ecx,56(%eax)
-       #     in0 = 1634760805
-       mov     $1634760805,%ecx
-       #     in5 = 824206446
-       mov     $824206446,%edx
-       #     in10 = 2036477238
-       mov     $2036477238,%ebx
-       #     in15 = 1797285236
-       mov     $1797285236,%esi
-       #     *(uint32 *) (x + 0) = in0
-       movl    %ecx,0(%eax)
-       #     *(uint32 *) (x + 20) = in5
-       movl    %edx,20(%eax)
-       #     *(uint32 *) (x + 40) = in10
-       movl    %ebx,40(%eax)
-       #     *(uint32 *) (x + 60) = in15
-       movl    %esi,60(%eax)
-._keysetupdone:
-       #   eax = eax_stack
-       movl    64(%esp),%eax
-       #   ebx = ebx_stack
-       movl    68(%esp),%ebx
-       #   esi = esi_stack
-       movl    72(%esp),%esi
-       #   edi = edi_stack
-       movl    76(%esp),%edi
-       #   ebp = ebp_stack
-       movl    80(%esp),%ebp
-       # leave
-       add     %eax,%esp
-       ret
-ENDPROC(salsa20_keysetup)
-
-# enter salsa20_ivsetup
-ENTRY(salsa20_ivsetup)
-       mov     %esp,%eax
-       and     $31,%eax
-       add     $256,%eax
-       sub     %eax,%esp
-       #   eax_stack = eax
-       movl    %eax,64(%esp)
-       #   ebx_stack = ebx
-       movl    %ebx,68(%esp)
-       #   esi_stack = esi
-       movl    %esi,72(%esp)
-       #   edi_stack = edi
-       movl    %edi,76(%esp)
-       #   ebp_stack = ebp
-       movl    %ebp,80(%esp)
-       #   iv = arg2
-       movl    8(%esp,%eax),%ecx
-       #   x = arg1
-       movl    4(%esp,%eax),%eax
-       #   in6 = *(uint32 *) (iv + 0)
-       movl    0(%ecx),%edx
-       #   in7 = *(uint32 *) (iv + 4)
-       movl    4(%ecx),%ecx
-       #   in8 = 0
-       mov     $0,%ebx
-       #   in9 = 0
-       mov     $0,%esi
-       #   *(uint32 *) (x + 24) = in6
-       movl    %edx,24(%eax)
-       #   *(uint32 *) (x + 28) = in7
-       movl    %ecx,28(%eax)
-       #   *(uint32 *) (x + 32) = in8
-       movl    %ebx,32(%eax)
-       #   *(uint32 *) (x + 36) = in9
-       movl    %esi,36(%eax)
-       #   eax = eax_stack
-       movl    64(%esp),%eax
-       #   ebx = ebx_stack
-       movl    68(%esp),%ebx
-       #   esi = esi_stack
-       movl    72(%esp),%esi
-       #   edi = edi_stack
-       movl    76(%esp),%edi
-       #   ebp = ebp_stack
-       movl    80(%esp),%ebp
-       # leave
-       add     %eax,%esp
-       ret
-ENDPROC(salsa20_ivsetup)
diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S 
b/arch/x86/crypto/salsa20-x86_64-asm_64.S
deleted file mode 100644
index 10db30d58006..000000000000
--- a/arch/x86/crypto/salsa20-x86_64-asm_64.S
+++ /dev/null
@@ -1,919 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 */
-#include <linux/linkage.h>
-
-# enter salsa20_encrypt_bytes
-ENTRY(salsa20_encrypt_bytes)
-       mov     %rsp,%r11
-       and     $31,%r11
-       add     $256,%r11
-       sub     %r11,%rsp
-       # x = arg1
-       mov     %rdi,%r8
-       # m = arg2
-       mov     %rsi,%rsi
-       # out = arg3
-       mov     %rdx,%rdi
-       # bytes = arg4
-       mov     %rcx,%rdx
-       #               unsigned>? bytes - 0
-       cmp     $0,%rdx
-       # comment:fp stack unchanged by jump
-       # goto done if !unsigned>
-       jbe     ._done
-       # comment:fp stack unchanged by fallthrough
-# start:
-._start:
-       # r11_stack = r11
-       movq    %r11,0(%rsp)
-       # r12_stack = r12
-       movq    %r12,8(%rsp)
-       # r13_stack = r13
-       movq    %r13,16(%rsp)
-       # r14_stack = r14
-       movq    %r14,24(%rsp)
-       # r15_stack = r15
-       movq    %r15,32(%rsp)
-       # rbx_stack = rbx
-       movq    %rbx,40(%rsp)
-       # rbp_stack = rbp
-       movq    %rbp,48(%rsp)
-       # in0 = *(uint64 *) (x + 0)
-       movq    0(%r8),%rcx
-       # in2 = *(uint64 *) (x + 8)
-       movq    8(%r8),%r9
-       # in4 = *(uint64 *) (x + 16)
-       movq    16(%r8),%rax
-       # in6 = *(uint64 *) (x + 24)
-       movq    24(%r8),%r10
-       # in8 = *(uint64 *) (x + 32)
-       movq    32(%r8),%r11
-       # in10 = *(uint64 *) (x + 40)
-       movq    40(%r8),%r12
-       # in12 = *(uint64 *) (x + 48)
-       movq    48(%r8),%r13
-       # in14 = *(uint64 *) (x + 56)
-       movq    56(%r8),%r14
-       # j0 = in0
-       movq    %rcx,56(%rsp)
-       # j2 = in2
-       movq    %r9,64(%rsp)
-       # j4 = in4
-       movq    %rax,72(%rsp)
-       # j6 = in6
-       movq    %r10,80(%rsp)
-       # j8 = in8
-       movq    %r11,88(%rsp)
-       # j10 = in10
-       movq    %r12,96(%rsp)
-       # j12 = in12
-       movq    %r13,104(%rsp)
-       # j14 = in14
-       movq    %r14,112(%rsp)
-       # x_backup = x
-       movq    %r8,120(%rsp)
-# bytesatleast1:
-._bytesatleast1:
-       #                   unsigned<? bytes - 64
-       cmp     $64,%rdx
-       # comment:fp stack unchanged by jump
-       #   goto nocopy if !unsigned<
-       jae     ._nocopy
-       #     ctarget = out
-       movq    %rdi,128(%rsp)
-       #     out = &tmp
-       leaq    192(%rsp),%rdi
-       #     i = bytes
-       mov     %rdx,%rcx
-       #     while (i) { *out++ = *m++; --i }
-       rep     movsb
-       #     out = &tmp
-       leaq    192(%rsp),%rdi
-       #     m = &tmp
-       leaq    192(%rsp),%rsi
-       # comment:fp stack unchanged by fallthrough
-#   nocopy:
-._nocopy:
-       #   out_backup = out
-       movq    %rdi,136(%rsp)
-       #   m_backup = m
-       movq    %rsi,144(%rsp)
-       #   bytes_backup = bytes
-       movq    %rdx,152(%rsp)
-       #   x1 = j0
-       movq    56(%rsp),%rdi
-       #   x0 = x1
-       mov     %rdi,%rdx
-       #   (uint64) x1 >>= 32
-       shr     $32,%rdi
-       #               x3 = j2
-       movq    64(%rsp),%rsi
-       #               x2 = x3
-       mov     %rsi,%rcx
-       #               (uint64) x3 >>= 32
-       shr     $32,%rsi
-       #   x5 = j4
-       movq    72(%rsp),%r8
-       #   x4 = x5
-       mov     %r8,%r9
-       #   (uint64) x5 >>= 32
-       shr     $32,%r8
-       #   x5_stack = x5
-       movq    %r8,160(%rsp)
-       #               x7 = j6
-       movq    80(%rsp),%r8
-       #               x6 = x7
-       mov     %r8,%rax
-       #               (uint64) x7 >>= 32
-       shr     $32,%r8
-       #   x9 = j8
-       movq    88(%rsp),%r10
-       #   x8 = x9
-       mov     %r10,%r11
-       #   (uint64) x9 >>= 32
-       shr     $32,%r10
-       #               x11 = j10
-       movq    96(%rsp),%r12
-       #               x10 = x11
-       mov     %r12,%r13
-       #               x10_stack = x10
-       movq    %r13,168(%rsp)
-       #               (uint64) x11 >>= 32
-       shr     $32,%r12
-       #   x13 = j12
-       movq    104(%rsp),%r13
-       #   x12 = x13
-       mov     %r13,%r14
-       #   (uint64) x13 >>= 32
-       shr     $32,%r13
-       #               x15 = j14
-       movq    112(%rsp),%r15
-       #               x14 = x15
-       mov     %r15,%rbx
-       #               (uint64) x15 >>= 32
-       shr     $32,%r15
-       #               x15_stack = x15
-       movq    %r15,176(%rsp)
-       #   i = 20
-       mov     $20,%r15
-#   mainloop:
-._mainloop:
-       #   i_backup = i
-       movq    %r15,184(%rsp)
-       #               x5 = x5_stack
-       movq    160(%rsp),%r15
-       # a = x12 + x0
-       lea     (%r14,%rdx),%rbp
-       # (uint32) a <<<= 7
-       rol     $7,%ebp
-       # x4 ^= a
-       xor     %rbp,%r9
-       #               b = x1 + x5
-       lea     (%rdi,%r15),%rbp
-       #               (uint32) b <<<= 7
-       rol     $7,%ebp
-       #               x9 ^= b
-       xor     %rbp,%r10
-       # a = x0 + x4
-       lea     (%rdx,%r9),%rbp
-       # (uint32) a <<<= 9
-       rol     $9,%ebp
-       # x8 ^= a
-       xor     %rbp,%r11
-       #               b = x5 + x9
-       lea     (%r15,%r10),%rbp
-       #               (uint32) b <<<= 9
-       rol     $9,%ebp
-       #               x13 ^= b
-       xor     %rbp,%r13
-       # a = x4 + x8
-       lea     (%r9,%r11),%rbp
-       # (uint32) a <<<= 13
-       rol     $13,%ebp
-       # x12 ^= a
-       xor     %rbp,%r14
-       #               b = x9 + x13
-       lea     (%r10,%r13),%rbp
-       #               (uint32) b <<<= 13
-       rol     $13,%ebp
-       #               x1 ^= b
-       xor     %rbp,%rdi
-       # a = x8 + x12
-       lea     (%r11,%r14),%rbp
-       # (uint32) a <<<= 18
-       rol     $18,%ebp
-       # x0 ^= a
-       xor     %rbp,%rdx
-       #               b = x13 + x1
-       lea     (%r13,%rdi),%rbp
-       #               (uint32) b <<<= 18
-       rol     $18,%ebp
-       #               x5 ^= b
-       xor     %rbp,%r15
-       #                               x10 = x10_stack
-       movq    168(%rsp),%rbp
-       #               x5_stack = x5
-       movq    %r15,160(%rsp)
-       #                               c = x6 + x10
-       lea     (%rax,%rbp),%r15
-       #                               (uint32) c <<<= 7
-       rol     $7,%r15d
-       #                               x14 ^= c
-       xor     %r15,%rbx
-       #                               c = x10 + x14
-       lea     (%rbp,%rbx),%r15
-       #                               (uint32) c <<<= 9
-       rol     $9,%r15d
-       #                               x2 ^= c
-       xor     %r15,%rcx
-       #                               c = x14 + x2
-       lea     (%rbx,%rcx),%r15
-       #                               (uint32) c <<<= 13
-       rol     $13,%r15d
-       #                               x6 ^= c
-       xor     %r15,%rax
-       #                               c = x2 + x6
-       lea     (%rcx,%rax),%r15
-       #                               (uint32) c <<<= 18
-       rol     $18,%r15d
-       #                               x10 ^= c
-       xor     %r15,%rbp
-       #                                               x15 = x15_stack
-       movq    176(%rsp),%r15
-       #                               x10_stack = x10
-       movq    %rbp,168(%rsp)
-       #                                               d = x11 + x15
-       lea     (%r12,%r15),%rbp
-       #                                               (uint32) d <<<= 7
-       rol     $7,%ebp
-       #                                               x3 ^= d
-       xor     %rbp,%rsi
-       #                                               d = x15 + x3
-       lea     (%r15,%rsi),%rbp
-       #                                               (uint32) d <<<= 9
-       rol     $9,%ebp
-       #                                               x7 ^= d
-       xor     %rbp,%r8
-       #                                               d = x3 + x7
-       lea     (%rsi,%r8),%rbp
-       #                                               (uint32) d <<<= 13
-       rol     $13,%ebp
-       #                                               x11 ^= d
-       xor     %rbp,%r12
-       #                                               d = x7 + x11
-       lea     (%r8,%r12),%rbp
-       #                                               (uint32) d <<<= 18
-       rol     $18,%ebp
-       #                                               x15 ^= d
-       xor     %rbp,%r15
-       #                                               x15_stack = x15
-       movq    %r15,176(%rsp)
-       #               x5 = x5_stack
-       movq    160(%rsp),%r15
-       # a = x3 + x0
-       lea     (%rsi,%rdx),%rbp
-       # (uint32) a <<<= 7
-       rol     $7,%ebp
-       # x1 ^= a
-       xor     %rbp,%rdi
-       #               b = x4 + x5
-       lea     (%r9,%r15),%rbp
-       #               (uint32) b <<<= 7
-       rol     $7,%ebp
-       #               x6 ^= b
-       xor     %rbp,%rax
-       # a = x0 + x1
-       lea     (%rdx,%rdi),%rbp
-       # (uint32) a <<<= 9
-       rol     $9,%ebp
-       # x2 ^= a
-       xor     %rbp,%rcx
-       #               b = x5 + x6
-       lea     (%r15,%rax),%rbp
-       #               (uint32) b <<<= 9
-       rol     $9,%ebp
-       #               x7 ^= b
-       xor     %rbp,%r8
-       # a = x1 + x2
-       lea     (%rdi,%rcx),%rbp
-       # (uint32) a <<<= 13
-       rol     $13,%ebp
-       # x3 ^= a
-       xor     %rbp,%rsi
-       #               b = x6 + x7
-       lea     (%rax,%r8),%rbp
-       #               (uint32) b <<<= 13
-       rol     $13,%ebp
-       #               x4 ^= b
-       xor     %rbp,%r9
-       # a = x2 + x3
-       lea     (%rcx,%rsi),%rbp
-       # (uint32) a <<<= 18
-       rol     $18,%ebp
-       # x0 ^= a
-       xor     %rbp,%rdx
-       #               b = x7 + x4
-       lea     (%r8,%r9),%rbp
-       #               (uint32) b <<<= 18
-       rol     $18,%ebp
-       #               x5 ^= b
-       xor     %rbp,%r15
-       #                               x10 = x10_stack
-       movq    168(%rsp),%rbp
-       #               x5_stack = x5
-       movq    %r15,160(%rsp)
-       #                               c = x9 + x10
-       lea     (%r10,%rbp),%r15
-       #                               (uint32) c <<<= 7
-       rol     $7,%r15d
-       #                               x11 ^= c
-       xor     %r15,%r12
-       #                               c = x10 + x11
-       lea     (%rbp,%r12),%r15
-       #                               (uint32) c <<<= 9
-       rol     $9,%r15d
-       #                               x8 ^= c
-       xor     %r15,%r11
-       #                               c = x11 + x8
-       lea     (%r12,%r11),%r15
-       #                               (uint32) c <<<= 13
-       rol     $13,%r15d
-       #                               x9 ^= c
-       xor     %r15,%r10
-       #                               c = x8 + x9
-       lea     (%r11,%r10),%r15
-       #                               (uint32) c <<<= 18
-       rol     $18,%r15d
-       #                               x10 ^= c
-       xor     %r15,%rbp
-       #                                               x15 = x15_stack
-       movq    176(%rsp),%r15
-       #                               x10_stack = x10
-       movq    %rbp,168(%rsp)
-       #                                               d = x14 + x15
-       lea     (%rbx,%r15),%rbp
-       #                                               (uint32) d <<<= 7
-       rol     $7,%ebp
-       #                                               x12 ^= d
-       xor     %rbp,%r14
-       #                                               d = x15 + x12
-       lea     (%r15,%r14),%rbp
-       #                                               (uint32) d <<<= 9
-       rol     $9,%ebp
-       #                                               x13 ^= d
-       xor     %rbp,%r13
-       #                                               d = x12 + x13
-       lea     (%r14,%r13),%rbp
-       #                                               (uint32) d <<<= 13
-       rol     $13,%ebp
-       #                                               x14 ^= d
-       xor     %rbp,%rbx
-       #                                               d = x13 + x14
-       lea     (%r13,%rbx),%rbp
-       #                                               (uint32) d <<<= 18
-       rol     $18,%ebp
-       #                                               x15 ^= d
-       xor     %rbp,%r15
-       #                                               x15_stack = x15
-       movq    %r15,176(%rsp)
-       #               x5 = x5_stack
-       movq    160(%rsp),%r15
-       # a = x12 + x0
-       lea     (%r14,%rdx),%rbp
-       # (uint32) a <<<= 7
-       rol     $7,%ebp
-       # x4 ^= a
-       xor     %rbp,%r9
-       #               b = x1 + x5
-       lea     (%rdi,%r15),%rbp
-       #               (uint32) b <<<= 7
-       rol     $7,%ebp
-       #               x9 ^= b
-       xor     %rbp,%r10
-       # a = x0 + x4
-       lea     (%rdx,%r9),%rbp
-       # (uint32) a <<<= 9
-       rol     $9,%ebp
-       # x8 ^= a
-       xor     %rbp,%r11
-       #               b = x5 + x9
-       lea     (%r15,%r10),%rbp
-       #               (uint32) b <<<= 9
-       rol     $9,%ebp
-       #               x13 ^= b
-       xor     %rbp,%r13
-       # a = x4 + x8
-       lea     (%r9,%r11),%rbp
-       # (uint32) a <<<= 13
-       rol     $13,%ebp
-       # x12 ^= a
-       xor     %rbp,%r14
-       #               b = x9 + x13
-       lea     (%r10,%r13),%rbp
-       #               (uint32) b <<<= 13
-       rol     $13,%ebp
-       #               x1 ^= b
-       xor     %rbp,%rdi
-       # a = x8 + x12
-       lea     (%r11,%r14),%rbp
-       # (uint32) a <<<= 18
-       rol     $18,%ebp
-       # x0 ^= a
-       xor     %rbp,%rdx
-       #               b = x13 + x1
-       lea     (%r13,%rdi),%rbp
-       #               (uint32) b <<<= 18
-       rol     $18,%ebp
-       #               x5 ^= b
-       xor     %rbp,%r15
-       #                               x10 = x10_stack
-       movq    168(%rsp),%rbp
-       #               x5_stack = x5
-       movq    %r15,160(%rsp)
-       #                               c = x6 + x10
-       lea     (%rax,%rbp),%r15
-       #                               (uint32) c <<<= 7
-       rol     $7,%r15d
-       #                               x14 ^= c
-       xor     %r15,%rbx
-       #                               c = x10 + x14
-       lea     (%rbp,%rbx),%r15
-       #                               (uint32) c <<<= 9
-       rol     $9,%r15d
-       #                               x2 ^= c
-       xor     %r15,%rcx
-       #                               c = x14 + x2
-       lea     (%rbx,%rcx),%r15
-       #                               (uint32) c <<<= 13
-       rol     $13,%r15d
-       #                               x6 ^= c
-       xor     %r15,%rax
-       #                               c = x2 + x6
-       lea     (%rcx,%rax),%r15
-       #                               (uint32) c <<<= 18
-       rol     $18,%r15d
-       #                               x10 ^= c
-       xor     %r15,%rbp
-       #                                               x15 = x15_stack
-       movq    176(%rsp),%r15
-       #                               x10_stack = x10
-       movq    %rbp,168(%rsp)
-       #                                               d = x11 + x15
-       lea     (%r12,%r15),%rbp
-       #                                               (uint32) d <<<= 7
-       rol     $7,%ebp
-       #                                               x3 ^= d
-       xor     %rbp,%rsi
-       #                                               d = x15 + x3
-       lea     (%r15,%rsi),%rbp
-       #                                               (uint32) d <<<= 9
-       rol     $9,%ebp
-       #                                               x7 ^= d
-       xor     %rbp,%r8
-       #                                               d = x3 + x7
-       lea     (%rsi,%r8),%rbp
-       #                                               (uint32) d <<<= 13
-       rol     $13,%ebp
-       #                                               x11 ^= d
-       xor     %rbp,%r12
-       #                                               d = x7 + x11
-       lea     (%r8,%r12),%rbp
-       #                                               (uint32) d <<<= 18
-       rol     $18,%ebp
-       #                                               x15 ^= d
-       xor     %rbp,%r15
-       #                                               x15_stack = x15
-       movq    %r15,176(%rsp)
-       #               x5 = x5_stack
-       movq    160(%rsp),%r15
-       # a = x3 + x0
-       lea     (%rsi,%rdx),%rbp
-       # (uint32) a <<<= 7
-       rol     $7,%ebp
-       # x1 ^= a
-       xor     %rbp,%rdi
-       #               b = x4 + x5
-       lea     (%r9,%r15),%rbp
-       #               (uint32) b <<<= 7
-       rol     $7,%ebp
-       #               x6 ^= b
-       xor     %rbp,%rax
-       # a = x0 + x1
-       lea     (%rdx,%rdi),%rbp
-       # (uint32) a <<<= 9
-       rol     $9,%ebp
-       # x2 ^= a
-       xor     %rbp,%rcx
-       #               b = x5 + x6
-       lea     (%r15,%rax),%rbp
-       #               (uint32) b <<<= 9
-       rol     $9,%ebp
-       #               x7 ^= b
-       xor     %rbp,%r8
-       # a = x1 + x2
-       lea     (%rdi,%rcx),%rbp
-       # (uint32) a <<<= 13
-       rol     $13,%ebp
-       # x3 ^= a
-       xor     %rbp,%rsi
-       #               b = x6 + x7
-       lea     (%rax,%r8),%rbp
-       #               (uint32) b <<<= 13
-       rol     $13,%ebp
-       #               x4 ^= b
-       xor     %rbp,%r9
-       # a = x2 + x3
-       lea     (%rcx,%rsi),%rbp
-       # (uint32) a <<<= 18
-       rol     $18,%ebp
-       # x0 ^= a
-       xor     %rbp,%rdx
-       #               b = x7 + x4
-       lea     (%r8,%r9),%rbp
-       #               (uint32) b <<<= 18
-       rol     $18,%ebp
-       #               x5 ^= b
-       xor     %rbp,%r15
-       #                               x10 = x10_stack
-       movq    168(%rsp),%rbp
-       #               x5_stack = x5
-       movq    %r15,160(%rsp)
-       #                               c = x9 + x10
-       lea     (%r10,%rbp),%r15
-       #                               (uint32) c <<<= 7
-       rol     $7,%r15d
-       #                               x11 ^= c
-       xor     %r15,%r12
-       #                               c = x10 + x11
-       lea     (%rbp,%r12),%r15
-       #                               (uint32) c <<<= 9
-       rol     $9,%r15d
-       #                               x8 ^= c
-       xor     %r15,%r11
-       #                               c = x11 + x8
-       lea     (%r12,%r11),%r15
-       #                               (uint32) c <<<= 13
-       rol     $13,%r15d
-       #                               x9 ^= c
-       xor     %r15,%r10
-       #                               c = x8 + x9
-       lea     (%r11,%r10),%r15
-       #                               (uint32) c <<<= 18
-       rol     $18,%r15d
-       #                               x10 ^= c
-       xor     %r15,%rbp
-       #                                               x15 = x15_stack
-       movq    176(%rsp),%r15
-       #                               x10_stack = x10
-       movq    %rbp,168(%rsp)
-       #                                               d = x14 + x15
-       lea     (%rbx,%r15),%rbp
-       #                                               (uint32) d <<<= 7
-       rol     $7,%ebp
-       #                                               x12 ^= d
-       xor     %rbp,%r14
-       #                                               d = x15 + x12
-       lea     (%r15,%r14),%rbp
-       #                                               (uint32) d <<<= 9
-       rol     $9,%ebp
-       #                                               x13 ^= d
-       xor     %rbp,%r13
-       #                                               d = x12 + x13
-       lea     (%r14,%r13),%rbp
-       #                                               (uint32) d <<<= 13
-       rol     $13,%ebp
-       #                                               x14 ^= d
-       xor     %rbp,%rbx
-       #                                               d = x13 + x14
-       lea     (%r13,%rbx),%rbp
-       #                                               (uint32) d <<<= 18
-       rol     $18,%ebp
-       #                                               x15 ^= d
-       xor     %rbp,%r15
-       #                                               x15_stack = x15
-       movq    %r15,176(%rsp)
-       #   i = i_backup
-       movq    184(%rsp),%r15
-       #                  unsigned>? i -= 4
-       sub     $4,%r15
-       # comment:fp stack unchanged by jump
-       # goto mainloop if unsigned>
-       ja      ._mainloop
-       #   (uint32) x2 += j2
-       addl    64(%rsp),%ecx
-       #   x3 <<= 32
-       shl     $32,%rsi
-       #   x3 += j2
-       addq    64(%rsp),%rsi
-       #   (uint64) x3 >>= 32
-       shr     $32,%rsi
-       #   x3 <<= 32
-       shl     $32,%rsi
-       #   x2 += x3
-       add     %rsi,%rcx
-       #   (uint32) x6 += j6
-       addl    80(%rsp),%eax
-       #   x7 <<= 32
-       shl     $32,%r8
-       #   x7 += j6
-       addq    80(%rsp),%r8
-       #   (uint64) x7 >>= 32
-       shr     $32,%r8
-       #   x7 <<= 32
-       shl     $32,%r8
-       #   x6 += x7
-       add     %r8,%rax
-       #   (uint32) x8 += j8
-       addl    88(%rsp),%r11d
-       #   x9 <<= 32
-       shl     $32,%r10
-       #   x9 += j8
-       addq    88(%rsp),%r10
-       #   (uint64) x9 >>= 32
-       shr     $32,%r10
-       #   x9 <<= 32
-       shl     $32,%r10
-       #   x8 += x9
-       add     %r10,%r11
-       #   (uint32) x12 += j12
-       addl    104(%rsp),%r14d
-       #   x13 <<= 32
-       shl     $32,%r13
-       #   x13 += j12
-       addq    104(%rsp),%r13
-       #   (uint64) x13 >>= 32
-       shr     $32,%r13
-       #   x13 <<= 32
-       shl     $32,%r13
-       #   x12 += x13
-       add     %r13,%r14
-       #   (uint32) x0 += j0
-       addl    56(%rsp),%edx
-       #   x1 <<= 32
-       shl     $32,%rdi
-       #   x1 += j0
-       addq    56(%rsp),%rdi
-       #   (uint64) x1 >>= 32
-       shr     $32,%rdi
-       #   x1 <<= 32
-       shl     $32,%rdi
-       #   x0 += x1
-       add     %rdi,%rdx
-       #   x5 = x5_stack
-       movq    160(%rsp),%rdi
-       #   (uint32) x4 += j4
-       addl    72(%rsp),%r9d
-       #   x5 <<= 32
-       shl     $32,%rdi
-       #   x5 += j4
-       addq    72(%rsp),%rdi
-       #   (uint64) x5 >>= 32
-       shr     $32,%rdi
-       #   x5 <<= 32
-       shl     $32,%rdi
-       #   x4 += x5
-       add     %rdi,%r9
-       #   x10 = x10_stack
-       movq    168(%rsp),%r8
-       #   (uint32) x10 += j10
-       addl    96(%rsp),%r8d
-       #   x11 <<= 32
-       shl     $32,%r12
-       #   x11 += j10
-       addq    96(%rsp),%r12
-       #   (uint64) x11 >>= 32
-       shr     $32,%r12
-       #   x11 <<= 32
-       shl     $32,%r12
-       #   x10 += x11
-       add     %r12,%r8
-       #   x15 = x15_stack
-       movq    176(%rsp),%rdi
-       #   (uint32) x14 += j14
-       addl    112(%rsp),%ebx
-       #   x15 <<= 32
-       shl     $32,%rdi
-       #   x15 += j14
-       addq    112(%rsp),%rdi
-       #   (uint64) x15 >>= 32
-       shr     $32,%rdi
-       #   x15 <<= 32
-       shl     $32,%rdi
-       #   x14 += x15
-       add     %rdi,%rbx
-       #   out = out_backup
-       movq    136(%rsp),%rdi
-       #   m = m_backup
-       movq    144(%rsp),%rsi
-       #   x0 ^= *(uint64 *) (m + 0)
-       xorq    0(%rsi),%rdx
-       #   *(uint64 *) (out + 0) = x0
-       movq    %rdx,0(%rdi)
-       #   x2 ^= *(uint64 *) (m + 8)
-       xorq    8(%rsi),%rcx
-       #   *(uint64 *) (out + 8) = x2
-       movq    %rcx,8(%rdi)
-       #   x4 ^= *(uint64 *) (m + 16)
-       xorq    16(%rsi),%r9
-       #   *(uint64 *) (out + 16) = x4
-       movq    %r9,16(%rdi)
-       #   x6 ^= *(uint64 *) (m + 24)
-       xorq    24(%rsi),%rax
-       #   *(uint64 *) (out + 24) = x6
-       movq    %rax,24(%rdi)
-       #   x8 ^= *(uint64 *) (m + 32)
-       xorq    32(%rsi),%r11
-       #   *(uint64 *) (out + 32) = x8
-       movq    %r11,32(%rdi)
-       #   x10 ^= *(uint64 *) (m + 40)
-       xorq    40(%rsi),%r8
-       #   *(uint64 *) (out + 40) = x10
-       movq    %r8,40(%rdi)
-       #   x12 ^= *(uint64 *) (m + 48)
-       xorq    48(%rsi),%r14
-       #   *(uint64 *) (out + 48) = x12
-       movq    %r14,48(%rdi)
-       #   x14 ^= *(uint64 *) (m + 56)
-       xorq    56(%rsi),%rbx
-       #   *(uint64 *) (out + 56) = x14
-       movq    %rbx,56(%rdi)
-       #   bytes = bytes_backup
-       movq    152(%rsp),%rdx
-       #   in8 = j8
-       movq    88(%rsp),%rcx
-       #   in8 += 1
-       add     $1,%rcx
-       #   j8 = in8
-       movq    %rcx,88(%rsp)
-       #                          unsigned>? unsigned<? bytes - 64
-       cmp     $64,%rdx
-       # comment:fp stack unchanged by jump
-       #   goto bytesatleast65 if unsigned>
-       ja      ._bytesatleast65
-       # comment:fp stack unchanged by jump
-       #     goto bytesatleast64 if !unsigned<
-       jae     ._bytesatleast64
-       #       m = out
-       mov     %rdi,%rsi
-       #       out = ctarget
-       movq    128(%rsp),%rdi
-       #       i = bytes
-       mov     %rdx,%rcx
-       #       while (i) { *out++ = *m++; --i }
-       rep     movsb
-       # comment:fp stack unchanged by fallthrough
-#     bytesatleast64:
-._bytesatleast64:
-       #     x = x_backup
-       movq    120(%rsp),%rdi
-       #     in8 = j8
-       movq    88(%rsp),%rsi
-       #     *(uint64 *) (x + 32) = in8
-       movq    %rsi,32(%rdi)
-       #     r11 = r11_stack
-       movq    0(%rsp),%r11
-       #     r12 = r12_stack
-       movq    8(%rsp),%r12
-       #     r13 = r13_stack
-       movq    16(%rsp),%r13
-       #     r14 = r14_stack
-       movq    24(%rsp),%r14
-       #     r15 = r15_stack
-       movq    32(%rsp),%r15
-       #     rbx = rbx_stack
-       movq    40(%rsp),%rbx
-       #     rbp = rbp_stack
-       movq    48(%rsp),%rbp
-       # comment:fp stack unchanged by fallthrough
-#     done:
-._done:
-       #     leave
-       add     %r11,%rsp
-       mov     %rdi,%rax
-       mov     %rsi,%rdx
-       ret
-#   bytesatleast65:
-._bytesatleast65:
-       #   bytes -= 64
-       sub     $64,%rdx
-       #   out += 64
-       add     $64,%rdi
-       #   m += 64
-       add     $64,%rsi
-       # comment:fp stack unchanged by jump
-       # goto bytesatleast1
-       jmp     ._bytesatleast1
-ENDPROC(salsa20_encrypt_bytes)
-
-# enter salsa20_keysetup
-ENTRY(salsa20_keysetup)
-       mov     %rsp,%r11
-       and     $31,%r11
-       add     $256,%r11
-       sub     %r11,%rsp
-       #   k = arg2
-       mov     %rsi,%rsi
-       #   kbits = arg3
-       mov     %rdx,%rdx
-       #   x = arg1
-       mov     %rdi,%rdi
-       #   in0 = *(uint64 *) (k + 0)
-       movq    0(%rsi),%r8
-       #   in2 = *(uint64 *) (k + 8)
-       movq    8(%rsi),%r9
-       #   *(uint64 *) (x + 4) = in0
-       movq    %r8,4(%rdi)
-       #   *(uint64 *) (x + 12) = in2
-       movq    %r9,12(%rdi)
-       #                    unsigned<? kbits - 256
-       cmp     $256,%rdx
-       # comment:fp stack unchanged by jump
-       #   goto kbits128 if unsigned<
-       jb      ._kbits128
-#   kbits256:
-._kbits256:
-       #     in10 = *(uint64 *) (k + 16)
-       movq    16(%rsi),%rdx
-       #     in12 = *(uint64 *) (k + 24)
-       movq    24(%rsi),%rsi
-       #     *(uint64 *) (x + 44) = in10
-       movq    %rdx,44(%rdi)
-       #     *(uint64 *) (x + 52) = in12
-       movq    %rsi,52(%rdi)
-       #     in0 = 1634760805
-       mov     $1634760805,%rsi
-       #     in4 = 857760878
-       mov     $857760878,%rdx
-       #     in10 = 2036477234
-       mov     $2036477234,%rcx
-       #     in14 = 1797285236
-       mov     $1797285236,%r8
-       #     *(uint32 *) (x + 0) = in0
-       movl    %esi,0(%rdi)
-       #     *(uint32 *) (x + 20) = in4
-       movl    %edx,20(%rdi)
-       #     *(uint32 *) (x + 40) = in10
-       movl    %ecx,40(%rdi)
-       #     *(uint32 *) (x + 60) = in14
-       movl    %r8d,60(%rdi)
-       # comment:fp stack unchanged by jump
-       #   goto keysetupdone
-       jmp     ._keysetupdone
-#   kbits128:
-._kbits128:
-       #     in10 = *(uint64 *) (k + 0)
-       movq    0(%rsi),%rdx
-       #     in12 = *(uint64 *) (k + 8)
-       movq    8(%rsi),%rsi
-       #     *(uint64 *) (x + 44) = in10
-       movq    %rdx,44(%rdi)
-       #     *(uint64 *) (x + 52) = in12
-       movq    %rsi,52(%rdi)
-       #     in0 = 1634760805
-       mov     $1634760805,%rsi
-       #     in4 = 824206446
-       mov     $824206446,%rdx
-       #     in10 = 2036477238
-       mov     $2036477238,%rcx
-       #     in14 = 1797285236
-       mov     $1797285236,%r8
-       #     *(uint32 *) (x + 0) = in0
-       movl    %esi,0(%rdi)
-       #     *(uint32 *) (x + 20) = in4
-       movl    %edx,20(%rdi)
-       #     *(uint32 *) (x + 40) = in10
-       movl    %ecx,40(%rdi)
-       #     *(uint32 *) (x + 60) = in14
-       movl    %r8d,60(%rdi)
-#   keysetupdone:
-._keysetupdone:
-       # leave
-       add     %r11,%rsp
-       mov     %rdi,%rax
-       mov     %rsi,%rdx
-       ret
-ENDPROC(salsa20_keysetup)
-
-# enter salsa20_ivsetup
-ENTRY(salsa20_ivsetup)
-       mov     %rsp,%r11
-       and     $31,%r11
-       add     $256,%r11
-       sub     %r11,%rsp
-       #   iv = arg2
-       mov     %rsi,%rsi
-       #   x = arg1
-       mov     %rdi,%rdi
-       #   in6 = *(uint64 *) (iv + 0)
-       movq    0(%rsi),%rsi
-       #   in8 = 0
-       mov     $0,%r8
-       #   *(uint64 *) (x + 24) = in6
-       movq    %rsi,24(%rdi)
-       #   *(uint64 *) (x + 32) = in8
-       movq    %r8,32(%rdi)
-       # leave
-       add     %r11,%rsp
-       mov     %rdi,%rax
-       mov     %rsi,%rdx
-       ret
-ENDPROC(salsa20_ivsetup)
diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c
deleted file mode 100644
index cb91a64a99e7..000000000000
--- a/arch/x86/crypto/salsa20_glue.c
+++ /dev/null
@@ -1,116 +0,0 @@
-/*
- * Glue code for optimized assembly version of  Salsa20.
- *
- * Copyright (c) 2007 Tan Swee Heng <[email protected]>
- *
- * The assembly codes are public domain assembly codes written by Daniel. J.
- * Bernstein <[email protected]>. The codes are modified to include indentation
- * and to remove extraneous comments and functions that are not needed.
- * - i586 version, renamed as salsa20-i586-asm_32.S
- *   available from <http://cr.yp.to/snuffle/salsa20/x86-pm/salsa20.s>
- * - x86-64 version, renamed as salsa20-x86_64-asm_64.S
- *   available from <http://cr.yp.to/snuffle/salsa20/amd64-3/salsa20.s>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the Free
- * Software Foundation; either version 2 of the License, or (at your option)
- * any later version.
- *
- */
-
-#include <crypto/algapi.h>
-#include <linux/module.h>
-#include <linux/crypto.h>
-
-#define SALSA20_IV_SIZE        8U
-#define SALSA20_MIN_KEY_SIZE  16U
-#define SALSA20_MAX_KEY_SIZE  32U
-
-struct salsa20_ctx
-{
-       u32 input[16];
-};
-
-asmlinkage void salsa20_keysetup(struct salsa20_ctx *ctx, const u8 *k,
-                                u32 keysize, u32 ivsize);
-asmlinkage void salsa20_ivsetup(struct salsa20_ctx *ctx, const u8 *iv);
-asmlinkage void salsa20_encrypt_bytes(struct salsa20_ctx *ctx,
-                                     const u8 *src, u8 *dst, u32 bytes);
-
-static int setkey(struct crypto_tfm *tfm, const u8 *key,
-                 unsigned int keysize)
-{
-       struct salsa20_ctx *ctx = crypto_tfm_ctx(tfm);
-       salsa20_keysetup(ctx, key, keysize*8, SALSA20_IV_SIZE*8);
-       return 0;
-}
-
-static int encrypt(struct blkcipher_desc *desc,
-                  struct scatterlist *dst, struct scatterlist *src,
-                  unsigned int nbytes)
-{
-       struct blkcipher_walk walk;
-       struct crypto_blkcipher *tfm = desc->tfm;
-       struct salsa20_ctx *ctx = crypto_blkcipher_ctx(tfm);
-       int err;
-
-       blkcipher_walk_init(&walk, dst, src, nbytes);
-       err = blkcipher_walk_virt_block(desc, &walk, 64);
-
-       salsa20_ivsetup(ctx, walk.iv);
-
-       while (walk.nbytes >= 64) {
-               salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
-                                     walk.dst.virt.addr,
-                                     walk.nbytes - (walk.nbytes % 64));
-               err = blkcipher_walk_done(desc, &walk, walk.nbytes % 64);
-       }
-
-       if (walk.nbytes) {
-               salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
-                                     walk.dst.virt.addr, walk.nbytes);
-               err = blkcipher_walk_done(desc, &walk, 0);
-       }
-
-       return err;
-}
-
-static struct crypto_alg alg = {
-       .cra_name           =   "salsa20",
-       .cra_driver_name    =   "salsa20-asm",
-       .cra_priority       =   200,
-       .cra_flags          =   CRYPTO_ALG_TYPE_BLKCIPHER,
-       .cra_type           =   &crypto_blkcipher_type,
-       .cra_blocksize      =   1,
-       .cra_ctxsize        =   sizeof(struct salsa20_ctx),
-       .cra_alignmask      =   3,
-       .cra_module         =   THIS_MODULE,
-       .cra_u              =   {
-               .blkcipher = {
-                       .setkey         =   setkey,
-                       .encrypt        =   encrypt,
-                       .decrypt        =   encrypt,
-                       .min_keysize    =   SALSA20_MIN_KEY_SIZE,
-                       .max_keysize    =   SALSA20_MAX_KEY_SIZE,
-                       .ivsize         =   SALSA20_IV_SIZE,
-               }
-       }
-};
-
-static int __init init(void)
-{
-       return crypto_register_alg(&alg);
-}
-
-static void __exit fini(void)
-{
-       crypto_unregister_alg(&alg);
-}
-
-module_init(init);
-module_exit(fini);
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm (optimized assembly 
version)");
-MODULE_ALIAS_CRYPTO("salsa20");
-MODULE_ALIAS_CRYPTO("salsa20-asm");
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index e1ea13ae53b9..b9a8f34b5e5a 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -290,7 +290,7 @@ static int uprobe_init_insn(struct arch_uprobe *auprobe, 
struct insn *insn, bool
        insn_init(insn, auprobe->insn, sizeof(auprobe->insn), x86_64);
        /* has the side-effect of processing the entire instruction */
        insn_get_length(insn);
-       if (WARN_ON_ONCE(!insn_complete(insn)))
+       if (!insn_complete(insn))
                return -ENOEXEC;
 
        if (is_prefix_bad(insn))
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index fcd8789470d1..fd173e6425cc 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -1230,12 +1230,20 @@ asmlinkage __visible void __init xen_start_kernel(void)
 
        xen_setup_features();
 
-       xen_setup_machphys_mapping();
-
        /* Install Xen paravirt ops */
        pv_info = xen_info;
        pv_init_ops.patch = paravirt_patch_default;
        pv_cpu_ops = xen_cpu_ops;
+       xen_init_irq_ops();
+
+       /*
+        * Setup xen_vcpu early because it is needed for
+        * local_irq_disable(), irqs_disabled(), e.g. in printk().
+        *
+        * Don't do the full vcpu_info placement stuff until we have
+        * the cpu_possible_mask and a non-dummy shared_info.
+        */
+       xen_vcpu_info_reset(0);
 
        x86_platform.get_nmi_reason = xen_get_nmi_reason;
 
@@ -1247,6 +1255,7 @@ asmlinkage __visible void __init xen_start_kernel(void)
         * Set up some pagetable state before starting to set any ptes.
         */
 
+       xen_setup_machphys_mapping();
        xen_init_mmu_ops();
 
        /* Prevent unwanted bits from being set in PTEs. */
@@ -1271,20 +1280,9 @@ asmlinkage __visible void __init xen_start_kernel(void)
        get_cpu_cap(&boot_cpu_data);
        x86_configure_nx();
 
-       xen_init_irq_ops();
-
        /* Let's presume PV guests always boot on vCPU with id 0. */
        per_cpu(xen_vcpu_id, 0) = 0;
 
-       /*
-        * Setup xen_vcpu early because idt_setup_early_handler needs it for
-        * local_irq_disable(), irqs_disabled().
-        *
-        * Don't do the full vcpu_info placement stuff until we have
-        * the cpu_possible_mask and a non-dummy shared_info.
-        */
-       xen_vcpu_info_reset(0);
-
        idt_setup_early_handler();
 
        xen_init_capabilities();
diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
index 74179852e46c..7515a19fd324 100644
--- a/arch/x86/xen/irq.c
+++ b/arch/x86/xen/irq.c
@@ -128,8 +128,6 @@ static const struct pv_irq_ops xen_irq_ops __initconst = {
 
 void __init xen_init_irq_ops(void)
 {
-       /* For PVH we use default pv_irq_ops settings. */
-       if (!xen_feature(XENFEAT_hvm_callback_vector))
-               pv_irq_ops = xen_irq_ops;
+       pv_irq_ops = xen_irq_ops;
        x86_init.irqs.intr_init = xen_init_IRQ;
 }
diff --git a/crypto/Kconfig b/crypto/Kconfig
index 42212b60a0ee..5579eb88d460 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -1324,32 +1324,6 @@ config CRYPTO_SALSA20
          The Salsa20 stream cipher algorithm is designed by Daniel J.
          Bernstein <[email protected]>. See <http://cr.yp.to/snuffle.html>
 
-config CRYPTO_SALSA20_586
-       tristate "Salsa20 stream cipher algorithm (i586)"
-       depends on (X86 || UML_X86) && !64BIT
-       select CRYPTO_BLKCIPHER
-       help
-         Salsa20 stream cipher algorithm.
-
-         Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
-         Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
-
-         The Salsa20 stream cipher algorithm is designed by Daniel J.
-         Bernstein <[email protected]>. See <http://cr.yp.to/snuffle.html>
-
-config CRYPTO_SALSA20_X86_64
-       tristate "Salsa20 stream cipher algorithm (x86_64)"
-       depends on (X86 || UML_X86) && 64BIT
-       select CRYPTO_BLKCIPHER
-       help
-         Salsa20 stream cipher algorithm.
-
-         Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT
-         Stream Cipher Project. See <http://www.ecrypt.eu.org/stream/>
-
-         The Salsa20 stream cipher algorithm is designed by Daniel J.
-         Bernstein <[email protected]>. See <http://cr.yp.to/snuffle.html>
-
 config CRYPTO_CHACHA20
        tristate "ChaCha20 cipher algorithm"
        select CRYPTO_BLKCIPHER
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 75eb50041c99..f003e301723a 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1267,6 +1267,59 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
        return strcmp(buf, dmi->driver_data) < 0;
 }
 
+static bool ahci_broken_lpm(struct pci_dev *pdev)
+{
+       static const struct dmi_system_id sysids[] = {
+               /* Various Lenovo 50 series have LPM issues with older BIOSen */
+               {
+                       .matches = {
+                               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X250"),
+                       },
+                       .driver_data = "20180406", /* 1.31 */
+               },
+               {
+                       .matches = {
+                               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L450"),
+                       },
+                       .driver_data = "20180420", /* 1.28 */
+               },
+               {
+                       .matches = {
+                               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad 
T450s"),
+                       },
+                       .driver_data = "20180315", /* 1.33 */
+               },
+               {
+                       .matches = {
+                               DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                               DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W541"),
+                       },
+                       /*
+                        * Note date based on release notes, 2.35 has been
+                        * reported to be good, but I've been unable to get
+                        * a hold of the reporter to get the DMI BIOS date.
+                        * TODO: fix this.
+                        */
+                       .driver_data = "20180310", /* 2.35 */
+               },
+               { }     /* terminate list */
+       };
+       const struct dmi_system_id *dmi = dmi_first_match(sysids);
+       int year, month, date;
+       char buf[9];
+
+       if (!dmi)
+               return false;
+
+       dmi_get_date(DMI_BIOS_DATE, &year, &month, &date);
+       snprintf(buf, sizeof(buf), "%04d%02d%02d", year, month, date);
+
+       return strcmp(buf, dmi->driver_data) < 0;
+}
+
 static bool ahci_broken_online(struct pci_dev *pdev)
 {
 #define ENCODE_BUSDEVFN(bus, slot, func)                       \
@@ -1677,6 +1730,12 @@ static int ahci_init_one(struct pci_dev *pdev, const 
struct pci_device_id *ent)
                        "quirky BIOS, skipping spindown on poweroff\n");
        }
 
+       if (ahci_broken_lpm(pdev)) {
+               pi.flags |= ATA_FLAG_NO_LPM;
+               dev_warn(&pdev->dev,
+                        "BIOS update required for Link Power Management 
support\n");
+       }
+
        if (ahci_broken_suspend(pdev)) {
                hpriv->flags |= AHCI_HFLAG_NO_SUSPEND;
                dev_warn(&pdev->dev,
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index cad2530a5b52..6938bd86ff1c 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2501,6 +2501,9 @@ int ata_dev_configure(struct ata_device *dev)
            (id[ATA_ID_SATA_CAPABILITY] & 0xe) == 0x2)
                dev->horkage |= ATA_HORKAGE_NOLPM;
 
+       if (ap->flags & ATA_FLAG_NO_LPM)
+               dev->horkage |= ATA_HORKAGE_NOLPM;
+
        if (dev->horkage & ATA_HORKAGE_NOLPM) {
                ata_dev_warn(dev, "LPM support broken, forcing max_power\n");
                dev->link->ap->target_lpm_policy = ATA_LPM_MAX_POWER;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 6b0440a12c51..bf5777bc04d3 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3801,10 +3801,20 @@ static unsigned int ata_scsi_zbc_out_xlat(struct 
ata_queued_cmd *qc)
                 */
                goto invalid_param_len;
        }
-       if (block > dev->n_sectors)
-               goto out_of_range;
 
        all = cdb[14] & 0x1;
+       if (all) {
+               /*
+                * Ignore the block address (zone ID) as defined by ZBC.
+                */
+               block = 0;
+       } else if (block >= dev->n_sectors) {
+               /*
+                * Block must be a valid zone ID (a zone start LBA).
+                */
+               fp = 2;
+               goto invalid_fld;
+       }
 
        if (ata_ncq_enabled(qc->dev) &&
            ata_fpdma_zac_mgmt_out_supported(qc->dev)) {
@@ -3833,10 +3843,6 @@ static unsigned int ata_scsi_zbc_out_xlat(struct 
ata_queued_cmd *qc)
  invalid_fld:
        ata_scsi_set_invalid_field(qc->dev, scmd, fp, 0xff);
        return 1;
- out_of_range:
-       /* "Logical Block Address out of range" */
-       ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x21, 0x00);
-       return 1;
 invalid_param_len:
        /* "Parameter list length error" */
        ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x1a, 0x0);
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 1a87f87c88d0..6d61633a7f89 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -617,6 +617,36 @@ static void loop_reread_partitions(struct loop_device *lo,
                        __func__, lo->lo_number, lo->lo_file_name, rc);
 }
 
+static inline int is_loop_device(struct file *file)
+{
+       struct inode *i = file->f_mapping->host;
+
+       return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
+}
+
+static int loop_validate_file(struct file *file, struct block_device *bdev)
+{
+       struct inode    *inode = file->f_mapping->host;
+       struct file     *f = file;
+
+       /* Avoid recursion */
+       while (is_loop_device(f)) {
+               struct loop_device *l;
+
+               if (f->f_mapping->host->i_bdev == bdev)
+                       return -EBADF;
+
+               l = f->f_mapping->host->i_bdev->bd_disk->private_data;
+               if (l->lo_state == Lo_unbound) {
+                       return -EINVAL;
+               }
+               f = l->lo_backing_file;
+       }
+       if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
+               return -EINVAL;
+       return 0;
+}
+
 /*
  * loop_change_fd switched the backing store of a loopback device to
  * a new file. This is useful for operating system installers to free up
@@ -646,14 +676,15 @@ static int loop_change_fd(struct loop_device *lo, struct 
block_device *bdev,
        if (!file)
                goto out;
 
+       error = loop_validate_file(file, bdev);
+       if (error)
+               goto out_putf;
+
        inode = file->f_mapping->host;
        old_file = lo->lo_backing_file;
 
        error = -EINVAL;
 
-       if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
-               goto out_putf;
-
        /* size of the new backing store needs to be the same */
        if (get_loop_size(lo, file) != get_loop_size(lo, old_file))
                goto out_putf;
@@ -679,13 +710,6 @@ static int loop_change_fd(struct loop_device *lo, struct 
block_device *bdev,
        return error;
 }
 
-static inline int is_loop_device(struct file *file)
-{
-       struct inode *i = file->f_mapping->host;
-
-       return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR;
-}
-
 /* loop sysfs attributes */
 
 static ssize_t loop_attr_show(struct device *dev, char *page,
@@ -782,16 +806,17 @@ static struct attribute_group loop_attribute_group = {
        .attrs= loop_attrs,
 };
 
-static int loop_sysfs_init(struct loop_device *lo)
+static void loop_sysfs_init(struct loop_device *lo)
 {
-       return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
-                                 &loop_attribute_group);
+       lo->sysfs_inited = !sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
+                                               &loop_attribute_group);
 }
 
 static void loop_sysfs_exit(struct loop_device *lo)
 {
-       sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
-                          &loop_attribute_group);
+       if (lo->sysfs_inited)
+               sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
+                                  &loop_attribute_group);
 }
 
 static void loop_config_discard(struct loop_device *lo)
@@ -850,7 +875,7 @@ static int loop_prepare_queue(struct loop_device *lo)
 static int loop_set_fd(struct loop_device *lo, fmode_t mode,
                       struct block_device *bdev, unsigned int arg)
 {
-       struct file     *file, *f;
+       struct file     *file;
        struct inode    *inode;
        struct address_space *mapping;
        int             lo_flags = 0;
@@ -869,29 +894,13 @@ static int loop_set_fd(struct loop_device *lo, fmode_t 
mode,
        if (lo->lo_state != Lo_unbound)
                goto out_putf;
 
-       /* Avoid recursion */
-       f = file;
-       while (is_loop_device(f)) {
-               struct loop_device *l;
-
-               if (f->f_mapping->host->i_bdev == bdev)
-                       goto out_putf;
-
-               l = f->f_mapping->host->i_bdev->bd_disk->private_data;
-               if (l->lo_state == Lo_unbound) {
-                       error = -EINVAL;
-                       goto out_putf;
-               }
-               f = l->lo_backing_file;
-       }
+       error = loop_validate_file(file, bdev);
+       if (error)
+               goto out_putf;
 
        mapping = file->f_mapping;
        inode = mapping->host;
 
-       error = -EINVAL;
-       if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
-               goto out_putf;
-
        if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) ||
            !file->f_op->write_iter)
                lo_flags |= LO_FLAGS_READ_ONLY;
diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index 1f3956702993..dfc54ceba410 100644
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -58,6 +58,7 @@ struct loop_device {
        struct kthread_worker   worker;
        struct task_struct      *worker_task;
        bool                    use_dio;
+       bool                    sysfs_inited;
 
        struct request_queue    *lo_queue;
        struct blk_mq_tag_set   tag_set;
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index 60292d243e24..ec2d11af6c78 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -547,6 +547,14 @@ static int tegra_i2c_disable_packet_mode(struct 
tegra_i2c_dev *i2c_dev)
 {
        u32 cnfg;
 
+       /*
+        * NACK interrupt is generated before the I2C controller generates
+        * the STOP condition on the bus. So wait for 2 clock periods
+        * before disabling the controller so that the STOP condition has
+        * been delivered properly.
+        */
+       udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate));
+
        cnfg = i2c_readl(i2c_dev, I2C_CNFG);
        if (cnfg & I2C_CNFG_PACKET_MODE_EN)
                i2c_writel(i2c_dev, cnfg & ~I2C_CNFG_PACKET_MODE_EN, I2C_CNFG);
@@ -708,15 +716,6 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev 
*i2c_dev,
        if (likely(i2c_dev->msg_err == I2C_ERR_NONE))
                return 0;
 
-       /*
-        * NACK interrupt is generated before the I2C controller generates
-        * the STOP condition on the bus. So wait for 2 clock periods
-        * before resetting the controller so that the STOP condition has
-        * been delivered properly.
-        */
-       if (i2c_dev->msg_err == I2C_ERR_NO_ACK)
-               udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate));
-
        tegra_i2c_init(i2c_dev);
        if (i2c_dev->msg_err == I2C_ERR_NO_ACK) {
                if (msg->flags & I2C_M_IGNORE_NAK)
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 7507cc641de3..27b3c39e586a 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -34,6 +34,18 @@ config INFINIBAND_USER_ACCESS
          libibverbs, libibcm and a hardware driver library from
          <http://www.openfabrics.org/git/>.
 
+config INFINIBAND_USER_ACCESS_UCM
+       bool "Userspace CM (UCM, DEPRECATED)"
+       depends on BROKEN
+       depends on INFINIBAND_USER_ACCESS
+       help
+         The UCM module has known security flaws, which no one is
+         interested to fix. The user-space part of this code was
+         dropped from the upstream a long time ago.
+
+         This option is DEPRECATED and planned to be removed.
+
+
 config INFINIBAND_EXP_USER_ACCESS
        bool "Allow experimental support for Infiniband ABI"
        depends on INFINIBAND_USER_ACCESS
diff --git a/drivers/infiniband/core/Makefile b/drivers/infiniband/core/Makefile
index 9c0a2b5c834e..991c2522fb41 100644
--- a/drivers/infiniband/core/Makefile
+++ b/drivers/infiniband/core/Makefile
@@ -5,8 +5,8 @@ user_access-$(CONFIG_INFINIBAND_ADDR_TRANS)     := rdma_ucm.o
 obj-$(CONFIG_INFINIBAND) +=            ib_core.o ib_cm.o iw_cm.o \
                                        $(infiniband-y)
 obj-$(CONFIG_INFINIBAND_USER_MAD) +=   ib_umad.o
-obj-$(CONFIG_INFINIBAND_USER_ACCESS) +=        ib_uverbs.o ib_ucm.o \
-                                       $(user_access-y)
+obj-$(CONFIG_INFINIBAND_USER_ACCESS) += ib_uverbs.o $(user_access-y)
+obj-$(CONFIG_INFINIBAND_USER_ACCESS_UCM) += ib_ucm.o $(user_access-y)
 
 ib_core-y :=                   packer.o ud_header.o verbs.o cq.o rw.o sysfs.o \
                                device.o fmr_pool.o cache.o netlink.o \
diff --git a/drivers/infiniband/hw/cxgb4/mem.c 
b/drivers/infiniband/hw/cxgb4/mem.c
index c2fba76becd4..b5784cb145f5 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -720,7 +720,7 @@ static int c4iw_set_page(struct ib_mr *ibmr, u64 addr)
 {
        struct c4iw_mr *mhp = to_c4iw_mr(ibmr);
 
-       if (unlikely(mhp->mpl_len == mhp->max_mpl_len))
+       if (unlikely(mhp->mpl_len == mhp->attr.pbl_size))
                return -ENOMEM;
 
        mhp->mpl[mhp->mpl_len++] = addr;
diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
index 84c6a6ff4a67..818bac1a4056 100644
--- a/drivers/infiniband/hw/hfi1/rc.c
+++ b/drivers/infiniband/hw/hfi1/rc.c
@@ -273,7 +273,7 @@ int hfi1_make_rc_req(struct rvt_qp *qp, struct 
hfi1_pkt_state *ps)
 
        lockdep_assert_held(&qp->s_lock);
        ps->s_txreq = get_txreq(ps->dev, qp);
-       if (IS_ERR(ps->s_txreq))
+       if (!ps->s_txreq)
                goto bail_no_tx;
 
        ps->s_txreq->phdr.hdr.hdr_type = priv->hdr_type;
diff --git a/drivers/infiniband/hw/hfi1/uc.c b/drivers/infiniband/hw/hfi1/uc.c
index 0b646173ca22..92e033fbb048 100644
--- a/drivers/infiniband/hw/hfi1/uc.c
+++ b/drivers/infiniband/hw/hfi1/uc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2015, 2016 Intel Corporation.
+ * Copyright(c) 2015 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -72,7 +72,7 @@ int hfi1_make_uc_req(struct rvt_qp *qp, struct hfi1_pkt_state 
*ps)
        int middle = 0;
 
        ps->s_txreq = get_txreq(ps->dev, qp);
-       if (IS_ERR(ps->s_txreq))
+       if (!ps->s_txreq)
                goto bail_no_tx;
 
        if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK)) {
diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c
index 38c7d9c456fe..37abd150fad3 100644
--- a/drivers/infiniband/hw/hfi1/ud.c
+++ b/drivers/infiniband/hw/hfi1/ud.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2015, 2016 Intel Corporation.
+ * Copyright(c) 2015 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -479,7 +479,7 @@ int hfi1_make_ud_req(struct rvt_qp *qp, struct 
hfi1_pkt_state *ps)
        u32 lid;
 
        ps->s_txreq = get_txreq(ps->dev, qp);
-       if (IS_ERR(ps->s_txreq))
+       if (!ps->s_txreq)
                goto bail_no_tx;
 
        if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_NEXT_SEND_OK)) {
diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.c 
b/drivers/infiniband/hw/hfi1/verbs_txreq.c
index 873e48ea923f..c4ab2d5b4502 100644
--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c
+++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2016 - 2017 Intel Corporation.
+ * Copyright(c) 2016 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -94,7 +94,7 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev,
                                struct rvt_qp *qp)
        __must_hold(&qp->s_lock)
 {
-       struct verbs_txreq *tx = ERR_PTR(-EBUSY);
+       struct verbs_txreq *tx = NULL;
 
        write_seqlock(&dev->txwait_lock);
        if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) {
diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.h 
b/drivers/infiniband/hw/hfi1/verbs_txreq.h
index 76216f2ef35a..22fc5ddf01ca 100644
--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h
+++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2016 Intel Corporation.
+ * Copyright(c) 2016 - 2018 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -83,7 +83,7 @@ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev 
*dev,
        if (unlikely(!tx)) {
                /* call slow path to get the lock */
                tx = __get_txreq(dev, qp);
-               if (IS_ERR(tx))
+               if (!tx)
                        return tx;
        }
        tx->qp = qp;
diff --git a/drivers/media/rc/ir-mce_kbd-decoder.c 
b/drivers/media/rc/ir-mce_kbd-decoder.c
index 7c572a643656..2a1728edb3c6 100644
--- a/drivers/media/rc/ir-mce_kbd-decoder.c
+++ b/drivers/media/rc/ir-mce_kbd-decoder.c
@@ -130,6 +130,8 @@ static void mce_kbd_rx_timeout(unsigned long data)
 
        for (i = 0; i < MCIR2_MASK_KEYS_START; i++)
                input_report_key(mce_kbd->idev, kbd_keycodes[i], 0);
+
+       input_sync(mce_kbd->idev);
 }
 
 static enum mce_kbd_mode mce_kbd_mode(struct mce_kbd_dec *data)
diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c
index e05c3245930a..fa840666bdd1 100644
--- a/drivers/misc/ibmasm/ibmasmfs.c
+++ b/drivers/misc/ibmasm/ibmasmfs.c
@@ -507,35 +507,14 @@ static int remote_settings_file_close(struct inode 
*inode, struct file *file)
 static ssize_t remote_settings_file_read(struct file *file, char __user *buf, 
size_t count, loff_t *offset)
 {
        void __iomem *address = (void __iomem *)file->private_data;
-       unsigned char *page;
-       int retval;
        int len = 0;
        unsigned int value;
-
-       if (*offset < 0)
-               return -EINVAL;
-       if (count == 0 || count > 1024)
-               return 0;
-       if (*offset != 0)
-               return 0;
-
-       page = (unsigned char *)__get_free_page(GFP_KERNEL);
-       if (!page)
-               return -ENOMEM;
+       char lbuf[20];
 
        value = readl(address);
-       len = sprintf(page, "%d\n", value);
-
-       if (copy_to_user(buf, page, len)) {
-               retval = -EFAULT;
-               goto exit;
-       }
-       *offset += len;
-       retval = len;
+       len = snprintf(lbuf, sizeof(lbuf), "%d\n", value);
 
-exit:
-       free_page((unsigned long)page);
-       return retval;
+       return simple_read_from_buffer(buf, count, offset, lbuf, len);
 }
 
 static ssize_t remote_settings_file_write(struct file *file, const char __user 
*ubuff, size_t count, loff_t *offset)
diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
index efd733472a35..56c6f79a5c5a 100644
--- a/drivers/misc/vmw_balloon.c
+++ b/drivers/misc/vmw_balloon.c
@@ -467,7 +467,7 @@ static int vmballoon_send_batched_lock(struct vmballoon *b,
                unsigned int num_pages, bool is_2m_pages, unsigned int *target)
 {
        unsigned long status;
-       unsigned long pfn = page_to_pfn(b->page);
+       unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page));
 
        STATS_INC(b->stats.lock[is_2m_pages]);
 
@@ -515,7 +515,7 @@ static bool vmballoon_send_batched_unlock(struct vmballoon 
*b,
                unsigned int num_pages, bool is_2m_pages, unsigned int *target)
 {
        unsigned long status;
-       unsigned long pfn = page_to_pfn(b->page);
+       unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page));
 
        STATS_INC(b->stats.unlock[is_2m_pages]);
 
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index de31e20dc56c..6a2cbbba29aa 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1089,8 +1089,8 @@ static void dw_mci_ctrl_thld(struct dw_mci *host, struct 
mmc_data *data)
         * It's used when HS400 mode is enabled.
         */
        if (data->flags & MMC_DATA_WRITE &&
-               !(host->timing != MMC_TIMING_MMC_HS400))
-               return;
+               host->timing != MMC_TIMING_MMC_HS400)
+               goto disable;
 
        if (data->flags & MMC_DATA_WRITE)
                enable = SDMMC_CARD_WR_THR_EN;
@@ -1098,7 +1098,8 @@ static void dw_mci_ctrl_thld(struct dw_mci *host, struct 
mmc_data *data)
                enable = SDMMC_CARD_RD_THR_EN;
 
        if (host->timing != MMC_TIMING_MMC_HS200 &&
-           host->timing != MMC_TIMING_UHS_SDR104)
+           host->timing != MMC_TIMING_UHS_SDR104 &&
+           host->timing != MMC_TIMING_MMC_HS400)
                goto disable;
 
        blksz_depth = blksz / (1 << host->data_shift);
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c 
b/drivers/mmc/host/sdhci-esdhc-imx.c
index 8b941f814472..c81de2f25281 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -305,6 +305,15 @@ static u32 esdhc_readl_le(struct sdhci_host *host, int reg)
 
                        if (imx_data->socdata->flags & ESDHC_FLAG_HS400)
                                val |= SDHCI_SUPPORT_HS400;
+
+                       /*
+                        * Do not advertise faster UHS modes if there are no
+                        * pinctrl states for 100MHz/200MHz.
+                        */
+                       if (IS_ERR_OR_NULL(imx_data->pins_100mhz) ||
+                           IS_ERR_OR_NULL(imx_data->pins_200mhz))
+                               val &= ~(SDHCI_SUPPORT_SDR50 | 
SDHCI_SUPPORT_DDR50
+                                        | SDHCI_SUPPORT_SDR104 | 
SDHCI_SUPPORT_HS400);
                }
        }
 
@@ -1135,18 +1144,6 @@ sdhci_esdhc_imx_probe_dt(struct platform_device *pdev,
                                                ESDHC_PINCTRL_STATE_100MHZ);
                imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl,
                                                ESDHC_PINCTRL_STATE_200MHZ);
-               if (IS_ERR(imx_data->pins_100mhz) ||
-                               IS_ERR(imx_data->pins_200mhz)) {
-                       dev_warn(mmc_dev(host->mmc),
-                               "could not get ultra high speed state, work on 
normal mode\n");
-                       /*
-                        * fall back to not supporting uhs by specifying no
-                        * 1.8v quirk
-                        */
-                       host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
-               }
-       } else {
-               host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V;
        }
 
        /* call to generic mmc_of_parse to support additional capabilities */
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 3d4724e38aa9..4cac4755abef 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1233,17 +1233,15 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int 
nr_io_queues,
 static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
                                int qid, int depth)
 {
-       if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) {
-               unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth),
-                                                     dev->ctrl.page_size);
-               nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
-               nvmeq->sq_cmds_io = dev->cmb + offset;
-       } else {
-               nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
-                                       &nvmeq->sq_dma_addr, GFP_KERNEL);
-               if (!nvmeq->sq_cmds)
-                       return -ENOMEM;
-       }
+
+       /* CMB SQEs will be mapped before creation */
+       if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz))
+               return 0;
+
+       nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
+                                           &nvmeq->sq_dma_addr, GFP_KERNEL);
+       if (!nvmeq->sq_cmds)
+               return -ENOMEM;
 
        return 0;
 }
@@ -1320,6 +1318,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, 
int qid)
        struct nvme_dev *dev = nvmeq->dev;
        int result;
 
+       if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) {
+               unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth),
+                                                     dev->ctrl.page_size);
+               nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset;
+               nvmeq->sq_cmds_io = dev->cmb + offset;
+       }
+
        nvmeq->cq_vector = qid - 1;
        result = adapter_alloc_cq(dev, qid, nvmeq);
        if (result < 0)
diff --git a/drivers/scsi/megaraid/megaraid_sas.h 
b/drivers/scsi/megaraid/megaraid_sas.h
index a6722c93a295..81de4a1fbb9b 100644
--- a/drivers/scsi/megaraid/megaraid_sas.h
+++ b/drivers/scsi/megaraid/megaraid_sas.h
@@ -1504,6 +1504,13 @@ enum FW_BOOT_CONTEXT {
 
 #define MR_CAN_HANDLE_SYNC_CACHE_OFFSET                0X01000000
 
+enum MR_ADAPTER_TYPE {
+       MFI_SERIES = 1,
+       THUNDERBOLT_SERIES = 2,
+       INVADER_SERIES = 3,
+       VENTURA_SERIES = 4,
+};
+
 /*
 * register set for both 1068 and 1078 controllers
 * structure extended for 1078 registers
@@ -2092,6 +2099,7 @@ enum MR_PD_TYPE {
 
 struct megasas_instance {
 
+       unsigned int *reply_map;
        __le32 *producer;
        dma_addr_t producer_h;
        __le32 *consumer;
@@ -2236,12 +2244,12 @@ struct megasas_instance {
        bool dev_handle;
        bool fw_sync_cache_support;
        u32 mfi_frame_size;
-       bool is_ventura;
        bool msix_combined;
        u16 max_raid_mapsize;
        /* preffered count to send as LDIO irrspective of FP capable.*/
        u8  r1_ldio_hint_default;
        u32 nvme_page_size;
+       u8 adapter_type;
 };
 struct MR_LD_VF_MAP {
        u32 size;
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c 
b/drivers/scsi/megaraid/megaraid_sas_base.c
index 4beb4dd2bee8..985378e4bb6f 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -2023,7 +2023,7 @@ void megaraid_sas_kill_hba(struct megasas_instance 
*instance)
        msleep(1000);
        if ((instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
                (instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0071SKINNY) ||
-               (instance->ctrl_context)) {
+               (instance->adapter_type != MFI_SERIES)) {
                writel(MFI_STOP_ADP, &instance->reg_set->doorbell);
                /* Flush */
                readl(&instance->reg_set->doorbell);
@@ -2494,7 +2494,8 @@ int megasas_sriov_start_heartbeat(struct megasas_instance 
*instance,
        dev_warn(&instance->pdev->dev, "SR-IOV: Starting heartbeat for 
scsi%d\n",
               instance->host->host_no);
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                retval = megasas_issue_blocked_cmd(instance, cmd,
                        MEGASAS_ROUTINE_WAIT_TIME_VF);
        else
@@ -2790,7 +2791,9 @@ static int megasas_reset_bus_host(struct scsi_cmnd *scmd)
        /*
         * First wait for all commands to complete
         */
-       if (instance->ctrl_context) {
+       if (instance->adapter_type == MFI_SERIES) {
+               ret = megasas_generic_reset(scmd);
+       } else {
                struct megasas_cmd_fusion *cmd;
                cmd = (struct megasas_cmd_fusion *)scmd->SCp.ptr;
                if (cmd)
@@ -2798,8 +2801,7 @@ static int megasas_reset_bus_host(struct scsi_cmnd *scmd)
                                MEGA_MPI2_RAID_DEFAULT_IO_FRAME_SIZE);
                ret = megasas_reset_fusion(scmd->device->host,
                                SCSIIO_TIMEOUT_OCR);
-       } else
-               ret = megasas_generic_reset(scmd);
+       }
 
        return ret;
 }
@@ -2816,7 +2818,7 @@ static int megasas_task_abort(struct scsi_cmnd *scmd)
 
        instance = (struct megasas_instance *)scmd->device->host->hostdata;
 
-       if (instance->ctrl_context)
+       if (instance->adapter_type != MFI_SERIES)
                ret = megasas_task_abort_fusion(scmd);
        else {
                sdev_printk(KERN_NOTICE, scmd->device, "TASK ABORT not 
supported\n");
@@ -2838,7 +2840,7 @@ static int megasas_reset_target(struct scsi_cmnd *scmd)
 
        instance = (struct megasas_instance *)scmd->device->host->hostdata;
 
-       if (instance->ctrl_context)
+       if (instance->adapter_type != MFI_SERIES)
                ret = megasas_reset_target_fusion(scmd);
        else {
                sdev_printk(KERN_NOTICE, scmd->device, "TARGET RESET not 
supported\n");
@@ -3715,7 +3717,7 @@ megasas_transition_to_ready(struct megasas_instance 
*instance, int ocr)
                                PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
                                (instance->pdev->device ==
                                 PCI_DEVICE_ID_LSI_SAS0071SKINNY) ||
-                               (instance->ctrl_context))
+                               (instance->adapter_type != MFI_SERIES))
                                writel(
                                  MFI_INIT_CLEAR_HANDSHAKE|MFI_INIT_HOTPLUG,
                                  &instance->reg_set->doorbell);
@@ -3733,7 +3735,7 @@ megasas_transition_to_ready(struct megasas_instance 
*instance, int ocr)
                             PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
                                (instance->pdev->device ==
                                 PCI_DEVICE_ID_LSI_SAS0071SKINNY) ||
-                               (instance->ctrl_context))
+                               (instance->adapter_type != MFI_SERIES))
                                writel(MFI_INIT_HOTPLUG,
                                       &instance->reg_set->doorbell);
                        else
@@ -3753,11 +3755,11 @@ megasas_transition_to_ready(struct megasas_instance 
*instance, int ocr)
                                PCI_DEVICE_ID_LSI_SAS0073SKINNY) ||
                                (instance->pdev->device ==
                                PCI_DEVICE_ID_LSI_SAS0071SKINNY)  ||
-                               (instance->ctrl_context)) {
+                               (instance->adapter_type != MFI_SERIES)) {
                                writel(MFI_RESET_FLAGS,
                                        &instance->reg_set->doorbell);
 
-                               if (instance->ctrl_context) {
+                               if (instance->adapter_type != MFI_SERIES) {
                                        for (i = 0; i < (10 * 1000); i += 20) {
                                                if (readl(
                                                            &instance->
@@ -3924,7 +3926,8 @@ static int megasas_create_frame_pool(struct 
megasas_instance *instance)
         * max_sge_sz  = 12 byte (sizeof  megasas_sge64)
         * Total 192 byte (3 MFI frame of 64 byte)
         */
-       frame_count = instance->ctrl_context ? (3 + 1) : (15 + 1);
+       frame_count = (instance->adapter_type == MFI_SERIES) ?
+                       (15 + 1) : (3 + 1);
        instance->mfi_frame_size = MEGAMFI_FRAME_SIZE * frame_count;
        /*
         * Use DMA pool facility provided by PCI layer
@@ -3979,7 +3982,7 @@ static int megasas_create_frame_pool(struct 
megasas_instance *instance)
                memset(cmd->frame, 0, instance->mfi_frame_size);
                cmd->frame->io.context = cpu_to_le32(cmd->index);
                cmd->frame->io.pad_0 = 0;
-               if (!instance->ctrl_context && reset_devices)
+               if ((instance->adapter_type == MFI_SERIES) && reset_devices)
                        cmd->frame->hdr.cmd = MFI_CMD_INVALID;
        }
 
@@ -4099,7 +4102,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance)
 inline int
 dcmd_timeout_ocr_possible(struct megasas_instance *instance) {
 
-       if (!instance->ctrl_context)
+       if (instance->adapter_type == MFI_SERIES)
                return KILL_ADAPTER;
        else if (instance->unload ||
                        test_bit(MEGASAS_FUSION_IN_RESET, 
&instance->reset_flags))
@@ -4143,7 +4146,8 @@ megasas_get_pd_info(struct megasas_instance *instance, 
struct scsi_device *sdev)
        dcmd->sgl.sge32[0].phys_addr = cpu_to_le32(instance->pd_info_h);
        dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct MR_PD_INFO));
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                ret = megasas_issue_blocked_cmd(instance, cmd, 
MFI_IO_TIMEOUT_SECS);
        else
                ret = megasas_issue_polled(instance, cmd);
@@ -4240,7 +4244,8 @@ megasas_get_pd_list(struct megasas_instance *instance)
        dcmd->sgl.sge32[0].phys_addr = cpu_to_le32(ci_h);
        dcmd->sgl.sge32[0].length = cpu_to_le32(MEGASAS_MAX_PD * sizeof(struct 
MR_PD_LIST));
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                ret = megasas_issue_blocked_cmd(instance, cmd,
                        MFI_IO_TIMEOUT_SECS);
        else
@@ -4251,7 +4256,7 @@ megasas_get_pd_list(struct megasas_instance *instance)
                dev_info(&instance->pdev->dev, "MR_DCMD_PD_LIST_QUERY "
                        "failed/not supported by firmware\n");
 
-               if (instance->ctrl_context)
+               if (instance->adapter_type != MFI_SERIES)
                        megaraid_sas_kill_hba(instance);
                else
                        instance->pd_list_not_supported = 1;
@@ -4372,7 +4377,8 @@ megasas_get_ld_list(struct megasas_instance *instance)
        dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct MR_LD_LIST));
        dcmd->pad_0  = 0;
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                ret = megasas_issue_blocked_cmd(instance, cmd,
                        MFI_IO_TIMEOUT_SECS);
        else
@@ -4491,7 +4497,8 @@ megasas_ld_list_query(struct megasas_instance *instance, 
u8 query_type)
        dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct 
MR_LD_TARGETID_LIST));
        dcmd->pad_0  = 0;
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                ret = megasas_issue_blocked_cmd(instance, cmd, 
MFI_IO_TIMEOUT_SECS);
        else
                ret = megasas_issue_polled(instance, cmd);
@@ -4664,7 +4671,8 @@ megasas_get_ctrl_info(struct megasas_instance *instance)
        dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct 
megasas_ctrl_info));
        dcmd->mbox.b[0] = 1;
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                ret = megasas_issue_blocked_cmd(instance, cmd, 
MFI_IO_TIMEOUT_SECS);
        else
                ret = megasas_issue_polled(instance, cmd);
@@ -4783,7 +4791,8 @@ int megasas_set_crash_dump_params(struct megasas_instance 
*instance,
        dcmd->sgl.sge32[0].phys_addr = cpu_to_le32(instance->crash_dump_h);
        dcmd->sgl.sge32[0].length = cpu_to_le32(CRASH_DMA_BUF_SIZE);
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                ret = megasas_issue_blocked_cmd(instance, cmd, 
MFI_IO_TIMEOUT_SECS);
        else
                ret = megasas_issue_polled(instance, cmd);
@@ -5129,6 +5138,26 @@ megasas_setup_jbod_map(struct megasas_instance *instance)
                instance->use_seqnum_jbod_fp = false;
 }
 
+static void megasas_setup_reply_map(struct megasas_instance *instance)
+{
+       const struct cpumask *mask;
+       unsigned int queue, cpu;
+
+       for (queue = 0; queue < instance->msix_vectors; queue++) {
+               mask = pci_irq_get_affinity(instance->pdev, queue);
+               if (!mask)
+                       goto fallback;
+
+               for_each_cpu(cpu, mask)
+                       instance->reply_map[cpu] = queue;
+       }
+       return;
+
+fallback:
+       for_each_possible_cpu(cpu)
+               instance->reply_map[cpu] = cpu % instance->msix_vectors;
+}
+
 /**
  * megasas_init_fw -   Initializes the FW
  * @instance:          Adapter soft state
@@ -5170,7 +5199,7 @@ static int megasas_init_fw(struct megasas_instance 
*instance)
 
        reg_set = instance->reg_set;
 
-       if (fusion)
+       if (instance->adapter_type != MFI_SERIES)
                instance->instancet = &megasas_instance_template_fusion;
        else {
                switch (instance->pdev->device) {
@@ -5211,7 +5240,7 @@ static int megasas_init_fw(struct megasas_instance 
*instance)
                        goto fail_ready_state;
        }
 
-       if (instance->is_ventura) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                scratch_pad_3 =
                        readl(&instance->reg_set->outbound_scratch_pad_3);
                instance->max_raid_mapsize = ((scratch_pad_3 >>
@@ -5229,7 +5258,8 @@ static int megasas_init_fw(struct megasas_instance 
*instance)
                        (&instance->reg_set->outbound_scratch_pad_2);
                /* Check max MSI-X vectors */
                if (fusion) {
-                       if (fusion->adapter_type == THUNDERBOLT_SERIES) { /* 
Thunderbolt Series*/
+                       if (instance->adapter_type == THUNDERBOLT_SERIES) {
+                               /* Thunderbolt Series*/
                                instance->msix_vectors = (scratch_pad_2
                                        & MR_MAX_REPLY_QUEUES_OFFSET) + 1;
                                fw_msix_count = instance->msix_vectors;
@@ -5293,6 +5323,8 @@ static int megasas_init_fw(struct megasas_instance 
*instance)
                        goto fail_setup_irqs;
        }
 
+       megasas_setup_reply_map(instance);
+
        dev_info(&instance->pdev->dev,
                "firmware supports msix\t: (%d)", fw_msix_count);
        dev_info(&instance->pdev->dev,
@@ -5319,7 +5351,7 @@ static int megasas_init_fw(struct megasas_instance 
*instance)
        if (instance->instancet->init_adapter(instance))
                goto fail_init_adapter;
 
-       if (instance->is_ventura) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                scratch_pad_4 =
                        readl(&instance->reg_set->outbound_scratch_pad_4);
                if ((scratch_pad_4 & MR_NVME_PAGE_SIZE_MASK) >=
@@ -5355,7 +5387,7 @@ static int megasas_init_fw(struct megasas_instance 
*instance)
        memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS);
 
        /* stream detection initialization */
-       if (instance->is_ventura && fusion) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                fusion->stream_detect_by_ld =
                        kzalloc(sizeof(struct LD_STREAM_DETECT *)
                        * MAX_LOGICAL_DRIVES_EXT,
@@ -5804,7 +5836,8 @@ megasas_get_target_prop(struct megasas_instance *instance,
        dcmd->sgl.sge32[0].length =
                cpu_to_le32(sizeof(struct MR_TARGET_PROPERTIES));
 
-       if (instance->ctrl_context && !instance->mask_interrupts)
+       if ((instance->adapter_type != MFI_SERIES) &&
+           !instance->mask_interrupts)
                ret = megasas_issue_blocked_cmd(instance,
                                                cmd, MFI_IO_TIMEOUT_SECS);
        else
@@ -5965,6 +5998,125 @@ megasas_set_dma_mask(struct pci_dev *pdev)
        return 1;
 }
 
+/*
+ * megasas_set_adapter_type -  Set adapter type.
+ *                             Supported controllers can be divided in
+ *                             4 categories-  enum MR_ADAPTER_TYPE {
+ *                                                     MFI_SERIES = 1,
+ *                                                     THUNDERBOLT_SERIES = 2,
+ *                                                     INVADER_SERIES = 3,
+ *                                                     VENTURA_SERIES = 4,
+ *                                             };
+ * @instance:                  Adapter soft state
+ * return:                     void
+ */
+static inline void megasas_set_adapter_type(struct megasas_instance *instance)
+{
+       switch (instance->pdev->device) {
+       case PCI_DEVICE_ID_LSI_VENTURA:
+       case PCI_DEVICE_ID_LSI_HARPOON:
+       case PCI_DEVICE_ID_LSI_TOMCAT:
+       case PCI_DEVICE_ID_LSI_VENTURA_4PORT:
+       case PCI_DEVICE_ID_LSI_CRUSADER_4PORT:
+               instance->adapter_type = VENTURA_SERIES;
+               break;
+       case PCI_DEVICE_ID_LSI_FUSION:
+       case PCI_DEVICE_ID_LSI_PLASMA:
+               instance->adapter_type = THUNDERBOLT_SERIES;
+               break;
+       case PCI_DEVICE_ID_LSI_INVADER:
+       case PCI_DEVICE_ID_LSI_INTRUDER:
+       case PCI_DEVICE_ID_LSI_INTRUDER_24:
+       case PCI_DEVICE_ID_LSI_CUTLASS_52:
+       case PCI_DEVICE_ID_LSI_CUTLASS_53:
+       case PCI_DEVICE_ID_LSI_FURY:
+               instance->adapter_type = INVADER_SERIES;
+               break;
+       default: /* For all other supported controllers */
+               instance->adapter_type = MFI_SERIES;
+               break;
+       }
+}
+
+static inline int megasas_alloc_mfi_ctrl_mem(struct megasas_instance *instance)
+{
+       instance->producer = pci_alloc_consistent(instance->pdev, sizeof(u32),
+                                                 &instance->producer_h);
+       instance->consumer = pci_alloc_consistent(instance->pdev, sizeof(u32),
+                                                 &instance->consumer_h);
+
+       if (!instance->producer || !instance->consumer) {
+               dev_err(&instance->pdev->dev,
+                       "Failed to allocate memory for producer, consumer\n");
+               return -1;
+       }
+
+       *instance->producer = 0;
+       *instance->consumer = 0;
+       return 0;
+}
+
+/**
+ * megasas_alloc_ctrl_mem -    Allocate per controller memory for core data
+ *                             structures which are not common across MFI
+ *                             adapters and fusion adapters.
+ *                             For MFI based adapters, allocate producer and
+ *                             consumer buffers. For fusion adapters, allocate
+ *                             memory for fusion context.
+ * @instance:                  Adapter soft state
+ * return:                     0 for SUCCESS
+ */
+static int megasas_alloc_ctrl_mem(struct megasas_instance *instance)
+{
+       instance->reply_map = kzalloc(sizeof(unsigned int) * nr_cpu_ids,
+                                     GFP_KERNEL);
+       if (!instance->reply_map)
+               return -ENOMEM;
+
+       switch (instance->adapter_type) {
+       case MFI_SERIES:
+               if (megasas_alloc_mfi_ctrl_mem(instance))
+                       goto fail;
+               break;
+       case VENTURA_SERIES:
+       case THUNDERBOLT_SERIES:
+       case INVADER_SERIES:
+               if (megasas_alloc_fusion_context(instance))
+                       goto fail;
+               break;
+       }
+
+       return 0;
+ fail:
+       kfree(instance->reply_map);
+       instance->reply_map = NULL;
+       return -ENOMEM;
+}
+
+/*
+ * megasas_free_ctrl_mem -     Free fusion context for fusion adapters and
+ *                             producer, consumer buffers for MFI adapters
+ *
+ * @instance -                 Adapter soft instance
+ *
+ */
+static inline void megasas_free_ctrl_mem(struct megasas_instance *instance)
+{
+       kfree(instance->reply_map);
+       if (instance->adapter_type == MFI_SERIES) {
+               if (instance->producer)
+                       pci_free_consistent(instance->pdev, sizeof(u32),
+                                           instance->producer,
+                                           instance->producer_h);
+               if (instance->consumer)
+                       pci_free_consistent(instance->pdev, sizeof(u32),
+                                           instance->consumer,
+                                           instance->consumer_h);
+       } else {
+               megasas_free_fusion_context(instance);
+       }
+}
+
 /**
  * megasas_probe_one - PCI hotplug entry point
  * @pdev:              PCI device structure
@@ -5977,7 +6129,6 @@ static int megasas_probe_one(struct pci_dev *pdev,
        struct Scsi_Host *host;
        struct megasas_instance *instance;
        u16 control = 0;
-       struct fusion_context *fusion = NULL;
 
        /* Reset MSI-X in the kdump kernel */
        if (reset_devices) {
@@ -6022,56 +6173,10 @@ static int megasas_probe_one(struct pci_dev *pdev,
        atomic_set(&instance->fw_reset_no_pci_access, 0);
        instance->pdev = pdev;
 
-       switch (instance->pdev->device) {
-       case PCI_DEVICE_ID_LSI_VENTURA:
-       case PCI_DEVICE_ID_LSI_HARPOON:
-       case PCI_DEVICE_ID_LSI_TOMCAT:
-       case PCI_DEVICE_ID_LSI_VENTURA_4PORT:
-       case PCI_DEVICE_ID_LSI_CRUSADER_4PORT:
-            instance->is_ventura = true;
-       case PCI_DEVICE_ID_LSI_FUSION:
-       case PCI_DEVICE_ID_LSI_PLASMA:
-       case PCI_DEVICE_ID_LSI_INVADER:
-       case PCI_DEVICE_ID_LSI_FURY:
-       case PCI_DEVICE_ID_LSI_INTRUDER:
-       case PCI_DEVICE_ID_LSI_INTRUDER_24:
-       case PCI_DEVICE_ID_LSI_CUTLASS_52:
-       case PCI_DEVICE_ID_LSI_CUTLASS_53:
-       {
-               if (megasas_alloc_fusion_context(instance)) {
-                       megasas_free_fusion_context(instance);
-                       goto fail_alloc_dma_buf;
-               }
-               fusion = instance->ctrl_context;
-
-               if ((instance->pdev->device == PCI_DEVICE_ID_LSI_FUSION) ||
-                       (instance->pdev->device == PCI_DEVICE_ID_LSI_PLASMA))
-                       fusion->adapter_type = THUNDERBOLT_SERIES;
-               else if (instance->is_ventura)
-                       fusion->adapter_type = VENTURA_SERIES;
-               else
-                       fusion->adapter_type = INVADER_SERIES;
-       }
-       break;
-       default: /* For all other supported controllers */
+       megasas_set_adapter_type(instance);
 
-               instance->producer =
-                       pci_alloc_consistent(pdev, sizeof(u32),
-                                            &instance->producer_h);
-               instance->consumer =
-                       pci_alloc_consistent(pdev, sizeof(u32),
-                                            &instance->consumer_h);
-
-               if (!instance->producer || !instance->consumer) {
-                       dev_printk(KERN_DEBUG, &pdev->dev, "Failed to allocate "
-                              "memory for producer, consumer\n");
-                       goto fail_alloc_dma_buf;
-               }
-
-               *instance->producer = 0;
-               *instance->consumer = 0;
-               break;
-       }
+       if (megasas_alloc_ctrl_mem(instance))
+               goto fail_alloc_dma_buf;
 
        /* Crash dump feature related initialisation*/
        instance->drv_buf_index = 0;
@@ -6166,7 +6271,7 @@ static int megasas_probe_one(struct pci_dev *pdev,
        instance->disableOnlineCtrlReset = 1;
        instance->UnevenSpanSupport = 0;
 
-       if (instance->ctrl_context) {
+       if (instance->adapter_type != MFI_SERIES) {
                INIT_WORK(&instance->work_init, megasas_fusion_ocr_wq);
                INIT_WORK(&instance->crash_init, megasas_fusion_crash_dump_wq);
        } else
@@ -6246,7 +6351,7 @@ static int megasas_probe_one(struct pci_dev *pdev,
        instance->instancet->disable_intr(instance);
        megasas_destroy_irqs(instance);
 
-       if (instance->ctrl_context)
+       if (instance->adapter_type != MFI_SERIES)
                megasas_release_fusion(instance);
        else
                megasas_release_mfi(instance);
@@ -6267,14 +6372,8 @@ static int megasas_probe_one(struct pci_dev *pdev,
                pci_free_consistent(pdev, sizeof(struct MR_TARGET_PROPERTIES),
                                        instance->tgt_prop,
                                        instance->tgt_prop_h);
-       if (instance->producer)
-               pci_free_consistent(pdev, sizeof(u32), instance->producer,
-                                   instance->producer_h);
-       if (instance->consumer)
-               pci_free_consistent(pdev, sizeof(u32), instance->consumer,
-                                   instance->consumer_h);
+       megasas_free_ctrl_mem(instance);
        scsi_host_put(host);
-
 fail_alloc_instance:
 fail_set_dma_mask:
        pci_disable_device(pdev);
@@ -6480,7 +6579,9 @@ megasas_resume(struct pci_dev *pdev)
        if (rval < 0)
                goto fail_reenable_msix;
 
-       if (instance->ctrl_context) {
+       megasas_setup_reply_map(instance);
+
+       if (instance->adapter_type != MFI_SERIES) {
                megasas_reset_reply_desc(instance);
                if (megasas_ioc_init_fusion(instance)) {
                        megasas_free_cmds(instance);
@@ -6543,12 +6644,8 @@ megasas_resume(struct pci_dev *pdev)
                pci_free_consistent(pdev, sizeof(struct MR_TARGET_PROPERTIES),
                                        instance->tgt_prop,
                                        instance->tgt_prop_h);
-       if (instance->producer)
-               pci_free_consistent(pdev, sizeof(u32), instance->producer,
-                               instance->producer_h);
-       if (instance->consumer)
-               pci_free_consistent(pdev, sizeof(u32), instance->consumer,
-                               instance->consumer_h);
+
+       megasas_free_ctrl_mem(instance);
        scsi_host_put(host);
 
 fail_set_dma_mask:
@@ -6656,7 +6753,7 @@ static void megasas_detach_one(struct pci_dev *pdev)
        if (instance->msix_vectors)
                pci_free_irq_vectors(instance->pdev);
 
-       if (instance->is_ventura) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                for (i = 0; i < MAX_LOGICAL_DRIVES_EXT; ++i)
                        kfree(fusion->stream_detect_by_ld[i]);
                kfree(fusion->stream_detect_by_ld);
@@ -6664,7 +6761,7 @@ static void megasas_detach_one(struct pci_dev *pdev)
        }
 
 
-       if (instance->ctrl_context) {
+       if (instance->adapter_type != MFI_SERIES) {
                megasas_release_fusion(instance);
                        pd_seq_map_sz = sizeof(struct MR_PD_CFG_SEQ_NUM_SYNC) +
                                (sizeof(struct MR_PD_CFG_SEQ) *
@@ -6689,15 +6786,8 @@ static void megasas_detach_one(struct pci_dev *pdev)
                                        fusion->pd_seq_sync[i],
                                        fusion->pd_seq_phys[i]);
                }
-               megasas_free_fusion_context(instance);
        } else {
                megasas_release_mfi(instance);
-               pci_free_consistent(pdev, sizeof(u32),
-                                   instance->producer,
-                                   instance->producer_h);
-               pci_free_consistent(pdev, sizeof(u32),
-                                   instance->consumer,
-                                   instance->consumer_h);
        }
 
        kfree(instance->ctrl_info);
@@ -6738,6 +6828,8 @@ static void megasas_detach_one(struct pci_dev *pdev)
                pci_free_consistent(pdev, sizeof(struct MR_DRV_SYSTEM_INFO),
                                    instance->system_info_buf, 
instance->system_info_h);
 
+       megasas_free_ctrl_mem(instance);
+
        scsi_host_put(host);
 
        pci_disable_device(pdev);
diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c 
b/drivers/scsi/megaraid/megaraid_sas_fp.c
index 08945142b9f8..f2ffde430ec1 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fp.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fp.c
@@ -745,7 +745,7 @@ static u8 mr_spanset_get_phy_params(struct megasas_instance 
*instance, u32 ld,
                *pDevHandle = MR_PdDevHandleGet(pd, map);
                *pPdInterface = MR_PdInterfaceTypeGet(pd, map);
                /* get second pd also for raid 1/10 fast path writes*/
-               if (instance->is_ventura &&
+               if ((instance->adapter_type == VENTURA_SERIES) &&
                    (raid->level == 1) &&
                    !io_info->isRead) {
                        r1_alt_pd = MR_ArPdGet(arRef, physArm + 1, map);
@@ -755,8 +755,8 @@ static u8 mr_spanset_get_phy_params(struct megasas_instance 
*instance, u32 ld,
                }
        } else {
                if ((raid->level >= 5) &&
-                       ((fusion->adapter_type == THUNDERBOLT_SERIES)  ||
-                       ((fusion->adapter_type == INVADER_SERIES) &&
+                       ((instance->adapter_type == THUNDERBOLT_SERIES)  ||
+                       ((instance->adapter_type == INVADER_SERIES) &&
                        (raid->regTypeReqOnRead != REGION_TYPE_UNUSED))))
                        pRAID_Context->reg_lock_flags = REGION_TYPE_EXCLUSIVE;
                else if (raid->level == 1) {
@@ -770,7 +770,7 @@ static u8 mr_spanset_get_phy_params(struct megasas_instance 
*instance, u32 ld,
        }
 
        *pdBlock += stripRef + le64_to_cpu(MR_LdSpanPtrGet(ld, span, 
map)->startBlk);
-       if (instance->is_ventura) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                ((struct RAID_CONTEXT_G35 *)pRAID_Context)->span_arm =
                        (span << RAID_CTX_SPANARM_SPAN_SHIFT) | physArm;
                io_info->span_arm =
@@ -861,7 +861,7 @@ u8 MR_GetPhyParams(struct megasas_instance *instance, u32 
ld, u64 stripRow,
                *pDevHandle = MR_PdDevHandleGet(pd, map);
                *pPdInterface = MR_PdInterfaceTypeGet(pd, map);
                /* get second pd also for raid 1/10 fast path writes*/
-               if (instance->is_ventura &&
+               if ((instance->adapter_type == VENTURA_SERIES) &&
                    (raid->level == 1) &&
                    !io_info->isRead) {
                        r1_alt_pd = MR_ArPdGet(arRef, physArm + 1, map);
@@ -871,8 +871,8 @@ u8 MR_GetPhyParams(struct megasas_instance *instance, u32 
ld, u64 stripRow,
                }
        } else {
                if ((raid->level >= 5) &&
-                       ((fusion->adapter_type == THUNDERBOLT_SERIES)  ||
-                       ((fusion->adapter_type == INVADER_SERIES) &&
+                       ((instance->adapter_type == THUNDERBOLT_SERIES)  ||
+                       ((instance->adapter_type == INVADER_SERIES) &&
                        (raid->regTypeReqOnRead != REGION_TYPE_UNUSED))))
                        pRAID_Context->reg_lock_flags = REGION_TYPE_EXCLUSIVE;
                else if (raid->level == 1) {
@@ -888,7 +888,7 @@ u8 MR_GetPhyParams(struct megasas_instance *instance, u32 
ld, u64 stripRow,
        }
 
        *pdBlock += stripRef + le64_to_cpu(MR_LdSpanPtrGet(ld, span, 
map)->startBlk);
-       if (instance->is_ventura) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                ((struct RAID_CONTEXT_G35 *)pRAID_Context)->span_arm =
                                (span << RAID_CTX_SPANARM_SPAN_SHIFT) | physArm;
                io_info->span_arm =
@@ -1096,10 +1096,10 @@ MR_BuildRaidContext(struct megasas_instance *instance,
                cpu_to_le16(raid->fpIoTimeoutForLd ?
                            raid->fpIoTimeoutForLd :
                            map->raidMap.fpPdIoTimeoutSec);
-       if (fusion->adapter_type == INVADER_SERIES)
+       if (instance->adapter_type == INVADER_SERIES)
                pRAID_Context->reg_lock_flags = (isRead) ?
                        raid->regTypeReqOnRead : raid->regTypeReqOnWrite;
-       else if (!instance->is_ventura)
+       else if (instance->adapter_type == THUNDERBOLT_SERIES)
                pRAID_Context->reg_lock_flags = (isRead) ?
                        REGION_TYPE_SHARED_READ : raid->regTypeReqOnWrite;
        pRAID_Context->virtual_disk_tgt_id = raid->targetId;
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c 
b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index 72a919179d06..d8f626567f59 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -237,7 +237,7 @@ megasas_fusion_update_can_queue(struct megasas_instance 
*instance, int fw_boot_c
        reg_set = instance->reg_set;
 
        /* ventura FW does not fill outbound_scratch_pad_3 with queue depth */
-       if (!instance->is_ventura)
+       if (instance->adapter_type < VENTURA_SERIES)
                cur_max_fw_cmds =
                readl(&instance->reg_set->outbound_scratch_pad_3) & 0x00FFFF;
 
@@ -285,7 +285,7 @@ megasas_fusion_update_can_queue(struct megasas_instance 
*instance, int fw_boot_c
                instance->host->can_queue = instance->cur_can_queue;
        }
 
-       if (instance->is_ventura)
+       if (instance->adapter_type == VENTURA_SERIES)
                instance->max_mpt_cmds =
                instance->max_fw_cmds * RAID_1_PEER_CMDS;
        else
@@ -838,7 +838,7 @@ megasas_ioc_init_fusion(struct megasas_instance *instance)
        drv_ops = (MFI_CAPABILITIES *) &(init_frame->driver_operations);
 
        /* driver support Extended MSIX */
-       if (fusion->adapter_type >= INVADER_SERIES)
+       if (instance->adapter_type >= INVADER_SERIES)
                drv_ops->mfi_capabilities.support_additional_msix = 1;
        /* driver supports HA / Remote LUN over Fast Path interface */
        drv_ops->mfi_capabilities.support_fp_remote_lun = 1;
@@ -1789,7 +1789,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance,
 
        fusion = instance->ctrl_context;
 
-       if (fusion->adapter_type >= INVADER_SERIES) {
+       if (instance->adapter_type >= INVADER_SERIES) {
                struct MPI25_IEEE_SGE_CHAIN64 *sgl_ptr_end = sgl_ptr;
                sgl_ptr_end += fusion->max_sge_in_main_msg - 1;
                sgl_ptr_end->Flags = 0;
@@ -1799,7 +1799,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance,
                sgl_ptr->Length = cpu_to_le32(sg_dma_len(os_sgl));
                sgl_ptr->Address = cpu_to_le64(sg_dma_address(os_sgl));
                sgl_ptr->Flags = 0;
-               if (fusion->adapter_type >= INVADER_SERIES)
+               if (instance->adapter_type >= INVADER_SERIES)
                        if (i == sge_count - 1)
                                sgl_ptr->Flags = IEEE_SGE_FLAGS_END_OF_LIST;
                sgl_ptr++;
@@ -1809,7 +1809,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance,
                    (sge_count > fusion->max_sge_in_main_msg)) {
 
                        struct MPI25_IEEE_SGE_CHAIN64 *sg_chain;
-                       if (fusion->adapter_type >= INVADER_SERIES) {
+                       if (instance->adapter_type >= INVADER_SERIES) {
                                if ((le16_to_cpu(cmd->io_request->IoFlags) &
                                        
MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH) !=
                                        
MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH)
@@ -1825,7 +1825,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance,
                        sg_chain = sgl_ptr;
                        /* Prepare chain element */
                        sg_chain->NextChainOffset = 0;
-                       if (fusion->adapter_type >= INVADER_SERIES)
+                       if (instance->adapter_type >= INVADER_SERIES)
                                sg_chain->Flags = IEEE_SGE_FLAGS_CHAIN_ELEMENT;
                        else
                                sg_chain->Flags =
@@ -2341,15 +2341,12 @@ megasas_build_ldio_fusion(struct megasas_instance 
*instance,
                        fp_possible = (io_info.fpOkForIo > 0) ? true : false;
        }
 
-       /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
-          id by default, not CPU group id, otherwise all MSI-X queues won't
-          be utilized */
-       cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
-               raw_smp_processor_id() % instance->msix_vectors : 0;
+       cmd->request_desc->SCSIIO.MSIxIndex =
+               instance->reply_map[raw_smp_processor_id()];
 
        praid_context = &io_request->RaidContext;
 
-       if (instance->is_ventura) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                spin_lock_irqsave(&instance->stream_lock, spinlock_flags);
                megasas_stream_detect(instance, cmd, &io_info);
                spin_unlock_irqrestore(&instance->stream_lock, spinlock_flags);
@@ -2402,7 +2399,7 @@ megasas_build_ldio_fusion(struct megasas_instance 
*instance,
                cmd->request_desc->SCSIIO.RequestFlags =
                        (MPI2_REQ_DESCRIPT_FLAGS_FP_IO
                         << MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
-               if (fusion->adapter_type == INVADER_SERIES) {
+               if (instance->adapter_type == INVADER_SERIES) {
                        if (io_request->RaidContext.raid_context.reg_lock_flags 
==
                            REGION_TYPE_UNUSED)
                                cmd->request_desc->SCSIIO.RequestFlags =
@@ -2415,7 +2412,7 @@ megasas_build_ldio_fusion(struct megasas_instance 
*instance,
                        io_request->RaidContext.raid_context.reg_lock_flags |=
                          (MR_RL_FLAGS_GRANT_DESTINATION_CUDA |
                           MR_RL_FLAGS_SEQ_NUM_ENABLE);
-               } else if (instance->is_ventura) {
+               } else if (instance->adapter_type == VENTURA_SERIES) {
                        io_request->RaidContext.raid_context_g35.nseg_type |=
                                                (1 << RAID_CONTEXT_NSEG_SHIFT);
                        io_request->RaidContext.raid_context_g35.nseg_type |=
@@ -2434,7 +2431,7 @@ megasas_build_ldio_fusion(struct megasas_instance 
*instance,
                                        &io_info, local_map_ptr);
                        scp->SCp.Status |= MEGASAS_LOAD_BALANCE_FLAG;
                        cmd->pd_r1_lb = io_info.pd_after_lb;
-                       if (instance->is_ventura)
+                       if (instance->adapter_type == VENTURA_SERIES)
                                
io_request->RaidContext.raid_context_g35.span_arm
                                        = io_info.span_arm;
                        else
@@ -2444,7 +2441,7 @@ megasas_build_ldio_fusion(struct megasas_instance 
*instance,
                } else
                        scp->SCp.Status &= ~MEGASAS_LOAD_BALANCE_FLAG;
 
-               if (instance->is_ventura)
+               if (instance->adapter_type == VENTURA_SERIES)
                        cmd->r1_alt_dev_handle = io_info.r1_alt_dev_handle;
                else
                        cmd->r1_alt_dev_handle = MR_DEVHANDLE_INVALID;
@@ -2467,7 +2464,7 @@ megasas_build_ldio_fusion(struct megasas_instance 
*instance,
                cmd->request_desc->SCSIIO.RequestFlags =
                        (MEGASAS_REQ_DESCRIPT_FLAGS_LD_IO
                         << MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT);
-               if (fusion->adapter_type == INVADER_SERIES) {
+               if (instance->adapter_type == INVADER_SERIES) {
                        if (io_info.do_fp_rlbypass ||
                        (io_request->RaidContext.raid_context.reg_lock_flags
                                        == REGION_TYPE_UNUSED))
@@ -2480,7 +2477,7 @@ megasas_build_ldio_fusion(struct megasas_instance 
*instance,
                                (MR_RL_FLAGS_GRANT_DESTINATION_CPU0 |
                                 MR_RL_FLAGS_SEQ_NUM_ENABLE);
                        io_request->RaidContext.raid_context.nseg = 0x1;
-               } else if (instance->is_ventura) {
+               } else if (instance->adapter_type == VENTURA_SERIES) {
                        io_request->RaidContext.raid_context_g35.routing_flags 
|=
                                        (1 << 
MR_RAID_CTX_ROUTINGFLAGS_SQN_SHIFT);
                        io_request->RaidContext.raid_context_g35.nseg_type |=
@@ -2555,7 +2552,7 @@ static void megasas_build_ld_nonrw_fusion(struct 
megasas_instance *instance,
 
                /* set RAID context values */
                pRAID_Context->config_seq_num = raid->seqNum;
-               if (!instance->is_ventura)
+               if (instance->adapter_type != VENTURA_SERIES)
                        pRAID_Context->reg_lock_flags = REGION_TYPE_SHARED_READ;
                pRAID_Context->timeout_value =
                        cpu_to_le16(raid->fpIoTimeoutForLd);
@@ -2640,7 +2637,7 @@ megasas_build_syspd_fusion(struct megasas_instance 
*instance,
                                cpu_to_le16(device_id + (MAX_PHYSICAL_DEVICES - 
1));
                pRAID_Context->config_seq_num = pd_sync->seq[pd_index].seqNum;
                io_request->DevHandle = pd_sync->seq[pd_index].devHandle;
-               if (instance->is_ventura) {
+               if (instance->adapter_type == VENTURA_SERIES) {
                        io_request->RaidContext.raid_context_g35.routing_flags 
|=
                                (1 << MR_RAID_CTX_ROUTINGFLAGS_SQN_SHIFT);
                        io_request->RaidContext.raid_context_g35.nseg_type |=
@@ -2667,10 +2664,9 @@ megasas_build_syspd_fusion(struct megasas_instance 
*instance,
        }
 
        cmd->request_desc->SCSIIO.DevHandle = io_request->DevHandle;
-       cmd->request_desc->SCSIIO.MSIxIndex =
-               instance->msix_vectors ?
-               (raw_smp_processor_id() % instance->msix_vectors) : 0;
 
+       cmd->request_desc->SCSIIO.MSIxIndex =
+               instance->reply_map[raw_smp_processor_id()];
 
        if (!fp_possible) {
                /* system pd firmware path */
@@ -2688,7 +2684,7 @@ megasas_build_syspd_fusion(struct megasas_instance 
*instance,
                pRAID_Context->timeout_value =
                        cpu_to_le16((os_timeout_value > timeout_limit) ?
                        timeout_limit : os_timeout_value);
-               if (fusion->adapter_type >= INVADER_SERIES)
+               if (instance->adapter_type >= INVADER_SERIES)
                        io_request->IoFlags |=
                                
cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH);
 
@@ -2771,7 +2767,7 @@ megasas_build_io_fusion(struct megasas_instance *instance,
                return 1;
        }
 
-       if (instance->is_ventura) {
+       if (instance->adapter_type == VENTURA_SERIES) {
                set_num_sge(&io_request->RaidContext.raid_context_g35, 
sge_count);
                
cpu_to_le16s(&io_request->RaidContext.raid_context_g35.routing_flags);
                
cpu_to_le16s(&io_request->RaidContext.raid_context_g35.nseg_type);
@@ -3301,7 +3297,7 @@ build_mpt_mfi_pass_thru(struct megasas_instance *instance,
 
        io_req = cmd->io_request;
 
-       if (fusion->adapter_type >= INVADER_SERIES) {
+       if (instance->adapter_type >= INVADER_SERIES) {
                struct MPI25_IEEE_SGE_CHAIN64 *sgl_ptr_end =
                        (struct MPI25_IEEE_SGE_CHAIN64 *)&io_req->SGL;
                sgl_ptr_end += fusion->max_sge_in_main_msg - 1;
@@ -4233,7 +4229,7 @@ int megasas_reset_fusion(struct Scsi_Host *shost, int 
reason)
                for (i = 0 ; i < instance->max_scsi_cmds; i++) {
                        cmd_fusion = fusion->cmd_list[i];
                        /*check for extra commands issued by driver*/
-                       if (instance->is_ventura) {
+                       if (instance->adapter_type == VENTURA_SERIES) {
                                r1_cmd = fusion->cmd_list[i + 
instance->max_fw_cmds];
                                megasas_return_cmd_fusion(instance, r1_cmd);
                        }
@@ -4334,7 +4330,7 @@ int megasas_reset_fusion(struct Scsi_Host *shost, int 
reason)
                                megasas_set_dynamic_target_properties(sdev);
 
                        /* reset stream detection array */
-                       if (instance->is_ventura) {
+                       if (instance->adapter_type == VENTURA_SERIES) {
                                for (j = 0; j < MAX_LOGICAL_DRIVES_EXT; ++j) {
                                        memset(fusion->stream_detect_by_ld[j],
                                        0, sizeof(struct LD_STREAM_DETECT));
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.h 
b/drivers/scsi/megaraid/megaraid_sas_fusion.h
index d78d76112501..7c1f7ccf031d 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h
@@ -104,12 +104,6 @@ enum MR_RAID_FLAGS_IO_SUB_TYPE {
 #define RAID_1_PEER_CMDS 2
 #define JBOD_MAPS_COUNT        2
 
-enum MR_FUSION_ADAPTER_TYPE {
-       THUNDERBOLT_SERIES = 0,
-       INVADER_SERIES = 1,
-       VENTURA_SERIES = 2,
-};
-
 /*
  * Raid Context structure which describes MegaRAID specific IO Parameters
  * This resides at offset 0x60 where the SGL normally starts in MPT IO Frames
@@ -1319,7 +1313,6 @@ struct fusion_context {
        struct LD_LOAD_BALANCE_INFO *load_balance_info;
        u32 load_balance_info_pages;
        LD_SPAN_INFO log_to_span[MAX_LOGICAL_DRIVES_EXT];
-       u8 adapter_type;
        struct LD_STREAM_DETECT **stream_detect_by_ld;
 };
 
diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c 
b/drivers/staging/rtl8723bs/core/rtw_ap.c
index d3007c1c45e3..a84400f07a38 100644
--- a/drivers/staging/rtl8723bs/core/rtw_ap.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
@@ -1059,7 +1059,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 
*pbuf,  int len)
                return _FAIL;
 
 
-       if (len > MAX_IE_SZ)
+       if (len < 0 || len > MAX_IE_SZ)
                return _FAIL;
 
        pbss_network->IELength = len;
diff --git a/drivers/staging/rtlwifi/rtl8822be/hw.c 
b/drivers/staging/rtlwifi/rtl8822be/hw.c
index 74386003044f..c6db2bd20594 100644
--- a/drivers/staging/rtlwifi/rtl8822be/hw.c
+++ b/drivers/staging/rtlwifi/rtl8822be/hw.c
@@ -814,7 +814,7 @@ static void _rtl8822be_enable_aspm_back_door(struct 
ieee80211_hw *hw)
                return;
 
        pci_read_config_byte(rtlpci->pdev, 0x70f, &tmp);
-       pci_write_config_byte(rtlpci->pdev, 0x70f, tmp | BIT(7));
+       pci_write_config_byte(rtlpci->pdev, 0x70f, tmp | ASPM_L1_LATENCY << 3);
 
        pci_read_config_byte(rtlpci->pdev, 0x719, &tmp);
        pci_write_config_byte(rtlpci->pdev, 0x719, tmp | BIT(3) | BIT(4));
diff --git a/drivers/staging/rtlwifi/wifi.h b/drivers/staging/rtlwifi/wifi.h
index eb91c130b245..5f0bc363ad41 100644
--- a/drivers/staging/rtlwifi/wifi.h
+++ b/drivers/staging/rtlwifi/wifi.h
@@ -99,6 +99,7 @@
 #define RTL_USB_MAX_RX_COUNT                   100
 #define QBSS_LOAD_SIZE                         5
 #define MAX_WMMELE_LENGTH                      64
+#define ASPM_L1_LATENCY                                7
 
 #define TOTAL_CAM_ENTRY                                32
 
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 40ce175655e6..99f67764765f 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -231,6 +231,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Corsair K70 RGB */
        { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
+       /* Corsair Strafe */
+       { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT |
+         USB_QUIRK_DELAY_CTRL_MSG },
+
        /* Corsair Strafe RGB */
        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
          USB_QUIRK_DELAY_CTRL_MSG },
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 00b710016d21..b7b55eb82714 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -604,7 +604,7 @@ struct xhci_ring *xhci_stream_id_to_ring(
        if (!ep->stream_info)
                return NULL;
 
-       if (stream_id > ep->stream_info->num_streams)
+       if (stream_id >= ep->stream_info->num_streams)
                return NULL;
        return ep->stream_info->stream_rings[stream_id];
 }
diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
index 58abdf28620a..47763311a42e 100644
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -400,8 +400,7 @@ static ssize_t yurex_read(struct file *file, char __user 
*buffer, size_t count,
                          loff_t *ppos)
 {
        struct usb_yurex *dev;
-       int retval = 0;
-       int bytes_read = 0;
+       int len = 0;
        char in_buffer[20];
        unsigned long flags;
 
@@ -409,26 +408,16 @@ static ssize_t yurex_read(struct file *file, char __user 
*buffer, size_t count,
 
        mutex_lock(&dev->io_mutex);
        if (!dev->interface) {          /* already disconnected */
-               retval = -ENODEV;
-               goto exit;
+               mutex_unlock(&dev->io_mutex);
+               return -ENODEV;
        }
 
        spin_lock_irqsave(&dev->lock, flags);
-       bytes_read = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
+       len = snprintf(in_buffer, 20, "%lld\n", dev->bbu);
        spin_unlock_irqrestore(&dev->lock, flags);
-
-       if (*ppos < bytes_read) {
-               if (copy_to_user(buffer, in_buffer + *ppos, bytes_read - *ppos))
-                       retval = -EFAULT;
-               else {
-                       retval = bytes_read - *ppos;
-                       *ppos += bytes_read;
-               }
-       }
-
-exit:
        mutex_unlock(&dev->io_mutex);
-       return retval;
+
+       return simple_read_from_buffer(buffer, count, ppos, in_buffer, len);
 }
 
 static ssize_t yurex_write(struct file *file, const char __user *user_buffer,
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 351745aec0e1..578596d301b8 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -131,7 +131,7 @@ static int ch341_control_in(struct usb_device *dev,
        r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request,
                            USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
                            value, index, buf, bufsize, DEFAULT_TIMEOUT);
-       if (r < bufsize) {
+       if (r < (int)bufsize) {
                if (r >= 0) {
                        dev_err(&dev->dev,
                                "short control message received (%d < %u)\n",
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 142a83e5974c..c931ae689a91 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -152,6 +152,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
        { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
        { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor 
Bridge Controller */
+       { USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */
        { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
        { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long 
Range */
        { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 196908dd25a1..f8e8285663a6 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -373,8 +373,10 @@ static int keyspan_pda_get_modem_info(struct usb_serial 
*serial,
                             3, /* get pins */
                             USB_TYPE_VENDOR|USB_RECIP_INTERFACE|USB_DIR_IN,
                             0, 0, data, 1, 2000);
-       if (rc >= 0)
+       if (rc == 1)
                *value = *data;
+       else if (rc >= 0)
+               rc = -EIO;
 
        kfree(data);
        return rc;
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index e8669aae14b3..5e490177cf75 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -481,6 +481,9 @@ static void mos7840_control_callback(struct urb *urb)
        }
 
        dev_dbg(dev, "%s urb buffer size is %d\n", __func__, 
urb->actual_length);
+       if (urb->actual_length < 1)
+               goto out;
+
        dev_dbg(dev, "%s mos7840_port->MsrLsr is %d port %d\n", __func__,
                mos7840_port->MsrLsr, mos7840_port->port_num);
        data = urb->transfer_buffer;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 73b01e474fdc..c0e3f91e28e9 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1235,9 +1235,8 @@ static int load_elf_library(struct file *file)
                goto out_free_ph;
        }
 
-       len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
-                           ELF_MIN_ALIGN - 1);
-       bss = eppnt->p_memsz + eppnt->p_vaddr;
+       len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);
+       bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);
        if (bss > len) {
                error = vm_brk(len, bss - len);
                if (error)
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index e31d6ed3ec32..542364bf923e 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -138,10 +138,6 @@ static int devpts_ptmx_path(struct path *path)
        struct super_block *sb;
        int err;
 
-       /* Has the devpts filesystem already been found? */
-       if (path->mnt->mnt_sb->s_magic == DEVPTS_SUPER_MAGIC)
-               return 0;
-
        /* Is a devpts filesystem at "pts" in the same directory? */
        err = path_pts(path);
        if (err)
@@ -159,22 +155,32 @@ static int devpts_ptmx_path(struct path *path)
 struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi)
 {
        struct path path;
-       int err;
+       int err = 0;
 
        path = filp->f_path;
        path_get(&path);
 
-       err = devpts_ptmx_path(&path);
+       /* Walk upward while the start point is a bind mount of
+        * a single file.
+        */
+       while (path.mnt->mnt_root == path.dentry)
+               if (follow_up(&path) == 0)
+                       break;
+
+       /* devpts_ptmx_path() finds a devpts fs or returns an error. */
+       if ((path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) ||
+           (DEVPTS_SB(path.mnt->mnt_sb) != fsi))
+               err = devpts_ptmx_path(&path);
        dput(path.dentry);
-       if (err) {
-               mntput(path.mnt);
-               return ERR_PTR(err);
-       }
-       if (DEVPTS_SB(path.mnt->mnt_sb) != fsi) {
-               mntput(path.mnt);
-               return ERR_PTR(-ENODEV);
+       if (!err) {
+               if (DEVPTS_SB(path.mnt->mnt_sb) == fsi)
+                       return path.mnt;
+
+               err = -ENODEV;
        }
-       return path.mnt;
+
+       mntput(path.mnt);
+       return ERR_PTR(err);
 }
 
 struct pts_fs_info *devpts_acquire(struct file *filp)
@@ -182,15 +188,19 @@ struct pts_fs_info *devpts_acquire(struct file *filp)
        struct pts_fs_info *result;
        struct path path;
        struct super_block *sb;
-       int err;
 
        path = filp->f_path;
        path_get(&path);
 
-       err = devpts_ptmx_path(&path);
-       if (err) {
-               result = ERR_PTR(err);
-               goto out;
+       /* Has the devpts filesystem already been found? */
+       if (path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) {
+               int err;
+
+               err = devpts_ptmx_path(&path);
+               if (err) {
+                       result = ERR_PTR(err);
+                       goto out;
+               }
        }
 
        /*
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 4b4a72f392be..3b34004a71c1 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1470,18 +1470,6 @@ static inline bool __exist_node_summaries(struct 
f2fs_sb_info *sbi)
                        is_set_ckpt_flags(sbi, CP_FASTBOOT_FLAG));
 }
 
-/*
- * Check whether the given nid is within node id range.
- */
-static inline int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
-{
-       if (unlikely(nid < F2FS_ROOT_INO(sbi)))
-               return -EINVAL;
-       if (unlikely(nid >= NM_I(sbi)->max_nid))
-               return -EINVAL;
-       return 0;
-}
-
 /*
  * Check whether the inode has blocks or not
  */
@@ -2470,6 +2458,7 @@ f2fs_hash_t f2fs_dentry_hash(const struct qstr *name_info,
 struct dnode_of_data;
 struct node_info;
 
+int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid);
 bool available_free_memory(struct f2fs_sb_info *sbi, int type);
 int need_dentry_mark(struct f2fs_sb_info *sbi, nid_t nid);
 bool is_checkpointed_node(struct f2fs_sb_info *sbi, nid_t nid);
diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index 50c88e37ed66..259b0aa283f0 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -188,12 +188,8 @@ static int do_read_inode(struct inode *inode)
        projid_t i_projid;
 
        /* Check if ino is within scope */
-       if (check_nid_range(sbi, inode->i_ino)) {
-               f2fs_msg(inode->i_sb, KERN_ERR, "bad inode number: %lu",
-                        (unsigned long) inode->i_ino);
-               WARN_ON(1);
+       if (check_nid_range(sbi, inode->i_ino))
                return -EINVAL;
-       }
 
        node_page = get_node_page(sbi, inode->i_ino);
        if (IS_ERR(node_page))
@@ -538,8 +534,11 @@ void f2fs_evict_inode(struct inode *inode)
                alloc_nid_failed(sbi, inode->i_ino);
                clear_inode_flag(inode, FI_FREE_NID);
        } else {
-               f2fs_bug_on(sbi, err &&
-                       !exist_written_data(sbi, inode->i_ino, ORPHAN_INO));
+               /*
+                * If xattr nid is corrupted, we can reach out error condition,
+                * err & !exist_written_data(sbi, inode->i_ino, ORPHAN_INO)).
+                * In that case, check_nid_range() is enough to give a clue.
+                */
        }
 out_clear:
        fscrypt_put_encryption_info(inode, NULL);
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index fca87835a1da..f623da26159f 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -29,6 +29,21 @@ static struct kmem_cache *nat_entry_slab;
 static struct kmem_cache *free_nid_slab;
 static struct kmem_cache *nat_entry_set_slab;
 
+/*
+ * Check whether the given nid is within node id range.
+ */
+int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid)
+{
+       if (unlikely(nid < F2FS_ROOT_INO(sbi) || nid >= NM_I(sbi)->max_nid)) {
+               set_sbi_flag(sbi, SBI_NEED_FSCK);
+               f2fs_msg(sbi->sb, KERN_WARNING,
+                               "%s: out-of-range nid=%x, run fsck to fix.",
+                               __func__, nid);
+               return -EINVAL;
+       }
+       return 0;
+}
+
 bool available_free_memory(struct f2fs_sb_info *sbi, int type)
 {
        struct f2fs_nm_info *nm_i = NM_I(sbi);
@@ -1122,7 +1137,8 @@ void ra_node_page(struct f2fs_sb_info *sbi, nid_t nid)
 
        if (!nid)
                return;
-       f2fs_bug_on(sbi, check_nid_range(sbi, nid));
+       if (check_nid_range(sbi, nid))
+               return;
 
        rcu_read_lock();
        apage = radix_tree_lookup(&NODE_MAPPING(sbi)->page_tree, nid);
@@ -1146,7 +1162,8 @@ static struct page *__get_node_page(struct f2fs_sb_info 
*sbi, pgoff_t nid,
 
        if (!nid)
                return ERR_PTR(-ENOENT);
-       f2fs_bug_on(sbi, check_nid_range(sbi, nid));
+       if (check_nid_range(sbi, nid))
+               return ERR_PTR(-EINVAL);
 repeat:
        page = f2fs_grab_cache_page(NODE_MAPPING(sbi), nid, false);
        if (!page)
diff --git a/fs/inode.c b/fs/inode.c
index e07b3e1f5970..cfc36d11bcb3 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -2006,8 +2006,14 @@ void inode_init_owner(struct inode *inode, const struct 
inode *dir,
        inode->i_uid = current_fsuid();
        if (dir && dir->i_mode & S_ISGID) {
                inode->i_gid = dir->i_gid;
+
+               /* Directories are special, and always inherit S_ISGID */
                if (S_ISDIR(mode))
                        mode |= S_ISGID;
+               else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) &&
+                        !in_group_p(inode->i_gid) &&
+                        !capable_wrt_inode_uidgid(dir, CAP_FSETID))
+                       mode &= ~S_ISGID;
        } else
                inode->i_gid = current_fsgid();
        inode->i_mode = mode;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 4cd8328e4039..6f337fff38c4 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -850,7 +850,7 @@ static int show_smap(struct seq_file *m, void *v, int 
is_pid)
                           mss->private_hugetlb >> 10,
                           mss->swap >> 10,
                           (unsigned long)(mss->swap_pss >> (10 + PSS_SHIFT)),
-                          (unsigned long)(mss->pss >> (10 + PSS_SHIFT)));
+                          (unsigned long)(mss->pss_locked >> (10 + 
PSS_SHIFT)));
 
        if (!rollup_mode) {
                arch_show_smap(m, vma);
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 931c32f1f18d..c5188dc389c8 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -211,6 +211,7 @@ enum {
        ATA_FLAG_SLAVE_POSS     = (1 << 0), /* host supports slave dev */
                                            /* (doesn't imply presence) */
        ATA_FLAG_SATA           = (1 << 1),
+       ATA_FLAG_NO_LPM         = (1 << 2), /* host not happy with LPM */
        ATA_FLAG_NO_LOG_PAGE    = (1 << 5), /* do not issue log page read */
        ATA_FLAG_NO_ATAPI       = (1 << 6), /* No ATAPI support */
        ATA_FLAG_PIO_DMA        = (1 << 7), /* PIO cmds via DMA */
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index e12d35108225..a37a3b4b6342 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -39,7 +39,7 @@ static void irq_spread_init_one(struct cpumask *irqmsk, 
struct cpumask *nmsk,
        }
 }
 
-static cpumask_var_t *alloc_node_to_present_cpumask(void)
+static cpumask_var_t *alloc_node_to_possible_cpumask(void)
 {
        cpumask_var_t *masks;
        int node;
@@ -62,7 +62,7 @@ static cpumask_var_t *alloc_node_to_present_cpumask(void)
        return NULL;
 }
 
-static void free_node_to_present_cpumask(cpumask_var_t *masks)
+static void free_node_to_possible_cpumask(cpumask_var_t *masks)
 {
        int node;
 
@@ -71,22 +71,22 @@ static void free_node_to_present_cpumask(cpumask_var_t 
*masks)
        kfree(masks);
 }
 
-static void build_node_to_present_cpumask(cpumask_var_t *masks)
+static void build_node_to_possible_cpumask(cpumask_var_t *masks)
 {
        int cpu;
 
-       for_each_present_cpu(cpu)
+       for_each_possible_cpu(cpu)
                cpumask_set_cpu(cpu, masks[cpu_to_node(cpu)]);
 }
 
-static int get_nodes_in_cpumask(cpumask_var_t *node_to_present_cpumask,
+static int get_nodes_in_cpumask(cpumask_var_t *node_to_possible_cpumask,
                                const struct cpumask *mask, nodemask_t *nodemsk)
 {
        int n, nodes = 0;
 
        /* Calculate the number of nodes in the supplied affinity mask */
        for_each_node(n) {
-               if (cpumask_intersects(mask, node_to_present_cpumask[n])) {
+               if (cpumask_intersects(mask, node_to_possible_cpumask[n])) {
                        node_set(n, *nodemsk);
                        nodes++;
                }
@@ -109,7 +109,7 @@ irq_create_affinity_masks(int nvecs, const struct 
irq_affinity *affd)
        int last_affv = affv + affd->pre_vectors;
        nodemask_t nodemsk = NODE_MASK_NONE;
        struct cpumask *masks;
-       cpumask_var_t nmsk, *node_to_present_cpumask;
+       cpumask_var_t nmsk, *node_to_possible_cpumask;
 
        /*
         * If there aren't any vectors left after applying the pre/post
@@ -125,8 +125,8 @@ irq_create_affinity_masks(int nvecs, const struct 
irq_affinity *affd)
        if (!masks)
                goto out;
 
-       node_to_present_cpumask = alloc_node_to_present_cpumask();
-       if (!node_to_present_cpumask)
+       node_to_possible_cpumask = alloc_node_to_possible_cpumask();
+       if (!node_to_possible_cpumask)
                goto out;
 
        /* Fill out vectors at the beginning that don't need affinity */
@@ -135,8 +135,8 @@ irq_create_affinity_masks(int nvecs, const struct 
irq_affinity *affd)
 
        /* Stabilize the cpumasks */
        get_online_cpus();
-       build_node_to_present_cpumask(node_to_present_cpumask);
-       nodes = get_nodes_in_cpumask(node_to_present_cpumask, cpu_present_mask,
+       build_node_to_possible_cpumask(node_to_possible_cpumask);
+       nodes = get_nodes_in_cpumask(node_to_possible_cpumask, 
cpu_possible_mask,
                                     &nodemsk);
 
        /*
@@ -146,7 +146,7 @@ irq_create_affinity_masks(int nvecs, const struct 
irq_affinity *affd)
        if (affv <= nodes) {
                for_each_node_mask(n, nodemsk) {
                        cpumask_copy(masks + curvec,
-                                    node_to_present_cpumask[n]);
+                                    node_to_possible_cpumask[n]);
                        if (++curvec == last_affv)
                                break;
                }
@@ -160,7 +160,7 @@ irq_create_affinity_masks(int nvecs, const struct 
irq_affinity *affd)
                vecs_per_node = (affv - (curvec - affd->pre_vectors)) / nodes;
 
                /* Get the cpus on this node which are in the mask */
-               cpumask_and(nmsk, cpu_present_mask, node_to_present_cpumask[n]);
+               cpumask_and(nmsk, cpu_possible_mask, 
node_to_possible_cpumask[n]);
 
                /* Calculate the number of cpus per vector */
                ncpus = cpumask_weight(nmsk);
@@ -192,7 +192,7 @@ irq_create_affinity_masks(int nvecs, const struct 
irq_affinity *affd)
        /* Fill out vectors at the end that don't need affinity */
        for (; curvec < nvecs; curvec++)
                cpumask_copy(masks + curvec, irq_default_affinity);
-       free_node_to_present_cpumask(node_to_present_cpumask);
+       free_node_to_possible_cpumask(node_to_possible_cpumask);
 out:
        free_cpumask_var(nmsk);
        return masks;
@@ -214,7 +214,7 @@ int irq_calc_affinity_vectors(int minvec, int maxvec, const 
struct irq_affinity
                return 0;
 
        get_online_cpus();
-       ret = min_t(int, cpumask_weight(cpu_present_mask), vecs) + resv;
+       ret = min_t(int, cpumask_weight(cpu_possible_mask), vecs) + resv;
        put_online_cpus();
        return ret;
 }
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 22df9f7ff672..69017a569f30 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -186,6 +186,11 @@ static ssize_t snapshot_write(struct file *filp, const 
char __user *buf,
                res = PAGE_SIZE - pg_offp;
        }
 
+       if (!data_of(data->handle)) {
+               res = -EINVAL;
+               goto unlock;
+       }
+
        res = simple_write_to_buffer(data_of(data->handle), res, &pg_offp,
                        buf, count);
        if (res > 0)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 520ecaf61dc4..e268750bd4ad 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3359,8 +3359,8 @@ static void print_func_help_header(struct trace_buffer 
*buf, struct seq_file *m,
 
        print_event_info(buf, m);
 
-       seq_printf(m, "#           TASK-PID   CPU#   %s  TIMESTAMP  
FUNCTION\n", tgid ? "TGID     " : "");
-       seq_printf(m, "#              | |       |    %s     |         |\n",     
 tgid ? "  |      " : "");
+       seq_printf(m, "#           TASK-PID   %s  CPU#   TIMESTAMP  
FUNCTION\n", tgid ? "TGID     " : "");
+       seq_printf(m, "#              | |     %s    |       |         |\n",     
 tgid ? "  |      " : "");
 }
 
 static void print_func_help_header_irq(struct trace_buffer *buf, struct 
seq_file *m,
@@ -3380,9 +3380,9 @@ static void print_func_help_header_irq(struct 
trace_buffer *buf, struct seq_file
                   tgid ? tgid_space : space);
        seq_printf(m, "#                          %s||| /     delay\n",
                   tgid ? tgid_space : space);
-       seq_printf(m, "#           TASK-PID   CPU#%s||||    TIMESTAMP  
FUNCTION\n",
+       seq_printf(m, "#           TASK-PID %sCPU#  ||||    TIMESTAMP  
FUNCTION\n",
                   tgid ? "   TGID   " : space);
-       seq_printf(m, "#              | |       | %s||||       |         |\n",
+       seq_printf(m, "#              | |   %s  |   ||||       |         |\n",
                   tgid ? "     |    " : space);
 }
 
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index c738e764e2a5..4500b00e4e36 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -594,8 +594,7 @@ int trace_print_context(struct trace_iterator *iter)
 
        trace_find_cmdline(entry->pid, comm);
 
-       trace_seq_printf(s, "%16s-%-5d [%03d] ",
-                              comm, entry->pid, iter->cpu);
+       trace_seq_printf(s, "%16s-%-5d ", comm, entry->pid);
 
        if (tr->trace_flags & TRACE_ITER_RECORD_TGID) {
                unsigned int tgid = trace_find_tgid(entry->pid);
@@ -606,6 +605,8 @@ int trace_print_context(struct trace_iterator *iter)
                        trace_seq_printf(s, "(%5d) ", tgid);
        }
 
+       trace_seq_printf(s, "[%03d] ", iter->cpu);
+
        if (tr->trace_flags & TRACE_ITER_IRQ_INFO)
                trace_print_lat_fmt(s, entry);
 
diff --git a/mm/gup.c b/mm/gup.c
index 72c921da0f3b..4cc8a6ff0f56 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1235,8 +1235,6 @@ int __mm_populate(unsigned long start, unsigned long len, 
int ignore_errors)
        int locked = 0;
        long ret = 0;
 
-       VM_BUG_ON(start & ~PAGE_MASK);
-       VM_BUG_ON(len != PAGE_ALIGN(len));
        end = start + len;
 
        for (nstart = start; nstart < end; nstart = nend) {
diff --git a/mm/mmap.c b/mm/mmap.c
index f858b1f336af..2398776195d2 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -177,8 +177,8 @@ static struct vm_area_struct *remove_vma(struct 
vm_area_struct *vma)
        return next;
 }
 
-static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf);
-
+static int do_brk_flags(unsigned long addr, unsigned long request, unsigned 
long flags,
+               struct list_head *uf);
 SYSCALL_DEFINE1(brk, unsigned long, brk)
 {
        unsigned long retval;
@@ -236,7 +236,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
                goto out;
 
        /* Ok, looks good - let it rip. */
-       if (do_brk(oldbrk, newbrk-oldbrk, &uf) < 0)
+       if (do_brk_flags(oldbrk, newbrk-oldbrk, 0, &uf) < 0)
                goto out;
 
 set_brk:
@@ -2887,21 +2887,14 @@ static inline void verify_mm_writelocked(struct 
mm_struct *mm)
  *  anonymous maps.  eventually we may be able to do some
  *  brk-specific accounting here.
  */
-static int do_brk_flags(unsigned long addr, unsigned long request, unsigned 
long flags, struct list_head *uf)
+static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long 
flags, struct list_head *uf)
 {
        struct mm_struct *mm = current->mm;
        struct vm_area_struct *vma, *prev;
-       unsigned long len;
        struct rb_node **rb_link, *rb_parent;
        pgoff_t pgoff = addr >> PAGE_SHIFT;
        int error;
 
-       len = PAGE_ALIGN(request);
-       if (len < request)
-               return -ENOMEM;
-       if (!len)
-               return 0;
-
        /* Until we need other flags, refuse anything except VM_EXEC. */
        if ((flags & (~VM_EXEC)) != 0)
                return -EINVAL;
@@ -2973,18 +2966,20 @@ static int do_brk_flags(unsigned long addr, unsigned 
long request, unsigned long
        return 0;
 }
 
-static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf)
-{
-       return do_brk_flags(addr, len, 0, uf);
-}
-
-int vm_brk_flags(unsigned long addr, unsigned long len, unsigned long flags)
+int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long 
flags)
 {
        struct mm_struct *mm = current->mm;
+       unsigned long len;
        int ret;
        bool populate;
        LIST_HEAD(uf);
 
+       len = PAGE_ALIGN(request);
+       if (len < request)
+               return -ENOMEM;
+       if (!len)
+               return 0;
+
        if (down_write_killable(&mm->mmap_sem))
                return -EINTR;
 
diff --git a/mm/rmap.c b/mm/rmap.c
index b874c4761e84..97edcf44d88c 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -64,6 +64,7 @@
 #include <linux/backing-dev.h>
 #include <linux/page_idle.h>
 #include <linux/memremap.h>
+#include <linux/userfaultfd_k.h>
 
 #include <asm/tlbflush.h>
 
@@ -1476,11 +1477,16 @@ static bool try_to_unmap_one(struct page *page, struct 
vm_area_struct *vma,
                                set_pte_at(mm, address, pvmw.pte, pteval);
                        }
 
-               } else if (pte_unused(pteval)) {
+               } else if (pte_unused(pteval) && !userfaultfd_armed(vma)) {
                        /*
                         * The guest indicated that the page content is of no
                         * interest anymore. Simply discard the pte, vmscan
                         * will take care of the rest.
+                        * A future reference will then fault in a new zero
+                        * page. When userfaultfd is active, we must not drop
+                        * this page though, as its main user (postcopy
+                        * migration) will not expect userfaults on already
+                        * copied pages.
                         */
                        dec_mm_counter(mm, mm_counter(page));
                } else if (IS_ENABLED(CONFIG_MIGRATION) &&
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index e27fb6e97d18..25738b20676d 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -696,6 +696,8 @@ ebt_check_entry(struct ebt_entry *e, struct net *net,
        }
        i = 0;
 
+       memset(&mtpar, 0, sizeof(mtpar));
+       memset(&tgpar, 0, sizeof(tgpar));
        mtpar.net       = tgpar.net       = net;
        mtpar.table     = tgpar.table     = name;
        mtpar.entryinfo = tgpar.entryinfo = e;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 1a925f2394ad..114d4bef1bec 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -541,6 +541,7 @@ find_check_entry(struct ipt_entry *e, struct net *net, 
const char *name,
                return -ENOMEM;
 
        j = 0;
+       memset(&mtpar, 0, sizeof(mtpar));
        mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index c5fe42e6b7f7..2e51e0156903 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -561,6 +561,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, 
const char *name,
                return -ENOMEM;
 
        j = 0;
+       memset(&mtpar, 0, sizeof(mtpar));
        mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ipv6;
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index c9796629858f..02bbc2f9f1f1 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1228,6 +1228,9 @@ static int nfqnl_recv_unsupp(struct net *net, struct sock 
*ctnl,
 static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = {
        [NFQA_CFG_CMD]          = { .len = sizeof(struct nfqnl_msg_config_cmd) 
},
        [NFQA_CFG_PARAMS]       = { .len = sizeof(struct 
nfqnl_msg_config_params) },
+       [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 },
+       [NFQA_CFG_MASK]         = { .type = NLA_U32 },
+       [NFQA_CFG_FLAGS]        = { .type = NLA_U32 },
 };
 
 static const struct nf_queue_handler nfqh = {
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index 7d7eb1354eee..ffb6aba71998 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -33,6 +33,7 @@
 #include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/pm_runtime.h>
 #include <sound/core.h>
 #include <sound/jack.h>
 #include <sound/asoundef.h>
@@ -764,8 +765,10 @@ static void check_presence_and_report(struct hda_codec 
*codec, hda_nid_t nid,
 
        if (pin_idx < 0)
                return;
+       mutex_lock(&spec->pcm_lock);
        if (hdmi_present_sense(get_pin(spec, pin_idx), 1))
                snd_hda_jack_report_sync(codec);
+       mutex_unlock(&spec->pcm_lock);
 }
 
 static void jack_callback(struct hda_codec *codec,
@@ -1628,21 +1631,23 @@ static void sync_eld_via_acomp(struct hda_codec *codec,
 static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
 {
        struct hda_codec *codec = per_pin->codec;
-       struct hdmi_spec *spec = codec->spec;
        int ret;
 
        /* no temporary power up/down needed for component notifier */
-       if (!codec_has_acomp(codec))
-               snd_hda_power_up_pm(codec);
+       if (!codec_has_acomp(codec)) {
+               ret = snd_hda_power_up_pm(codec);
+               if (ret < 0 && pm_runtime_suspended(hda_codec_dev(codec))) {
+                       snd_hda_power_down_pm(codec);
+                       return false;
+               }
+       }
 
-       mutex_lock(&spec->pcm_lock);
        if (codec_has_acomp(codec)) {
                sync_eld_via_acomp(codec, per_pin);
                ret = false; /* don't call snd_hda_jack_report_sync() */
        } else {
                ret = hdmi_present_sense_via_verbs(per_pin, repoll);
        }
-       mutex_unlock(&spec->pcm_lock);
 
        if (!codec_has_acomp(codec))
                snd_hda_power_down_pm(codec);
@@ -1654,12 +1659,16 @@ static void hdmi_repoll_eld(struct work_struct *work)
 {
        struct hdmi_spec_per_pin *per_pin =
        container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work);
+       struct hda_codec *codec = per_pin->codec;
+       struct hdmi_spec *spec = codec->spec;
 
        if (per_pin->repoll_count++ > 6)
                per_pin->repoll_count = 0;
 
+       mutex_lock(&spec->pcm_lock);
        if (hdmi_present_sense(per_pin, per_pin->repoll_count))
                snd_hda_jack_report_sync(per_pin->codec);
+       mutex_unlock(&spec->pcm_lock);
 }
 
 static void intel_haswell_fixup_connect_list(struct hda_codec *codec,
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 02157e3d82bb..bf7737fc3b28 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6445,7 +6445,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", 
ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", 
ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", 
ALC294_FIXUP_LENOVO_MIC_LOCATION),
-       SND_PCI_QUIRK(0x17aa, 0x3136, "ThinkCentre Station", 
ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", 
ALC294_FIXUP_LENOVO_MIC_LOCATION),
        SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", 
ALC269_FIXUP_DMIC_THINKPAD_ACPI),
        SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
@@ -6628,6 +6627,11 @@ static const struct snd_hda_pin_quirk 
alc269_pin_fixup_tbl[] = {
                {0x1a, 0x02a11040},
                {0x1b, 0x01014020},
                {0x21, 0x0221101f}),
+       SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", 
ALC294_FIXUP_LENOVO_MIC_LOCATION,
+               {0x14, 0x90170110},
+               {0x19, 0x02a11020},
+               {0x1a, 0x02a11030},
+               {0x21, 0x0221101f}),
        SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", 
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                {0x12, 0x90a60140},
                {0x14, 0x90170150},
diff --git a/sound/soc/mediatek/common/mtk-afe-platform-driver.c 
b/sound/soc/mediatek/common/mtk-afe-platform-driver.c
index 82d439c15f4e..e58fbefa5e6b 100644
--- a/sound/soc/mediatek/common/mtk-afe-platform-driver.c
+++ b/sound/soc/mediatek/common/mtk-afe-platform-driver.c
@@ -63,13 +63,13 @@ static const struct snd_pcm_ops mtk_afe_pcm_ops = {
 static int mtk_afe_pcm_new(struct snd_soc_pcm_runtime *rtd)
 {
        size_t size;
-       struct snd_card *card = rtd->card->snd_card;
        struct snd_pcm *pcm = rtd->pcm;
        struct mtk_base_afe *afe = snd_soc_platform_get_drvdata(rtd->platform);
 
        size = afe->mtk_afe_hardware->buffer_bytes_max;
        return snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
-                                                    card->dev, size, size);
+                                                    rtd->platform->dev,
+                                                    size, size);
 }
 
 static void mtk_afe_pcm_free(struct snd_pcm *pcm)
diff --git a/tools/build/Build.include b/tools/build/Build.include
index a4bbb984941d..d9048f145f97 100644
--- a/tools/build/Build.include
+++ b/tools/build/Build.include
@@ -63,8 +63,8 @@ dep-cmd = $(if $(wildcard $(fixdep)),
            $(fixdep) $(depfile) $@ '$(make-cmd)' > $(dot-target).tmp;          
 \
            rm -f $(depfile);                                                   
 \
            mv -f $(dot-target).tmp $(dot-target).cmd,                          
 \
-           printf '\# cannot find fixdep (%s)\n' $(fixdep) > 
$(dot-target).cmd; \
-           printf '\# using basic dep data\n\n' >> $(dot-target).cmd;          
 \
+           printf '$(pound) cannot find fixdep (%s)\n' $(fixdep) > 
$(dot-target).cmd; \
+           printf '$(pound) using basic dep data\n\n' >> $(dot-target).cmd;    
       \
            cat $(depfile) >> $(dot-target).cmd;                                
 \
            printf '\n%s\n' 'cmd_$@ := $(make-cmd)' >> $(dot-target).cmd)
 

Reply via email to