Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

294 files changed, 2894 insertions, 1326 deletions

diff --git a/Documentation/acpi/acpi-lid.txt b/Documentation/acpi/acpi-lid.txt
index 22cb3091f297..effe7af3a5af 100644
--- a/Documentation/acpi/acpi-lid.txt
+++ b/Documentation/acpi/acpi-lid.txt
@@ -59,20 +59,28 @@ button driver uses the following 3 modes in order not to trigger issues.
 If the userspace hasn't been prepared to ignore the unreliable "opened"
 events and the unreliable initial state notification, Linux users can use
 the following kernel parameters to handle the possible issues:
-A. button.lid_init_state=open:
+A. button.lid_init_state=method:
+   When this option is specified, the ACPI button driver reports the
+   initial lid state using the returning value of the _LID control method
+   and whether the "opened"/"closed" events are paired fully relies on the
+   firmware implementation.
+   This option can be used to fix some platforms where the returning value
+   of the _LID control method is reliable but the initial lid state
+   notification is missing.
+   This option is the default behavior during the period the userspace
+   isn't ready to handle the buggy AML tables.
+B. button.lid_init_state=open:
    When this option is specified, the ACPI button driver always reports the
    initial lid state as "opened" and whether the "opened"/"closed" events
    are paired fully relies on the firmware implementation.
    This may fix some platforms where the returning value of the _LID
    control method is not reliable and the initial lid state notification is
    missing.
-   This option is the default behavior during the period the userspace
-   isn't ready to handle the buggy AML tables.
 
 If the userspace has been prepared to ignore the unreliable "opened" events
 and the unreliable initial state notification, Linux users should always
 use the following kernel parameter:
-B. button.lid_init_state=ignore:
+C. button.lid_init_state=ignore:
    When this option is specified, the ACPI button driver never reports the
    initial lid state and there is a compensation mechanism implemented to
    ensure that the reliable "closed" notifications can always be delievered
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index 289c80f7760e..09aa2e949787 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -1,4 +1,5 @@
 .. |struct cpufreq_policy| replace:: :c:type:`struct cpufreq_policy <cpufreq_policy>`
+.. |intel_pstate| replace:: :doc:`intel_pstate <intel_pstate>`
 
 =======================
 CPU Performance Scaling
@@ -75,7 +76,7 @@ feedback registers, as that information is typically specific to the hardware
 interface it comes from and may not be easily represented in an abstract,
 platform-independent way.  For this reason, ``CPUFreq`` allows scaling drivers
 to bypass the governor layer and implement their own performance scaling
-algorithms.  That is done by the ``intel_pstate`` scaling driver.
+algorithms.  That is done by the |intel_pstate| scaling driver.
 
 
 ``CPUFreq`` Policy Objects
@@ -174,13 +175,13 @@ necessary to restart the scaling governor so that it can take the new online CPU
 into account.  That is achieved by invoking the governor's ``->stop`` and
 ``->start()`` callbacks, in this order, for the entire policy.
 
-As mentioned before, the ``intel_pstate`` scaling driver bypasses the scaling
+As mentioned before, the |intel_pstate| scaling driver bypasses the scaling
 governor layer of ``CPUFreq`` and provides its own P-state selection algorithms.
-Consequently, if ``intel_pstate`` is used, scaling governors are not attached to
+Consequently, if |intel_pstate| is used, scaling governors are not attached to
 new policy objects.  Instead, the driver's ``->setpolicy()`` callback is invoked
 to register per-CPU utilization update callbacks for each policy.  These
 callbacks are invoked by the CPU scheduler in the same way as for scaling
-governors, but in the ``intel_pstate`` case they both determine the P-state to
+governors, but in the |intel_pstate| case they both determine the P-state to
 use and change the hardware configuration accordingly in one go from scheduler
 context.
 
@@ -257,7 +258,7 @@ are the following:
 
 ``scaling_available_governors``
         List of ``CPUFreq`` scaling governors present in the kernel that can
-        be attached to this policy or (if the ``intel_pstate`` scaling driver is
+        be attached to this policy or (if the |intel_pstate| scaling driver is
         in use) list of scaling algorithms provided by the driver that can be
         applied to this policy.
 
@@ -274,7 +275,7 @@ are the following:
         the CPU is actually running at (due to hardware design and other
         limitations).
 
-        Some scaling drivers (e.g. ``intel_pstate``) attempt to provide
+        Some scaling drivers (e.g. |intel_pstate|) attempt to provide
         information more precisely reflecting the current CPU frequency through
         this attribute, but that still may not be the exact current CPU
         frequency as seen by the hardware at the moment.
@@ -284,13 +285,13 @@ are the following:
 
 ``scaling_governor``
         The scaling governor currently attached to this policy or (if the
-        ``intel_pstate`` scaling driver is in use) the scaling algorithm
+        |intel_pstate| scaling driver is in use) the scaling algorithm
         provided by the driver that is currently applied to this policy.
 
         This attribute is read-write and writing to it will cause a new scaling
         governor to be attached to this policy or a new scaling algorithm
         provided by the scaling driver to be applied to it (in the
-        ``intel_pstate`` case), as indicated by the string written to this
+        |intel_pstate| case), as indicated by the string written to this
         attribute (which must be one of the names listed by the
         ``scaling_available_governors`` attribute described above).
 
@@ -619,7 +620,7 @@ This file is located under :file:`/sys/devices/system/cpu/cpufreq/` and controls
 the "boost" setting for the whole system.  It is not present if the underlying
 scaling driver does not support the frequency boost mechanism (or supports it,
 but provides a driver-specific interface for controlling it, like
-``intel_pstate``).
+|intel_pstate|).
 
 If the value in this file is 1, the frequency boost mechanism is enabled.  This
 means that either the hardware can be put into states in which it is able to
diff --git a/Documentation/admin-guide/pm/index.rst b/Documentation/admin-guide/pm/index.rst
index c80f087321fc..7f148f76f432 100644
--- a/Documentation/admin-guide/pm/index.rst
+++ b/Documentation/admin-guide/pm/index.rst
@@ -6,6 +6,7 @@ Power Management
    :maxdepth: 2
 
    cpufreq
+   intel_pstate
 
 .. only::  subproject and html
 
diff --git a/Documentation/admin-guide/pm/intel_pstate.rst b/Documentation/admin-guide/pm/intel_pstate.rst
new file mode 100644
index 000000000000..33d703989ea8
--- /dev/null
+++ b/Documentation/admin-guide/pm/intel_pstate.rst
@@ -0,0 +1,755 @@
+===============================================
+``intel_pstate`` CPU Performance Scaling Driver
+===============================================
+
+::
+
+ Copyright (c) 2017 Intel Corp., Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+
+General Information
+===================
+
+``intel_pstate`` is a part of the
+:doc:`CPU performance scaling subsystem <cpufreq>` in the Linux kernel
+(``CPUFreq``).  It is a scaling driver for the Sandy Bridge and later
+generations of Intel processors.  Note, however, that some of those processors
+may not be supported.  [To understand ``intel_pstate`` it is necessary to know
+how ``CPUFreq`` works in general, so this is the time to read :doc:`cpufreq` if
+you have not done that yet.]
+
+For the processors supported by ``intel_pstate``, the P-state concept is broader
+than just an operating frequency or an operating performance point (see the
+`LinuxCon Europe 2015 presentation by Kristen Accardi <LCEU2015_>`_ for more
+information about that).  For this reason, the representation of P-states used
+by ``intel_pstate`` internally follows the hardware specification (for details
+refer to `Intel® 64 and IA-32 Architectures Software Developer’s Manual
+Volume 3: System Programming Guide <SDM_>`_).  However, the ``CPUFreq`` core
+uses frequencies for identifying operating performance points of CPUs and
+frequencies are involved in the user space interface exposed by it, so
+``intel_pstate`` maps its internal representation of P-states to frequencies too
+(fortunately, that mapping is unambiguous).  At the same time, it would not be
+practical for ``intel_pstate`` to supply the ``CPUFreq`` core with a table of
+available frequencies due to the possible size of it, so the driver does not do
+that.  Some functionality of the core is limited by that.
+
+Since the hardware P-state selection interface used by ``intel_pstate`` is
+available at the logical CPU level, the driver always works with individual
+CPUs.  Consequently, if ``intel_pstate`` is in use, every ``CPUFreq`` policy
+object corresponds to one logical CPU and ``CPUFreq`` policies are effectively
+equivalent to CPUs.  In particular, this means that they become "inactive" every
+time the corresponding CPU is taken offline and need to be re-initialized when
+it goes back online.
+
+``intel_pstate`` is not modular, so it cannot be unloaded, which means that the
+only way to pass early-configuration-time parameters to it is via the kernel
+command line.  However, its configuration can be adjusted via ``sysfs`` to a
+great extent.  In some configurations it even is possible to unregister it via
+``sysfs`` which allows another ``CPUFreq`` scaling driver to be loaded and
+registered (see `below <status_attr_>`_).
+
+
+Operation Modes
+===============
+
+``intel_pstate`` can operate in three different modes: in the active mode with
+or without hardware-managed P-states support and in the passive mode.  Which of
+them will be in effect depends on what kernel command line options are used and
+on the capabilities of the processor.
+
+Active Mode
+-----------
+
+This is the default operation mode of ``intel_pstate``.  If it works in this
+mode, the ``scaling_driver`` policy attribute in ``sysfs`` for all ``CPUFreq``
+policies contains the string "intel_pstate".
+
+In this mode the driver bypasses the scaling governors layer of ``CPUFreq`` and
+provides its own scaling algorithms for P-state selection.  Those algorithms
+can be applied to ``CPUFreq`` policies in the same way as generic scaling
+governors (that is, through the ``scaling_governor`` policy attribute in
+``sysfs``).  [Note that different P-state selection algorithms may be chosen for
+different policies, but that is not recommended.]
+
+They are not generic scaling governors, but their names are the same as the
+names of some of those governors.  Moreover, confusingly enough, they generally
+do not work in the same way as the generic governors they share the names with.
+For example, the ``powersave`` P-state selection algorithm provided by
+``intel_pstate`` is not a counterpart of the generic ``powersave`` governor
+(roughly, it corresponds to the ``schedutil`` and ``ondemand`` governors).
+
+There are two P-state selection algorithms provided by ``intel_pstate`` in the
+active mode: ``powersave`` and ``performance``.  The way they both operate
+depends on whether or not the hardware-managed P-states (HWP) feature has been
+enabled in the processor and possibly on the processor model.
+
+Which of the P-state selection algorithms is used by default depends on the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option.
+Namely, if that option is set, the ``performance`` algorithm will be used by
+default, and the other one will be used by default if it is not set.
+
+Active Mode With HWP
+~~~~~~~~~~~~~~~~~~~~
+
+If the processor supports the HWP feature, it will be enabled during the
+processor initialization and cannot be disabled after that.  It is possible
+to avoid enabling it by passing the ``intel_pstate=no_hwp`` argument to the
+kernel in the command line.
+
+If the HWP feature has been enabled, ``intel_pstate`` relies on the processor to
+select P-states by itself, but still it can give hints to the processor's
+internal P-state selection logic.  What those hints are depends on which P-state
+selection algorithm has been applied to the given policy (or to the CPU it
+corresponds to).
+
+Even though the P-state selection is carried out by the processor automatically,
+``intel_pstate`` registers utilization update callbacks with the CPU scheduler
+in this mode.  However, they are not used for running a P-state selection
+algorithm, but for periodic updates of the current CPU frequency information to
+be made available from the ``scaling_cur_freq`` policy attribute in ``sysfs``.
+
+HWP + ``performance``
+.....................
+
+In this configuration ``intel_pstate`` will write 0 to the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob (otherwise), which means that the processor's
+internal P-state selection logic is expected to focus entirely on performance.
+
+This will override the EPP/EPB setting coming from the ``sysfs`` interface
+(see `Energy vs Performance Hints`_ below).
+
+Also, in this configuration the range of P-states available to the processor's
+internal P-state selection logic is always restricted to the upper boundary
+(that is, the maximum P-state that the driver is allowed to use).
+
+HWP + ``powersave``
+...................
+
+In this configuration ``intel_pstate`` will set the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob (otherwise) to whatever value it was
+previously set to via ``sysfs`` (or whatever default value it was
+set to by the platform firmware).  This usually causes the processor's
+internal P-state selection logic to be less performance-focused.
+
+Active Mode Without HWP
+~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the default operation mode for processors that do not support the HWP
+feature.  It also is used by default with the ``intel_pstate=no_hwp`` argument
+in the kernel command line.  However, in this mode ``intel_pstate`` may refuse
+to work with the given processor if it does not recognize it.  [Note that
+``intel_pstate`` will never refuse to work with any processor with the HWP
+feature enabled.]
+
+In this mode ``intel_pstate`` registers utilization update callbacks with the
+CPU scheduler in order to run a P-state selection algorithm, either
+``powersave`` or ``performance``, depending on the ``scaling_cur_freq`` policy
+setting in ``sysfs``.  The current CPU frequency information to be made
+available from the ``scaling_cur_freq`` policy attribute in ``sysfs`` is
+periodically updated by those utilization update callbacks too.
+
+``performance``
+...............
+
+Without HWP, this P-state selection algorithm is always the same regardless of
+the processor model and platform configuration.
+
+It selects the maximum P-state it is allowed to use, subject to limits set via
+``sysfs``, every time the P-state selection computations are carried out by the
+driver's utilization update callback for the given CPU (that does not happen
+more often than every 10 ms), but the hardware configuration will not be changed
+if the new P-state is the same as the current one.
+
+This is the default P-state selection algorithm if the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option
+is set.
+
+``powersave``
+.............
+
+Without HWP, this P-state selection algorithm generally depends on the
+processor model and/or the system profile setting in the ACPI tables and there
+are two variants of it.
+
+One of them is used with processors from the Atom line and (regardless of the
+processor model) on platforms with the system profile in the ACPI tables set to
+"mobile" (laptops mostly), "tablet", "appliance PC", "desktop", or
+"workstation".  It is also used with processors supporting the HWP feature if
+that feature has not been enabled (that is, with the ``intel_pstate=no_hwp``
+argument in the kernel command line).  It is similar to the algorithm
+implemented by the generic ``schedutil`` scaling governor except that the
+utilization metric used by it is based on numbers coming from feedback
+registers of the CPU.  It generally selects P-states proportional to the
+current CPU utilization, so it is referred to as the "proportional" algorithm.
+
+The second variant of the ``powersave`` P-state selection algorithm, used in all
+of the other cases (generally, on processors from the Core line, so it is
+referred to as the "Core" algorithm), is based on the values read from the APERF
+and MPERF feedback registers and the previously requested target P-state.
+It does not really take CPU utilization into account explicitly, but as a rule
+it causes the CPU P-state to ramp up very quickly in response to increased
+utilization which is generally desirable in server environments.
+
+Regardless of the variant, this algorithm is run by the driver's utilization
+update callback for the given CPU when it is invoked by the CPU scheduler, but
+not more often than every 10 ms (that can be tweaked via ``debugfs`` in `this
+particular case <Tuning Interface in debugfs_>`_).  Like in the ``performance``
+case, the hardware configuration is not touched if the new P-state turns out to
+be the same as the current one.
+
+This is the default P-state selection algorithm if the
+:c:macro:`CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE` kernel configuration option
+is not set.
+
+Passive Mode
+------------
+
+This mode is used if the ``intel_pstate=passive`` argument is passed to the
+kernel in the command line (it implies the ``intel_pstate=no_hwp`` setting too).
+Like in the active mode without HWP support, in this mode ``intel_pstate`` may
+refuse to work with the given processor if it does not recognize it.
+
+If the driver works in this mode, the ``scaling_driver`` policy attribute in
+``sysfs`` for all ``CPUFreq`` policies contains the string "intel_cpufreq".
+Then, the driver behaves like a regular ``CPUFreq`` scaling driver.  That is,
+it is invoked by generic scaling governors when necessary to talk to the
+hardware in order to change the P-state of a CPU (in particular, the
+``schedutil`` governor can invoke it directly from scheduler context).
+
+While in this mode, ``intel_pstate`` can be used with all of the (generic)
+scaling governors listed by the ``scaling_available_governors`` policy attribute
+in ``sysfs`` (and the P-state selection algorithms described above are not
+used).  Then, it is responsible for the configuration of policy objects
+corresponding to CPUs and provides the ``CPUFreq`` core (and the scaling
+governors attached to the policy objects) with accurate information on the
+maximum and minimum operating frequencies supported by the hardware (including
+the so-called "turbo" frequency ranges).  In other words, in the passive mode
+the entire range of available P-states is exposed by ``intel_pstate`` to the
+``CPUFreq`` core.  However, in this mode the driver does not register
+utilization update callbacks with the CPU scheduler and the ``scaling_cur_freq``
+information comes from the ``CPUFreq`` core (and is the last frequency selected
+by the current scaling governor for the given policy).
+
+
+.. _turbo:
+
+Turbo P-states Support
+======================
+
+In the majority of cases, the entire range of P-states available to
+``intel_pstate`` can be divided into two sub-ranges that correspond to
+different types of processor behavior, above and below a boundary that
+will be referred to as the "turbo threshold" in what follows.
+
+The P-states above the turbo threshold are referred to as "turbo P-states" and
+the whole sub-range of P-states they belong to is referred to as the "turbo
+range".  These names are related to the Turbo Boost technology allowing a
+multicore processor to opportunistically increase the P-state of one or more
+cores if there is enough power to do that and if that is not going to cause the
+thermal envelope of the processor package to be exceeded.
+
+Specifically, if software sets the P-state of a CPU core within the turbo range
+(that is, above the turbo threshold), the processor is permitted to take over
+performance scaling control for that core and put it into turbo P-states of its
+choice going forward.  However, that permission is interpreted differently by
+different processor generations.  Namely, the Sandy Bridge generation of
+processors will never use any P-states above the last one set by software for
+the given core, even if it is within the turbo range, whereas all of the later
+processor generations will take it as a license to use any P-states from the
+turbo range, even above the one set by software.  In other words, on those
+processors setting any P-state from the turbo range will enable the processor
+to put the given core into all turbo P-states up to and including the maximum
+supported one as it sees fit.
+
+One important property of turbo P-states is that they are not sustainable.  More
+precisely, there is no guarantee that any CPUs will be able to stay in any of
+those states indefinitely, because the power distribution within the processor
+package may change over time  or the thermal envelope it was designed for might
+be exceeded if a turbo P-state was used for too long.
+
+In turn, the P-states below the turbo threshold generally are sustainable.  In
+fact, if one of them is set by software, the processor is not expected to change
+it to a lower one unless in a thermal stress or a power limit violation
+situation (a higher P-state may still be used if it is set for another CPU in
+the same package at the same time, for example).
+
+Some processors allow multiple cores to be in turbo P-states at the same time,
+but the maximum P-state that can be set for them generally depends on the number
+of cores running concurrently.  The maximum turbo P-state that can be set for 3
+cores at the same time usually is lower than the analogous maximum P-state for
+2 cores, which in turn usually is lower than the maximum turbo P-state that can
+be set for 1 core.  The one-core maximum turbo P-state is thus the maximum
+supported one overall.
+
+The maximum supported turbo P-state, the turbo threshold (the maximum supported
+non-turbo P-state) and the minimum supported P-state are specific to the
+processor model and can be determined by reading the processor's model-specific
+registers (MSRs).  Moreover, some processors support the Configurable TDP
+(Thermal Design Power) feature and, when that feature is enabled, the turbo
+threshold effectively becomes a configurable value that can be set by the
+platform firmware.
+
+Unlike ``_PSS`` objects in the ACPI tables, ``intel_pstate`` always exposes
+the entire range of available P-states, including the whole turbo range, to the
+``CPUFreq`` core and (in the passive mode) to generic scaling governors.  This
+generally causes turbo P-states to be set more often when ``intel_pstate`` is
+used relative to ACPI-based CPU performance scaling (see `below <acpi-cpufreq_>`_
+for more information).
+
+Moreover, since ``intel_pstate`` always knows what the real turbo threshold is
+(even if the Configurable TDP feature is enabled in the processor), its
+``no_turbo`` attribute in ``sysfs`` (described `below <no_turbo_attr_>`_) should
+work as expected in all cases (that is, if set to disable turbo P-states, it
+always should prevent ``intel_pstate`` from using them).
+
+
+Processor Support
+=================
+
+To handle a given processor ``intel_pstate`` requires a number of different
+pieces of information on it to be known, including:
+
+ * The minimum supported P-state.
+
+ * The maximum supported `non-turbo P-state <turbo_>`_.
+
+ * Whether or not turbo P-states are supported at all.
+
+ * The maximum supported `one-core turbo P-state <turbo_>`_ (if turbo P-states
+   are supported).
+
+ * The scaling formula to translate the driver's internal representation
+   of P-states into frequencies and the other way around.
+
+Generally, ways to obtain that information are specific to the processor model
+or family.  Although it often is possible to obtain all of it from the processor
+itself (using model-specific registers), there are cases in which hardware
+manuals need to be consulted to get to it too.
+
+For this reason, there is a list of supported processors in ``intel_pstate`` and
+the driver initialization will fail if the detected processor is not in that
+list, unless it supports the `HWP feature <Active Mode_>`_.  [The interface to
+obtain all of the information listed above is the same for all of the processors
+supporting the HWP feature, which is why they all are supported by
+``intel_pstate``.]
+
+
+User Space Interface in ``sysfs``
+=================================
+
+Global Attributes
+-----------------
+
+``intel_pstate`` exposes several global attributes (files) in ``sysfs`` to
+control its functionality at the system level.  They are located in the
+``/sys/devices/system/cpu/cpufreq/intel_pstate/`` directory and affect all
+CPUs.
+
+Some of them are not present if the ``intel_pstate=per_cpu_perf_limits``
+argument is passed to the kernel in the command line.
+
+``max_perf_pct``
+        Maximum P-state the driver is allowed to set in percent of the
+        maximum supported performance level (the highest supported `turbo
+        P-state <turbo_>`_).
+
+        This attribute will not be exposed if the
+        ``intel_pstate=per_cpu_perf_limits`` argument is present in the kernel
+        command line.
+
+``min_perf_pct``
+        Minimum P-state the driver is allowed to set in percent of the
+        maximum supported performance level (the highest supported `turbo
+        P-state <turbo_>`_).
+
+        This attribute will not be exposed if the
+        ``intel_pstate=per_cpu_perf_limits`` argument is present in the kernel
+        command line.
+
+``num_pstates``
+        Number of P-states supported by the processor (between 0 and 255
+        inclusive) including both turbo and non-turbo P-states (see
+        `Turbo P-states Support`_).
+
+        The value of this attribute is not affected by the ``no_turbo``
+        setting described `below <no_turbo_attr_>`_.
+
+        This attribute is read-only.
+
+``turbo_pct``
+        Ratio of the `turbo range <turbo_>`_ size to the size of the entire
+        range of supported P-states, in percent.
+
+        This attribute is read-only.
+
+.. _no_turbo_attr:
+
+``no_turbo``
+        If set (equal to 1), the driver is not allowed to set any turbo P-states
+        (see `Turbo P-states Support`_).  If unset (equalt to 0, which is the
+        default), turbo P-states can be set by the driver.
+        [Note that ``intel_pstate`` does not support the general ``boost``
+        attribute (supported by some other scaling drivers) which is replaced
+        by this one.]
+
+        This attrubute does not affect the maximum supported frequency value
+        supplied to the ``CPUFreq`` core and exposed via the policy interface,
+        but it affects the maximum possible value of per-policy P-state limits
+        (see `Interpretation of Policy Attributes`_ below for details).
+
+.. _status_attr:
+
+``status``
+        Operation mode of the driver: "active", "passive" or "off".
+
+        "active"
+                The driver is functional and in the `active mode
+                <Active Mode_>`_.
+
+        "passive"
+                The driver is functional and in the `passive mode
+                <Passive Mode_>`_.
+
+        "off"
+                The driver is not functional (it is not registered as a scaling
+                driver with the ``CPUFreq`` core).
+
+        This attribute can be written to in order to change the driver's
+        operation mode or to unregister it.  The string written to it must be
+        one of the possible values of it and, if successful, the write will
+        cause the driver to switch over to the operation mode represented by
+        that string - or to be unregistered in the "off" case.  [Actually,
+        switching over from the active mode to the passive mode or the other
+        way around causes the driver to be unregistered and registered again
+        with a different set of callbacks, so all of its settings (the global
+        as well as the per-policy ones) are then reset to their default
+        values, possibly depending on the target operation mode.]
+
+        That only is supported in some configurations, though (for example, if
+        the `HWP feature is enabled in the processor <Active Mode With HWP_>`_,
+        the operation mode of the driver cannot be changed), and if it is not
+        supported in the current configuration, writes to this attribute with
+        fail with an appropriate error.
+
+Interpretation of Policy Attributes
+-----------------------------------
+
+The interpretation of some ``CPUFreq`` policy attributes described in
+:doc:`cpufreq` is special with ``intel_pstate`` as the current scaling driver
+and it generally depends on the driver's `operation mode <Operation Modes_>`_.
+
+First of all, the values of the ``cpuinfo_max_freq``, ``cpuinfo_min_freq`` and
+``scaling_cur_freq`` attributes are produced by applying a processor-specific
+multiplier to the internal P-state representation used by ``intel_pstate``.
+Also, the values of the ``scaling_max_freq`` and ``scaling_min_freq``
+attributes are capped by the frequency corresponding to the maximum P-state that
+the driver is allowed to set.
+
+If the ``no_turbo`` `global attribute <no_turbo_attr_>`_ is set, the driver is
+not allowed to use turbo P-states, so the maximum value of ``scaling_max_freq``
+and ``scaling_min_freq`` is limited to the maximum non-turbo P-state frequency.
+Accordingly, setting ``no_turbo`` causes ``scaling_max_freq`` and
+``scaling_min_freq`` to go down to that value if they were above it before.
+However, the old values of ``scaling_max_freq`` and ``scaling_min_freq`` will be
+restored after unsetting ``no_turbo``, unless these attributes have been written
+to after ``no_turbo`` was set.
+
+If ``no_turbo`` is not set, the maximum possible value of ``scaling_max_freq``
+and ``scaling_min_freq`` corresponds to the maximum supported turbo P-state,
+which also is the value of ``cpuinfo_max_freq`` in either case.
+
+Next, the following policy attributes have special meaning if
+``intel_pstate`` works in the `active mode <Active Mode_>`_:
+
+``scaling_available_governors``
+        List of P-state selection algorithms provided by ``intel_pstate``.
+
+``scaling_governor``
+        P-state selection algorithm provided by ``intel_pstate`` currently in
+        use with the given policy.
+
+``scaling_cur_freq``
+        Frequency of the average P-state of the CPU represented by the given
+        policy for the time interval between the last two invocations of the
+        driver's utilization update callback by the CPU scheduler for that CPU.
+
+The meaning of these attributes in the `passive mode <Passive Mode_>`_ is the
+same as for other scaling drivers.
+
+Additionally, the value of the ``scaling_driver`` attribute for ``intel_pstate``
+depends on the operation mode of the driver.  Namely, it is either
+"intel_pstate" (in the `active mode <Active Mode_>`_) or "intel_cpufreq" (in the
+`passive mode <Passive Mode_>`_).
+
+Coordination of P-State Limits
+------------------------------
+
+``intel_pstate`` allows P-state limits to be set in two ways: with the help of
+the ``max_perf_pct`` and ``min_perf_pct`` `global attributes
+<Global Attributes_>`_ or via the ``scaling_max_freq`` and ``scaling_min_freq``
+``CPUFreq`` policy attributes.  The coordination between those limits is based
+on the following rules, regardless of the current operation mode of the driver:
+
+ 1. All CPUs are affected by the global limits (that is, none of them can be
+    requested to run faster than the global maximum and none of them can be
+    requested to run slower than the global minimum).
+
+ 2. Each individual CPU is affected by its own per-policy limits (that is, it
+    cannot be requested to run faster than its own per-policy maximum and it
+    cannot be requested to run slower than its own per-policy minimum).
+
+ 3. The global and per-policy limits can be set independently.
+
+If the `HWP feature is enabled in the processor <Active Mode With HWP_>`_, the
+resulting effective values are written into its registers whenever the limits
+change in order to request its internal P-state selection logic to always set
+P-states within these limits.  Otherwise, the limits are taken into account by
+scaling governors (in the `passive mode <Passive Mode_>`_) and by the driver
+every time before setting a new P-state for a CPU.
+
+Additionally, if the ``intel_pstate=per_cpu_perf_limits`` command line argument
+is passed to the kernel, ``max_perf_pct`` and ``min_perf_pct`` are not exposed
+at all and the only way to set the limits is by using the policy attributes.
+
+
+Energy vs Performance Hints
+---------------------------
+
+If ``intel_pstate`` works in the `active mode with the HWP feature enabled
+<Active Mode With HWP_>`_ in the processor, additional attributes are present
+in every ``CPUFreq`` policy directory in ``sysfs``.  They are intended to allow
+user space to help ``intel_pstate`` to adjust the processor's internal P-state
+selection logic by focusing it on performance or on energy-efficiency, or
+somewhere between the two extremes:
+
+``energy_performance_preference``
+        Current value of the energy vs performance hint for the given policy
+        (or the CPU represented by it).
+
+        The hint can be changed by writing to this attribute.
+
+``energy_performance_available_preferences``
+        List of strings that can be written to the
+        ``energy_performance_preference`` attribute.
+
+        They represent different energy vs performance hints and should be
+        self-explanatory, except that ``default`` represents whatever hint
+        value was set by the platform firmware.
+
+Strings written to the ``energy_performance_preference`` attribute are
+internally translated to integer values written to the processor's
+Energy-Performance Preference (EPP) knob (if supported) or its
+Energy-Performance Bias (EPB) knob.
+
+[Note that tasks may by migrated from one CPU to another by the scheduler's
+load-balancing algorithm and if different energy vs performance hints are
+set for those CPUs, that may lead to undesirable outcomes.  To avoid such
+issues it is better to set the same energy vs performance hint for all CPUs
+or to pin every task potentially sensitive to them to a specific CPU.]
+
+.. _acpi-cpufreq:
+
+``intel_pstate`` vs ``acpi-cpufreq``
+====================================
+
+On the majority of systems supported by ``intel_pstate``, the ACPI tables
+provided by the platform firmware contain ``_PSS`` objects returning information
+that can be used for CPU performance scaling (refer to the `ACPI specification`_
+for details on the ``_PSS`` objects and the format of the information returned
+by them).
+
+The information returned by the ACPI ``_PSS`` objects is used by the
+``acpi-cpufreq`` scaling driver.  On systems supported by ``intel_pstate``
+the ``acpi-cpufreq`` driver uses the same hardware CPU performance scaling
+interface, but the set of P-states it can use is limited by the ``_PSS``
+output.
+
+On those systems each ``_PSS`` object returns a list of P-states supported by
+the corresponding CPU which basically is a subset of the P-states range that can
+be used by ``intel_pstate`` on the same system, with one exception: the whole
+`turbo range <turbo_>`_ is represented by one item in it (the topmost one).  By
+convention, the frequency returned by ``_PSS`` for that item is greater by 1 MHz
+than the frequency of the highest non-turbo P-state listed by it, but the
+corresponding P-state representation (following the hardware specification)
+returned for it matches the maximum supported turbo P-state (or is the
+special value 255 meaning essentially "go as high as you can get").
+
+The list of P-states returned by ``_PSS`` is reflected by the table of
+available frequencies supplied by ``acpi-cpufreq`` to the ``CPUFreq`` core and
+scaling governors and the minimum and maximum supported frequencies reported by
+it come from that list as well.  In particular, given the special representation
+of the turbo range described above, this means that the maximum supported
+frequency reported by ``acpi-cpufreq`` is higher by 1 MHz than the frequency
+of the highest supported non-turbo P-state listed by ``_PSS`` which, of course,
+affects decisions made by the scaling governors, except for ``powersave`` and
+``performance``.
+
+For example, if a given governor attempts to select a frequency proportional to
+estimated CPU load and maps the load of 100% to the maximum supported frequency
+(possibly multiplied by a constant), then it will tend to choose P-states below
+the turbo threshold if ``acpi-cpufreq`` is used as the scaling driver, because
+in that case the turbo range corresponds to a small fraction of the frequency
+band it can use (1 MHz vs 1 GHz or more).  In consequence, it will only go to
+the turbo range for the highest loads and the other loads above 50% that might
+benefit from running at turbo frequencies will be given non-turbo P-states
+instead.
+
+One more issue related to that may appear on systems supporting the
+`Configurable TDP feature <turbo_>`_ allowing the platform firmware to set the
+turbo threshold.  Namely, if that is not coordinated with the lists of P-states
+returned by ``_PSS`` properly, there may be more than one item corresponding to
+a turbo P-state in those lists and there may be a problem with avoiding the
+turbo range (if desirable or necessary).  Usually, to avoid using turbo
+P-states overall, ``acpi-cpufreq`` simply avoids using the topmost state listed
+by ``_PSS``, but that is not sufficient when there are other turbo P-states in
+the list returned by it.
+
+Apart from the above, ``acpi-cpufreq`` works like ``intel_pstate`` in the
+`passive mode <Passive Mode_>`_, except that the number of P-states it can set
+is limited to the ones listed by the ACPI ``_PSS`` objects.
+
+
+Kernel Command Line Options for ``intel_pstate``
+================================================
+
+Several kernel command line options can be used to pass early-configuration-time
+parameters to ``intel_pstate`` in order to enforce specific behavior of it.  All
+of them have to be prepended with the ``intel_pstate=`` prefix.
+
+``disable``
+        Do not register ``intel_pstate`` as the scaling driver even if the
+        processor is supported by it.
+
+``passive``
+        Register ``intel_pstate`` in the `passive mode <Passive Mode_>`_ to
+        start with.
+
+        This option implies the ``no_hwp`` one described below.
+
+``force``
+        Register ``intel_pstate`` as the scaling driver instead of
+        ``acpi-cpufreq`` even if the latter is preferred on the given system.
+
+        This may prevent some platform features (such as thermal controls and
+        power capping) that rely on the availability of ACPI P-states
+        information from functioning as expected, so it should be used with
+        caution.
+
+        This option does not work with processors that are not supported by
+        ``intel_pstate`` and on platforms where the ``pcc-cpufreq`` scaling
+        driver is used instead of ``acpi-cpufreq``.
+
+``no_hwp``
+        Do not enable the `hardware-managed P-states (HWP) feature
+        <Active Mode With HWP_>`_ even if it is supported by the processor.
+
+``hwp_only``
+        Register ``intel_pstate`` as the scaling driver only if the
+        `hardware-managed P-states (HWP) feature <Active Mode With HWP_>`_ is
+        supported by the processor.
+
+``support_acpi_ppc``
+        Take ACPI ``_PPC`` performance limits into account.
+
+        If the preferred power management profile in the FADT (Fixed ACPI
+        Description Table) is set to "Enterprise Server" or "Performance
+        Server", the ACPI ``_PPC`` limits are taken into account by default
+        and this option has no effect.
+
+``per_cpu_perf_limits``
+        Use per-logical-CPU P-State limits (see `Coordination of P-state
+        Limits`_ for details).
+
+
+Diagnostics and Tuning
+======================
+
+Trace Events
+------------
+
+There are two static trace events that can be used for ``intel_pstate``
+diagnostics.  One of them is the ``cpu_frequency`` trace event generally used
+by ``CPUFreq``, and the other one is the ``pstate_sample`` trace event specific
+to ``intel_pstate``.  Both of them are triggered by ``intel_pstate`` only if
+it works in the `active mode <Active Mode_>`_.
+
+The following sequence of shell commands can be used to enable them and see
+their output (if the kernel is generally configured to support event tracing)::
+
+ # cd /sys/kernel/debug/tracing/
+ # echo 1 > events/power/pstate_sample/enable
+ # echo 1 > events/power/cpu_frequency/enable
+ # cat trace
+ gnome-terminal--4510  [001] ..s.  1177.680733: pstate_sample: core_busy=107 scaled=94 from=26 to=26 mperf=1143818 aperf=1230607 tsc=29838618 freq=2474476
+ cat-5235  [002] ..s.  1177.681723: cpu_frequency: state=2900000 cpu_id=2
+
+If ``intel_pstate`` works in the `passive mode <Passive Mode_>`_, the
+``cpu_frequency`` trace event will be triggered either by the ``schedutil``
+scaling governor (for the policies it is attached to), or by the ``CPUFreq``
+core (for the policies with other scaling governors).
+
+``ftrace``
+----------
+
+The ``ftrace`` interface can be used for low-level diagnostics of
+``intel_pstate``.  For example, to check how often the function to set a
+P-state is called, the ``ftrace`` filter can be set to to
+:c:func:`intel_pstate_set_pstate`::
+
+ # cd /sys/kernel/debug/tracing/
+ # cat available_filter_functions | grep -i pstate
+ intel_pstate_set_pstate
+ intel_pstate_cpu_init
+ ...
+ # echo intel_pstate_set_pstate > set_ftrace_filter
+ # echo function > current_tracer
+ # cat trace | head -15
+ # tracer: function
+ #
+ # entries-in-buffer/entries-written: 80/80   #P:4
+ #
+ #                              _-----=> irqs-off
+ #                             / _----=> need-resched
+ #                            | / _---=> hardirq/softirq
+ #                            || / _--=> preempt-depth
+ #                            ||| /     delay
+ #           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
+ #              | |       |   ||||       |         |
+             Xorg-3129  [000] ..s.  2537.644844: intel_pstate_set_pstate <-intel_pstate_timer_func
+  gnome-terminal--4510  [002] ..s.  2537.649844: intel_pstate_set_pstate <-intel_pstate_timer_func
+      gnome-shell-3409  [001] ..s.  2537.650850: intel_pstate_set_pstate <-intel_pstate_timer_func
+           <idle>-0     [000] ..s.  2537.654843: intel_pstate_set_pstate <-intel_pstate_timer_func
+
+Tuning Interface in ``debugfs``
+-------------------------------
+
+The ``powersave`` algorithm provided by ``intel_pstate`` for `the Core line of
+processors in the active mode <powersave_>`_ is based on a `PID controller`_
+whose parameters were chosen to address a number of different use cases at the
+same time.  However, it still is possible to fine-tune it to a specific workload
+and the ``debugfs`` interface under ``/sys/kernel/debug/pstate_snb/`` is
+provided for this purpose.  [Note that the ``pstate_snb`` directory will be
+present only if the specific P-state selection algorithm matching the interface
+in it actually is in use.]
+
+The following files present in that directory can be used to modify the PID
+controller parameters at run time:
+
+| ``deadband``
+| ``d_gain_pct``
+| ``i_gain_pct``
+| ``p_gain_pct``
+| ``sample_rate_ms``
+| ``setpoint``
+
+Note, however, that achieving desirable results this way generally requires
+expert-level understanding of the power vs performance tradeoff, so extra care
+is recommended when attempting to do that.
+
+
+.. _LCEU2015: http://events.linuxfoundation.org/sites/events/files/slides/LinuxConEurope_2015.pdf
+.. _SDM: http://www.intel.com/content/www/us/en/architecture-and-technology/64-ia-32-architectures-software-developer-system-programming-manual-325384.html
+.. _ACPI specification: http://www.uefi.org/sites/default/files/resources/ACPI_6_1.pdf
+.. _PID controller: https://en.wikipedia.org/wiki/PID_controller
diff --git a/Documentation/cpu-freq/intel-pstate.txt b/Documentation/cpu-freq/intel-pstate.txt
deleted file mode 100644
index 3fdcdfd968ba..000000000000
--- a/Documentation/cpu-freq/intel-pstate.txt
+++ /dev/null
@@ -1,281 +0,0 @@
-Intel P-State driver
---------------------
-
-This driver provides an interface to control the P-State selection for the
-SandyBridge+ Intel processors.
-
-The following document explains P-States:
-http://events.linuxfoundation.org/sites/events/files/slides/LinuxConEurope_2015.pdf
-As stated in the document, P-State doesn’t exactly mean a frequency. However, for
-the sake of the relationship with cpufreq, P-State and frequency are used
-interchangeably.
-
-Understanding the cpufreq core governors and policies are important before
-discussing more details about the Intel P-State driver. Based on what callbacks
-a cpufreq driver provides to the cpufreq core, it can support two types of
-drivers:
-- with target_index() callback: In this mode, the drivers using cpufreq core
-simply provide the minimum and maximum frequency limits and an additional
-interface target_index() to set the current frequency. The cpufreq subsystem
-has a number of scaling governors ("performance", "powersave", "ondemand",
-etc.). Depending on which governor is in use, cpufreq core will call for
-transitions to a specific frequency using target_index() callback.
-- setpolicy() callback: In this mode, drivers do not provide target_index()
-callback, so cpufreq core can't request a transition to a specific frequency.
-The driver provides minimum and maximum frequency limits and callbacks to set a
-policy. The policy in cpufreq sysfs is referred to as the "scaling governor".
-The cpufreq core can request the driver to operate in any of the two policies:
-"performance" and "powersave". The driver decides which frequency to use based
-on the above policy selection considering minimum and maximum frequency limits.
-
-The Intel P-State driver falls under the latter category, which implements the
-setpolicy() callback. This driver decides what P-State to use based on the
-requested policy from the cpufreq core. If the processor is capable of
-selecting its next P-State internally, then the driver will offload this
-responsibility to the processor (aka HWP: Hardware P-States). If not, the
-driver implements algorithms to select the next P-State.
-
-Since these policies are implemented in the driver, they are not same as the
-cpufreq scaling governors implementation, even if they have the same name in
-the cpufreq sysfs (scaling_governors). For example the "performance" policy is
-similar to cpufreq’s "performance" governor, but "powersave" is completely
-different than the cpufreq "powersave" governor. The strategy here is similar
-to cpufreq "ondemand", where the requested P-State is related to the system load.
-
-Sysfs Interface
-
-In addition to the frequency-controlling interfaces provided by the cpufreq
-core, the driver provides its own sysfs files to control the P-State selection.
-These files have been added to /sys/devices/system/cpu/intel_pstate/.
-Any changes made to these files are applicable to all CPUs (even in a
-multi-package system, Refer to later section on placing "Per-CPU limits").
-
-      max_perf_pct: Limits the maximum P-State that will be requested by
-      the driver. It states it as a percentage of the available performance. The
-      available (P-State) performance may be reduced by the no_turbo
-      setting described below.
-
-      min_perf_pct: Limits the minimum P-State that will be requested by
-      the driver. It states it as a percentage of the max (non-turbo)
-      performance level.
-
-      no_turbo: Limits the driver to selecting P-State below the turbo
-      frequency range.
-
-      turbo_pct: Displays the percentage of the total performance that
-      is supported by hardware that is in the turbo range. This number
-      is independent of whether turbo has been disabled or not.
-
-      num_pstates: Displays the number of P-States that are supported
-      by hardware. This number is independent of whether turbo has
-      been disabled or not.
-
-For example, if a system has these parameters:
-        Max 1 core turbo ratio: 0x21 (Max 1 core ratio is the maximum P-State)
-        Max non turbo ratio: 0x17
-        Minimum ratio : 0x08 (Here the ratio is called max efficiency ratio)
-
-Sysfs will show :
-        max_perf_pct:100, which corresponds to 1 core ratio
-        min_perf_pct:24, max_efficiency_ratio / max 1 Core ratio
-        no_turbo:0, turbo is not disabled
-        num_pstates:26 = (max 1 Core ratio - Max Efficiency Ratio + 1)
-        turbo_pct:39 = (max 1 core ratio - max non turbo ratio) / num_pstates
-
-Refer to "Intel® 64 and IA-32 Architectures Software Developer’s Manual
-Volume 3: System Programming Guide" to understand ratios.
-
-There is one more sysfs attribute in /sys/devices/system/cpu/intel_pstate/
-that can be used for controlling the operation mode of the driver:
-
-      status: Three settings are possible:
-      "off"     - The driver is not in use at this time.
-      "active"  - The driver works as a P-state governor (default).
-      "passive" - The driver works as a regular cpufreq one and collaborates
-                  with the generic cpufreq governors (it sets P-states as
-                  requested by those governors).
-      The current setting is returned by reads from this attribute.  Writing one
-      of the above strings to it changes the operation mode as indicated by that
-      string, if possible.  If HW-managed P-states (HWP) are enabled, it is not
-      possible to change the driver's operation mode and attempts to write to
-      this attribute will fail.
-
-cpufreq sysfs for Intel P-State
-
-Since this driver registers with cpufreq, cpufreq sysfs is also presented.
-There are some important differences, which need to be considered.
-
-scaling_cur_freq: This displays the real frequency which was used during
-the last sample period instead of what is requested. Some other cpufreq driver,
-like acpi-cpufreq, displays what is requested (Some changes are on the
-way to fix this for acpi-cpufreq driver). The same is true for frequencies
-displayed at /proc/cpuinfo.
-
-scaling_governor: This displays current active policy. Since each CPU has a
-cpufreq sysfs, it is possible to set a scaling governor to each CPU. But this
-is not possible with Intel P-States, as there is one common policy for all
-CPUs. Here, the last requested policy will be applicable to all CPUs. It is
-suggested that one use the cpupower utility to change policy to all CPUs at the
-same time.
-
-scaling_setspeed: This attribute can never be used with Intel P-State.
-
-scaling_max_freq/scaling_min_freq: This interface can be used similarly to
-the max_perf_pct/min_perf_pct of Intel P-State sysfs. However since frequencies
-are converted to nearest possible P-State, this is prone to rounding errors.
-This method is not preferred to limit performance.
-
-affected_cpus: Not used
-related_cpus: Not used
-
-For contemporary Intel processors, the frequency is controlled by the
-processor itself and the P-State exposed to software is related to
-performance levels.  The idea that frequency can be set to a single
-frequency is fictional for Intel Core processors. Even if the scaling
-driver selects a single P-State, the actual frequency the processor
-will run at is selected by the processor itself.
-
-Per-CPU limits
-
-The kernel command line option "intel_pstate=per_cpu_perf_limits" forces
-the intel_pstate driver to use per-CPU performance limits.  When it is set,
-the sysfs control interface described above is subject to limitations.
-- The following controls are not available for both read and write
-        /sys/devices/system/cpu/intel_pstate/max_perf_pct
-        /sys/devices/system/cpu/intel_pstate/min_perf_pct
-- The following controls can be used to set performance limits, as far as the
-architecture of the processor permits:
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_max_freq
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_min_freq
-        /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor
-- User can still observe turbo percent and number of P-States from
-        /sys/devices/system/cpu/intel_pstate/turbo_pct
-        /sys/devices/system/cpu/intel_pstate/num_pstates
-- User can read write system wide turbo status
-        /sys/devices/system/cpu/no_turbo
-
-Support of energy performance hints
-It is possible to provide hints to the HWP algorithms in the processor
-to be more performance centric to more energy centric. When the driver
-is using HWP, two additional cpufreq sysfs attributes are presented for
-each logical CPU.
-These attributes are:
-        - energy_performance_available_preferences
-        - energy_performance_preference
-
-To get list of supported hints:
-$ cat energy_performance_available_preferences
-    default performance balance_performance balance_power power
-
-The current preference can be read or changed via cpufreq sysfs
-attribute "energy_performance_preference". Reading from this attribute
-will display current effective setting. User can write any of the valid
-preference string to this attribute. User can always restore to power-on
-default by writing "default".
-
-Since threads can migrate to different CPUs, this is possible that the
-new CPU may have different energy performance preference than the previous
-one. To avoid such issues, either threads can be pinned to specific CPUs
-or set the same energy performance preference value to all CPUs.
-
-Tuning Intel P-State driver
-
-When the performance can be tuned using PID (Proportional Integral
-Derivative) controller, debugfs files are provided for adjusting performance.
-They are presented under:
-/sys/kernel/debug/pstate_snb/
-
-The PID tunable parameters are:
-      deadband
-      d_gain_pct
-      i_gain_pct
-      p_gain_pct
-      sample_rate_ms
-      setpoint
-
-To adjust these parameters, some understanding of driver implementation is
-necessary. There are some tweeks described here, but be very careful. Adjusting
-them requires expert level understanding of power and performance relationship.
-These limits are only useful when the "powersave" policy is active.
-
--To make the system more responsive to load changes, sample_rate_ms can
-be adjusted  (current default is 10ms).
--To make the system use higher performance, even if the load is lower, setpoint
-can be adjusted to a lower number. This will also lead to faster ramp up time
-to reach the maximum P-State.
-If there are no derivative and integral coefficients, The next P-State will be
-equal to:
-        current P-State - ((setpoint - current cpu load) * p_gain_pct)
-
-For example, if the current PID parameters are (Which are defaults for the core
-processors like SandyBridge):
-      deadband = 0
-      d_gain_pct = 0
-      i_gain_pct = 0
-      p_gain_pct = 20
-      sample_rate_ms = 10
-      setpoint = 97
-
-If the current P-State = 0x08 and current load = 100, this will result in the
-next P-State = 0x08 - ((97 - 100) * 0.2) = 8.6 (rounded to 9). Here the P-State
-goes up by only 1. If during next sample interval the current load doesn't
-change and still 100, then P-State goes up by one again. This process will
-continue as long as the load is more than the setpoint until the maximum P-State
-is reached.
-
-For the same load at setpoint = 60, this will result in the next P-State
-= 0x08 - ((60 - 100) * 0.2) = 16
-So by changing the setpoint from 97 to 60, there is an increase of the
-next P-State from 9 to 16. So this will make processor execute at higher
-P-State for the same CPU load. If the load continues to be more than the
-setpoint during next sample intervals, then P-State will go up again till the
-maximum P-State is reached. But the ramp up time to reach the maximum P-State
-will be much faster when the setpoint is 60 compared to 97.
-
-Debugging Intel P-State driver
-
-Event tracing
-To debug P-State transition, the Linux event tracing interface can be used.
-There are two specific events, which can be enabled (Provided the kernel
-configs related to event tracing are enabled).
-
-# cd /sys/kernel/debug/tracing/
-# echo 1 > events/power/pstate_sample/enable
-# echo 1 > events/power/cpu_frequency/enable
-# cat trace
-gnome-terminal--4510  [001] ..s.  1177.680733: pstate_sample: core_busy=107
-        scaled=94 from=26 to=26 mperf=1143818 aperf=1230607 tsc=29838618
-                freq=2474476
-cat-5235  [002] ..s.  1177.681723: cpu_frequency: state=2900000 cpu_id=2
-
-
-Using ftrace
-
-If function level tracing is required, the Linux ftrace interface can be used.
-For example if we want to check how often a function to set a P-State is
-called, we can set ftrace filter to intel_pstate_set_pstate.
-
-# cd /sys/kernel/debug/tracing/
-# cat available_filter_functions | grep -i pstate
-intel_pstate_set_pstate
-intel_pstate_cpu_init
-...
-
-# echo intel_pstate_set_pstate > set_ftrace_filter
-# echo function > current_tracer
-# cat trace | head -15
-# tracer: function
-#
-# entries-in-buffer/entries-written: 80/80   #P:4
-#
-#                              _-----=> irqs-off
-#                             / _----=> need-resched
-#                            | / _---=> hardirq/softirq
-#                            || / _--=> preempt-depth
-#                            ||| /     delay
-#           TASK-PID   CPU#  ||||    TIMESTAMP  FUNCTION
-#              | |       |   ||||       |         |
-            Xorg-3129  [000] ..s.  2537.644844: intel_pstate_set_pstate <-intel_pstate_timer_func
- gnome-terminal--4510  [002] ..s.  2537.649844: intel_pstate_set_pstate <-intel_pstate_timer_func
-     gnome-shell-3409  [001] ..s.  2537.650850: intel_pstate_set_pstate <-intel_pstate_timer_func
-          <idle>-0     [000] ..s.  2537.654843: intel_pstate_set_pstate <-intel_pstate_timer_func
diff --git a/Documentation/devicetree/bindings/staging/ion/hi6220-ion.txt b/Documentation/devicetree/bindings/staging/ion/hi6220-ion.txt
deleted file mode 100644
index c59e27c632c1..000000000000
--- a/Documentation/devicetree/bindings/staging/ion/hi6220-ion.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-Hi6220 SoC ION
-===================================================================
-Required properties:
-- compatible : "hisilicon,hi6220-ion"
-- list of the ION heaps
-        - heap name : maybe heap_sys_user@0
-        - heap id   : id should be unique in the system.
-        - heap base : base ddr address of the heap,0 means that
-        it is dynamic.
-        - heap size : memory size and 0 means it is dynamic.
-        - heap type : the heap type of the heap, please also
-        see the define in ion.h(drivers/staging/android/uapi/ion.h)
--------------------------------------------------------------------
-Example:
-        hi6220-ion {
-                compatible = "hisilicon,hi6220-ion";
-                heap_sys_user@0 {
-                        heap-name = "sys_user";
-                        heap-id   = <0x0>;
-                        heap-base = <0x0>;
-                        heap-size = <0x0>;
-                        heap-type = "ion_system";
-                };
-                heap_sys_contig@0 {
-                        heap-name = "sys_contig";
-                        heap-id   = <0x1>;
-                        heap-base = <0x0>;
-                        heap-size = <0x0>;
-                        heap-type = "ion_system_contig";
-                };
-        };
diff --git a/Documentation/usb/typec.rst b/Documentation/usb/typec.rst
index b67a46779de9..8a7249f2ff04 100644
--- a/Documentation/usb/typec.rst
+++ b/Documentation/usb/typec.rst
@@ -114,8 +114,7 @@ the details during registration. The class offers the following API for
 registering/unregistering cables and their plugs:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_register_cable typec_unregister_cable typec_register_plug
-   typec_unregister_plug
+   :functions: typec_register_cable typec_unregister_cable typec_register_plug typec_unregister_plug
 
 The class will provide a handle to struct typec_cable and struct typec_plug if
 the registration is successful, or NULL if it isn't.
@@ -137,8 +136,7 @@ during connection of a partner or cable, the port driver must use the following
 APIs to report it to the class:
 
 .. kernel-doc:: drivers/usb/typec/typec.c
-   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role
-   typec_set_pwr_opmode
+   :functions: typec_set_data_role typec_set_pwr_role typec_set_vconn_role typec_set_pwr_opmode
 
 Alternate Modes
 ~~~~~~~~~~~~~~~
diff --git a/Documentation/watchdog/watchdog-parameters.txt b/Documentation/watchdog/watchdog-parameters.txt
index 4f7d86dd0a5d..914518aeb972 100644
--- a/Documentation/watchdog/watchdog-parameters.txt
+++ b/Documentation/watchdog/watchdog-parameters.txt
@@ -117,7 +117,7 @@ nowayout: Watchdog cannot be stopped once started
 -------------------------------------------------
 iTCO_wdt:
 heartbeat: Watchdog heartbeat in seconds.
-        (2<heartbeat<39 (TCO v1) or 613 (TCO v2), default=30)
+        (5<=heartbeat<=74 (TCO v1) or 1226 (TCO v2), default=30)
 nowayout: Watchdog cannot be stopped once started
         (default=kernel config parameter)
 -------------------------------------------------
diff --git a/MAINTAINERS b/MAINTAINERS
index f7d568b8f133..9e984645c4b0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -846,7 +846,6 @@ M:	Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
 S:      Supported
-F:      Documentation/devicetree/bindings/staging/ion/
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
 F:      drivers/staging/android/uapi/ion_test.h
@@ -3116,6 +3115,14 @@ F:	drivers/net/ieee802154/cc2520.c
 F:      include/linux/spi/cc2520.h
 F:      Documentation/devicetree/bindings/net/ieee802154/cc2520.txt
 
+CCREE ARM TRUSTZONE CRYPTOCELL 700 REE DRIVER
+M:      Gilad Ben-Yossef <gilad@benyossef.com>
+L:      linux-crypto@vger.kernel.org
+L:      driverdev-devel@linuxdriverproject.org
+S:      Supported
+F:      drivers/staging/ccree/
+W:      https://developer.arm.com/products/system-ip/trustzone-cryptocell/cryptocell-700-family
+
 CEC FRAMEWORK
 M:      Hans Verkuil <hans.verkuil@cisco.com>
 L:      linux-media@vger.kernel.org
@@ -5695,7 +5702,7 @@ M:	Alex Elder <elder@kernel.org>
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 S:      Maintained
 F:      drivers/staging/greybus/
-L:      greybus-dev@lists.linaro.org
+L:      greybus-dev@lists.linaro.org (moderated for non-subscribers)
 
 GREYBUS AUDIO PROTOCOLS DRIVERS
 M:      Vaibhav Agarwal <vaibhav.sr@gmail.com>
@@ -9553,10 +9560,6 @@ F:	drivers/net/wireless/intersil/orinoco/
 
 OSD LIBRARY and FILESYSTEM
 M:      Boaz Harrosh <ooo@electrozaur.com>
-M:      Benny Halevy <bhalevy@primarydata.com>
-L:      osd-dev@open-osd.org
-W:      http://open-osd.org
-T:      git git://git.open-osd.org/open-osd.git
 S:      Maintained
 F:      drivers/scsi/osd/
 F:      include/scsi/osd_*
diff --git a/Makefile b/Makefile
index b1ee4a49efa2..63e10bd4f14a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 12
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc2
 NAME = Fearless Coyote
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 9ec56dc97374..ce93124a850b 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1201,8 +1201,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options,
         if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
                 return -EFAULT;
 
-        err = 0;
-        err |= put_user(status, ustatus);
+        err = put_user(status, ustatus);
+        if (ret < 0)
+                return err ? err : ret;
+
         err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
         err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
         err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
diff --git a/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi b/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
index 12c981e51134..9a0599f711ff 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9512.dtsi
@@ -1,6 +1,6 @@
 / {
         aliases {
-                ethernet = &ethernet;
+                ethernet0 = &ethernet;
         };
 };
 
diff --git a/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi b/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
index 3f0a56ebcf1f..dc7ae776db5f 100644
--- a/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
+++ b/arch/arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
@@ -1,6 +1,6 @@
 / {
         aliases {
-                ethernet = &ethernet;
+                ethernet0 = &ethernet;
         };
 };
 
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index 35cea3fcaf5c..561f27d8d922 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -198,8 +198,8 @@
                                 brcm,pins = <0 1>;
                                 brcm,function = <BCM2835_FSEL_ALT0>;
                         };
-                        i2c0_gpio32: i2c0_gpio32 {
-                                brcm,pins = <32 34>;
+                        i2c0_gpio28: i2c0_gpio28 {
+                                brcm,pins = <28 29>;
                                 brcm,function = <BCM2835_FSEL_ALT0>;
                         };
                         i2c0_gpio44: i2c0_gpio44 {
@@ -295,20 +295,28 @@
                         /* Separate from the uart0_gpio14 group
                          * because it conflicts with spi1_gpio16, and
                          * people often run uart0 on the two pins
-                         * without flow contrl.
+                         * without flow control.
                          */
                         uart0_ctsrts_gpio16: uart0_ctsrts_gpio16 {
                                 brcm,pins = <16 17>;
                                 brcm,function = <BCM2835_FSEL_ALT3>;
                         };
-                        uart0_gpio30: uart0_gpio30 {
+                        uart0_ctsrts_gpio30: uart0_ctsrts_gpio30 {
                                 brcm,pins = <30 31>;
                                 brcm,function = <BCM2835_FSEL_ALT3>;
                         };
-                        uart0_ctsrts_gpio32: uart0_ctsrts_gpio32 {
+                        uart0_gpio32: uart0_gpio32 {
                                 brcm,pins = <32 33>;
                                 brcm,function = <BCM2835_FSEL_ALT3>;
                         };
+                        uart0_gpio36: uart0_gpio36 {
+                                brcm,pins = <36 37>;
+                                brcm,function = <BCM2835_FSEL_ALT2>;
+                        };
+                        uart0_ctsrts_gpio38: uart0_ctsrts_gpio38 {
+                                brcm,pins = <38 39>;
+                                brcm,function = <BCM2835_FSEL_ALT2>;
+                        };
 
                         uart1_gpio14: uart1_gpio14 {
                                 brcm,pins = <14 15>;
@@ -326,10 +334,6 @@
                                 brcm,pins = <30 31>;
                                 brcm,function = <BCM2835_FSEL_ALT5>;
                         };
-                        uart1_gpio36: uart1_gpio36 {
-                                brcm,pins = <36 37 38 39>;
-                                brcm,function = <BCM2835_FSEL_ALT2>;
-                        };
                         uart1_gpio40: uart1_gpio40 {
                                 brcm,pins = <40 41>;
                                 brcm,function = <BCM2835_FSEL_ALT5>;
diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
index 4bc4b575c99b..31a9e061ddd0 100644
--- a/arch/arm/boot/dts/dra7-evm.dts
+++ b/arch/arm/boot/dts/dra7-evm.dts
@@ -204,6 +204,8 @@
         tps659038: tps659038@58 {
                 compatible = "ti,tps659038";
                 reg = <0x58>;
+                ti,palmas-override-powerhold;
+                ti,system-power-controller;
 
                 tps659038_pmic {
                         compatible = "ti,tps659038-pmic";
diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
index 57892f264cea..e7144662af45 100644
--- a/arch/arm/boot/dts/dra7.dtsi
+++ b/arch/arm/boot/dts/dra7.dtsi
@@ -2017,4 +2017,8 @@
         coefficients = <0 2000>;
 };
 
+&cpu_crit {
+        temperature = <120000>; /* milli Celsius */
+};
+
 /include/ "dra7xx-clocks.dtsi"
diff --git a/arch/arm/boot/dts/imx53-qsrb.dts b/arch/arm/boot/dts/imx53-qsrb.dts
index de2215832372..4e103a905dc9 100644
--- a/arch/arm/boot/dts/imx53-qsrb.dts
+++ b/arch/arm/boot/dts/imx53-qsrb.dts
@@ -23,7 +23,7 @@
         imx53-qsrb {
                 pinctrl_pmic: pmicgrp {
                         fsl,pins = <
-                                MX53_PAD_CSI0_DAT5__GPIO5_23    0x1e4 /* IRQ */
+                                MX53_PAD_CSI0_DAT5__GPIO5_23    0x1c4 /* IRQ */
                         >;
                 };
         };
diff --git a/arch/arm/boot/dts/imx6sx-sdb.dts b/arch/arm/boot/dts/imx6sx-sdb.dts
index 5bb8fd57e7f5..d71da30c9cff 100644
--- a/arch/arm/boot/dts/imx6sx-sdb.dts
+++ b/arch/arm/boot/dts/imx6sx-sdb.dts
@@ -12,23 +12,6 @@
         model = "Freescale i.MX6 SoloX SDB RevB Board";
 };
 
-&cpu0 {
-        operating-points = <
-                /* kHz    uV */
-                996000  1250000
-                792000  1175000
-                396000  1175000
-                198000  1175000
-                >;
-        fsl,soc-operating-points = <
-                /* ARM kHz      SOC uV */
-                996000  1250000
-                792000  1175000
-                396000  1175000
-                198000  1175000
-        >;
-};
-
 &i2c1 {
         clock-frequency = <100000>;
         pinctrl-names = "default";
diff --git a/arch/arm/boot/dts/include/arm b/arch/arm/boot/dts/include/arm
deleted file mode 120000
index a96aa0ea9d8c..000000000000
--- a/arch/arm/boot/dts/include/arm
+++ /dev/null
@@ -1 +0,0 @@
-..
\ No newline at end of file
diff --git a/arch/arm/boot/dts/include/arm64 b/arch/arm/boot/dts/include/arm64
deleted file mode 120000
index 074a835fca3e..000000000000
--- a/arch/arm/boot/dts/include/arm64
+++ /dev/null
@@ -1 +0,0 @@
-../../../../arm64/boot/dts
\ No newline at end of file
diff --git a/arch/arm/boot/dts/include/dt-bindings b/arch/arm/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/arm/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
index 08cce17a25a0..43e9364083de 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
+++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts
@@ -249,9 +249,9 @@
                         OMAP3_CORE1_IOPAD(0x2110, PIN_INPUT | MUX_MODE0)   /* cam_xclka.cam_xclka */
                         OMAP3_CORE1_IOPAD(0x2112, PIN_INPUT | MUX_MODE0)   /* cam_pclk.cam_pclk */
 
-                        OMAP3_CORE1_IOPAD(0x2114, PIN_INPUT | MUX_MODE0)   /* cam_d0.cam_d0 */
-                        OMAP3_CORE1_IOPAD(0x2116, PIN_INPUT | MUX_MODE0)   /* cam_d1.cam_d1 */
-                        OMAP3_CORE1_IOPAD(0x2118, PIN_INPUT | MUX_MODE0)   /* cam_d2.cam_d2 */
+                        OMAP3_CORE1_IOPAD(0x2116, PIN_INPUT | MUX_MODE0)   /* cam_d0.cam_d0 */
+                        OMAP3_CORE1_IOPAD(0x2118, PIN_INPUT | MUX_MODE0)   /* cam_d1.cam_d1 */
+                        OMAP3_CORE1_IOPAD(0x211a, PIN_INPUT | MUX_MODE0)   /* cam_d2.cam_d2 */
                         OMAP3_CORE1_IOPAD(0x211c, PIN_INPUT | MUX_MODE0)   /* cam_d3.cam_d3 */
                         OMAP3_CORE1_IOPAD(0x211e, PIN_INPUT | MUX_MODE0)   /* cam_d4.cam_d4 */
                         OMAP3_CORE1_IOPAD(0x2120, PIN_INPUT | MUX_MODE0)   /* cam_d5.cam_d5 */
diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi
index 402579ab70d2..3a9e9b6aea68 100644
--- a/arch/arm/boot/dts/mt7623.dtsi
+++ b/arch/arm/boot/dts/mt7623.dtsi
@@ -72,6 +72,8 @@
                              <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>,
                              <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>,
                              <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_HIGH)>;
+                clock-frequency = <13000000>;
+                arm,cpu-registers-not-fw-configured;
         };
 
         watchdog: watchdog@10007000 {
diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi
index b3a8b1f24499..9ec737069369 100644
--- a/arch/arm/boot/dts/omap3-gta04.dtsi
+++ b/arch/arm/boot/dts/omap3-gta04.dtsi
@@ -55,7 +55,8 @@
                 simple-audio-card,bitclock-master = <&telephony_link_master>;
                 simple-audio-card,frame-master = <&telephony_link_master>;
                 simple-audio-card,format = "i2s";
-
+                simple-audio-card,bitclock-inversion;
+                simple-audio-card,frame-inversion;
                 simple-audio-card,cpu {
                         sound-dai = <&mcbsp4>;
                 };
diff --git a/arch/arm/boot/dts/omap4-panda-a4.dts b/arch/arm/boot/dts/omap4-panda-a4.dts
index 78d363177762..f1a6476af371 100644
--- a/arch/arm/boot/dts/omap4-panda-a4.dts
+++ b/arch/arm/boot/dts/omap4-panda-a4.dts
@@ -13,7 +13,7 @@
 /* Pandaboard Rev A4+ have external pullups on SCL & SDA */
 &dss_hdmi_pins {
         pinctrl-single,pins = <
-                OMAP4_IOPAD(0x09a, PIN_INPUT_PULLUP | MUX_MODE0)        /* hdmi_cec.hdmi_cec */
+                OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0)               /* hdmi_cec.hdmi_cec */
                 OMAP4_IOPAD(0x09c, PIN_INPUT | MUX_MODE0)               /* hdmi_scl.hdmi_scl */
                 OMAP4_IOPAD(0x09e, PIN_INPUT | MUX_MODE0)               /* hdmi_sda.hdmi_sda */
                 >;
diff --git a/arch/arm/boot/dts/omap4-panda-es.dts b/arch/arm/boot/dts/omap4-panda-es.dts
index 119f8e657edc..940fe4f7c5f6 100644
--- a/arch/arm/boot/dts/omap4-panda-es.dts
+++ b/arch/arm/boot/dts/omap4-panda-es.dts
@@ -34,7 +34,7 @@
 /* PandaboardES has external pullups on SCL & SDA */
 &dss_hdmi_pins {
         pinctrl-single,pins = <
-                OMAP4_IOPAD(0x09a, PIN_INPUT_PULLUP | MUX_MODE0)        /* hdmi_cec.hdmi_cec */
+                OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0)               /* hdmi_cec.hdmi_cec */
                 OMAP4_IOPAD(0x09c, PIN_INPUT | MUX_MODE0)               /* hdmi_scl.hdmi_scl */
                 OMAP4_IOPAD(0x09e, PIN_INPUT | MUX_MODE0)               /* hdmi_sda.hdmi_sda */
                 >;
diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig
new file mode 100644
index 000000000000..d2d75fa664a6
--- /dev/null
+++ b/arch/arm/configs/gemini_defconfig
@@ -0,0 +1,68 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_SYSVIPC=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_USER_NS=y
+CONFIG_RELAY=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_ARCH_MULTI_V4=y
+# CONFIG_ARCH_MULTI_V7 is not set
+CONFIG_ARCH_GEMINI=y
+CONFIG_PCI=y
+CONFIG_PREEMPT=y
+CONFIG_AEABI=y
+CONFIG_CMDLINE="console=ttyS0,115200n8"
+CONFIG_KEXEC=y
+CONFIG_BINFMT_MISC=y
+CONFIG_PM=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_MTD=y
+CONFIG_MTD_BLOCK=y
+CONFIG_MTD_CFI=y
+CONFIG_MTD_CFI_INTELEXT=y
+CONFIG_MTD_CFI_AMDSTD=y
+CONFIG_MTD_CFI_STAA=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_MTD_PHYSMAP_OF=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=16384
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_BLK_DEV_SD=y
+# CONFIG_SCSI_LOWLEVEL is not set
+CONFIG_ATA=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_GPIO=y
+# CONFIG_INPUT_MOUSE is not set
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_NR_UARTS=1
+CONFIG_SERIAL_8250_RUNTIME_UARTS=1
+CONFIG_SERIAL_OF_PLATFORM=y
+# CONFIG_HW_RANDOM is not set
+# CONFIG_HWMON is not set
+CONFIG_WATCHDOG=y
+CONFIG_GEMINI_WATCHDOG=y
+CONFIG_USB=y
+CONFIG_USB_MON=y
+CONFIG_USB_FOTG210_HCD=y
+CONFIG_USB_STORAGE=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_GEMINI=y
+CONFIG_DMADEVICES=y
+# CONFIG_DNOTIFY is not set
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_ROMFS_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
+# CONFIG_ENABLE_MUST_CHECK is not set
+CONFIG_DEBUG_FS=y
diff --git a/arch/arm/include/asm/kvm_coproc.h b/arch/arm/include/asm/kvm_coproc.h
index 4917c2f7e459..e74ab0fbab79 100644
--- a/arch/arm/include/asm/kvm_coproc.h
+++ b/arch/arm/include/asm/kvm_coproc.h
@@ -31,7 +31,8 @@ void kvm_register_target_coproc_table(struct kvm_coproc_target_table *table);
 int kvm_handle_cp10_id(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp_0_13_access(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp14_load_store(struct kvm_vcpu *vcpu, struct kvm_run *run);
-int kvm_handle_cp14_access(struct kvm_vcpu *vcpu, struct kvm_run *run);
+int kvm_handle_cp14_32(struct kvm_vcpu *vcpu, struct kvm_run *run);
+int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run);
 int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run);
 
diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
index 2c14b69511e9..6d1d2e26dfe5 100644
--- a/arch/arm/kvm/coproc.c
+++ b/arch/arm/kvm/coproc.c
@@ -32,6 +32,7 @@
 #include <asm/vfp.h>
 #include "../vfp/vfpinstr.h"
 
+#define CREATE_TRACE_POINTS
 #include "trace.h"
 #include "coproc.h"
 
@@ -111,12 +112,6 @@ int kvm_handle_cp14_load_store(struct kvm_vcpu *vcpu, struct kvm_run *run)
         return 1;
 }
 
-int kvm_handle_cp14_access(struct kvm_vcpu *vcpu, struct kvm_run *run)
-{
-        kvm_inject_undefined(vcpu);
-        return 1;
-}
-
 static void reset_mpidr(struct kvm_vcpu *vcpu, const struct coproc_reg *r)
 {
         /*
@@ -284,7 +279,7 @@ static bool access_gic_sre(struct kvm_vcpu *vcpu,
  * must always support PMCCNTR (the cycle counter): we just RAZ/WI for
  * all PM registers, which doesn't crash the guest kernel at least.
  */
-static bool pm_fake(struct kvm_vcpu *vcpu,
+static bool trap_raz_wi(struct kvm_vcpu *vcpu,
                     const struct coproc_params *p,
                     const struct coproc_reg *r)
 {
@@ -294,19 +289,19 @@ static bool pm_fake(struct kvm_vcpu *vcpu,
                 return read_zero(vcpu, p);
 }
 
-#define access_pmcr pm_fake
-#define access_pmcntenset pm_fake
-#define access_pmcntenclr pm_fake
-#define access_pmovsr pm_fake
-#define access_pmselr pm_fake
-#define access_pmceid0 pm_fake
-#define access_pmceid1 pm_fake
-#define access_pmccntr pm_fake
-#define access_pmxevtyper pm_fake
-#define access_pmxevcntr pm_fake
-#define access_pmuserenr pm_fake
-#define access_pmintenset pm_fake
-#define access_pmintenclr pm_fake
+#define access_pmcr trap_raz_wi
+#define access_pmcntenset trap_raz_wi
+#define access_pmcntenclr trap_raz_wi
+#define access_pmovsr trap_raz_wi
+#define access_pmselr trap_raz_wi
+#define access_pmceid0 trap_raz_wi
+#define access_pmceid1 trap_raz_wi
+#define access_pmccntr trap_raz_wi
+#define access_pmxevtyper trap_raz_wi
+#define access_pmxevcntr trap_raz_wi
+#define access_pmuserenr trap_raz_wi
+#define access_pmintenset trap_raz_wi
+#define access_pmintenclr trap_raz_wi
 
 /* Architected CP15 registers.
  * CRn denotes the primary register number, but is copied to the CRm in the
@@ -532,12 +527,7 @@ static int emulate_cp15(struct kvm_vcpu *vcpu,
         return 1;
 }
 
-/**
- * kvm_handle_cp15_64 -- handles a mrrc/mcrr trap on a guest CP15 access
- * @vcpu: The VCPU pointer
- * @run:  The kvm_run struct
- */
-int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+static struct coproc_params decode_64bit_hsr(struct kvm_vcpu *vcpu)
 {
         struct coproc_params params;
 
@@ -551,9 +541,38 @@ int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
         params.Rt2 = (kvm_vcpu_get_hsr(vcpu) >> 10) & 0xf;
         params.CRm = 0;
 
+        return params;
+}
+
+/**
+ * kvm_handle_cp15_64 -- handles a mrrc/mcrr trap on a guest CP15 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp15_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_64bit_hsr(vcpu);
+
         return emulate_cp15(vcpu, &params);
 }
 
+/**
+ * kvm_handle_cp14_64 -- handles a mrrc/mcrr trap on a guest CP14 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_64bit_hsr(vcpu);
+
+        /* raz_wi cp14 */
+        trap_raz_wi(vcpu, &params, NULL);
+
+        /* handled */
+        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+        return 1;
+}
+
 static void reset_coproc_regs(struct kvm_vcpu *vcpu,
                               const struct coproc_reg *table, size_t num)
 {
@@ -564,12 +583,7 @@ static void reset_coproc_regs(struct kvm_vcpu *vcpu,
                         table[i].reset(vcpu, &table[i]);
 }
 
-/**
- * kvm_handle_cp15_32 -- handles a mrc/mcr trap on a guest CP15 access
- * @vcpu: The VCPU pointer
- * @run:  The kvm_run struct
- */
-int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
+static struct coproc_params decode_32bit_hsr(struct kvm_vcpu *vcpu)
 {
         struct coproc_params params;
 
@@ -583,9 +597,37 @@ int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
         params.Op2 = (kvm_vcpu_get_hsr(vcpu) >> 17) & 0x7;
         params.Rt2 = 0;
 
+        return params;
+}
+
+/**
+ * kvm_handle_cp15_32 -- handles a mrc/mcr trap on a guest CP15 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp15_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_32bit_hsr(vcpu);
         return emulate_cp15(vcpu, &params);
 }
 
+/**
+ * kvm_handle_cp14_32 -- handles a mrc/mcr trap on a guest CP14 access
+ * @vcpu: The VCPU pointer
+ * @run:  The kvm_run struct
+ */
+int kvm_handle_cp14_32(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+        struct coproc_params params = decode_32bit_hsr(vcpu);
+
+        /* raz_wi cp14 */
+        trap_raz_wi(vcpu, &params, NULL);
+
+        /* handled */
+        kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu));
+        return 1;
+}
+
 /******************************************************************************
  * Userspace API
  *****************************************************************************/
diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c
index 5fd7968cdae9..f86a9aaef462 100644
--- a/arch/arm/kvm/handle_exit.c
+++ b/arch/arm/kvm/handle_exit.c
@@ -95,9 +95,9 @@ static exit_handle_fn arm_exit_handlers[] = {
         [HSR_EC_WFI]            = kvm_handle_wfx,
         [HSR_EC_CP15_32]        = kvm_handle_cp15_32,
         [HSR_EC_CP15_64]        = kvm_handle_cp15_64,
-        [HSR_EC_CP14_MR]        = kvm_handle_cp14_access,
+        [HSR_EC_CP14_MR]        = kvm_handle_cp14_32,
         [HSR_EC_CP14_LS]        = kvm_handle_cp14_load_store,
-        [HSR_EC_CP14_64]        = kvm_handle_cp14_access,
+        [HSR_EC_CP14_64]        = kvm_handle_cp14_64,
         [HSR_EC_CP_0_13]        = kvm_handle_cp_0_13_access,
         [HSR_EC_CP10_ID]        = kvm_handle_cp10_id,
         [HSR_EC_HVC]            = handle_hvc,
diff --git a/arch/arm/kvm/hyp/Makefile b/arch/arm/kvm/hyp/Makefile
index 3023bb530edf..8679405b0b2b 100644
--- a/arch/arm/kvm/hyp/Makefile
+++ b/arch/arm/kvm/hyp/Makefile
@@ -2,6 +2,8 @@
 # Makefile for Kernel-based Virtual Machine module, HYP part
 #
 
+ccflags-y += -fno-stack-protector
+
 KVM=../../../../virt/kvm
 
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
diff --git a/arch/arm/kvm/hyp/switch.c b/arch/arm/kvm/hyp/switch.c
index 92678b7bd046..624a510d31df 100644
--- a/arch/arm/kvm/hyp/switch.c
+++ b/arch/arm/kvm/hyp/switch.c
@@ -48,7 +48,9 @@ static void __hyp_text __activate_traps(struct kvm_vcpu *vcpu, u32 *fpexc_host)
         write_sysreg(HSTR_T(15), HSTR);
         write_sysreg(HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11), HCPTR);
         val = read_sysreg(HDCR);
-        write_sysreg(val | HDCR_TPM | HDCR_TPMCR, HDCR);
+        val |= HDCR_TPM | HDCR_TPMCR; /* trap performance monitors */
+        val |= HDCR_TDRA | HDCR_TDOSA | HDCR_TDA; /* trap debug regs */
+        write_sysreg(val, HDCR);
 }
 
 static void __hyp_text __deactivate_traps(struct kvm_vcpu *vcpu)
diff --git a/arch/arm/kvm/trace.h b/arch/arm/kvm/trace.h
index fc0943776db2..b0d10648c486 100644
--- a/arch/arm/kvm/trace.h
+++ b/arch/arm/kvm/trace.h
@@ -1,5 +1,5 @@
-#if !defined(_TRACE_KVM_H) || defined(TRACE_HEADER_MULTI_READ)
-#define _TRACE_KVM_H
+#if !defined(_TRACE_ARM_KVM_H) || defined(TRACE_HEADER_MULTI_READ)
+#define _TRACE_ARM_KVM_H
 
 #include <linux/tracepoint.h>
 
@@ -74,10 +74,10 @@ TRACE_EVENT(kvm_hvc,
                   __entry->vcpu_pc, __entry->r0, __entry->imm)
 );
 
-#endif /* _TRACE_KVM_H */
+#endif /* _TRACE_ARM_KVM_H */
 
 #undef TRACE_INCLUDE_PATH
-#define TRACE_INCLUDE_PATH arch/arm/kvm
+#define TRACE_INCLUDE_PATH .
 #undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE trace
 
diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
index 2cd27c830ab6..283e79ab587d 100644
--- a/arch/arm/mach-at91/pm.c
+++ b/arch/arm/mach-at91/pm.c
@@ -335,7 +335,7 @@ static const struct ramc_info ramc_infos[] __initconst = {
         { .idle = sama5d3_ddr_standby, .memctrl = AT91_MEMCTRL_DDRSDR},
 };
 
-static const struct of_device_id const ramc_ids[] __initconst = {
+static const struct of_device_id ramc_ids[] __initconst = {
         { .compatible = "atmel,at91rm9200-sdramc", .data = &ramc_infos[0] },
         { .compatible = "atmel,at91sam9260-sdramc", .data = &ramc_infos[1] },
         { .compatible = "atmel,at91sam9g45-ddramc", .data = &ramc_infos[2] },
diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c
index cf3f8658f0e5..a55a7ecf146a 100644
--- a/arch/arm/mach-bcm/bcm_kona_smc.c
+++ b/arch/arm/mach-bcm/bcm_kona_smc.c
@@ -33,7 +33,7 @@ struct bcm_kona_smc_data {
         unsigned result;
 };
 
-static const struct of_device_id const bcm_kona_smc_ids[] __initconst = {
+static const struct of_device_id bcm_kona_smc_ids[] __initconst = {
         {.compatible = "brcm,kona-smc"},
         {.compatible = "bcm,kona-smc"}, /* deprecated name */
         {},
diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c
index 03da3813f1ab..7d5a44a06648 100644
--- a/arch/arm/mach-cns3xxx/core.c
+++ b/arch/arm/mach-cns3xxx/core.c
@@ -346,7 +346,7 @@ static struct usb_ohci_pdata cns3xxx_usb_ohci_pdata = {
         .power_off      = csn3xxx_usb_power_off,
 };
 
-static const struct of_dev_auxdata const cns3xxx_auxdata[] __initconst = {
+static const struct of_dev_auxdata cns3xxx_auxdata[] __initconst = {
         { "intel,usb-ehci", CNS3XXX_USB_BASE, "ehci-platform", &cns3xxx_usb_ehci_pdata },
         { "intel,usb-ohci", CNS3XXX_USB_OHCI_BASE, "ohci-platform", &cns3xxx_usb_ohci_pdata },
         { "cavium,cns3420-ahci", CNS3XXX_SATA2_BASE, "ahci", NULL },
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index 3089d3bfa19b..8cc6338fcb12 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -266,11 +266,12 @@ extern int omap4_cpu_kill(unsigned int cpu);
 extern const struct smp_operations omap4_smp_ops;
 #endif
 
+extern u32 omap4_get_cpu1_ns_pa_addr(void);
+
 #if defined(CONFIG_SMP) && defined(CONFIG_PM)
 extern int omap4_mpuss_init(void);
 extern int omap4_enter_lowpower(unsigned int cpu, unsigned int power_state);
 extern int omap4_hotplug_cpu(unsigned int cpu, unsigned int power_state);
-extern u32 omap4_get_cpu1_ns_pa_addr(void);
 #else
 static inline int omap4_enter_lowpower(unsigned int cpu,
                                         unsigned int power_state)
diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
index 03ec6d307c82..4cfc4f9b2c69 100644
--- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
+++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
@@ -213,11 +213,6 @@ static void __init save_l2x0_context(void)
 {}
 #endif
 
-u32 omap4_get_cpu1_ns_pa_addr(void)
-{
-        return old_cpu1_ns_pa_addr;
-}
-
 /**
  * omap4_enter_lowpower: OMAP4 MPUSS Low Power Entry Function
  * The purpose of this function is to manage low power programming
@@ -457,6 +452,11 @@ int __init omap4_mpuss_init(void)
 
 #endif
 
+u32 omap4_get_cpu1_ns_pa_addr(void)
+{
+        return old_cpu1_ns_pa_addr;
+}
+
 /*
  * For kexec, we must set CPU1_WAKEUP_NS_PA_ADDR to point to
  * current kernel's secondary_startup() early before
diff --git a/arch/arm/mach-omap2/omap-smp.c b/arch/arm/mach-omap2/omap-smp.c
index 3faf454ba487..33e4953c61a8 100644
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -306,7 +306,6 @@ static void __init omap4_smp_maybe_reset_cpu1(struct omap_smp_config *c)
 
         cpu1_startup_pa = readl_relaxed(cfg.wakeupgen_base +
                                         OMAP_AUX_CORE_BOOT_1);
-        cpu1_ns_pa_addr = omap4_get_cpu1_ns_pa_addr();
 
         /* Did the configured secondary_startup() get overwritten? */
         if (!omap4_smp_cpu1_startup_valid(cpu1_startup_pa))
@@ -316,9 +315,13 @@ static void __init omap4_smp_maybe_reset_cpu1(struct omap_smp_config *c)
          * If omap4 or 5 has NS_PA_ADDR configured, CPU1 may be in a
          * deeper idle state in WFI and will wake to an invalid address.
          */
-        if ((soc_is_omap44xx() || soc_is_omap54xx()) &&
-            !omap4_smp_cpu1_startup_valid(cpu1_ns_pa_addr))
-                needs_reset = true;
+        if ((soc_is_omap44xx() || soc_is_omap54xx())) {
+                cpu1_ns_pa_addr = omap4_get_cpu1_ns_pa_addr();
+                if (!omap4_smp_cpu1_startup_valid(cpu1_ns_pa_addr))
+                        needs_reset = true;
+        } else {
+                cpu1_ns_pa_addr = 0;
+        }
 
         if (!needs_reset || !c->cpu1_rstctrl_va)
                 return;
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index 2b138b65129a..dc11841ca334 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -711,7 +711,7 @@ static struct omap_prcm_init_data scrm_data __initdata = {
 };
 #endif
 
-static const struct of_device_id const omap_prcm_dt_match_table[] __initconst = {
+static const struct of_device_id omap_prcm_dt_match_table[] __initconst = {
 #ifdef CONFIG_SOC_AM33XX
         { .compatible = "ti,am3-prcm", .data = &am3_prm_data },
 #endif
diff --git a/arch/arm/mach-omap2/vc.c b/arch/arm/mach-omap2/vc.c
index 2028167fff31..d76b1e5eb8ba 100644
--- a/arch/arm/mach-omap2/vc.c
+++ b/arch/arm/mach-omap2/vc.c
@@ -559,7 +559,7 @@ struct i2c_init_data {
         u8 hsscll_12;
 };
 
-static const struct i2c_init_data const omap4_i2c_timing_data[] __initconst = {
+static const struct i2c_init_data omap4_i2c_timing_data[] __initconst = {
         {
                 .load = 50,
                 .loadbits = 0x3,
diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c
index 4878ba90026d..289e036c9c30 100644
--- a/arch/arm/mach-spear/time.c
+++ b/arch/arm/mach-spear/time.c
@@ -204,7 +204,7 @@ static void __init spear_clockevent_init(int irq)
         setup_irq(irq, &spear_timer_irq);
 }
 
-static const struct of_device_id const timer_of_match[] __initconst = {
+static const struct of_device_id timer_of_match[] __initconst = {
         { .compatible = "st,spear-timer", },
         { },
 };
diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index 4afcffcb46cb..73272f43ca01 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -106,8 +106,13 @@ config ARCH_MVEBU
         select ARMADA_AP806_SYSCON
         select ARMADA_CP110_SYSCON
         select ARMADA_37XX_CLK
+        select GPIOLIB
+        select GPIOLIB_IRQCHIP
         select MVEBU_ODMI
         select MVEBU_PIC
+        select OF_GPIO
+        select PINCTRL
+        select PINCTRL_ARMADA_37XX
         help
           This enables support for Marvell EBU familly, including:
            - Armada 3700 SoC Family
diff --git a/arch/arm64/boot/dts/include/arm b/arch/arm64/boot/dts/include/arm
deleted file mode 120000
index cf63d80e2b93..000000000000
--- a/arch/arm64/boot/dts/include/arm
+++ /dev/null
@@ -1 +0,0 @@
-../../../../arm/boot/dts
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/include/arm64 b/arch/arm64/boot/dts/include/arm64
deleted file mode 120000
index a96aa0ea9d8c..000000000000
--- a/arch/arm64/boot/dts/include/arm64
+++ /dev/null
@@ -1 +0,0 @@
-..
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/include/dt-bindings b/arch/arm64/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/arm64/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/marvell/armada-3720-db.dts b/arch/arm64/boot/dts/marvell/armada-3720-db.dts
index cef5f976bc0f..a89855f57091 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-db.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-db.dts
@@ -79,6 +79,8 @@
 };
 
 &i2c0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&i2c1_pins>;
         status = "okay";
 
         gpio_exp: pca9555@22 {
@@ -113,6 +115,8 @@
 
 &spi0 {
         status = "okay";
+        pinctrl-names = "default";
+        pinctrl-0 = <&spi_quad_pins>;
 
         m25p80@0 {
                 compatible = "jedec,spi-nor";
@@ -143,6 +147,8 @@
 
 /* Exported on the micro USB connector CON32 through an FTDI */
 &uart0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&uart1_pins>;
         status = "okay";
 };
 
@@ -184,6 +190,8 @@
 };
 
 &eth0 {
+        pinctrl-names = "default";
+        pinctrl-0 = <&rgmii_pins>;
         phy-mode = "rgmii-id";
         phy = <&phy0>;
         status = "okay";
diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
index 58ae9e095af2..4d495ec39202 100644
--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
@@ -161,16 +161,83 @@
                                 #clock-cells = <1>;
                         };
 
-                        gpio1: gpio@13800 {
-                                compatible = "marvell,mvebu-gpio-3700",
+                        pinctrl_nb: pinctrl@13800 {
+                                compatible = "marvell,armada3710-nb-pinctrl",
                                 "syscon", "simple-mfd";
-                                reg = <0x13800 0x500>;
+                                reg = <0x13800 0x100>, <0x13C00 0x20>;
+                                gpionb: gpio {
+                                        #gpio-cells = <2>;
+                                        gpio-ranges = <&pinctrl_nb 0 0 36>;
+                                        gpio-controller;
+                                        interrupts =
+                                        <GIC_SPI 51 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 56 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 57 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 58 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 152 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 153 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 154 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 155 IRQ_TYPE_LEVEL_HIGH>;
+
+                                };
 
                                 xtalclk: xtal-clk {
                                         compatible = "marvell,armada-3700-xtal-clock";
                                         clock-output-names = "xtal";
                                         #clock-cells = <0>;
                                 };
+
+                                spi_quad_pins: spi-quad-pins {
+                                        groups = "spi_quad";
+                                        function = "spi";
+                                };
+
+                                i2c1_pins: i2c1-pins {
+                                        groups = "i2c1";
+                                        function = "i2c";
+                                };
+
+                                i2c2_pins: i2c2-pins {
+                                        groups = "i2c2";
+                                        function = "i2c";
+                                };
+
+                                uart1_pins: uart1-pins {
+                                        groups = "uart1";
+                                        function = "uart";
+                                };
+
+                                uart2_pins: uart2-pins {
+                                        groups = "uart2";
+                                        function = "uart";
+                                };
+                        };
+
+                        pinctrl_sb: pinctrl@18800 {
+                                compatible = "marvell,armada3710-sb-pinctrl",
+                                "syscon", "simple-mfd";
+                                reg = <0x18800 0x100>, <0x18C00 0x20>;
+                                gpiosb: gpio {
+                                        #gpio-cells = <2>;
+                                        gpio-ranges = <&pinctrl_sb 0 0 29>;
+                                        gpio-controller;
+                                        interrupts =
+                                        <GIC_SPI 160 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 159 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 158 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 157 IRQ_TYPE_LEVEL_HIGH>,
+                                        <GIC_SPI 156 IRQ_TYPE_LEVEL_HIGH>;
+                                };
+
+                                rgmii_pins: mii-pins {
+                                        groups = "rgmii";
+                                        function = "mii";
+                                };
+
                         };
 
                         eth0: ethernet@30000 {
diff --git a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
index 0ecaad4333a7..1c3634fa94bf 100644
--- a/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
+++ b/arch/arm64/boot/dts/mediatek/mt8173-evb.dts
@@ -134,6 +134,9 @@
         bus-width = <8>;
         max-frequency = <50000000>;
         cap-mmc-highspeed;
+        mediatek,hs200-cmd-int-delay=<26>;
+        mediatek,hs400-cmd-int-delay=<14>;
+        mediatek,hs400-cmd-resp-sel-rising;
         vmmc-supply = <&mt6397_vemc_3v3_reg>;
         vqmmc-supply = <&mt6397_vio18_reg>;
         non-removable;
diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
index 658bb9dc9dfd..7bd31066399b 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
+++ b/arch/arm64/boot/dts/rockchip/rk3399-gru-kevin.dts
@@ -44,7 +44,7 @@
 
 /dts-v1/;
 #include "rk3399-gru.dtsi"
-#include <include/dt-bindings/input/linux-event-codes.h>
+#include <dt-bindings/input/linux-event-codes.h>
 
 /*
  * Kevin-specific things
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index ce072859e3b2..65cdd878cfbd 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -30,7 +30,6 @@ CONFIG_PROFILING=y
 CONFIG_JUMP_LABEL=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
-# CONFIG_BLK_DEV_BSG is not set
 # CONFIG_IOSCHED_DEADLINE is not set
 CONFIG_ARCH_SUNXI=y
 CONFIG_ARCH_ALPINE=y
@@ -62,16 +61,15 @@ CONFIG_ARCH_XGENE=y
 CONFIG_ARCH_ZX=y
 CONFIG_ARCH_ZYNQMP=y
 CONFIG_PCI=y
-CONFIG_PCI_MSI=y
 CONFIG_PCI_IOV=y
-CONFIG_PCI_AARDVARK=y
-CONFIG_PCIE_RCAR=y
-CONFIG_PCI_HOST_GENERIC=y
-CONFIG_PCI_XGENE=y
 CONFIG_PCI_LAYERSCAPE=y
 CONFIG_PCI_HISI=y
 CONFIG_PCIE_QCOM=y
 CONFIG_PCIE_ARMADA_8K=y
+CONFIG_PCI_AARDVARK=y
+CONFIG_PCIE_RCAR=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCI_XGENE=y
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_SCHED_MC=y
 CONFIG_NUMA=y
@@ -80,12 +78,11 @@ CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
 CONFIG_SECCOMP=y
-CONFIG_XEN=y
 CONFIG_KEXEC=y
 CONFIG_CRASH_DUMP=y
+CONFIG_XEN=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 CONFIG_COMPAT=y
-CONFIG_CPU_IDLE=y
 CONFIG_HIBERNATION=y
 CONFIG_ARM_CPUIDLE=y
 CONFIG_CPU_FREQ=y
@@ -155,8 +152,8 @@ CONFIG_MTD_SPI_NOR=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_NBD=m
 CONFIG_VIRTIO_BLK=y
-CONFIG_EEPROM_AT25=m
 CONFIG_SRAM=y
+CONFIG_EEPROM_AT25=m
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_BLK_DEV_SD=y
 CONFIG_SCSI_SAS_ATA=y
@@ -168,8 +165,8 @@ CONFIG_AHCI_CEVA=y
 CONFIG_AHCI_MVEBU=y
 CONFIG_AHCI_XGENE=y
 CONFIG_AHCI_QORIQ=y
-CONFIG_SATA_RCAR=y
 CONFIG_SATA_SIL24=y
+CONFIG_SATA_RCAR=y
 CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_NETDEVICES=y
@@ -186,18 +183,17 @@ CONFIG_HNS_ENET=y
 CONFIG_E1000E=y
 CONFIG_IGB=y
 CONFIG_IGBVF=y
-CONFIG_MVPP2=y
 CONFIG_MVNETA=y
+CONFIG_MVPP2=y
 CONFIG_SKY2=y
 CONFIG_RAVB=y
 CONFIG_SMC91X=y
 CONFIG_SMSC911X=y
 CONFIG_STMMAC_ETH=m
-CONFIG_REALTEK_PHY=m
+CONFIG_MDIO_BUS_MUX_MMIOREG=y
 CONFIG_MESON_GXL_PHY=m
 CONFIG_MICREL_PHY=y
-CONFIG_MDIO_BUS_MUX=y
-CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_REALTEK_PHY=m
 CONFIG_USB_PEGASUS=m
 CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=m
@@ -230,14 +226,14 @@ CONFIG_SERIAL_8250_UNIPHIER=y
 CONFIG_SERIAL_OF_PLATFORM=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_MESON=y
+CONFIG_SERIAL_MESON_CONSOLE=y
 CONFIG_SERIAL_SAMSUNG=y
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
 CONFIG_SERIAL_TEGRA=y
 CONFIG_SERIAL_SH_SCI=y
 CONFIG_SERIAL_SH_SCI_NR_UARTS=11
 CONFIG_SERIAL_SH_SCI_CONSOLE=y
-CONFIG_SERIAL_MESON=y
-CONFIG_SERIAL_MESON_CONSOLE=y
 CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
 CONFIG_SERIAL_XILINX_PS_UART=y
@@ -261,14 +257,14 @@ CONFIG_I2C_UNIPHIER_F=y
 CONFIG_I2C_RCAR=y
 CONFIG_I2C_CROS_EC_TUNNEL=y
 CONFIG_SPI=y
-CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_BCM2835=m
 CONFIG_SPI_BCM2835AUX=m
+CONFIG_SPI_MESON_SPIFC=m
 CONFIG_SPI_ORION=y
 CONFIG_SPI_PL022=y
 CONFIG_SPI_QUP=y
-CONFIG_SPI_SPIDEV=m
 CONFIG_SPI_S3C64XX=y
+CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
 CONFIG_PINCTRL_SINGLE=y
 CONFIG_PINCTRL_MAX77620=y
@@ -286,33 +282,30 @@ CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
 CONFIG_GPIO_MAX77620=y
 CONFIG_POWER_RESET_MSM=y
-CONFIG_BATTERY_BQ27XXX=y
 CONFIG_POWER_RESET_XGENE=y
 CONFIG_POWER_RESET_SYSCON=y
+CONFIG_BATTERY_BQ27XXX=y
+CONFIG_SENSORS_ARM_SCPI=y
 CONFIG_SENSORS_LM90=m
 CONFIG_SENSORS_INA2XX=m
-CONFIG_SENSORS_ARM_SCPI=y
-CONFIG_THERMAL=y
-CONFIG_THERMAL_EMULATION=y
 CONFIG_THERMAL_GOV_POWER_ALLOCATOR=y
 CONFIG_CPU_THERMAL=y
-CONFIG_BCM2835_THERMAL=y
+CONFIG_THERMAL_EMULATION=y
 CONFIG_EXYNOS_THERMAL=y
 CONFIG_WATCHDOG=y
-CONFIG_BCM2835_WDT=y
-CONFIG_RENESAS_WDT=y
 CONFIG_S3C2410_WATCHDOG=y
 CONFIG_MESON_GXBB_WATCHDOG=m
 CONFIG_MESON_WATCHDOG=m
+CONFIG_RENESAS_WDT=y
+CONFIG_BCM2835_WDT=y
+CONFIG_MFD_CROS_EC=y
+CONFIG_MFD_CROS_EC_I2C=y
 CONFIG_MFD_EXYNOS_LPASS=m
+CONFIG_MFD_HI655X_PMIC=y
 CONFIG_MFD_MAX77620=y
-CONFIG_MFD_RK808=y
 CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_RK808=y
 CONFIG_MFD_SEC_CORE=y
-CONFIG_MFD_HI655X_PMIC=y
-CONFIG_REGULATOR=y
-CONFIG_MFD_CROS_EC=y
-CONFIG_MFD_CROS_EC_I2C=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_REGULATOR_GPIO=y
 CONFIG_REGULATOR_HI655X=y
@@ -345,13 +338,12 @@ CONFIG_DRM_EXYNOS_DSI=y
 CONFIG_DRM_EXYNOS_HDMI=y
 CONFIG_DRM_EXYNOS_MIC=y
 CONFIG_DRM_RCAR_DU=m
-CONFIG_DRM_RCAR_HDMI=y
 CONFIG_DRM_RCAR_LVDS=y
 CONFIG_DRM_RCAR_VSP=y
 CONFIG_DRM_TEGRA=m
-CONFIG_DRM_VC4=m
 CONFIG_DRM_PANEL_SIMPLE=m
 CONFIG_DRM_I2C_ADV7511=m
+CONFIG_DRM_VC4=m
 CONFIG_DRM_HISI_KIRIN=m
 CONFIG_DRM_MESON=m
 CONFIG_FB=y
@@ -366,39 +358,37 @@ CONFIG_SOUND=y
 CONFIG_SND=y
 CONFIG_SND_SOC=y
 CONFIG_SND_BCM2835_SOC_I2S=m
-CONFIG_SND_SOC_RCAR=y
 CONFIG_SND_SOC_SAMSUNG=y
+CONFIG_SND_SOC_RCAR=y
 CONFIG_SND_SOC_AK4613=y
 CONFIG_USB=y
 CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=y
-CONFIG_USB_XHCI_PLATFORM=y
-CONFIG_USB_XHCI_RCAR=y
-CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_XHCI_TEGRA=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_EHCI_MSM=y
+CONFIG_USB_EHCI_EXYNOS=y
 CONFIG_USB_EHCI_HCD_PLATFORM=y
-CONFIG_USB_OHCI_EXYNOS=y
 CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_EXYNOS=y
 CONFIG_USB_OHCI_HCD_PLATFORM=y
 CONFIG_USB_RENESAS_USBHS=m
 CONFIG_USB_STORAGE=y
-CONFIG_USB_DWC2=y
 CONFIG_USB_DWC3=y
+CONFIG_USB_DWC2=y
 CONFIG_USB_CHIPIDEA=y
 CONFIG_USB_CHIPIDEA_UDC=y
 CONFIG_USB_CHIPIDEA_HOST=y
 CONFIG_USB_ISP1760=y
 CONFIG_USB_HSIC_USB3503=y
 CONFIG_USB_MSM_OTG=y
+CONFIG_USB_QCOM_8X16_PHY=y
 CONFIG_USB_ULPI=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_RENESAS_USBHS_UDC=m
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_ARMMMCI=y
-CONFIG_MMC_MESON_GX=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_ACPI=y
 CONFIG_MMC_SDHCI_PLTFM=y
@@ -406,6 +396,7 @@ CONFIG_MMC_SDHCI_OF_ARASAN=y
 CONFIG_MMC_SDHCI_OF_ESDHC=y
 CONFIG_MMC_SDHCI_CADENCE=y
 CONFIG_MMC_SDHCI_TEGRA=y
+CONFIG_MMC_MESON_GX=y
 CONFIG_MMC_SDHCI_MSM=y
 CONFIG_MMC_SPI=y
 CONFIG_MMC_SDHI=y
@@ -414,32 +405,31 @@ CONFIG_MMC_DW_EXYNOS=y
 CONFIG_MMC_DW_K3=y
 CONFIG_MMC_DW_ROCKCHIP=y
 CONFIG_MMC_SUNXI=y
-CONFIG_MMC_SDHCI_XENON=y
 CONFIG_MMC_BCM2835=y
+CONFIG_MMC_SDHCI_XENON=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LEDS_PWM=y
 CONFIG_LEDS_SYSCON=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_HEARTBEAT=y
 CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MAX77686=y
+CONFIG_RTC_DRV_RK808=m
 CONFIG_RTC_DRV_S5M=y
 CONFIG_RTC_DRV_DS3232=y
 CONFIG_RTC_DRV_EFI=y
+CONFIG_RTC_DRV_S3C=y
 CONFIG_RTC_DRV_PL031=y
 CONFIG_RTC_DRV_SUN6I=y
-CONFIG_RTC_DRV_RK808=m
 CONFIG_RTC_DRV_TEGRA=y
 CONFIG_RTC_DRV_XGENE=y
-CONFIG_RTC_DRV_S3C=y
 CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=m
 CONFIG_MV_XOR_V2=y
 CONFIG_PL330_DMA=y
-CONFIG_DMA_BCM2835=m
 CONFIG_TEGRA20_APB_DMA=y
 CONFIG_QCOM_BAM_DMA=y
 CONFIG_QCOM_HIDMA_MGMT=y
@@ -452,52 +442,53 @@ CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_XEN_GNTDEV=y
 CONFIG_XEN_GRANT_DEV_ALLOC=y
+CONFIG_COMMON_CLK_RK808=y
 CONFIG_COMMON_CLK_SCPI=y
 CONFIG_COMMON_CLK_CS2000_CP=y
 CONFIG_COMMON_CLK_S2MPS11=y
-CONFIG_COMMON_CLK_PWM=y
-CONFIG_COMMON_CLK_RK808=y
 CONFIG_CLK_QORIQ=y
+CONFIG_COMMON_CLK_PWM=y
 CONFIG_COMMON_CLK_QCOM=y
+CONFIG_QCOM_CLK_SMD_RPM=y
 CONFIG_MSM_GCC_8916=y
 CONFIG_MSM_GCC_8994=y
 CONFIG_MSM_MMCC_8996=y
 CONFIG_HWSPINLOCK_QCOM=y
-CONFIG_MAILBOX=y
 CONFIG_ARM_MHU=y
 CONFIG_PLATFORM_MHU=y
 CONFIG_BCM2835_MBOX=y
 CONFIG_HI6220_MBOX=y
 CONFIG_ARM_SMMU=y
 CONFIG_ARM_SMMU_V3=y
+CONFIG_RPMSG_QCOM_SMD=y
 CONFIG_RASPBERRYPI_POWER=y
 CONFIG_QCOM_SMEM=y
-CONFIG_QCOM_SMD=y
 CONFIG_QCOM_SMD_RPM=y
+CONFIG_QCOM_SMP2P=y
+CONFIG_QCOM_SMSM=y
 CONFIG_ROCKCHIP_PM_DOMAINS=y
 CONFIG_ARCH_TEGRA_132_SOC=y
 CONFIG_ARCH_TEGRA_210_SOC=y
 CONFIG_ARCH_TEGRA_186_SOC=y
 CONFIG_EXTCON_USB_GPIO=y
+CONFIG_IIO=y
+CONFIG_EXYNOS_ADC=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=m
+CONFIG_PWM_MESON=m
 CONFIG_PWM_ROCKCHIP=y
+CONFIG_PWM_SAMSUNG=y
 CONFIG_PWM_TEGRA=m
-CONFIG_PWM_MESON=m
-CONFIG_COMMON_RESET_HI6220=y
 CONFIG_PHY_RCAR_GEN3_USB2=y
 CONFIG_PHY_HI6220_USB=y
+CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_ROCKCHIP_INNO_USB2=y
 CONFIG_PHY_ROCKCHIP_EMMC=y
-CONFIG_PHY_SUN4I_USB=y
 CONFIG_PHY_XGENE=y
 CONFIG_PHY_TEGRA_XUSB=y
 CONFIG_ARM_SCPI_PROTOCOL=y
-CONFIG_ACPI=y
-CONFIG_IIO=y
-CONFIG_EXYNOS_ADC=y
-CONFIG_PWM_SAMSUNG=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_ACPI=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
@@ -511,7 +502,6 @@ CONFIG_FUSE_FS=m
 CONFIG_CUSE=m
 CONFIG_OVERLAY_FS=m
 CONFIG_VFAT_FS=y
-CONFIG_TMPFS=y
 CONFIG_HUGETLBFS=y
 CONFIG_CONFIGFS_FS=y
 CONFIG_EFIVAR_FS=y
@@ -539,11 +529,9 @@ CONFIG_MEMTEST=y
 CONFIG_SECURITY=y
 CONFIG_CRYPTO_ECHAINIV=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
-CONFIG_CRYPTO_DEV_SAFEXCEL=m
 CONFIG_ARM64_CRYPTO=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
-# CONFIG_CRYPTO_AES_ARM64_NEON_BLK is not set
diff --git a/arch/arm64/include/asm/atomic_ll_sc.h b/arch/arm64/include/asm/atomic_ll_sc.h
index f819fdcff1ac..f5a2d09afb38 100644
--- a/arch/arm64/include/asm/atomic_ll_sc.h
+++ b/arch/arm64/include/asm/atomic_ll_sc.h
@@ -264,7 +264,6 @@ __LL_SC_PREFIX(__cmpxchg_case_##name(volatile void *ptr,		\
         "       st" #rel "xr" #sz "\t%w[tmp], %" #w "[new], %[v]\n"     \
         "       cbnz    %w[tmp], 1b\n"                                  \
         "       " #mb "\n"                                              \
-        "       mov     %" #w "[oldval], %" #w "[old]\n"                \
         "2:"                                                            \
         : [tmp] "=&r" (tmp), [oldval] "=&r" (oldval),                   \
           [v] "+Q" (*(unsigned long *)ptr)                              \
diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index e7f84a7b4465..428ee1f2468c 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -115,6 +115,7 @@ struct arm64_cpu_capabilities {
 
 extern DECLARE_BITMAP(cpu_hwcaps, ARM64_NCAPS);
 extern struct static_key_false cpu_hwcap_keys[ARM64_NCAPS];
+extern struct static_key_false arm64_const_caps_ready;
 
 bool this_cpu_has_cap(unsigned int cap);
 
@@ -124,7 +125,7 @@ static inline bool cpu_have_feature(unsigned int num)
 }
 
 /* System capability check for constant caps */
-static inline bool cpus_have_const_cap(int num)
+static inline bool __cpus_have_const_cap(int num)
 {
         if (num >= ARM64_NCAPS)
                 return false;
@@ -138,6 +139,14 @@ static inline bool cpus_have_cap(unsigned int num)
         return test_bit(num, cpu_hwcaps);
 }
 
+static inline bool cpus_have_const_cap(int num)
+{
+        if (static_branch_likely(&arm64_const_caps_ready))
+                return __cpus_have_const_cap(num);
+        else
+                return cpus_have_cap(num);
+}
+
 static inline void cpus_set_cap(unsigned int num)
 {
         if (num >= ARM64_NCAPS) {
@@ -145,7 +154,6 @@ static inline void cpus_set_cap(unsigned int num)
                         num, ARM64_NCAPS);
         } else {
                 __set_bit(num, cpu_hwcaps);
-                static_branch_enable(&cpu_hwcap_keys[num]);
         }
 }
 
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 5e19165c5fa8..1f252a95bc02 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -24,6 +24,7 @@
 
 #include <linux/types.h>
 #include <linux/kvm_types.h>
+#include <asm/cpufeature.h>
 #include <asm/kvm.h>
 #include <asm/kvm_asm.h>
 #include <asm/kvm_mmio.h>
@@ -355,9 +356,12 @@ static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr,
                                        unsigned long vector_ptr)
 {
         /*
-         * Call initialization code, and switch to the full blown
-         * HYP code.
+         * Call initialization code, and switch to the full blown HYP code.
+         * If the cpucaps haven't been finalized yet, something has gone very
+         * wrong, and hyp will crash and burn when it uses any
+         * cpus_have_const_cap() wrapper.
          */
+        BUG_ON(!static_branch_likely(&arm64_const_caps_ready));
         __kvm_call_hyp((void *)pgd_ptr, hyp_stack_ptr, vector_ptr);
 }
 
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 94b8f7fc3310..817ce3365e20 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -985,8 +985,16 @@ void update_cpu_capabilities(const struct arm64_cpu_capabilities *caps,
  */
 void __init enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
 {
-        for (; caps->matches; caps++)
-                if (caps->enable && cpus_have_cap(caps->capability))
+        for (; caps->matches; caps++) {
+                unsigned int num = caps->capability;
+
+                if (!cpus_have_cap(num))
+                        continue;
+
+                /* Ensure cpus_have_const_cap(num) works */
+                static_branch_enable(&cpu_hwcap_keys[num]);
+
+                if (caps->enable) {
                         /*
                          * Use stop_machine() as it schedules the work allowing
                          * us to modify PSTATE, instead of on_each_cpu() which
@@ -994,6 +1002,8 @@ void __init enable_cpu_capabilities(const struct arm64_cpu_capabilities *caps)
                          * we return.
                          */
                         stop_machine(caps->enable, NULL, cpu_online_mask);
+                }
+        }
 }
 
 /*
@@ -1096,6 +1106,14 @@ static void __init setup_feature_capabilities(void)
         enable_cpu_capabilities(arm64_features);
 }
 
+DEFINE_STATIC_KEY_FALSE(arm64_const_caps_ready);
+EXPORT_SYMBOL(arm64_const_caps_ready);
+
+static void __init mark_const_caps_ready(void)
+{
+        static_branch_enable(&arm64_const_caps_ready);
+}
+
 /*
  * Check if the current CPU has a given feature capability.
  * Should be called from non-preemptible context.
@@ -1131,6 +1149,7 @@ void __init setup_cpu_features(void)
         /* Set the CPU feature capabilies */
         setup_feature_capabilities();
         enable_errata_workarounds();
+        mark_const_caps_ready();
         setup_elf_hwcaps(arm64_elf_hwcaps);
 
         if (system_supports_32bit_el0())
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index bcc79471b38e..83a1b1ad189f 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -877,15 +877,24 @@ static int armv8pmu_set_event_filter(struct hw_perf_event *event,
 
         if (attr->exclude_idle)
                 return -EPERM;
-        if (is_kernel_in_hyp_mode() &&
-            attr->exclude_kernel != attr->exclude_hv)
-                return -EINVAL;
+
+        /*
+         * If we're running in hyp mode, then we *are* the hypervisor.
+         * Therefore we ignore exclude_hv in this configuration, since
+         * there's no hypervisor to sample anyway. This is consistent
+         * with other architectures (x86 and Power).
+         */
+        if (is_kernel_in_hyp_mode()) {
+                if (!attr->exclude_kernel)
+                        config_base |= ARMV8_PMU_INCLUDE_EL2;
+        } else {
+                if (attr->exclude_kernel)
+                        config_base |= ARMV8_PMU_EXCLUDE_EL1;
+                if (!attr->exclude_hv)
+                        config_base |= ARMV8_PMU_INCLUDE_EL2;
+        }
         if (attr->exclude_user)
                 config_base |= ARMV8_PMU_EXCLUDE_EL0;
-        if (!is_kernel_in_hyp_mode() && attr->exclude_kernel)
-                config_base |= ARMV8_PMU_EXCLUDE_EL1;
-        if (!attr->exclude_hv)
-                config_base |= ARMV8_PMU_INCLUDE_EL2;
 
         /*
          * Install the filter into config_base as this is used to
diff --git a/arch/arm64/kvm/hyp/Makefile b/arch/arm64/kvm/hyp/Makefile
index aaf42ae8d8c3..14c4e3b14bcb 100644
--- a/arch/arm64/kvm/hyp/Makefile
+++ b/arch/arm64/kvm/hyp/Makefile
@@ -2,6 +2,8 @@
 # Makefile for Kernel-based Virtual Machine module, HYP part
 #
 
+ccflags-y += -fno-stack-protector
+
 KVM=../../../../virt/kvm
 
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o
diff --git a/arch/cris/boot/dts/include/dt-bindings b/arch/cris/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/cris/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/metag/boot/dts/include/dt-bindings b/arch/metag/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/metag/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/mips/boot/dts/include/dt-bindings b/arch/mips/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/mips/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/powerpc/boot/dts/include/dt-bindings b/arch/powerpc/boot/dts/include/dt-bindings
deleted file mode 120000
index 08c00e4972fa..000000000000
--- a/arch/powerpc/boot/dts/include/dt-bindings
+++ /dev/null
@@ -1 +0,0 @@
-../../../../../include/dt-bindings
\ No newline at end of file
diff --git a/arch/powerpc/include/asm/module.h b/arch/powerpc/include/asm/module.h
index 53885512b8d3..6c0132c7212f 100644
--- a/arch/powerpc/include/asm/module.h
+++ b/arch/powerpc/include/asm/module.h
@@ -14,6 +14,10 @@
 #include <asm-generic/module.h>
 
 
+#ifdef CC_USING_MPROFILE_KERNEL
+#define MODULE_ARCH_VERMAGIC    "mprofile-kernel"
+#endif
+
 #ifndef __powerpc64__
 /*
  * Thanks to Paul M for explaining this.
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
index 2a32483c7b6c..8da5d4c1cab2 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -132,7 +132,19 @@ extern long long virt_phys_offset;
 #define virt_to_pfn(kaddr)      (__pa(kaddr) >> PAGE_SHIFT)
 #define virt_to_page(kaddr)     pfn_to_page(virt_to_pfn(kaddr))
 #define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
+
+#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * On hash the vmalloc and other regions alias to the kernel region when passed
+ * through __pa(), which virt_to_pfn() uses. That means virt_addr_valid() can
+ * return true for some vmalloc addresses, which is incorrect. So explicitly
+ * check that the address is in the kernel region.
+ */
+#define virt_addr_valid(kaddr) (REGION_ID(kaddr) == KERNEL_REGION_ID && \
+                                pfn_valid(virt_to_pfn(kaddr)))
+#else
 #define virt_addr_valid(kaddr)  pfn_valid(virt_to_pfn(kaddr))
+#endif
 
 /*
  * On Book-E parts we need __va to parse the device tree and we can't
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index 07d4e0ad60db..4898d676dcae 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -416,7 +416,7 @@ power9_dd1_recover_paca:
          * which needs to be restored from the stack.
          */
         li      r3, 1
-        stb     r0,PACA_NAPSTATELOST(r13)
+        stb     r3,PACA_NAPSTATELOST(r13)
         blr
 
 /*
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 160ae0fa7d0d..fc4343514bed 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -305,16 +305,17 @@ int kprobe_handler(struct pt_regs *regs)
                         save_previous_kprobe(kcb);
                         set_current_kprobe(p, regs, kcb);
                         kprobes_inc_nmissed_count(p);
-                        prepare_singlestep(p, regs);
                         kcb->kprobe_status = KPROBE_REENTER;
                         if (p->ainsn.boostable >= 0) {
                                 ret = try_to_emulate(p, regs);
 
                                 if (ret > 0) {
                                         restore_previous_kprobe(kcb);
+                                        preempt_enable_no_resched();
                                         return 1;
                                 }
                         }
+                        prepare_singlestep(p, regs);
                         return 1;
                 } else {
                         if (*addr != BREAKPOINT_INSTRUCTION) {
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index d645da302bf2..baae104b16c7 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -864,6 +864,25 @@ static void tm_reclaim_thread(struct thread_struct *thr,
         if (!MSR_TM_SUSPENDED(mfmsr()))
                 return;
 
+        /*
+         * If we are in a transaction and FP is off then we can't have
+         * used FP inside that transaction. Hence the checkpointed
+         * state is the same as the live state. We need to copy the
+         * live state to the checkpointed state so that when the
+         * transaction is restored, the checkpointed state is correct
+         * and the aborted transaction sees the correct state. We use
+         * ckpt_regs.msr here as that's what tm_reclaim will use to
+         * determine if it's going to write the checkpointed state or
+         * not. So either this will write the checkpointed registers,
+         * or reclaim will. Similarly for VMX.
+         */
+        if ((thr->ckpt_regs.msr & MSR_FP) == 0)
+                memcpy(&thr->ckfp_state, &thr->fp_state,
+                       sizeof(struct thread_fp_state));
+        if ((thr->ckpt_regs.msr & MSR_VEC) == 0)
+                memcpy(&thr->ckvr_state, &thr->vr_state,
+                       sizeof(struct thread_vr_state));
+
         giveup_all(container_of(thr, struct task_struct, thread));
 
         tm_reclaim(thr, thr->ckpt_regs.msr, cause);
diff --git a/arch/powerpc/kvm/Kconfig b/arch/powerpc/kvm/Kconfig
index 24de532c1736..0c52cb5d43f5 100644
--- a/arch/powerpc/kvm/Kconfig
+++ b/arch/powerpc/kvm/Kconfig
@@ -67,7 +67,7 @@ config KVM_BOOK3S_64
         select KVM_BOOK3S_64_HANDLER
         select KVM
         select KVM_BOOK3S_PR_POSSIBLE if !KVM_BOOK3S_HV_POSSIBLE
-        select SPAPR_TCE_IOMMU if IOMMU_SUPPORT
+        select SPAPR_TCE_IOMMU if IOMMU_SUPPORT && (PPC_SERIES || PPC_POWERNV)
         ---help---
           Support running unmodified book3s_64 and book3s_32 guest kernels
           in virtual machines on book3s_64 host processors.
diff --git a/arch/powerpc/kvm/Makefile b/arch/powerpc/kvm/Makefile
index d91a2604c496..381a6ec0ff3b 100644
--- a/arch/powerpc/kvm/Makefile
+++ b/arch/powerpc/kvm/Makefile
@@ -46,7 +46,7 @@ kvm-e500mc-objs := \
         e500_emulate.o
 kvm-objs-$(CONFIG_KVM_E500MC) := $(kvm-e500mc-objs)
 
-kvm-book3s_64-builtin-objs-$(CONFIG_KVM_BOOK3S_64_HANDLER) := \
+kvm-book3s_64-builtin-objs-$(CONFIG_SPAPR_TCE_IOMMU) := \
         book3s_64_vio_hv.o
 
 kvm-pr-y := \
@@ -90,11 +90,11 @@ kvm-book3s_64-objs-$(CONFIG_KVM_XICS) += \
         book3s_xics.o
 
 kvm-book3s_64-objs-$(CONFIG_KVM_XIVE) += book3s_xive.o
+kvm-book3s_64-objs-$(CONFIG_SPAPR_TCE_IOMMU) += book3s_64_vio.o
 
 kvm-book3s_64-module-objs := \
         $(common-objs-y) \
         book3s.o \
-        book3s_64_vio.o \
         book3s_rtas.o \
         $(kvm-book3s_64-objs-y)
 
diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c
index eda0a8f6fae8..3adfd2f5301c 100644
--- a/arch/powerpc/kvm/book3s_64_vio_hv.c
+++ b/arch/powerpc/kvm/book3s_64_vio_hv.c
@@ -301,6 +301,10 @@ long kvmppc_rm_h_put_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
         /* udbg_printf("H_PUT_TCE(): liobn=0x%lx ioba=0x%lx, tce=0x%lx\n", */
         /*          liobn, ioba, tce); */
 
+        /* For radix, we might be in virtual mode, so punt */
+        if (kvm_is_radix(vcpu->kvm))
+                return H_TOO_HARD;
+
         stt = kvmppc_find_table(vcpu->kvm, liobn);
         if (!stt)
                 return H_TOO_HARD;
@@ -381,6 +385,10 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu,
         bool prereg = false;
         struct kvmppc_spapr_tce_iommu_table *stit;
 
+        /* For radix, we might be in virtual mode, so punt */
+        if (kvm_is_radix(vcpu->kvm))
+                return H_TOO_HARD;
+
         stt = kvmppc_find_table(vcpu->kvm, liobn);
         if (!stt)
                 return H_TOO_HARD;
@@ -491,6 +499,10 @@ long kvmppc_rm_h_stuff_tce(struct kvm_vcpu *vcpu,
         long i, ret;
         struct kvmppc_spapr_tce_iommu_table *stit;
 
+        /* For radix, we might be in virtual mode, so punt */
+        if (kvm_is_radix(vcpu->kvm))
+                return H_TOO_HARD;
+
         stt = kvmppc_find_table(vcpu->kvm, liobn);
         if (!stt)
                 return H_TOO_HARD;
@@ -527,6 +539,7 @@ long kvmppc_rm_h_stuff_tce(struct kvm_vcpu *vcpu,
         return H_SUCCESS;
 }
 
+/* This can be called in either virtual mode or real mode */
 long kvmppc_h_get_tce(struct kvm_vcpu *vcpu, unsigned long liobn,
                       unsigned long ioba)
 {
diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c
index 88a65923c649..ee4c2558c305 100644
--- a/arch/powerpc/kvm/book3s_hv_builtin.c
+++ b/arch/powerpc/kvm/book3s_hv_builtin.c
@@ -207,7 +207,14 @@ EXPORT_SYMBOL_GPL(kvmppc_hwrng_present);
 
 long kvmppc_h_random(struct kvm_vcpu *vcpu)
 {
-        if (powernv_get_random_real_mode(&vcpu->arch.gpr[4]))
+        int r;
+
+        /* Only need to do the expensive mfmsr() on radix */
+        if (kvm_is_radix(vcpu->kvm) && (mfmsr() & MSR_IR))
+                r = powernv_get_random_long(&vcpu->arch.gpr[4]);
+        else
+                r = powernv_get_random_real_mode(&vcpu->arch.gpr[4]);
+        if (r)
                 return H_SUCCESS;
 
         return H_HARDWARE;
diff --git a/arch/powerpc/kvm/book3s_pr_papr.c b/arch/powerpc/kvm/book3s_pr_papr.c
index bcbeeb62dd13..8a4205fa774f 100644
--- a/arch/powerpc/kvm/book3s_pr_papr.c
+++ b/arch/powerpc/kvm/book3s_pr_papr.c
@@ -50,7 +50,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu)
         pteg_addr = get_pteg_addr(vcpu, pte_index);
 
         mutex_lock(&vcpu->kvm->arch.hpt_mutex);
-        copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg));
+        ret = H_FUNCTION;
+        if (copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)))
+                goto done;
         hpte = pteg;
 
         ret = H_PTEG_FULL;
@@ -71,7 +73,9 @@ static int kvmppc_h_pr_enter(struct kvm_vcpu *vcpu)
         hpte[0] = cpu_to_be64(kvmppc_get_gpr(vcpu, 6));
         hpte[1] = cpu_to_be64(kvmppc_get_gpr(vcpu, 7));
         pteg_addr += i * HPTE_SIZE;
-        copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE);
+        ret = H_FUNCTION;
+        if (copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE))
+                goto done;
         kvmppc_set_gpr(vcpu, 4, pte_index | i);
         ret = H_SUCCESS;
 
@@ -93,7 +97,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu)
 
         pteg = get_pteg_addr(vcpu, pte_index);
         mutex_lock(&vcpu->kvm->arch.hpt_mutex);
-        copy_from_user(pte, (void __user *)pteg, sizeof(pte));
+        ret = H_FUNCTION;
+        if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
+                goto done;
         pte[0] = be64_to_cpu((__force __be64)pte[0]);
         pte[1] = be64_to_cpu((__force __be64)pte[1]);
 
@@ -103,7 +109,9 @@ static int kvmppc_h_pr_remove(struct kvm_vcpu *vcpu)
             ((flags & H_ANDCOND) && (pte[0] & avpn) != 0))
                 goto done;
 
-        copy_to_user((void __user *)pteg, &v, sizeof(v));
+        ret = H_FUNCTION;
+        if (copy_to_user((void __user *)pteg, &v, sizeof(v)))
+                goto done;
 
         rb = compute_tlbie_rb(pte[0], pte[1], pte_index);
         vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
@@ -171,7 +179,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu)
                 }
 
                 pteg = get_pteg_addr(vcpu, tsh & H_BULK_REMOVE_PTEX);
-                copy_from_user(pte, (void __user *)pteg, sizeof(pte));
+                if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) {
+                        ret = H_FUNCTION;
+                        break;
+                }
                 pte[0] = be64_to_cpu((__force __be64)pte[0]);
                 pte[1] = be64_to_cpu((__force __be64)pte[1]);
 
@@ -184,7 +195,10 @@ static int kvmppc_h_pr_bulk_remove(struct kvm_vcpu *vcpu)
                         tsh |= H_BULK_REMOVE_NOT_FOUND;
                 } else {
                         /* Splat the pteg in (userland) hpt */
-                        copy_to_user((void __user *)pteg, &v, sizeof(v));
+                        if (copy_to_user((void __user *)pteg, &v, sizeof(v))) {
+                                ret = H_FUNCTION;
+                                break;
+                        }
 
                         rb = compute_tlbie_rb(pte[0], pte[1],
                                               tsh & H_BULK_REMOVE_PTEX);
@@ -211,7 +225,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
 
         pteg = get_pteg_addr(vcpu, pte_index);
         mutex_lock(&vcpu->kvm->arch.hpt_mutex);
-        copy_from_user(pte, (void __user *)pteg, sizeof(pte));
+        ret = H_FUNCTION;
+        if (copy_from_user(pte, (void __user *)pteg, sizeof(pte)))
+                goto done;
         pte[0] = be64_to_cpu((__force __be64)pte[0]);
         pte[1] = be64_to_cpu((__force __be64)pte[1]);
 
@@ -234,7 +250,9 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
         vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false);
         pte[0] = (__force u64)cpu_to_be64(pte[0]);
         pte[1] = (__force u64)cpu_to_be64(pte[1]);
-        copy_to_user((void __user *)pteg, pte, sizeof(pte));
+        ret = H_FUNCTION;
+        if (copy_to_user((void __user *)pteg, pte, sizeof(pte)))
+                goto done;
         ret = H_SUCCESS;
 
  done:
@@ -244,36 +262,37 @@ static int kvmppc_h_pr_protect(struct kvm_vcpu *vcpu)
         return EMULATE_DONE;
 }
 
-static int kvmppc_h_pr_put_tce(struct kvm_vcpu *vcpu)
+static int kvmppc_h_pr_logical_ci_load(struct kvm_vcpu *vcpu)
 {
-        unsigned long liobn = kvmppc_get_gpr(vcpu, 4);
-        unsigned long ioba = kvmppc_get_gpr(vcpu, 5);
-        unsigned long tce = kvmppc_get_gpr(vcpu, 6);
         long rc;
 
-        rc = kvmppc_h_put_tce(vcpu, liobn, ioba, tce);
+        rc = kvmppc_h_logical_ci_load(vcpu);
         if (rc == H_TOO_HARD)
                 return EMULATE_FAIL;
         kvmppc_set_gpr(vcpu, 3, rc);
         return EMULATE_DONE;
 }
 
-static int kvmppc_h_pr_logical_ci_load(struct kvm_vcpu *vcpu)
+static int kvmppc_h_pr_logical_ci_store(struct kvm_vcpu *vcpu)
 {
         long rc;
 
-        rc = kvmppc_h_logical_ci_load(vcpu);
+        rc = kvmppc_h_logical_ci_store(vcpu);
         if (rc == H_TOO_HARD)
                 return EMULATE_FAIL;
         kvmppc_set_gpr(vcpu, 3, rc);
         return EMULATE_DONE;
 }
 
-static int kvmppc_h_pr_logical_ci_store(struct kvm_vcpu *vcpu)
+#ifdef CONFIG_SPAPR_TCE_IOMMU
+static int kvmppc_h_pr_put_tce(struct kvm_vcpu *vcpu)
 {
+        unsigned long liobn = kvmppc_get_gpr(vcpu, 4);
+        unsigned long ioba = kvmppc_get_gpr(vcpu, 5);
+        unsigned long tce = kvmppc_get_gpr(vcpu, 6);
         long rc;
 
-        rc = kvmppc_h_logical_ci_store(vcpu);
+        rc = kvmppc_h_put_tce(vcpu, liobn, ioba, tce);
         if (rc == H_TOO_HARD)
                 return EMULATE_FAIL;
         kvmppc_set_gpr(vcpu, 3, rc);
@@ -311,6 +330,23 @@ static int kvmppc_h_pr_stuff_tce(struct kvm_vcpu *vcpu)
         return EMULATE_DONE;
 }
 
+#else /* CONFIG_SPAPR_TCE_IOMMU */
+static int kvmppc_h_pr_put_tce(struct kvm_vcpu *vcpu)
+{
+        return EMULATE_FAIL;
+}
+
+static int kvmppc_h_pr_put_tce_indirect(struct kvm_vcpu *vcpu)
+{
+        return EMULATE_FAIL;
+}
+
+static int kvmppc_h_pr_stuff_tce(struct kvm_vcpu *vcpu)
+{
+        return EMULATE_FAIL;
+}
+#endif /* CONFIG_SPAPR_TCE_IOMMU */
+
 static int kvmppc_h_pr_xics_hcall(struct kvm_vcpu *vcpu, u32 cmd)
 {
         long rc = kvmppc_xics_hcall(vcpu, cmd);
diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c
index f7cf2cd564ef..7f71ab5fcad1 100644
--- a/arch/powerpc/kvm/powerpc.c
+++ b/arch/powerpc/kvm/powerpc.c
@@ -1749,7 +1749,7 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 r = kvm_vm_ioctl_enable_cap(kvm, &cap);
                 break;
         }
-#ifdef CONFIG_PPC_BOOK3S_64
+#ifdef CONFIG_SPAPR_TCE_IOMMU
         case KVM_CREATE_SPAPR_TCE_64: {
                 struct kvm_create_spapr_tce_64 create_tce_64;
 
@@ -1780,6 +1780,8 @@ long kvm_arch_vm_ioctl(struct file *filp,
                 r = kvm_vm_ioctl_create_spapr_tce(kvm, &create_tce_64);
                 goto out;
         }
+#endif
+#ifdef CONFIG_PPC_BOOK3S_64
         case KVM_PPC_GET_SMMU_INFO: {
                 struct kvm_ppc_smmu_info info;
                 struct kvm *kvm = filp->private_data;
diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c
index d659345a98d6..44fe4833910f 100644
--- a/arch/powerpc/mm/dump_linuxpagetables.c
+++ b/arch/powerpc/mm/dump_linuxpagetables.c
@@ -16,6 +16,7 @@
  */
 #include <linux/debugfs.h>
 #include <linux/fs.h>
+#include <linux/hugetlb.h>
 #include <linux/io.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
@@ -391,7 +392,7 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
 
         for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
                 addr = start + i * PMD_SIZE;
-                if (!pmd_none(*pmd))
+                if (!pmd_none(*pmd) && !pmd_huge(*pmd))
                         /* pmd exists */
                         walk_pte(st, pmd, addr);
                 else
@@ -407,7 +408,7 @@ static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 
         for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
                 addr = start + i * PUD_SIZE;
-                if (!pud_none(*pud))
+                if (!pud_none(*pud) && !pud_huge(*pud))
                         /* pud exists */
                         walk_pmd(st, pud, addr);
                 else
@@ -427,7 +428,7 @@ static void walk_pagetables(struct pg_state *st)
          */
         for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
                 addr = KERN_VIRT_START + i * PGDIR_SIZE;
-                if (!pgd_none(*pgd))
+                if (!pgd_none(*pgd) && !pgd_huge(*pgd))
                         /* pgd exists */
                         walk_pud(st, pgd, addr);
                 else
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 9c761fea0c98..695605eb1dfb 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -43,7 +43,7 @@
 #define KVM_PRIVATE_MEM_SLOTS 3
 #define KVM_MEM_SLOTS_NUM (KVM_USER_MEM_SLOTS + KVM_PRIVATE_MEM_SLOTS)
 
-#define KVM_HALT_POLL_NS_DEFAULT 400000
+#define KVM_HALT_POLL_NS_DEFAULT 200000
 
 #define KVM_IRQCHIP_NUM_PINS  KVM_IOAPIC_NUM_PINS
 
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 68766b276d9e..a059aac9e937 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -319,10 +319,10 @@ do {									\
 #define __get_user_asm_u64(x, ptr, retval, errret)                      \
 ({                                                                      \
         __typeof__(ptr) __ptr = (ptr);                                  \
-        asm volatile(ASM_STAC "\n"                                      \
+        asm volatile("\n"                                       \
                      "1:        movl %2,%%eax\n"                        \
                      "2:        movl %3,%%edx\n"                        \
-                     "3: " ASM_CLAC "\n"                                \
+                     "3:\n"                             \
                      ".section .fixup,\"ax\"\n"                         \
                      "4:        mov %4,%0\n"                            \
                      "  xorl %%eax,%%eax\n"                             \
@@ -331,7 +331,7 @@ do {									\
                      ".previous\n"                                      \
                      _ASM_EXTABLE(1b, 4b)                               \
                      _ASM_EXTABLE(2b, 4b)                               \
-                     : "=r" (retval), "=A"(x)                           \
+                     : "=r" (retval), "=&A"(x)                          \
                      : "m" (__m(__ptr)), "m" __m(((u32 *)(__ptr)) + 1), \
                        "i" (errret), "0" (retval));                     \
 })
@@ -703,14 +703,15 @@ extern struct movsl_mask {
 #define unsafe_put_user(x, ptr, err_label)                                      \
 do {                                                                            \
         int __pu_err;                                                           \
-        __put_user_size((x), (ptr), sizeof(*(ptr)), __pu_err, -EFAULT);         \
+        __typeof__(*(ptr)) __pu_val = (x);                                      \
+        __put_user_size(__pu_val, (ptr), sizeof(*(ptr)), __pu_err, -EFAULT);    \
         if (unlikely(__pu_err)) goto err_label;                                 \
 } while (0)
 
 #define unsafe_get_user(x, ptr, err_label)                                      \
 do {                                                                            \
         int __gu_err;                                                           \
-        unsigned long __gu_val;                                                 \
+        __inttype(*(ptr)) __gu_val;                                             \
         __get_user_size(__gu_val, (ptr), sizeof(*(ptr)), __gu_err, -EFAULT);    \
         (x) = (__force __typeof__(*(ptr)))__gu_val;                             \
         if (unlikely(__gu_err)) goto err_label;                                 \
diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
index c2f8dde3255c..d5d44c452624 100644
--- a/arch/x86/kernel/fpu/init.c
+++ b/arch/x86/kernel/fpu/init.c
@@ -90,6 +90,7 @@ static void fpu__init_system_early_generic(struct cpuinfo_x86 *c)
  * Boot time FPU feature detection code:
  */
 unsigned int mxcsr_feature_mask __read_mostly = 0xffffffffu;
+EXPORT_SYMBOL_GPL(mxcsr_feature_mask);
 
 static void __init fpu__init_system_mxcsr(void)
 {
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index c25cfaf584e7..0816ab2e8adc 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4173,7 +4173,7 @@ static int check_dr_write(struct x86_emulate_ctxt *ctxt)
 
 static int check_svme(struct x86_emulate_ctxt *ctxt)
 {
-        u64 efer;
+        u64 efer = 0;
 
         ctxt->ops->get_msr(ctxt, MSR_EFER, &efer);
 
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 56241746abbd..b0454c7e4cff 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -283,11 +283,13 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
         pt_element_t pte;
         pt_element_t __user *uninitialized_var(ptep_user);
         gfn_t table_gfn;
-        unsigned index, pt_access, pte_access, accessed_dirty, pte_pkey;
+        u64 pt_access, pte_access;
+        unsigned index, accessed_dirty, pte_pkey;
         unsigned nested_access;
         gpa_t pte_gpa;
         bool have_ad;
         int offset;
+        u64 walk_nx_mask = 0;
         const int write_fault = access & PFERR_WRITE_MASK;
         const int user_fault  = access & PFERR_USER_MASK;
         const int fetch_fault = access & PFERR_FETCH_MASK;
@@ -302,6 +304,7 @@ retry_walk:
         have_ad       = PT_HAVE_ACCESSED_DIRTY(mmu);
 
 #if PTTYPE == 64
+        walk_nx_mask = 1ULL << PT64_NX_SHIFT;
         if (walker->level == PT32E_ROOT_LEVEL) {
                 pte = mmu->get_pdptr(vcpu, (addr >> 30) & 3);
                 trace_kvm_mmu_paging_element(pte, walker->level);
@@ -313,8 +316,6 @@ retry_walk:
         walker->max_level = walker->level;
         ASSERT(!(is_long_mode(vcpu) && !is_pae(vcpu)));
 
-        accessed_dirty = have_ad ? PT_GUEST_ACCESSED_MASK : 0;
-
         /*
          * FIXME: on Intel processors, loads of the PDPTE registers for PAE paging
          * by the MOV to CR instruction are treated as reads and do not cause the
@@ -322,14 +323,14 @@ retry_walk:
          */
         nested_access = (have_ad ? PFERR_WRITE_MASK : 0) | PFERR_USER_MASK;
 
-        pt_access = pte_access = ACC_ALL;
+        pte_access = ~0;
         ++walker->level;
 
         do {
                 gfn_t real_gfn;
                 unsigned long host_addr;
 
-                pt_access &= pte_access;
+                pt_access = pte_access;
                 --walker->level;
 
                 index = PT_INDEX(addr, walker->level);
@@ -371,6 +372,12 @@ retry_walk:
 
                 trace_kvm_mmu_paging_element(pte, walker->level);
 
+                /*
+                 * Inverting the NX it lets us AND it like other
+                 * permission bits.
+                 */
+                pte_access = pt_access & (pte ^ walk_nx_mask);
+
                 if (unlikely(!FNAME(is_present_gpte)(pte)))
                         goto error;
 
@@ -379,14 +386,16 @@ retry_walk:
                         goto error;
                 }
 
-                accessed_dirty &= pte;
-                pte_access = pt_access & FNAME(gpte_access)(vcpu, pte);
-
                 walker->ptes[walker->level - 1] = pte;
         } while (!is_last_gpte(mmu, walker->level, pte));
 
         pte_pkey = FNAME(gpte_pkeys)(vcpu, pte);
-        errcode = permission_fault(vcpu, mmu, pte_access, pte_pkey, access);
+        accessed_dirty = have_ad ? pte_access & PT_GUEST_ACCESSED_MASK : 0;
+
+        /* Convert to ACC_*_MASK flags for struct guest_walker.  */
+        walker->pt_access = FNAME(gpte_access)(vcpu, pt_access ^ walk_nx_mask);
+        walker->pte_access = FNAME(gpte_access)(vcpu, pte_access ^ walk_nx_mask);
+        errcode = permission_fault(vcpu, mmu, walker->pte_access, pte_pkey, access);
         if (unlikely(errcode))
                 goto error;
 
@@ -403,7 +412,7 @@ retry_walk:
         walker->gfn = real_gpa >> PAGE_SHIFT;
 
         if (!write_fault)
-                FNAME(protect_clean_gpte)(mmu, &pte_access, pte);
+                FNAME(protect_clean_gpte)(mmu, &walker->pte_access, pte);
         else
                 /*
                  * On a write fault, fold the dirty bit into accessed_dirty.
@@ -421,10 +430,8 @@ retry_walk:
                         goto retry_walk;
         }
 
-        walker->pt_access = pt_access;
-        walker->pte_access = pte_access;
         pgprintk("%s: pte %llx pte_access %x pt_access %x\n",
-                 __func__, (u64)pte, pte_access, pt_access);
+                 __func__, (u64)pte, walker->pte_access, walker->pt_access);
         return 1;
 
 error:
@@ -452,7 +459,7 @@ error:
          */
         if (!(errcode & PFERR_RSVD_MASK)) {
                 vcpu->arch.exit_qualification &= 0x187;
-                vcpu->arch.exit_qualification |= ((pt_access & pte) & 0x7) << 3;
+                vcpu->arch.exit_qualification |= (pte_access & 0x7) << 3;
         }
 #endif
         walker->fault.address = addr;
diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c
index 9d4a8504a95a..5ab4a364348e 100644
--- a/arch/x86/kvm/pmu_intel.c
+++ b/arch/x86/kvm/pmu_intel.c
@@ -294,7 +294,7 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu)
                         ((u64)1 << edx.split.bit_width_fixed) - 1;
         }
 
-        pmu->global_ctrl = ((1 << pmu->nr_arch_gp_counters) - 1) |
+        pmu->global_ctrl = ((1ull << pmu->nr_arch_gp_counters) - 1) |
                 (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED);
         pmu->global_ctrl_mask = ~pmu->global_ctrl;
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index c27ac6923a18..183ddb235fb4 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1272,7 +1272,8 @@ static void init_vmcb(struct vcpu_svm *svm)
 
 }
 
-static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu, int index)
+static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu,
+                                       unsigned int index)
 {
         u64 *avic_physical_id_table;
         struct kvm_arch *vm_data = &vcpu->kvm->arch;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index c6f4ad44aa95..72f78396bc09 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6504,7 +6504,7 @@ static __init int hardware_setup(void)
                 enable_ept_ad_bits = 0;
         }
 
-        if (!cpu_has_vmx_ept_ad_bits())
+        if (!cpu_has_vmx_ept_ad_bits() || !enable_ept)
                 enable_ept_ad_bits = 0;
 
         if (!cpu_has_vmx_unrestricted_guest())
@@ -11213,7 +11213,7 @@ static int vmx_write_pml_buffer(struct kvm_vcpu *vcpu)
                 if (!nested_cpu_has_pml(vmcs12))
                         return 0;
 
-                if (vmcs12->guest_pml_index > PML_ENTITY_NUM) {
+                if (vmcs12->guest_pml_index >= PML_ENTITY_NUM) {
                         vmx->nested.pml_full = true;
                         return 1;
                 }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 464da936c53d..02363e37d4a6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1763,6 +1763,7 @@ u64 get_kvmclock_ns(struct kvm *kvm)
 {
         struct kvm_arch *ka = &kvm->arch;
         struct pvclock_vcpu_time_info hv_clock;
+        u64 ret;
 
         spin_lock(&ka->pvclock_gtod_sync_lock);
         if (!ka->use_master_clock) {
@@ -1774,10 +1775,17 @@ u64 get_kvmclock_ns(struct kvm *kvm)
         hv_clock.system_time = ka->master_kernel_ns + ka->kvmclock_offset;
         spin_unlock(&ka->pvclock_gtod_sync_lock);
 
+        /* both __this_cpu_read() and rdtsc() should be on the same cpu */
+        get_cpu();
+
         kvm_get_time_scale(NSEC_PER_SEC, __this_cpu_read(cpu_tsc_khz) * 1000LL,
                            &hv_clock.tsc_shift,
                            &hv_clock.tsc_to_system_mul);
-        return __pvclock_read_cycles(&hv_clock, rdtsc());
+        ret = __pvclock_read_cycles(&hv_clock, rdtsc());
+
+        put_cpu();
+
+        return ret;
 }
 
 static void kvm_setup_pvclock_page(struct kvm_vcpu *v)
@@ -3288,11 +3296,14 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu,
         }
 }
 
+#define XSAVE_MXCSR_OFFSET 24
+
 static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
                                         struct kvm_xsave *guest_xsave)
 {
         u64 xstate_bv =
                 *(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)];
+        u32 mxcsr = *(u32 *)&guest_xsave->region[XSAVE_MXCSR_OFFSET / sizeof(u32)];
 
         if (boot_cpu_has(X86_FEATURE_XSAVE)) {
                 /*
@@ -3300,11 +3311,13 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
                  * CPUID leaf 0xD, index 0, EDX:EAX.  This is for compatibility
                  * with old userspace.
                  */
-                if (xstate_bv & ~kvm_supported_xcr0())
+                if (xstate_bv & ~kvm_supported_xcr0() ||
+                        mxcsr & ~mxcsr_feature_mask)
                         return -EINVAL;
                 load_xsave(vcpu, (u8 *)guest_xsave->region);
         } else {
-                if (xstate_bv & ~XFEATURE_MASK_FPSSE)
+                if (xstate_bv & ~XFEATURE_MASK_FPSSE ||
+                        mxcsr & ~mxcsr_feature_mask)
                         return -EINVAL;
                 memcpy(&vcpu->arch.guest_fpu.state.fxsave,
                         guest_xsave->region, sizeof(struct fxregs_state));
@@ -4818,16 +4831,20 @@ emul_write:
 
 static int kernel_pio(struct kvm_vcpu *vcpu, void *pd)
 {
-        /* TODO: String I/O for in kernel device */
-        int r;
+        int r = 0, i;
 
-        if (vcpu->arch.pio.in)
-                r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port,
-                                    vcpu->arch.pio.size, pd);
-        else
-                r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
-                                     vcpu->arch.pio.port, vcpu->arch.pio.size,
-                                     pd);
+        for (i = 0; i < vcpu->arch.pio.count; i++) {
+                if (vcpu->arch.pio.in)
+                        r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port,
+                                            vcpu->arch.pio.size, pd);
+                else
+                        r = kvm_io_bus_write(vcpu, KVM_PIO_BUS,
+                                             vcpu->arch.pio.port, vcpu->arch.pio.size,
+                                             pd);
+                if (r)
+                        break;
+                pd += vcpu->arch.pio.size;
+        }
         return r;
 }
 
@@ -4865,6 +4882,8 @@ static int emulator_pio_in_emulated(struct x86_emulate_ctxt *ctxt,
         if (vcpu->arch.pio.count)
                 goto data_avail;
 
+        memset(vcpu->arch.pio_data, 0, size * count);
+
         ret = emulator_pio_in_out(vcpu, size, port, val, count, true);
         if (ret) {
 data_avail:
@@ -5048,6 +5067,8 @@ static bool emulator_get_segment(struct x86_emulate_ctxt *ctxt, u16 *selector,
 
         if (var.unusable) {
                 memset(desc, 0, sizeof(*desc));
+                if (base3)
+                        *base3 = 0;
                 return false;
         }
 
diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
index 7cd442690f9d..f33eef4ebd12 100644
--- a/arch/x86/xen/enlighten_pv.c
+++ b/arch/x86/xen/enlighten_pv.c
@@ -142,9 +142,7 @@ static void __init xen_banner(void)
         struct xen_extraversion extra;
         HYPERVISOR_xen_version(XENVER_extraversion, &extra);
 
-        pr_info("Booting paravirtualized kernel %son %s\n",
-                xen_feature(XENFEAT_auto_translated_physmap) ?
-                        "with PVH extensions " : "", pv_info.name);
+        pr_info("Booting paravirtualized kernel on %s\n", pv_info.name);
         printk(KERN_INFO "Xen version: %d.%d%s%s\n",
                version >> 16, version & 0xffff, extra.extraversion,
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
@@ -957,15 +955,10 @@ static void xen_write_msr(unsigned int msr, unsigned low, unsigned high)
 
 void xen_setup_shared_info(void)
 {
-        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                set_fixmap(FIX_PARAVIRT_BOOTMAP,
-                           xen_start_info->shared_info);
+        set_fixmap(FIX_PARAVIRT_BOOTMAP, xen_start_info->shared_info);
 
-                HYPERVISOR_shared_info =
-                        (struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
-        } else
-                HYPERVISOR_shared_info =
-                        (struct shared_info *)__va(xen_start_info->shared_info);
+        HYPERVISOR_shared_info =
+                (struct shared_info *)fix_to_virt(FIX_PARAVIRT_BOOTMAP);
 
 #ifndef CONFIG_SMP
         /* In UP this is as good a place as any to set up shared info */
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 5e375a5e815f..3be06f3caf3c 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -42,7 +42,7 @@ xmaddr_t arbitrary_virt_to_machine(void *vaddr)
 }
 EXPORT_SYMBOL_GPL(arbitrary_virt_to_machine);
 
-void xen_flush_tlb_all(void)
+static void xen_flush_tlb_all(void)
 {
         struct mmuext_op *op;
         struct multicall_space mcs;
diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c
index 7397d8b8459d..1f386d7fdf70 100644
--- a/arch/x86/xen/mmu_pv.c
+++ b/arch/x86/xen/mmu_pv.c
@@ -355,10 +355,8 @@ static pteval_t pte_pfn_to_mfn(pteval_t val)
                 pteval_t flags = val & PTE_FLAGS_MASK;
                 unsigned long mfn;
 
-                if (!xen_feature(XENFEAT_auto_translated_physmap))
-                        mfn = __pfn_to_mfn(pfn);
-                else
-                        mfn = pfn;
+                mfn = __pfn_to_mfn(pfn);
+
                 /*
                  * If there's no mfn for the pfn, then just create an
                  * empty non-present pte.  Unfortunately this loses
@@ -647,9 +645,6 @@ static int __xen_pgd_walk(struct mm_struct *mm, pgd_t *pgd,
         limit--;
         BUG_ON(limit >= FIXADDR_TOP);
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return 0;
-
         /*
          * 64-bit has a great big hole in the middle of the address
          * space, which contains the Xen mappings.  On 32-bit these
@@ -1289,9 +1284,6 @@ static void __init xen_pagetable_cleanhighmap(void)
 
 static void __init xen_pagetable_p2m_setup(void)
 {
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         xen_vmalloc_p2m_tree();
 
 #ifdef CONFIG_X86_64
@@ -1314,8 +1306,7 @@ static void __init xen_pagetable_init(void)
         xen_build_mfn_list_list();
 
         /* Remap memory freed due to conflicts with E820 map */
-        if (!xen_feature(XENFEAT_auto_translated_physmap))
-                xen_remap_memory();
+        xen_remap_memory();
 
         xen_setup_shared_info();
 }
@@ -1925,21 +1916,20 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
         /* Zap identity mapping */
         init_level4_pgt[0] = __pgd(0);
 
-        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                /* Pre-constructed entries are in pfn, so convert to mfn */
-                /* L4[272] -> level3_ident_pgt
-                 * L4[511] -> level3_kernel_pgt */
-                convert_pfn_mfn(init_level4_pgt);
+        /* Pre-constructed entries are in pfn, so convert to mfn */
+        /* L4[272] -> level3_ident_pgt  */
+        /* L4[511] -> level3_kernel_pgt */
+        convert_pfn_mfn(init_level4_pgt);
 
-                /* L3_i[0] -> level2_ident_pgt */
-                convert_pfn_mfn(level3_ident_pgt);
-                /* L3_k[510] -> level2_kernel_pgt
-                 * L3_k[511] -> level2_fixmap_pgt */
-                convert_pfn_mfn(level3_kernel_pgt);
+        /* L3_i[0] -> level2_ident_pgt */
+        convert_pfn_mfn(level3_ident_pgt);
+        /* L3_k[510] -> level2_kernel_pgt */
+        /* L3_k[511] -> level2_fixmap_pgt */
+        convert_pfn_mfn(level3_kernel_pgt);
+
+        /* L3_k[511][506] -> level1_fixmap_pgt */
+        convert_pfn_mfn(level2_fixmap_pgt);
 
-                /* L3_k[511][506] -> level1_fixmap_pgt */
-                convert_pfn_mfn(level2_fixmap_pgt);
-        }
         /* We get [511][511] and have Xen's version of level2_kernel_pgt */
         l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
         l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
@@ -1962,34 +1952,30 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn)
         if (i && i < pgd_index(__START_KERNEL_map))
                 init_level4_pgt[i] = ((pgd_t *)xen_start_info->pt_base)[i];
 
-        if (!xen_feature(XENFEAT_auto_translated_physmap)) {
-                /* Make pagetable pieces RO */
-                set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-                set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-                set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO);
-
-                /* Pin down new L4 */
-                pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
-                                  PFN_DOWN(__pa_symbol(init_level4_pgt)));
-
-                /* Unpin Xen-provided one */
-                pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+        /* Make pagetable pieces RO */
+        set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
+        set_page_prot(level2_ident_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level1_fixmap_pgt, PAGE_KERNEL_RO);
+
+        /* Pin down new L4 */
+        pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
+                          PFN_DOWN(__pa_symbol(init_level4_pgt)));
+
+        /* Unpin Xen-provided one */
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
 
-                /*
-                 * At this stage there can be no user pgd, and no page
-                 * structure to attach it to, so make sure we just set kernel
-                 * pgd.
-                 */
-                xen_mc_batch();
-                __xen_write_cr3(true, __pa(init_level4_pgt));
-                xen_mc_issue(PARAVIRT_LAZY_CPU);
-        } else
-                native_write_cr3(__pa(init_level4_pgt));
+        /*
+         * At this stage there can be no user pgd, and no page structure to
+         * attach it to, so make sure we just set kernel pgd.
+         */
+        xen_mc_batch();
+        __xen_write_cr3(true, __pa(init_level4_pgt));
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
 
         /* We can't that easily rip out L3 and L2, as the Xen pagetables are
          * set out this way: [L4], [L1], [L2], [L3], [L1], [L1] ...  for
@@ -2403,9 +2389,6 @@ static void xen_set_fixmap(unsigned idx, phys_addr_t phys, pgprot_t prot)
 
 static void __init xen_post_allocator_init(void)
 {
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         pv_mmu_ops.set_pte = xen_set_pte;
         pv_mmu_ops.set_pmd = xen_set_pmd;
         pv_mmu_ops.set_pud = xen_set_pud;
@@ -2511,9 +2494,6 @@ void __init xen_init_mmu_ops(void)
 {
         x86_init.paging.pagetable_init = xen_pagetable_init;
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         pv_mmu_ops = xen_mmu_ops;
 
         memset(dummy_mapping, 0xff, PAGE_SIZE);
@@ -2650,9 +2630,6 @@ int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order,
          * this function are redundant and can be ignored.
          */
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return 0;
-
         if (unlikely(order > MAX_CONTIG_ORDER))
                 return -ENOMEM;
 
@@ -2689,9 +2666,6 @@ void xen_destroy_contiguous_region(phys_addr_t pstart, unsigned int order)
         int success;
         unsigned long vstart;
 
-        if (xen_feature(XENFEAT_auto_translated_physmap))
-                return;
-
         if (unlikely(order > MAX_CONTIG_ORDER))
                 return;
 
diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index b7c2a06963d6..25aba9b107dd 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -57,6 +57,7 @@
 
 #define ACPI_BUTTON_LID_INIT_IGNORE     0x00
 #define ACPI_BUTTON_LID_INIT_OPEN       0x01
+#define ACPI_BUTTON_LID_INIT_METHOD     0x02
 
 #define _COMPONENT              ACPI_BUTTON_COMPONENT
 ACPI_MODULE_NAME("button");
@@ -376,6 +377,9 @@ static void acpi_lid_initialize_state(struct acpi_device *device)
         case ACPI_BUTTON_LID_INIT_OPEN:
                 (void)acpi_lid_notify_state(device, 1);
                 break;
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                (void)acpi_lid_update_state(device);
+                break;
         case ACPI_BUTTON_LID_INIT_IGNORE:
         default:
                 break;
@@ -560,6 +564,9 @@ static int param_set_lid_init_state(const char *val, struct kernel_param *kp)
         if (!strncmp(val, "open", sizeof("open") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_OPEN;
                 pr_info("Notify initial lid state as open\n");
+        } else if (!strncmp(val, "method", sizeof("method") - 1)) {
+                lid_init_state = ACPI_BUTTON_LID_INIT_METHOD;
+                pr_info("Notify initial lid state with _LID return value\n");
         } else if (!strncmp(val, "ignore", sizeof("ignore") - 1)) {
                 lid_init_state = ACPI_BUTTON_LID_INIT_IGNORE;
                 pr_info("Do not notify initial lid state\n");
@@ -573,6 +580,8 @@ static int param_get_lid_init_state(char *buffer, struct kernel_param *kp)
         switch (lid_init_state) {
         case ACPI_BUTTON_LID_INIT_OPEN:
                 return sprintf(buffer, "open");
+        case ACPI_BUTTON_LID_INIT_METHOD:
+                return sprintf(buffer, "method");
         case ACPI_BUTTON_LID_INIT_IGNORE:
                 return sprintf(buffer, "ignore");
         default:
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index f62082fdd670..9c36b27996fc 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -512,13 +512,12 @@ static bool wakeup_source_not_registered(struct wakeup_source *ws)
 /**
  * wakup_source_activate - Mark given wakeup source as active.
  * @ws: Wakeup source to handle.
- * @hard: If set, abort suspends in progress and wake up from suspend-to-idle.
  *
  * Update the @ws' statistics and, if @ws has just been activated, notify the PM
  * core of the event by incrementing the counter of of wakeup events being
  * processed.
  */
-static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
+static void wakeup_source_activate(struct wakeup_source *ws)
 {
         unsigned int cec;
 
@@ -526,9 +525,6 @@ static void wakeup_source_activate(struct wakeup_source *ws, bool hard)
                         "unregistered wakeup source\n"))
                 return;
 
-        if (hard)
-                pm_system_wakeup();
-
         ws->active = true;
         ws->active_count++;
         ws->last_time = ktime_get();
@@ -554,7 +550,10 @@ static void wakeup_source_report_event(struct wakeup_source *ws, bool hard)
                 ws->wakeup_count++;
 
         if (!ws->active)
-                wakeup_source_activate(ws, hard);
+                wakeup_source_activate(ws);
+
+        if (hard)
+                pm_system_wakeup();
 }
 
 /**
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index b5730e17b455..656624314f0d 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -315,24 +315,32 @@ void drbd_req_complete(struct drbd_request *req, struct bio_and_error *m)
 }
 
 /* still holds resource->req_lock */
-static int drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
+static void drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
 {
         struct drbd_device *device = req->device;
         D_ASSERT(device, m || (req->rq_state & RQ_POSTPONED));
 
+        if (!put)
+                return;
+
         if (!atomic_sub_and_test(put, &req->completion_ref))
-                return 0;
+                return;
 
         drbd_req_complete(req, m);
 
+        /* local completion may still come in later,
+         * we need to keep the req object around. */
+        if (req->rq_state & RQ_LOCAL_ABORTED)
+                return;
+
         if (req->rq_state & RQ_POSTPONED) {
                 /* don't destroy the req object just yet,
                  * but queue it for retry */
                 drbd_restart_request(req);
-                return 0;
+                return;
         }
 
-        return 1;
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void set_if_null_req_next(struct drbd_peer_device *peer_device, struct drbd_request *req)
@@ -519,12 +527,8 @@ static void mod_rq_state(struct drbd_request *req, struct bio_and_error *m,
         if (req->i.waiting)
                 wake_up(&device->misc_wait);
 
-        if (c_put) {
-                if (drbd_req_put_completion_ref(req, m, c_put))
-                        kref_put(&req->kref, drbd_req_destroy);
-        } else {
-                kref_put(&req->kref, drbd_req_destroy);
-        }
+        drbd_req_put_completion_ref(req, m, c_put);
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void drbd_report_io_error(struct drbd_device *device, struct drbd_request *req)
@@ -1366,8 +1370,7 @@ nodata:
         }
 
 out:
-        if (drbd_req_put_completion_ref(req, &m, 1))
-                kref_put(&req->kref, drbd_req_destroy);
+        drbd_req_put_completion_ref(req, &m, 1);
         spin_unlock_irq(&resource->req_lock);
 
         /* Even though above is a kref_put(), this is safe.
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 8fe61b5dc5a6..1f3dfaa54d87 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -504,11 +504,13 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
 
         dev_set_drvdata(&dev->dev, NULL);
 
-        if (be->blkif)
+        if (be->blkif) {
                 xen_blkif_disconnect(be->blkif);
 
-        /* Put the reference we set in xen_blkif_alloc(). */
-        xen_blkif_put(be->blkif);
+                /* Put the reference we set in xen_blkif_alloc(). */
+                xen_blkif_put(be->blkif);
+        }
+
         kfree(be->mode);
         kfree(be);
         return 0;
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 565e4cf04a02..8249762192d5 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str)
         } else if (!strcmp(str, "auto")) {
                 parport_nr[0] = LP_PARPORT_AUTO;
         } else if (!strcmp(str, "none")) {
-                parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+                if (parport_ptr < LP_NO)
+                        parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+                else
+                        printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+                               str);
         } else if (!strcmp(str, "reset")) {
                 reset = 1;
         }
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 7e4a9d1296bb..6e0cbe092220 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -340,6 +340,11 @@ static const struct vm_operations_struct mmap_mem_ops = {
 static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 {
         size_t size = vma->vm_end - vma->vm_start;
+        phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+        /* It's illegal to wrap around the end of the physical address space. */
+        if (offset + (phys_addr_t)size < offset)
+                return -EINVAL;
 
         if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
                 return -EINVAL;
diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm
index 74ed7e9a7f27..2011fec2d6ad 100644
--- a/drivers/cpufreq/Kconfig.arm
+++ b/drivers/cpufreq/Kconfig.arm
@@ -71,6 +71,15 @@ config ARM_HIGHBANK_CPUFREQ
 
           If in doubt, say N.
 
+config ARM_DB8500_CPUFREQ
+        tristate "ST-Ericsson DB8500 cpufreq" if COMPILE_TEST && !ARCH_U8500
+        default ARCH_U8500
+        depends on HAS_IOMEM
+        depends on !CPU_THERMAL || THERMAL
+        help
+          This adds the CPUFreq driver for ST-Ericsson Ux500 (DB8500) SoC
+          series.
+
 config ARM_IMX6Q_CPUFREQ
         tristate "Freescale i.MX6 cpufreq support"
         depends on ARCH_MXC
diff --git a/drivers/cpufreq/Makefile b/drivers/cpufreq/Makefile
index b7e78f063c4f..ab3a42cd29ef 100644
--- a/drivers/cpufreq/Makefile
+++ b/drivers/cpufreq/Makefile
@@ -53,7 +53,7 @@ obj-$(CONFIG_ARM_DT_BL_CPUFREQ)		+= arm_big_little_dt.o
 
 obj-$(CONFIG_ARM_BRCMSTB_AVS_CPUFREQ)   += brcmstb-avs-cpufreq.o
 obj-$(CONFIG_ARCH_DAVINCI)              += davinci-cpufreq.o
-obj-$(CONFIG_UX500_SOC_DB8500)          += dbx500-cpufreq.o
+obj-$(CONFIG_ARM_DB8500_CPUFREQ)        += dbx500-cpufreq.o
 obj-$(CONFIG_ARM_EXYNOS5440_CPUFREQ)    += exynos5440-cpufreq.o
 obj-$(CONFIG_ARM_HIGHBANK_CPUFREQ)      += highbank-cpufreq.o
 obj-$(CONFIG_ARM_IMX6Q_CPUFREQ)         += imx6q-cpufreq.o
diff --git a/drivers/dax/super.c b/drivers/dax/super.c
index ebf43f531ada..6ed32aac8bbe 100644
--- a/drivers/dax/super.c
+++ b/drivers/dax/super.c
@@ -44,6 +44,7 @@ void dax_read_unlock(int id)
 }
 EXPORT_SYMBOL_GPL(dax_read_unlock);
 
+#ifdef CONFIG_BLOCK
 int bdev_dax_pgoff(struct block_device *bdev, sector_t sector, size_t size,
                 pgoff_t *pgoff)
 {
@@ -112,6 +113,7 @@ int __bdev_dax_supported(struct super_block *sb, int blocksize)
         return 0;
 }
 EXPORT_SYMBOL_GPL(__bdev_dax_supported);
+#endif
 
 /**
  * struct dax_device - anchor object for dax services
diff --git a/drivers/firmware/efi/efi-pstore.c b/drivers/firmware/efi/efi-pstore.c
index ab3a951a17e6..ef1fafdad400 100644
--- a/drivers/firmware/efi/efi-pstore.c
+++ b/drivers/firmware/efi/efi-pstore.c
@@ -53,6 +53,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         if (sscanf(name, "dump-type%u-%u-%d-%lu-%c",
                    &record->type, &part, &cnt, &time, &data_type) == 5) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -64,6 +65,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
         } else if (sscanf(name, "dump-type%u-%u-%d-%lu",
                    &record->type, &part, &cnt, &time) == 4) {
                 record->id = generic_id(time, part, cnt);
+                record->part = part;
                 record->count = cnt;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -77,6 +79,7 @@ static int efi_pstore_read_func(struct efivar_entry *entry,
                  * multiple logs, remains.
                  */
                 record->id = generic_id(time, part, 0);
+                record->part = part;
                 record->count = 0;
                 record->time.tv_sec = time;
                 record->time.tv_nsec = 0;
@@ -241,9 +244,15 @@ static int efi_pstore_write(struct pstore_record *record)
         efi_guid_t vendor = LINUX_EFI_CRASH_GUID;
         int i, ret = 0;
 
+        record->time.tv_sec = get_seconds();
+        record->time.tv_nsec = 0;
+
+        record->id = generic_id(record->time.tv_sec, record->part,
+                                record->count);
+
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu-%c",
                  record->type, record->part, record->count,
-                 get_seconds(), record->compressed ? 'C' : 'D');
+                 record->time.tv_sec, record->compressed ? 'C' : 'D');
 
         for (i = 0; i < DUMP_NAME_LEN; i++)
                 efi_name[i] = name[i];
@@ -255,7 +264,6 @@ static int efi_pstore_write(struct pstore_record *record)
         if (record->reason == KMSG_DUMP_OOPS)
                 efivar_run_worker();
 
-        record->id = record->part;
         return ret;
 };
 
@@ -287,7 +295,7 @@ static int efi_pstore_erase_func(struct efivar_entry *entry, void *data)
                  * holding multiple logs, remains.
                  */
                 snprintf(name_old, sizeof(name_old), "dump-type%u-%u-%lu",
-                        ed->record->type, (unsigned int)ed->record->id,
+                        ed->record->type, ed->record->part,
                         ed->record->time.tv_sec);
 
                 for (i = 0; i < DUMP_NAME_LEN; i++)
@@ -320,10 +328,7 @@ static int efi_pstore_erase(struct pstore_record *record)
         char name[DUMP_NAME_LEN];
         efi_char16_t efi_name[DUMP_NAME_LEN];
         int found, i;
-        unsigned int part;
 
-        do_div(record->id, 1000);
-        part = do_div(record->id, 100);
         snprintf(name, sizeof(name), "dump-type%u-%u-%d-%lu",
                  record->type, record->part, record->count,
                  record->time.tv_sec);
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 3ce813110d5e..1e7860f02f4f 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -116,9 +116,13 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
                 return VPD_OK;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
-        info->key = kzalloc(key_len + 1, GFP_KERNEL);
-        if (!info->key)
+        if (!info)
                 return -ENOMEM;
+        info->key = kzalloc(key_len + 1, GFP_KERNEL);
+        if (!info->key) {
+                ret = -ENOMEM;
+                goto free_info;
+        }
 
         memcpy(info->key, key, key_len);
 
@@ -135,12 +139,17 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
         list_add_tail(&info->list, &sec->attribs);
 
         ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
-        if (ret) {
-                kfree(info->key);
-                return ret;
-        }
+        if (ret)
+                goto free_info_key;
 
         return 0;
+
+free_info_key:
+        kfree(info->key);
+free_info:
+        kfree(info);
+
+        return ret;
 }
 
 static void vpd_section_attrib_destroy(struct vpd_section *sec)
diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index 874ff32db366..00cfed3c3e1a 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -202,7 +202,8 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
         info->debug_buffer[info->debug_region_size] = 0;
 
         info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
-                                              sizeof(debug_name)),
+                                              sizeof(debug_name) -
+                                              sizeof("ti_sci_debug@")),
                                       0444, NULL, info, &ti_sci_debug_fops);
         if (IS_ERR(info->d))
                 return PTR_ERR(info->d);
diff --git a/drivers/gpu/drm/arm/hdlcd_crtc.c b/drivers/gpu/drm/arm/hdlcd_crtc.c
index 798a3cc480a2..1a3359c0f6cd 100644
--- a/drivers/gpu/drm/arm/hdlcd_crtc.c
+++ b/drivers/gpu/drm/arm/hdlcd_crtc.c
@@ -10,6 +10,7 @@
  */
 
 #include <drm/drmP.h>
+#include <drm/drm_atomic.h>
 #include <drm/drm_atomic_helper.h>
 #include <drm/drm_crtc.h>
 #include <drm/drm_crtc_helper.h>
@@ -226,16 +227,33 @@ static const struct drm_crtc_helper_funcs hdlcd_crtc_helper_funcs = {
 static int hdlcd_plane_atomic_check(struct drm_plane *plane,
                                     struct drm_plane_state *state)
 {
-        u32 src_w, src_h;
+        struct drm_rect clip = { 0 };
+        struct drm_crtc_state *crtc_state;
+        u32 src_h = state->src_h >> 16;
 
-        src_w = state->src_w >> 16;
-        src_h = state->src_h >> 16;
+        /* only the HDLCD_REG_FB_LINE_COUNT register has a limit */
+        if (src_h >= HDLCD_MAX_YRES) {
+                DRM_DEBUG_KMS("Invalid source width: %d\n", src_h);
+                return -EINVAL;
+        }
+
+        if (!state->fb || !state->crtc)
+                return 0;
 
-        /* we can't do any scaling of the plane source */
-        if ((src_w != state->crtc_w) || (src_h != state->crtc_h))
+        crtc_state = drm_atomic_get_existing_crtc_state(state->state,
+                                                        state->crtc);
+        if (!crtc_state) {
+                DRM_DEBUG_KMS("Invalid crtc state\n");
                 return -EINVAL;
+        }
 
-        return 0;
+        clip.x2 = crtc_state->adjusted_mode.hdisplay;
+        clip.y2 = crtc_state->adjusted_mode.vdisplay;
+
+        return drm_plane_helper_check_state(state, &clip,
+                                            DRM_PLANE_HELPER_NO_SCALING,
+                                            DRM_PLANE_HELPER_NO_SCALING,
+                                            false, true);
 }
 
 static void hdlcd_plane_atomic_update(struct drm_plane *plane,
@@ -244,21 +262,20 @@ static void hdlcd_plane_atomic_update(struct drm_plane *plane,
         struct drm_framebuffer *fb = plane->state->fb;
         struct hdlcd_drm_private *hdlcd;
         struct drm_gem_cma_object *gem;
-        u32 src_w, src_h, dest_w, dest_h;
+        u32 src_x, src_y, dest_h;
         dma_addr_t scanout_start;
 
         if (!fb)
                 return;
 
-        src_w = plane->state->src_w >> 16;
-        src_h = plane->state->src_h >> 16;
-        dest_w = plane->state->crtc_w;
-        dest_h = plane->state->crtc_h;
+        src_x = plane->state->src.x1 >> 16;
+        src_y = plane->state->src.y1 >> 16;
+        dest_h = drm_rect_height(&plane->state->dst);
         gem = drm_fb_cma_get_gem_obj(fb, 0);
+
         scanout_start = gem->paddr + fb->offsets[0] +
-                plane->state->crtc_y * fb->pitches[0] +
-                plane->state->crtc_x *
-                fb->format->cpp[0];
+                        src_y * fb->pitches[0] +
+                        src_x * fb->format->cpp[0];
 
         hdlcd = plane->dev->dev_private;
         hdlcd_write(hdlcd, HDLCD_REG_FB_LINE_LENGTH, fb->pitches[0]);
@@ -305,7 +322,6 @@ static struct drm_plane *hdlcd_plane_init(struct drm_device *drm)
                                        formats, ARRAY_SIZE(formats),
                                        DRM_PLANE_TYPE_PRIMARY, NULL);
         if (ret) {
-                devm_kfree(drm->dev, plane);
                 return ERR_PTR(ret);
         }
 
@@ -329,7 +345,6 @@ int hdlcd_setup_crtc(struct drm_device *drm)
                                         &hdlcd_crtc_funcs, NULL);
         if (ret) {
                 hdlcd_plane_destroy(primary);
-                devm_kfree(drm->dev, primary);
                 return ret;
         }
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
index 65a3bd7a0c00..423dda2785d4 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_output.c
@@ -152,8 +152,7 @@ static const struct drm_connector_funcs atmel_hlcdc_panel_connector_funcs = {
         .atomic_destroy_state = drm_atomic_helper_connector_destroy_state,
 };
 
-static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
-                                       const struct device_node *np)
+static int atmel_hlcdc_attach_endpoint(struct drm_device *dev, int endpoint)
 {
         struct atmel_hlcdc_dc *dc = dev->dev_private;
         struct atmel_hlcdc_rgb_output *output;
@@ -161,6 +160,11 @@ static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
         struct drm_bridge *bridge;
         int ret;
 
+        ret = drm_of_find_panel_or_bridge(dev->dev->of_node, 0, endpoint,
+                                          &panel, &bridge);
+        if (ret)
+                return ret;
+
         output = devm_kzalloc(dev->dev, sizeof(*output), GFP_KERNEL);
         if (!output)
                 return -EINVAL;
@@ -177,10 +181,6 @@ static int atmel_hlcdc_attach_endpoint(struct drm_device *dev,
 
         output->encoder.possible_crtcs = 0x1;
 
-        ret = drm_of_find_panel_or_bridge(np, 0, 0, &panel, &bridge);
-        if (ret)
-                return ret;
-
         if (panel) {
                 output->connector.dpms = DRM_MODE_DPMS_OFF;
                 output->connector.polled = DRM_CONNECTOR_POLL_CONNECT;
@@ -220,22 +220,14 @@ err_encoder_cleanup:
 
 int atmel_hlcdc_create_outputs(struct drm_device *dev)
 {
-        struct device_node *remote;
-        int ret = -ENODEV;
-        int endpoint = 0;
-
-        while (true) {
-                /* Loop thru possible multiple connections to the output */
-                remote = of_graph_get_remote_node(dev->dev->of_node, 0,
-                                                  endpoint++);
-                if (!remote)
-                        break;
-
-                ret = atmel_hlcdc_attach_endpoint(dev, remote);
-                of_node_put(remote);
-                if (ret)
-                        return ret;
-        }
+        int endpoint, ret = 0;
+
+        for (endpoint = 0; !ret; endpoint++)
+                ret = atmel_hlcdc_attach_endpoint(dev, endpoint);
+
+        /* At least one device was successfully attached.*/
+        if (ret == -ENODEV && endpoint)
+                return 0;
 
         return ret;
 }
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index e1909429837e..de80ee1b71df 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -44,6 +44,7 @@ static struct etnaviv_gem_submit *submit_create(struct drm_device *dev,
 
                 /* initially, until copy_from_user() and bo lookup succeeds: */
                 submit->nr_bos = 0;
+                submit->fence = NULL;
 
                 ww_acquire_init(&submit->ticket, &reservation_ww_class);
         }
@@ -294,7 +295,8 @@ static void submit_cleanup(struct etnaviv_gem_submit *submit)
         }
 
         ww_acquire_fini(&submit->ticket);
-        dma_fence_put(submit->fence);
+        if (submit->fence)
+                dma_fence_put(submit->fence);
         kfree(submit);
 }
 
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 0ad1a508e2af..c995e540ff96 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -1244,7 +1244,7 @@ static int dma_ctrl_write(struct intel_vgpu *vgpu, unsigned int offset,
         mode = vgpu_vreg(vgpu, offset);
 
         if (GFX_MODE_BIT_SET_IN_MASK(mode, START_DMA)) {
-                WARN_ONCE(1, "VM(%d): iGVT-g doesn't supporte GuC\n",
+                WARN_ONCE(1, "VM(%d): iGVT-g doesn't support GuC\n",
                                 vgpu->id);
                 return 0;
         }
diff --git a/drivers/gpu/drm/i915/gvt/render.c b/drivers/gpu/drm/i915/gvt/render.c
index c6e7972ac21d..a5e11d89df2f 100644
--- a/drivers/gpu/drm/i915/gvt/render.c
+++ b/drivers/gpu/drm/i915/gvt/render.c
@@ -340,6 +340,9 @@ void intel_gvt_restore_render_mmio(struct intel_vgpu *vgpu, int ring_id)
                 } else
                         v = mmio->value;
 
+                if (mmio->in_context)
+                        continue;
+
                 I915_WRITE(mmio->reg, v);
                 POSTING_READ(mmio->reg);
 
diff --git a/drivers/gpu/drm/i915/gvt/sched_policy.c b/drivers/gpu/drm/i915/gvt/sched_policy.c
index 79ba4b3440aa..f25ff133865f 100644
--- a/drivers/gpu/drm/i915/gvt/sched_policy.c
+++ b/drivers/gpu/drm/i915/gvt/sched_policy.c
@@ -129,9 +129,13 @@ static void try_to_schedule_next_vgpu(struct intel_gvt *gvt)
         struct vgpu_sched_data *vgpu_data;
         ktime_t cur_time;
 
-        /* no target to schedule */
-        if (!scheduler->next_vgpu)
+        /* no need to schedule if next_vgpu is the same with current_vgpu,
+         * let scheduler chose next_vgpu again by setting it to NULL.
+         */
+        if (scheduler->next_vgpu == scheduler->current_vgpu) {
+                scheduler->next_vgpu = NULL;
                 return;
+        }
 
         /*
          * after the flag is set, workload dispatch thread will
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 2aa6b97fd22f..a0563e18d753 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -195,9 +195,12 @@ static int ppgtt_bind_vma(struct i915_vma *vma,
         u32 pte_flags;
         int ret;
 
-        ret = vma->vm->allocate_va_range(vma->vm, vma->node.start, vma->size);
-        if (ret)
-                return ret;
+        if (!(vma->flags & I915_VMA_LOCAL_BIND)) {
+                ret = vma->vm->allocate_va_range(vma->vm, vma->node.start,
+                                                 vma->size);
+                if (ret)
+                        return ret;
+        }
 
         vma->pages = vma->obj->mm.pages;
 
@@ -2306,7 +2309,8 @@ static int aliasing_gtt_bind_vma(struct i915_vma *vma,
         if (flags & I915_VMA_LOCAL_BIND) {
                 struct i915_hw_ppgtt *appgtt = i915->mm.aliasing_ppgtt;
 
-                if (appgtt->base.allocate_va_range) {
+                if (!(vma->flags & I915_VMA_LOCAL_BIND) &&
+                    appgtt->base.allocate_va_range) {
                         ret = appgtt->base.allocate_va_range(&appgtt->base,
                                                              vma->node.start,
                                                              vma->node.size);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 11b12f412492..5a7c63e64381 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3051,10 +3051,14 @@ enum skl_disp_power_wells {
 #define CLKCFG_FSB_667                                  (3 << 0)        /* hrawclk 166 */
 #define CLKCFG_FSB_800                                  (2 << 0)        /* hrawclk 200 */
 #define CLKCFG_FSB_1067                                 (6 << 0)        /* hrawclk 266 */
+#define CLKCFG_FSB_1067_ALT                             (0 << 0)        /* hrawclk 266 */
 #define CLKCFG_FSB_1333                                 (7 << 0)        /* hrawclk 333 */
-/* Note, below two are guess */
-#define CLKCFG_FSB_1600                                 (4 << 0)        /* hrawclk 400 */
-#define CLKCFG_FSB_1600_ALT                             (0 << 0)        /* hrawclk 400 */
+/*
+ * Note that on at least on ELK the below value is reported for both
+ * 333 and 400 MHz BIOS FSB setting, but given that the gmch datasheet
+ * lists only 200/266/333 MHz FSB as supported let's decode it as 333 MHz.
+ */
+#define CLKCFG_FSB_1333_ALT                             (4 << 0)        /* hrawclk 333 */
 #define CLKCFG_FSB_MASK                                 (7 << 0)
 #define CLKCFG_MEM_533                                  (1 << 4)
 #define CLKCFG_MEM_667                                  (2 << 4)
diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c
index dd3ad52b7dfe..f29a226e24d8 100644
--- a/drivers/gpu/drm/i915/intel_cdclk.c
+++ b/drivers/gpu/drm/i915/intel_cdclk.c
@@ -1798,13 +1798,11 @@ static int g4x_hrawclk(struct drm_i915_private *dev_priv)
         case CLKCFG_FSB_800:
                 return 200000;
         case CLKCFG_FSB_1067:
+        case CLKCFG_FSB_1067_ALT:
                 return 266667;
         case CLKCFG_FSB_1333:
+        case CLKCFG_FSB_1333_ALT:
                 return 333333;
-        /* these two are just a guess; one of them might be right */
-        case CLKCFG_FSB_1600:
-        case CLKCFG_FSB_1600_ALT:
-                return 400000;
         default:
                 return 133333;
         }
diff --git a/drivers/gpu/drm/i915/intel_dsi.c b/drivers/gpu/drm/i915/intel_dsi.c
index 3ffe8b1f1d48..fc0ef492252a 100644
--- a/drivers/gpu/drm/i915/intel_dsi.c
+++ b/drivers/gpu/drm/i915/intel_dsi.c
@@ -410,11 +410,10 @@ static void glk_dsi_device_ready(struct intel_encoder *encoder)
                 val |= (ULPS_STATE_ENTER | DEVICE_READY);
                 I915_WRITE(MIPI_DEVICE_READY(port), val);
 
-                /* Wait for ULPS Not active */
+                /* Wait for ULPS active */
                 if (intel_wait_for_register(dev_priv,
-                                MIPI_CTRL(port), GLK_ULPS_NOT_ACTIVE,
-                                GLK_ULPS_NOT_ACTIVE, 20))
-                        DRM_ERROR("ULPS is still active\n");
+                                MIPI_CTRL(port), GLK_ULPS_NOT_ACTIVE, 0, 20))
+                        DRM_ERROR("ULPS not active\n");
 
                 /* Exit ULPS */
                 val = I915_READ(MIPI_DEVICE_READY(port));
diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c
index 25d8e76489e4..668f00480d97 100644
--- a/drivers/gpu/drm/i915/intel_lpe_audio.c
+++ b/drivers/gpu/drm/i915/intel_lpe_audio.c
@@ -63,6 +63,7 @@
 #include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/pci.h>
+#include <linux/pm_runtime.h>
 
 #include "i915_drv.h"
 #include <linux/delay.h>
@@ -121,6 +122,10 @@ lpe_audio_platdev_create(struct drm_i915_private *dev_priv)
 
         kfree(rsc);
 
+        pm_runtime_forbid(&platdev->dev);
+        pm_runtime_set_active(&platdev->dev);
+        pm_runtime_enable(&platdev->dev);
+
         return platdev;
 
 err:
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 21b10f9840c9..549763f5e17d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -360,6 +360,8 @@ nouveau_display_hpd_work(struct work_struct *work)
         pm_runtime_get_sync(drm->dev->dev);
 
         drm_helper_hpd_irq_event(drm->dev);
+        /* enable polling for external displays */
+        drm_kms_helper_poll_enable(drm->dev);
 
         pm_runtime_mark_last_busy(drm->dev->dev);
         pm_runtime_put_sync(drm->dev->dev);
@@ -413,10 +415,6 @@ nouveau_display_init(struct drm_device *dev)
         if (ret)
                 return ret;
 
-        /* enable polling for external displays */
-        if (!dev->mode_config.poll_enabled)
-                drm_kms_helper_poll_enable(dev);
-
         /* enable hotplug interrupts */
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 struct nouveau_connector *conn = nouveau_connector(connector);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 2b6ac24ce690..36268e1802b5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -502,6 +502,9 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
                 pm_runtime_allow(dev->dev);
                 pm_runtime_mark_last_busy(dev->dev);
                 pm_runtime_put(dev->dev);
+        } else {
+                /* enable polling for external displays */
+                drm_kms_helper_poll_enable(dev);
         }
         return 0;
 
@@ -774,9 +777,6 @@ nouveau_pmops_runtime_resume(struct device *dev)
 
         ret = nouveau_do_resume(drm_dev, true);
 
-        if (!drm_dev->mode_config.poll_enabled)
-                drm_kms_helper_poll_enable(drm_dev);
-
         /* do magic */
         nvif_mask(&device->object, 0x088488, (1 << 25), (1 << 25));
         vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON);
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
index 3a24788c3185..a7e55c422501 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c
@@ -148,7 +148,7 @@ gk104_fifo_runlist_commit(struct gk104_fifo *fifo, int runl)
         case NVKM_MEM_TARGET_NCOH: target = 3; break;
         default:
                 WARN_ON(1);
-                return;
+                goto unlock;
         }
 
         nvkm_wr32(device, 0x002270, (nvkm_memory_addr(mem) >> 12) |
@@ -160,6 +160,7 @@ gk104_fifo_runlist_commit(struct gk104_fifo *fifo, int runl)
                                        & 0x00100000),
                                msecs_to_jiffies(2000)) == 0)
                 nvkm_error(subdev, "runlist %d update timeout\n", runl);
+unlock:
         mutex_unlock(&subdev->mutex);
 }
 
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
index d1cf02d22db1..1b0c793c0192 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/ls_ucode_gr.c
@@ -116,6 +116,7 @@ ls_ucode_img_load_gr(const struct nvkm_subdev *subdev, struct ls_ucode_img *img,
         ret = nvkm_firmware_get(subdev->device, f, &sig);
         if (ret)
                 goto free_data;
+
         img->sig = kmemdup(sig->data, sig->size, GFP_KERNEL);
         if (!img->sig) {
                 ret = -ENOMEM;
@@ -126,8 +127,9 @@ ls_ucode_img_load_gr(const struct nvkm_subdev *subdev, struct ls_ucode_img *img,
         img->ucode_data = ls_ucode_img_build(bl, code, data,
                                              &img->ucode_desc);
         if (IS_ERR(img->ucode_data)) {
+                kfree(img->sig);
                 ret = PTR_ERR(img->ucode_data);
-                goto free_data;
+                goto free_sig;
         }
         img->ucode_size = img->ucode_desc.image_size;
 
diff --git a/drivers/gpu/host1x/Kconfig b/drivers/gpu/host1x/Kconfig
index b2fd029d67b3..91916326957f 100644
--- a/drivers/gpu/host1x/Kconfig
+++ b/drivers/gpu/host1x/Kconfig
@@ -1,6 +1,7 @@
 config TEGRA_HOST1X
         tristate "NVIDIA Tegra host1x driver"
         depends on ARCH_TEGRA || (ARM && COMPILE_TEST)
+        select IOMMU_IOVA if IOMMU_SUPPORT
         help
           Driver for the NVIDIA Tegra host1x hardware.
 
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index f2acd4b6bf01..d1263b82d646 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -94,6 +94,7 @@ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
 static int dw_i2c_acpi_configure(struct platform_device *pdev)
 {
         struct dw_i2c_dev *dev = platform_get_drvdata(pdev);
+        u32 ss_ht = 0, fp_ht = 0, hs_ht = 0, fs_ht = 0;
         acpi_handle handle = ACPI_HANDLE(&pdev->dev);
         const struct acpi_device_id *id;
         struct acpi_device *adev;
@@ -107,23 +108,24 @@ static int dw_i2c_acpi_configure(struct platform_device *pdev)
          * Try to get SDA hold time and *CNT values from an ACPI method for
          * selected speed modes.
          */
+        dw_i2c_acpi_params(pdev, "SSCN", &dev->ss_hcnt, &dev->ss_lcnt, &ss_ht);
+        dw_i2c_acpi_params(pdev, "FPCN", &dev->fp_hcnt, &dev->fp_lcnt, &fp_ht);
+        dw_i2c_acpi_params(pdev, "HSCN", &dev->hs_hcnt, &dev->hs_lcnt, &hs_ht);
+        dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt, &fs_ht);
+
         switch (dev->clk_freq) {
         case 100000:
-                dw_i2c_acpi_params(pdev, "SSCN", &dev->ss_hcnt, &dev->ss_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = ss_ht;
                 break;
         case 1000000:
-                dw_i2c_acpi_params(pdev, "FPCN", &dev->fp_hcnt, &dev->fp_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = fp_ht;
                 break;
         case 3400000:
-                dw_i2c_acpi_params(pdev, "HSCN", &dev->hs_hcnt, &dev->hs_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = hs_ht;
                 break;
         case 400000:
         default:
-                dw_i2c_acpi_params(pdev, "FMCN", &dev->fs_hcnt, &dev->fs_lcnt,
-                                   &dev->sda_hold_time);
+                dev->sda_hold_time = fs_ht;
                 break;
         }
 
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 8348f366ddd1..62618e77bedc 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -396,13 +396,13 @@ static void iommu_dma_free_iova(struct iommu_dma_cookie *cookie,
                 dma_addr_t iova, size_t size)
 {
         struct iova_domain *iovad = &cookie->iovad;
-        unsigned long shift = iova_shift(iovad);
 
         /* The MSI case is only ever cleaning up its most recent allocation */
         if (cookie->type == IOMMU_DMA_MSI_COOKIE)
                 cookie->msi_iova -= size;
         else
-                free_iova_fast(iovad, iova >> shift, size >> shift);
+                free_iova_fast(iovad, iova_pfn(iovad, iova),
+                                size >> iova_shift(iovad));
 }
 
 static void __iommu_dma_unmap(struct iommu_domain *domain, dma_addr_t dma_addr,
@@ -617,11 +617,14 @@ static dma_addr_t __iommu_dma_map(struct device *dev, phys_addr_t phys,
 {
         struct iommu_domain *domain = iommu_get_domain_for_dev(dev);
         struct iommu_dma_cookie *cookie = domain->iova_cookie;
-        struct iova_domain *iovad = &cookie->iovad;
-        size_t iova_off = iova_offset(iovad, phys);
+        size_t iova_off = 0;
         dma_addr_t iova;
 
-        size = iova_align(iovad, size + iova_off);
+        if (cookie->type == IOMMU_DMA_IOVA_COOKIE) {
+                iova_off = iova_offset(&cookie->iovad, phys);
+                size = iova_align(&cookie->iovad, size + iova_off);
+        }
+
         iova = iommu_dma_alloc_iova(domain, size, dma_get_mask(dev), dev);
         if (!iova)
                 return DMA_ERROR_CODE;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 90ab0115d78e..fc2765ccdb57 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2055,11 +2055,14 @@ static int domain_context_mapping_one(struct dmar_domain *domain,
         if (context_copied(context)) {
                 u16 did_old = context_domain_id(context);
 
-                if (did_old >= 0 && did_old < cap_ndoms(iommu->cap))
+                if (did_old >= 0 && did_old < cap_ndoms(iommu->cap)) {
                         iommu->flush.flush_context(iommu, did_old,
                                                    (((u16)bus) << 8) | devfn,
                                                    DMA_CCMD_MASK_NOBIT,
                                                    DMA_CCMD_DEVICE_INVL);
+                        iommu->flush.flush_iotlb(iommu, did_old, 0, 0,
+                                                 DMA_TLB_DSI_FLUSH);
+                }
         }
 
         pgd = domain->pgd;
diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c
index a27ef570c328..bc1efbfb9ddf 100644
--- a/drivers/iommu/mtk_iommu_v1.c
+++ b/drivers/iommu/mtk_iommu_v1.c
@@ -18,6 +18,7 @@
 #include <linux/clk.h>
 #include <linux/component.h>
 #include <linux/device.h>
+#include <linux/dma-mapping.h>
 #include <linux/dma-iommu.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
index d2306c821ebb..31d6b5a582d2 100644
--- a/drivers/irqchip/irq-mbigen.c
+++ b/drivers/irqchip/irq-mbigen.c
@@ -106,10 +106,7 @@ static inline void get_mbigen_type_reg(irq_hw_number_t hwirq,
 static inline void get_mbigen_clear_reg(irq_hw_number_t hwirq,
                                         u32 *mask, u32 *addr)
 {
-        unsigned int ofst;
-
-        hwirq -= RESERVED_IRQ_PER_MBIGEN_CHIP;
-        ofst = hwirq / 32 * 4;
+        unsigned int ofst = (hwirq / 32) * 4;
 
         *mask = 1 << (hwirq % 32);
         *addr = ofst + REG_MBIGEN_CLEAR_OFFSET;
@@ -337,9 +334,15 @@ static int mbigen_device_probe(struct platform_device *pdev)
         mgn_chip->pdev = pdev;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        mgn_chip->base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(mgn_chip->base))
-                return PTR_ERR(mgn_chip->base);
+        if (!res)
+                return -EINVAL;
+
+        mgn_chip->base = devm_ioremap(&pdev->dev, res->start,
+                                      resource_size(res));
+        if (!mgn_chip->base) {
+                dev_err(&pdev->dev, "failed to ioremap %pR\n", res);
+                return -ENOMEM;
+        }
 
         if (IS_ENABLED(CONFIG_OF) && pdev->dev.of_node)
                 err = mbigen_of_create_domain(pdev, mgn_chip);
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index bf0fe0137dfe..6d1b4b707cc2 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -512,7 +512,7 @@ static void gpmc_cs_show_timings(int cs, const char *desc)
         pr_info("gpmc cs%i access configuration:\n", cs);
         GPMC_GET_RAW_BOOL(GPMC_CS_CONFIG1,  4,  4, "time-para-granularity");
         GPMC_GET_RAW(GPMC_CS_CONFIG1,  8,  9, "mux-add-data");
-        GPMC_GET_RAW_MAX(GPMC_CS_CONFIG1, 12, 13,
+        GPMC_GET_RAW_SHIFT_MAX(GPMC_CS_CONFIG1, 12, 13, 1,
                          GPMC_CONFIG1_DEVICESIZE_MAX, "device-width");
         GPMC_GET_RAW(GPMC_CS_CONFIG1, 16, 17, "wait-pin");
         GPMC_GET_RAW_BOOL(GPMC_CS_CONFIG1, 21, 21, "wait-on-write");
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2cba76e6fa3c..07bbd4cc1852 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -492,6 +492,7 @@ config ASPEED_LPC_CTRL
 
 config PCI_ENDPOINT_TEST
         depends on PCI
+        select CRC32
         tristate "PCI Endpoint Test driver"
         ---help---
            Enable this configuration option to enable the host side test driver
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index c5fd4259da33..b44a6aeb346d 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2577,7 +2577,7 @@ int __bond_3ad_get_active_agg_info(struct bonding *bond,
                 return -1;
 
         ad_info->aggregator_id = aggregator->aggregator_identifier;
-        ad_info->ports = aggregator->num_of_ports;
+        ad_info->ports = __agg_active_ports(aggregator);
         ad_info->actor_key = aggregator->actor_oper_aggregator_key;
         ad_info->partner_key = aggregator->partner_oper_aggregator_key;
         ether_addr_copy(ad_info->partner_system,
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2be78807fd6e..73313318399c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4271,10 +4271,10 @@ static int bond_check_params(struct bond_params *params)
         int arp_validate_value, fail_over_mac_value, primary_reselect_value, i;
         struct bond_opt_value newval;
         const struct bond_opt_value *valptr;
-        int arp_all_targets_value;
+        int arp_all_targets_value = 0;
         u16 ad_actor_sys_prio = 0;
         u16 ad_user_port_key = 0;
-        __be32 arp_target[BOND_MAX_ARP_TARGETS];
+        __be32 arp_target[BOND_MAX_ARP_TARGETS] = { 0 };
         int arp_ip_count;
         int bond_mode   = BOND_MODE_ROUNDROBIN;
         int xmit_hashtype = BOND_XMIT_POLICY_LAYER2;
@@ -4501,7 +4501,6 @@ static int bond_check_params(struct bond_params *params)
                 arp_validate_value = 0;
         }
 
-        arp_all_targets_value = 0;
         if (arp_all_targets) {
                 bond_opt_initstr(&newval, arp_all_targets);
                 valptr = bond_opt_parse(bond_opt_get(BOND_OPT_ARP_ALL_TARGETS),
diff --git a/drivers/net/ethernet/atheros/atlx/atl2.c b/drivers/net/ethernet/atheros/atlx/atl2.c
index 63f2deec2a52..77a1c03255de 100644
--- a/drivers/net/ethernet/atheros/atlx/atl2.c
+++ b/drivers/net/ethernet/atheros/atlx/atl2.c
@@ -1353,6 +1353,7 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) &&
                 pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32))) {
                 printk(KERN_ERR "atl2: No usable DMA configuration, aborting\n");
+                err = -EIO;
                 goto err_dma;
         }
 
@@ -1366,10 +1367,11 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
          * pcibios_set_master to do the needed arch specific settings */
         pci_set_master(pdev);
 
-        err = -ENOMEM;
         netdev = alloc_etherdev(sizeof(struct atl2_adapter));
-        if (!netdev)
+        if (!netdev) {
+                err = -ENOMEM;
                 goto err_alloc_etherdev;
+        }
 
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
@@ -1408,8 +1410,6 @@ static int atl2_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 goto err_sw_init;
 
-        err = -EIO;
-
         netdev->hw_features = NETIF_F_HW_VLAN_CTAG_RX;
         netdev->features |= (NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX);
 
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 765400b62168..2dfca96a63b6 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -681,7 +681,7 @@ static int smsc95xx_set_features(struct net_device *netdev,
         if (ret < 0)
                 return ret;
 
-        if (features & NETIF_F_HW_CSUM)
+        if (features & NETIF_F_IP_CSUM)
                 read_buf |= Tx_COE_EN_;
         else
                 read_buf &= ~Tx_COE_EN_;
@@ -1279,12 +1279,19 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 
         spin_lock_init(&pdata->mac_cr_lock);
 
+        /* LAN95xx devices do not alter the computed checksum of 0 to 0xffff.
+         * RFC 2460, ipv6 UDP calculated checksum yields a result of zero must
+         * be changed to 0xffff. RFC 768, ipv4 UDP computed checksum is zero,
+         * it is transmitted as all ones. The zero transmitted checksum means
+         * transmitter generated no checksum. Hence, enable csum offload only
+         * for ipv4 packets.
+         */
         if (DEFAULT_TX_CSUM_ENABLE)
-                dev->net->features |= NETIF_F_HW_CSUM;
+                dev->net->features |= NETIF_F_IP_CSUM;
         if (DEFAULT_RX_CSUM_ENABLE)
                 dev->net->features |= NETIF_F_RXCSUM;
 
-        dev->net->hw_features = NETIF_F_HW_CSUM | NETIF_F_RXCSUM;
+        dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
         smsc95xx_init_mac_address(dev);
 
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index 70e689bf1cad..dca7165fabcf 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -1754,6 +1754,10 @@ nvme_fc_error_recovery(struct nvme_fc_ctrl *ctrl, char *errmsg)
         dev_info(ctrl->ctrl.device,
                 "NVME-FC{%d}: resetting controller\n", ctrl->cnum);
 
+        /* stop the queues on error, cleanup is in reset thread */
+        if (ctrl->queue_count > 1)
+                nvme_stop_queues(&ctrl->ctrl);
+
         if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_RECONNECTING)) {
                 dev_err(ctrl->ctrl.device,
                         "NVME-FC{%d}: error_recovery: Couldn't change state "
@@ -2720,6 +2724,12 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts,
         unsigned long flags;
         int ret, idx;
 
+        if (!(rport->remoteport.port_role &
+            (FC_PORT_ROLE_NVME_DISCOVERY | FC_PORT_ROLE_NVME_TARGET))) {
+                ret = -EBADR;
+                goto out_fail;
+        }
+
         ctrl = kzalloc(sizeof(*ctrl), GFP_KERNEL);
         if (!ctrl) {
                 ret = -ENOMEM;
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index fed803232edc..4c2ff2bb26bc 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1506,6 +1506,11 @@ static inline void nvme_release_cmb(struct nvme_dev *dev)
         if (dev->cmb) {
                 iounmap(dev->cmb);
                 dev->cmb = NULL;
+                if (dev->cmbsz) {
+                        sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+                                                     &dev_attr_cmb.attr, NULL);
+                        dev->cmbsz = 0;
+                }
         }
 }
 
@@ -1779,6 +1784,7 @@ static void nvme_pci_disable(struct nvme_dev *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev->dev);
 
+        nvme_release_cmb(dev);
         pci_free_irq_vectors(pdev);
 
         if (pci_is_enabled(pdev)) {
@@ -2184,7 +2190,6 @@ static void nvme_remove(struct pci_dev *pdev)
         nvme_dev_disable(dev, true);
         nvme_dev_remove_admin(dev);
         nvme_free_queues(dev, 0);
-        nvme_release_cmb(dev);
         nvme_release_prp_pools(dev);
         nvme_dev_unmap(dev);
         nvme_put_ctrl(&dev->ctrl);
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index cf90713043da..eb9399ac97cf 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -529,6 +529,12 @@ fail:
 }
 EXPORT_SYMBOL_GPL(nvmet_req_init);
 
+void nvmet_req_uninit(struct nvmet_req *req)
+{
+        percpu_ref_put(&req->sq->ref);
+}
+EXPORT_SYMBOL_GPL(nvmet_req_uninit);
+
 static inline bool nvmet_cc_en(u32 cc)
 {
         return cc & 0x1;
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 62eba29c85fb..2006fae61980 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -517,9 +517,7 @@ nvmet_fc_queue_to_cpu(struct nvmet_fc_tgtport *tgtport, int qid)
 {
         int cpu, idx, cnt;
 
-        if (!(tgtport->ops->target_features &
-                        NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED) ||
-            tgtport->ops->max_hw_queues == 1)
+        if (tgtport->ops->max_hw_queues == 1)
                 return WORK_CPU_UNBOUND;
 
         /* Simple cpu selection based on qid modulo active cpu count */
diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c
index 15551ef79c8c..294a6611fb24 100644
--- a/drivers/nvme/target/fcloop.c
+++ b/drivers/nvme/target/fcloop.c
@@ -698,7 +698,6 @@ static struct nvmet_fc_target_template tgttemplate = {
         .dma_boundary           = FCLOOP_DMABOUND_4G,
         /* optional features */
         .target_features        = NVMET_FCTGTFEAT_CMD_IN_ISR |
-                                  NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED |
                                   NVMET_FCTGTFEAT_OPDONE_IN_ISR,
         /* sizes of additional private data for data structures */
         .target_priv_sz         = sizeof(struct fcloop_tport),
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 7cb77ba5993b..cfc5c7fb0ab7 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -261,6 +261,7 @@ u16 nvmet_parse_fabrics_cmd(struct nvmet_req *req);
 
 bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq,
                 struct nvmet_sq *sq, struct nvmet_fabrics_ops *ops);
+void nvmet_req_uninit(struct nvmet_req *req);
 void nvmet_req_complete(struct nvmet_req *req, u16 status);
 
 void nvmet_cq_setup(struct nvmet_ctrl *ctrl, struct nvmet_cq *cq, u16 qid,
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index 99c69018a35f..9e45cde63376 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -567,6 +567,7 @@ static void nvmet_rdma_read_data_done(struct ib_cq *cq, struct ib_wc *wc)
         rsp->n_rdma = 0;
 
         if (unlikely(wc->status != IB_WC_SUCCESS)) {
+                nvmet_req_uninit(&rsp->req);
                 nvmet_rdma_release_rsp(rsp);
                 if (wc->status != IB_WC_WR_FLUSH_ERR) {
                         pr_info("RDMA READ for CQE 0x%p failed with status %s (%d).\n",
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 3080d9dd031d..43bd69dceabf 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -507,6 +507,9 @@ void *__unflatten_device_tree(const void *blob,
 
         /* Allocate memory for the expanded device tree */
         mem = dt_alloc(size + 4, __alignof__(struct device_node));
+        if (!mem)
+                return NULL;
+
         memset(mem, 0, size);
 
         *(__be32 *)(mem + size) = cpu_to_be32(0xdeadbeef);
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 4dec07ea510f..d507c3569a88 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -197,7 +197,7 @@ static int __init __reserved_mem_init_node(struct reserved_mem *rmem)
         const struct of_device_id *i;
 
         for (i = __reservedmem_of_table; i < &__rmem_of_table_sentinel; i++) {
-                int const (*initfn)(struct reserved_mem *rmem) = i->data;
+                reservedmem_of_init_fn initfn = i->data;
                 const char *compat = i->compatible;
 
                 if (!of_flat_dt_is_compatible(rmem->fdt_node, compat))
diff --git a/drivers/powercap/powercap_sys.c b/drivers/powercap/powercap_sys.c
index 14bde0db8c24..5b10b50f8686 100644
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_zone(
 
         power_zone->id = result;
         idr_init(&power_zone->idr);
+        result = -ENOMEM;
         power_zone->name = kstrdup(name, GFP_KERNEL);
         if (!power_zone->name)
                 goto err_name_alloc;
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index b3de973a6260..9dca53df3584 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -1088,7 +1088,7 @@ static u32 rtc_handler(void *context)
         }
         spin_unlock_irqrestore(&rtc_lock, flags);
 
-        pm_wakeup_event(dev, 0);
+        pm_wakeup_hard_event(dev);
         acpi_clear_event(ACPI_EVENT_RTC);
         acpi_disable_event(ACPI_EVENT_RTC, 0);
         return ACPI_INTERRUPT_HANDLED;
diff --git a/drivers/scsi/cxlflash/Kconfig b/drivers/scsi/cxlflash/Kconfig
index c052104e523e..a011c5dbf214 100644
--- a/drivers/scsi/cxlflash/Kconfig
+++ b/drivers/scsi/cxlflash/Kconfig
@@ -5,6 +5,7 @@
 config CXLFLASH
         tristate "Support for IBM CAPI Flash"
         depends on PCI && SCSI && CXL && EEH
+        select IRQ_POLL
         default m
         help
           Allows CAPI Accelerated IO to Flash
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index a808e8ef1d08..234352da5c3c 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -407,11 +407,12 @@ unlock:
  * can_queue. Eventually we will hit the point where we run
  * on all reserved structs.
  */
-static void fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
+static bool fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
 {
         struct fc_fcp_internal *si = fc_get_scsi_internal(lport);
         unsigned long flags;
         int can_queue;
+        bool changed = false;
 
         spin_lock_irqsave(lport->host->host_lock, flags);
 
@@ -427,9 +428,11 @@ static void fc_fcp_can_queue_ramp_down(struct fc_lport *lport)
         if (!can_queue)
                 can_queue = 1;
         lport->host->can_queue = can_queue;
+        changed = true;
 
 unlock:
         spin_unlock_irqrestore(lport->host->host_lock, flags);
+        return changed;
 }
 
 /*
@@ -1896,11 +1899,11 @@ int fc_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *sc_cmd)
 
         if (!fc_fcp_lport_queue_ready(lport)) {
                 if (lport->qfull) {
-                        fc_fcp_can_queue_ramp_down(lport);
-                        shost_printk(KERN_ERR, lport->host,
-                                     "libfc: queue full, "
-                                     "reducing can_queue to %d.\n",
-                                     lport->host->can_queue);
+                        if (fc_fcp_can_queue_ramp_down(lport))
+                                shost_printk(KERN_ERR, lport->host,
+                                             "libfc: queue full, "
+                                             "reducing can_queue to %d.\n",
+                                             lport->host->can_queue);
                 }
                 rc = SCSI_MLQUEUE_HOST_BUSY;
                 goto out;
diff --git a/drivers/scsi/lpfc/lpfc_crtn.h b/drivers/scsi/lpfc/lpfc_crtn.h
index 944b32ca4931..1c55408ac718 100644
--- a/drivers/scsi/lpfc/lpfc_crtn.h
+++ b/drivers/scsi/lpfc/lpfc_crtn.h
@@ -294,6 +294,7 @@ int lpfc_selective_reset(struct lpfc_hba *);
 void lpfc_reset_barrier(struct lpfc_hba *);
 int lpfc_sli_brdready(struct lpfc_hba *, uint32_t);
 int lpfc_sli_brdkill(struct lpfc_hba *);
+int lpfc_sli_chipset_init(struct lpfc_hba *phba);
 int lpfc_sli_brdreset(struct lpfc_hba *);
 int lpfc_sli_brdrestart(struct lpfc_hba *);
 int lpfc_sli_hba_setup(struct lpfc_hba *);
diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
index 1487406aea77..c7962dae4dab 100644
--- a/drivers/scsi/lpfc/lpfc_ct.c
+++ b/drivers/scsi/lpfc/lpfc_ct.c
@@ -630,7 +630,7 @@ lpfc_ns_rsp(struct lpfc_vport *vport, struct lpfc_dmabuf *mp, uint8_t fc4_type,
                                                 NLP_EVT_DEVICE_RECOVERY);
                         spin_lock_irq(shost->host_lock);
                         ndlp->nlp_flag &= ~NLP_NVMET_RECOV;
-                        spin_lock_irq(shost->host_lock);
+                        spin_unlock_irq(shost->host_lock);
                 }
         }
 
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 90ae354a9c45..4b1eb98c228d 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -3602,6 +3602,13 @@ lpfc_get_wwpn(struct lpfc_hba *phba)
         LPFC_MBOXQ_t *mboxq;
         MAILBOX_t *mb;
 
+        if (phba->sli_rev < LPFC_SLI_REV4) {
+                /* Reset the port first */
+                lpfc_sli_brdrestart(phba);
+                rc = lpfc_sli_chipset_init(phba);
+                if (rc)
+                        return (uint64_t)-1;
+        }
 
         mboxq = (LPFC_MBOXQ_t *) mempool_alloc(phba->mbox_mem_pool,
                                                 GFP_KERNEL);
@@ -8847,7 +8854,7 @@ lpfc_sli4_queue_unset(struct lpfc_hba *phba)
                 lpfc_wq_destroy(phba, phba->sli4_hba.nvmels_wq);
 
         /* Unset ELS work queue */
-        if (phba->sli4_hba.els_cq)
+        if (phba->sli4_hba.els_wq)
                 lpfc_wq_destroy(phba, phba->sli4_hba.els_wq);
 
         /* Unset unsolicited receive queue */
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 94434e621c33..0488580eea12 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -764,7 +764,6 @@ lpfc_nvmet_create_targetport(struct lpfc_hba *phba)
         lpfc_tgttemplate.max_sgl_segments = phba->cfg_nvme_seg_cnt + 1;
         lpfc_tgttemplate.max_hw_queues = phba->cfg_nvme_io_channel;
         lpfc_tgttemplate.target_features = NVMET_FCTGTFEAT_READDATA_RSP |
-                                           NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED |
                                            NVMET_FCTGTFEAT_CMD_IN_ISR |
                                            NVMET_FCTGTFEAT_OPDONE_IN_ISR;
 
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index cf19f4976f5f..2a4fc00dfa9b 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -4204,13 +4204,16 @@ lpfc_sli_brdreset(struct lpfc_hba *phba)
         /* Reset HBA */
         lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
                         "0325 Reset HBA Data: x%x x%x\n",
-                        phba->pport->port_state, psli->sli_flag);
+                        (phba->pport) ? phba->pport->port_state : 0,
+                        psli->sli_flag);
 
         /* perform board reset */
         phba->fc_eventTag = 0;
         phba->link_events = 0;
-        phba->pport->fc_myDID = 0;
-        phba->pport->fc_prevDID = 0;
+        if (phba->pport) {
+                phba->pport->fc_myDID = 0;
+                phba->pport->fc_prevDID = 0;
+        }
 
         /* Turn off parity checking and serr during the physical reset */
         pci_read_config_word(phba->pcidev, PCI_COMMAND, &cfg_value);
@@ -4336,7 +4339,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         /* Restart HBA */
         lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
                         "0337 Restart HBA Data: x%x x%x\n",
-                        phba->pport->port_state, psli->sli_flag);
+                        (phba->pport) ? phba->pport->port_state : 0,
+                        psli->sli_flag);
 
         word0 = 0;
         mb = (MAILBOX_t *) &word0;
@@ -4350,7 +4354,7 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         readl(to_slim); /* flush */
 
         /* Only skip post after fc_ffinit is completed */
-        if (phba->pport->port_state)
+        if (phba->pport && phba->pport->port_state)
                 word0 = 1;      /* This is really setting up word1 */
         else
                 word0 = 0;      /* This is really setting up word1 */
@@ -4359,7 +4363,8 @@ lpfc_sli_brdrestart_s3(struct lpfc_hba *phba)
         readl(to_slim); /* flush */
 
         lpfc_sli_brdreset(phba);
-        phba->pport->stopped = 0;
+        if (phba->pport)
+                phba->pport->stopped = 0;
         phba->link_state = LPFC_INIT_START;
         phba->hba_flag = 0;
         spin_unlock_irq(&phba->hbalock);
@@ -4446,7 +4451,7 @@ lpfc_sli_brdrestart(struct lpfc_hba *phba)
  * iteration, the function will restart the HBA again. The function returns
  * zero if HBA successfully restarted else returns negative error code.
  **/
-static int
+int
 lpfc_sli_chipset_init(struct lpfc_hba *phba)
 {
         uint32_t status, i = 0;
diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
index a4aadf5f4dc6..1cc814f1505a 100644
--- a/drivers/scsi/pmcraid.c
+++ b/drivers/scsi/pmcraid.c
@@ -3770,9 +3770,6 @@ static long pmcraid_ioctl_passthrough(
                         pmcraid_err("couldn't build passthrough ioadls\n");
                         goto out_free_cmd;
                 }
-        } else if (request_size < 0) {
-                rc = -EINVAL;
-                goto out_free_cmd;
         }
 
         /* If data is being written into the device, copy the data from user
diff --git a/drivers/scsi/qedf/qedf.h b/drivers/scsi/qedf/qedf.h
index 40aeb6bb96a2..07ee88200e91 100644
--- a/drivers/scsi/qedf/qedf.h
+++ b/drivers/scsi/qedf/qedf.h
@@ -259,7 +259,7 @@ struct qedf_io_log {
         uint16_t task_id;
         uint32_t port_id; /* Remote port fabric ID */
         int lun;
-        char op; /* SCSI CDB */
+        unsigned char op; /* SCSI CDB */
         uint8_t lba[4];
         unsigned int bufflen; /* SCSI buffer length */
         unsigned int sg_count; /* Number of SG elements */
diff --git a/drivers/scsi/qedf/qedf_els.c b/drivers/scsi/qedf/qedf_els.c
index c505d41f6dc8..90627033bde6 100644
--- a/drivers/scsi/qedf/qedf_els.c
+++ b/drivers/scsi/qedf/qedf_els.c
@@ -109,7 +109,7 @@ retry_els:
         did = fcport->rdata->ids.port_id;
         sid = fcport->sid;
 
-        __fc_fill_fc_hdr(fc_hdr, FC_RCTL_ELS_REQ, sid, did,
+        __fc_fill_fc_hdr(fc_hdr, FC_RCTL_ELS_REQ, did, sid,
                            FC_TYPE_ELS, FC_FC_FIRST_SEQ | FC_FC_END_SEQ |
                            FC_FC_SEQ_INIT, 0);
 
diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c
index cceddd995a4b..a5c97342fd5d 100644
--- a/drivers/scsi/qedf/qedf_main.c
+++ b/drivers/scsi/qedf/qedf_main.c
@@ -2895,7 +2895,7 @@ static int __qedf_probe(struct pci_dev *pdev, int mode)
         slowpath_params.drv_minor = QEDF_DRIVER_MINOR_VER;
         slowpath_params.drv_rev = QEDF_DRIVER_REV_VER;
         slowpath_params.drv_eng = QEDF_DRIVER_ENG_VER;
-        memcpy(slowpath_params.name, "qedf", QED_DRV_VER_STR_SIZE);
+        strncpy(slowpath_params.name, "qedf", QED_DRV_VER_STR_SIZE);
         rc = qed_ops->common->slowpath_start(qedf->cdev, &slowpath_params);
         if (rc) {
                 QEDF_ERR(&(qedf->dbg_ctx), "Cannot start slowpath.\n");
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 7bfbcfa7af40..61cdd99ae41e 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -763,6 +763,8 @@ struct scsi_device *__scsi_device_lookup(struct Scsi_Host *shost,
         struct scsi_device *sdev;
 
         list_for_each_entry(sdev, &shost->__devices, siblings) {
+                if (sdev->sdev_state == SDEV_DEL)
+                        continue;
                 if (sdev->channel == channel && sdev->id == id &&
                                 sdev->lun ==lun)
                         return sdev;
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 814a4bd8405d..e31f1cc90b81 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -30,6 +30,7 @@
 #include <scsi/scsi_driver.h>
 #include <scsi/scsi_eh.h>
 #include <scsi/scsi_host.h>
+#include <scsi/scsi_transport.h> /* __scsi_init_queue() */
 #include <scsi/scsi_dh.h>
 
 #include <trace/events/scsi.h>
diff --git a/drivers/soc/bcm/brcmstb/common.c b/drivers/soc/bcm/brcmstb/common.c
index b6195fdf0d00..22e98a90468c 100644
--- a/drivers/soc/bcm/brcmstb/common.c
+++ b/drivers/soc/bcm/brcmstb/common.c
@@ -49,7 +49,7 @@ static const struct of_device_id sun_top_ctrl_match[] = {
         { .compatible = "brcm,bcm7420-sun-top-ctrl", },
         { .compatible = "brcm,bcm7425-sun-top-ctrl", },
         { .compatible = "brcm,bcm7429-sun-top-ctrl", },
-        { .compatible = "brcm,bcm7425-sun-top-ctrl", },
+        { .compatible = "brcm,bcm7435-sun-top-ctrl", },
         { .compatible = "brcm,brcmstb-sun-top-ctrl", },
         { }
 };
diff --git a/drivers/soc/imx/Kconfig b/drivers/soc/imx/Kconfig
index 357a5d8f8da0..a5b86a28f343 100644
--- a/drivers/soc/imx/Kconfig
+++ b/drivers/soc/imx/Kconfig
@@ -2,8 +2,9 @@ menu "i.MX SoC drivers"
 
 config IMX7_PM_DOMAINS
         bool "i.MX7 PM domains"
-        select PM_GENERIC_DOMAINS
         depends on SOC_IMX7D || (COMPILE_TEST && OF)
+        depends on PM
+        select PM_GENERIC_DOMAINS
         default y if SOC_IMX7D
 
 endmenu
diff --git a/drivers/staging/android/ion/devicetree.txt b/drivers/staging/android/ion/devicetree.txt
deleted file mode 100644
index 168715271f06..000000000000
--- a/drivers/staging/android/ion/devicetree.txt
+++ /dev/null
@@ -1,51 +0,0 @@
-Ion Memory Manager
-
-Ion is a memory manager that allows for sharing of buffers via dma-buf.
-Ion allows for different types of allocation via an abstraction called
-a 'heap'. A heap represents a specific type of memory. Each heap has
-a different type. There can be multiple instances of the same heap
-type.
-
-Specific heap instances are tied to heap IDs. Heap IDs are not to be specified
-in the devicetree.
-
-Required properties for Ion
-
-- compatible: "linux,ion" PLUS a compatible property for the device
-
-All child nodes of a linux,ion node are interpreted as heaps
-
-required properties for heaps
-
-- compatible: compatible string for a heap type PLUS a compatible property
-for the specific instance of the heap. Current heap types
--- linux,ion-heap-system
--- linux,ion-heap-system-contig
--- linux,ion-heap-carveout
--- linux,ion-heap-chunk
--- linux,ion-heap-dma
--- linux,ion-heap-custom
-
-Optional properties
-- memory-region: A phandle to a memory region. Required for DMA heap type
-(see reserved-memory.txt for details on the reservation)
-
-Example:
-
-        ion {
-                compatbile = "hisilicon,ion", "linux,ion";
-
-                ion-system-heap {
-                        compatbile = "hisilicon,system-heap", "linux,ion-heap-system"
-                };
-
-                ion-camera-region {
-                        compatible = "hisilicon,camera-heap", "linux,ion-heap-dma"
-                        memory-region = <&camera_region>;
-                };
-
-                ion-fb-region {
-                        compatbile = "hisilicon,fb-heap", "linux,ion-heap-dma"
-                        memory-region = <&fb_region>;
-                };
-        }
diff --git a/drivers/staging/ccree/ssi_request_mgr.c b/drivers/staging/ccree/ssi_request_mgr.c
index 522bd62c102e..8611adf3bb2e 100644
--- a/drivers/staging/ccree/ssi_request_mgr.c
+++ b/drivers/staging/ccree/ssi_request_mgr.c
@@ -376,7 +376,6 @@ int send_request(
         rc = ssi_power_mgr_runtime_get(&drvdata->plat_dev->dev);
         if (rc != 0) {
                 SSI_LOG_ERR("ssi_power_mgr_runtime_get returned %x\n",rc);
-                spin_unlock_bh(&req_mgr_h->hw_lock);
                 return rc;
         }
 #endif
diff --git a/drivers/staging/fsl-dpaa2/Kconfig b/drivers/staging/fsl-dpaa2/Kconfig
index 2e325cb747ae..730fd6d4db33 100644
--- a/drivers/staging/fsl-dpaa2/Kconfig
+++ b/drivers/staging/fsl-dpaa2/Kconfig
@@ -12,6 +12,7 @@ config FSL_DPAA2
 config FSL_DPAA2_ETH
         tristate "Freescale DPAA2 Ethernet"
         depends on FSL_DPAA2 && FSL_MC_DPIO
+        depends on NETDEVICES && ETHERNET
         ---help---
           Ethernet driver for Freescale DPAA2 SoCs, using the
           Freescale MC bus driver
diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 4723a0bd5067..1c6ed5b2a6f9 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -97,8 +97,9 @@ void rtl92e_set_reg(struct net_device *dev, u8 variable, u8 *val)
 
         switch (variable) {
         case HW_VAR_BSSID:
-                rtl92e_writel(dev, BSSIDR, ((u32 *)(val))[0]);
-                rtl92e_writew(dev, BSSIDR+2, ((u16 *)(val+2))[0]);
+                /* BSSIDR 2 byte alignment */
+                rtl92e_writew(dev, BSSIDR, *(u16 *)val);
+                rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(val + 2));
                 break;
 
         case HW_VAR_MEDIA_STATUS:
@@ -624,7 +625,7 @@ void rtl92e_get_eeprom_size(struct net_device *dev)
         struct r8192_priv *priv = rtllib_priv(dev);
 
         RT_TRACE(COMP_INIT, "===========>%s()\n", __func__);
-        curCR = rtl92e_readl(dev, EPROM_CMD);
+        curCR = rtl92e_readw(dev, EPROM_CMD);
         RT_TRACE(COMP_INIT, "read from Reg Cmd9346CR(%x):%x\n", EPROM_CMD,
                  curCR);
         priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 :
@@ -961,8 +962,8 @@ static void _rtl92e_net_update(struct net_device *dev)
         rtl92e_config_rate(dev, &rate_config);
         priv->dot11CurrentPreambleMode = PREAMBLE_AUTO;
          priv->basic_rate = rate_config &= 0x15f;
-        rtl92e_writel(dev, BSSIDR, ((u32 *)net->bssid)[0]);
-        rtl92e_writew(dev, BSSIDR+4, ((u16 *)net->bssid)[2]);
+        rtl92e_writew(dev, BSSIDR, *(u16 *)net->bssid);
+        rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(net->bssid + 2));
 
         if (priv->rtllib->iw_mode == IW_MODE_ADHOC) {
                 rtl92e_writew(dev, ATIMWND, 2);
@@ -1182,8 +1183,7 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
                           struct cb_desc *cb_desc, struct sk_buff *skb)
 {
         struct r8192_priv *priv = rtllib_priv(dev);
-        dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
-                         PCI_DMA_TODEVICE);
+        dma_addr_t mapping;
         struct tx_fwinfo_8190pci *pTxFwInfo;
 
         pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1194,8 +1194,6 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,
                                                   pTxFwInfo->TxRate, cb_desc);
 
-        if (pci_dma_mapping_error(priv->pdev, mapping))
-                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
         if (cb_desc->bAMPDUEnable) {
                 pTxFwInfo->AllowAggregation = 1;
                 pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1230,6 +1228,14 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         }
 
         memset((u8 *)pdesc, 0, 12);
+
+        mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+                                 PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
+                return;
+        }
+
         pdesc->LINIP = 0;
         pdesc->CmdInit = 1;
         pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;
diff --git a/drivers/staging/rtl8192e/rtl819x_TSProc.c b/drivers/staging/rtl8192e/rtl819x_TSProc.c
index 48bbd9e8a52f..dcc4eb691889 100644
--- a/drivers/staging/rtl8192e/rtl819x_TSProc.c
+++ b/drivers/staging/rtl8192e/rtl819x_TSProc.c
@@ -306,11 +306,6 @@ static void MakeTSEntry(struct ts_common_info *pTsCommonInfo, u8 *Addr,
         pTsCommonInfo->TClasNum = TCLAS_Num;
 }
 
-static bool IsACValid(unsigned int tid)
-{
-        return tid < 7;
-}
-
 bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
            u8 *Addr, u8 TID, enum tr_select TxRxSelect, bool bAddNewTs)
 {
@@ -328,12 +323,6 @@ bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
         if (ieee->current_network.qos_data.supported == 0) {
                 UP = 0;
         } else {
-                if (!IsACValid(TID)) {
-                        netdev_warn(ieee->dev, "%s(): TID(%d) is not valid\n",
-                                    __func__, TID);
-                        return false;
-                }
-
                 switch (TID) {
                 case 0:
                 case 3:
@@ -351,6 +340,10 @@ bool GetTs(struct rtllib_device *ieee, struct ts_common_info **ppTS,
                 case 7:
                         UP = 7;
                         break;
+                default:
+                        netdev_warn(ieee->dev, "%s(): TID(%d) is not valid\n",
+                                    __func__, TID);
+                        return false;
                 }
         }
 
diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
index 5e7a61f24f8d..36c3189fc4b7 100644
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -3531,7 +3531,6 @@ int rtw_wdev_alloc(struct adapter *padapter, struct device *dev)
                 pwdev_priv->power_mgmt = true;
         else
                 pwdev_priv->power_mgmt = false;
-        kfree((u8 *)wdev);
 
         return ret;
 
diff --git a/drivers/staging/typec/fusb302/fusb302.c b/drivers/staging/typec/fusb302/fusb302.c
index 2cee9a952c9b..4a356e509fe4 100644
--- a/drivers/staging/typec/fusb302/fusb302.c
+++ b/drivers/staging/typec/fusb302/fusb302.c
@@ -264,22 +264,36 @@ static void fusb302_debugfs_exit(const struct fusb302_chip *chip) { }
 
 #define FUSB302_RESUME_RETRY 10
 #define FUSB302_RESUME_RETRY_SLEEP 50
-static int fusb302_i2c_write(struct fusb302_chip *chip,
-                             u8 address, u8 data)
+
+static bool fusb302_is_suspended(struct fusb302_chip *chip)
 {
         int retry_cnt;
-        int ret = 0;
 
-        atomic_set(&chip->i2c_busy, 1);
         for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
                 if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
+                        dev_err(chip->dev, "i2c: pm suspend, retry %d/%d\n",
+                                retry_cnt + 1, FUSB302_RESUME_RETRY);
                         msleep(FUSB302_RESUME_RETRY_SLEEP);
                 } else {
-                        break;
+                        return false;
                 }
         }
+
+        return true;
+}
+
+static int fusb302_i2c_write(struct fusb302_chip *chip,
+                             u8 address, u8 data)
+{
+        int ret = 0;
+
+        atomic_set(&chip->i2c_busy, 1);
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
+        }
+
         ret = i2c_smbus_write_byte_data(chip->i2c_client, address, data);
         if (ret < 0)
                 fusb302_log(chip, "cannot write 0x%02x to 0x%02x, ret=%d",
@@ -292,21 +306,17 @@ static int fusb302_i2c_write(struct fusb302_chip *chip,
 static int fusb302_i2c_block_write(struct fusb302_chip *chip, u8 address,
                                    u8 length, const u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         if (length <= 0)
                 return ret;
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_write_i2c_block_data(chip->i2c_client, address,
                                              length, data);
         if (ret < 0)
@@ -320,19 +330,15 @@ static int fusb302_i2c_block_write(struct fusb302_chip *chip, u8 address,
 static int fusb302_i2c_read(struct fusb302_chip *chip,
                             u8 address, u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_read_byte_data(chip->i2c_client, address);
         *data = (u8)ret;
         if (ret < 0)
@@ -345,33 +351,31 @@ static int fusb302_i2c_read(struct fusb302_chip *chip,
 static int fusb302_i2c_block_read(struct fusb302_chip *chip, u8 address,
                                   u8 length, u8 *data)
 {
-        int retry_cnt;
         int ret = 0;
 
         if (length <= 0)
                 return ret;
         atomic_set(&chip->i2c_busy, 1);
-        for (retry_cnt = 0; retry_cnt < FUSB302_RESUME_RETRY; retry_cnt++) {
-                if (atomic_read(&chip->pm_suspend)) {
-                        pr_err("fusb302_i2c: pm suspend, retry %d/%d\n",
-                               retry_cnt + 1, FUSB302_RESUME_RETRY);
-                        msleep(FUSB302_RESUME_RETRY_SLEEP);
-                } else {
-                        break;
-                }
+
+        if (fusb302_is_suspended(chip)) {
+                atomic_set(&chip->i2c_busy, 0);
+                return -ETIMEDOUT;
         }
+
         ret = i2c_smbus_read_i2c_block_data(chip->i2c_client, address,
                                             length, data);
         if (ret < 0) {
                 fusb302_log(chip, "cannot block read 0x%02x, len=%d, ret=%d",
                             address, length, ret);
-                return ret;
+                goto done;
         }
         if (ret != length) {
                 fusb302_log(chip, "only read %d/%d bytes from 0x%02x",
                             ret, length, address);
-                return -EIO;
+                ret = -EIO;
         }
+
+done:
         atomic_set(&chip->i2c_busy, 0);
 
         return ret;
@@ -489,7 +493,7 @@ static int tcpm_init(struct tcpc_dev *dev)
         ret = fusb302_i2c_read(chip, FUSB_REG_STATUS0, &data);
         if (ret < 0)
                 return ret;
-        chip->vbus_present = !!(FUSB_REG_STATUS0 & FUSB_REG_STATUS0_VBUSOK);
+        chip->vbus_present = !!(data & FUSB_REG_STATUS0_VBUSOK);
         ret = fusb302_i2c_read(chip, FUSB_REG_DEVICE_ID, &data);
         if (ret < 0)
                 return ret;
@@ -1025,7 +1029,7 @@ static int fusb302_pd_send_message(struct fusb302_chip *chip,
         buf[pos++] = FUSB302_TKN_SYNC1;
         buf[pos++] = FUSB302_TKN_SYNC2;
 
-        len = pd_header_cnt(msg->header) * 4;
+        len = pd_header_cnt_le(msg->header) * 4;
         /* plug 2 for header */
         len += 2;
         if (len > 0x1F) {
@@ -1481,7 +1485,7 @@ static int fusb302_pd_read_message(struct fusb302_chip *chip,
                                      (u8 *)&msg->header);
         if (ret < 0)
                 return ret;
-        len = pd_header_cnt(msg->header) * 4;
+        len = pd_header_cnt_le(msg->header) * 4;
         /* add 4 to length to include the CRC */
         if (len > PD_MAX_PAYLOAD * 4) {
                 fusb302_log(chip, "PD message too long %d", len);
@@ -1663,14 +1667,12 @@ static int init_gpio(struct fusb302_chip *chip)
         if (ret < 0) {
                 fusb302_log(chip,
                             "cannot set GPIO Int_N to input, ret=%d", ret);
-                gpio_free(chip->gpio_int_n);
                 return ret;
         }
         ret = gpio_to_irq(chip->gpio_int_n);
         if (ret < 0) {
                 fusb302_log(chip,
                             "cannot request IRQ for GPIO Int_N, ret=%d", ret);
-                gpio_free(chip->gpio_int_n);
                 return ret;
         }
         chip->gpio_int_n_irq = ret;
@@ -1787,11 +1789,13 @@ static const struct of_device_id fusb302_dt_match[] = {
         {.compatible = "fcs,fusb302"},
         {},
 };
+MODULE_DEVICE_TABLE(of, fusb302_dt_match);
 
 static const struct i2c_device_id fusb302_i2c_device_id[] = {
         {"typec_fusb302", 0},
         {},
 };
+MODULE_DEVICE_TABLE(i2c, fusb302_i2c_device_id);
 
 static const struct dev_pm_ops fusb302_pm_ops = {
         .suspend = fusb302_pm_suspend,
diff --git a/drivers/staging/typec/pd.h b/drivers/staging/typec/pd.h
index 8d97bdb95f23..510ef7279900 100644
--- a/drivers/staging/typec/pd.h
+++ b/drivers/staging/typec/pd.h
@@ -92,6 +92,16 @@ static inline unsigned int pd_header_type_le(__le16 header)
         return pd_header_type(le16_to_cpu(header));
 }
 
+static inline unsigned int pd_header_msgid(u16 header)
+{
+        return (header >> PD_HEADER_ID_SHIFT) & PD_HEADER_ID_MASK;
+}
+
+static inline unsigned int pd_header_msgid_le(__le16 header)
+{
+        return pd_header_msgid(le16_to_cpu(header));
+}
+
 #define PD_MAX_PAYLOAD          7
 
 struct pd_message {
diff --git a/drivers/staging/typec/pd_vdo.h b/drivers/staging/typec/pd_vdo.h
index dba172e0e0d1..d92259f8de0a 100644
--- a/drivers/staging/typec/pd_vdo.h
+++ b/drivers/staging/typec/pd_vdo.h
@@ -22,6 +22,9 @@
  * VDM object is minimum of VDM header + 6 additional data objects.
  */
 
+#define VDO_MAX_OBJECTS         6
+#define VDO_MAX_SIZE            (VDO_MAX_OBJECTS + 1)
+
 /*
  * VDM header
  * ----------
@@ -34,7 +37,6 @@
  * <5>      :: reserved (SVDM), command type (UVDM)
  * <4:0>    :: command
  */
-#define VDO_MAX_SIZE 7
 #define VDO(vid, type, custom)                          \
         (((vid) << 16) |                                \
          ((type) << 15) |                               \
diff --git a/drivers/staging/typec/tcpci.c b/drivers/staging/typec/tcpci.c
index 5e5be74c7850..df72d8b01e73 100644
--- a/drivers/staging/typec/tcpci.c
+++ b/drivers/staging/typec/tcpci.c
@@ -425,7 +425,7 @@ static const struct regmap_config tcpci_regmap_config = {
         .max_register = 0x7F, /* 0x80 .. 0xFF are vendor defined */
 };
 
-const struct tcpc_config tcpci_tcpc_config = {
+static const struct tcpc_config tcpci_tcpc_config = {
         .type = TYPEC_PORT_DFP,
         .default_role = TYPEC_SINK,
 };
diff --git a/drivers/staging/typec/tcpm.c b/drivers/staging/typec/tcpm.c
index abba655ba00a..20eb4ebcf8c3 100644
--- a/drivers/staging/typec/tcpm.c
+++ b/drivers/staging/typec/tcpm.c
@@ -238,6 +238,7 @@ struct tcpm_port {
         unsigned int hard_reset_count;
         bool pd_capable;
         bool explicit_contract;
+        unsigned int rx_msgid;
 
         /* Partner capabilities/requests */
         u32 sink_request;
@@ -251,6 +252,8 @@ struct tcpm_port {
         unsigned int nr_src_pdo;
         u32 snk_pdo[PDO_MAX_OBJECTS];
         unsigned int nr_snk_pdo;
+        u32 snk_vdo[VDO_MAX_OBJECTS];
+        unsigned int nr_snk_vdo;
 
         unsigned int max_snk_mv;
         unsigned int max_snk_ma;
@@ -997,6 +1000,7 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
         struct pd_mode_data *modep;
         int rlen = 0;
         u16 svid;
+        int i;
 
         tcpm_log(port, "Rx VDM cmd 0x%x type %d cmd %d len %d",
                  p0, cmd_type, cmd, cnt);
@@ -1007,6 +1011,14 @@ static int tcpm_pd_svdm(struct tcpm_port *port, const __le32 *payload, int cnt,
         case CMDT_INIT:
                 switch (cmd) {
                 case CMD_DISCOVER_IDENT:
+                        /* 6.4.4.3.1: Only respond as UFP (device) */
+                        if (port->data_role == TYPEC_DEVICE &&
+                            port->nr_snk_vdo) {
+                                for (i = 0; i <  port->nr_snk_vdo; i++)
+                                        response[i + 1]
+                                                = cpu_to_le32(port->snk_vdo[i]);
+                                rlen = port->nr_snk_vdo + 1;
+                        }
                         break;
                 case CMD_DISCOVER_SVID:
                         break;
@@ -1415,6 +1427,7 @@ static void tcpm_pd_ctrl_request(struct tcpm_port *port,
                         break;
                 case SOFT_RESET_SEND:
                         port->message_id = 0;
+                        port->rx_msgid = -1;
                         if (port->pwr_role == TYPEC_SOURCE)
                                 next_state = SRC_SEND_CAPABILITIES;
                         else
@@ -1503,6 +1516,22 @@ static void tcpm_pd_rx_handler(struct work_struct *work)
                  port->attached);
 
         if (port->attached) {
+                enum pd_ctrl_msg_type type = pd_header_type_le(msg->header);
+                unsigned int msgid = pd_header_msgid_le(msg->header);
+
+                /*
+                 * USB PD standard, 6.6.1.2:
+                 * "... if MessageID value in a received Message is the
+                 * same as the stored value, the receiver shall return a
+                 * GoodCRC Message with that MessageID value and drop
+                 * the Message (this is a retry of an already received
+                 * Message). Note: this shall not apply to the Soft_Reset
+                 * Message which always has a MessageID value of zero."
+                 */
+                if (msgid == port->rx_msgid && type != PD_CTRL_SOFT_RESET)
+                        goto done;
+                port->rx_msgid = msgid;
+
                 /*
                  * If both ends believe to be DFP/host, we have a data role
                  * mismatch.
@@ -1520,6 +1549,7 @@ static void tcpm_pd_rx_handler(struct work_struct *work)
                 }
         }
 
+done:
         mutex_unlock(&port->lock);
         kfree(event);
 }
@@ -1719,8 +1749,7 @@ static int tcpm_pd_build_request(struct tcpm_port *port, u32 *rdo)
         }
         ma = min(ma, port->max_snk_ma);
 
-        /* XXX: Any other flags need to be set? */
-        flags = 0;
+        flags = RDO_USB_COMM | RDO_NO_SUSPEND;
 
         /* Set mismatch bit if offered power is less than operating power */
         mw = ma * mv / 1000;
@@ -1957,6 +1986,12 @@ static void tcpm_reset_port(struct tcpm_port *port)
         port->attached = false;
         port->pd_capable = false;
 
+        /*
+         * First Rx ID should be 0; set this to a sentinel of -1 so that
+         * we can check tcpm_pd_rx_handler() if we had seen it before.
+         */
+        port->rx_msgid = -1;
+
         port->tcpc->set_pd_rx(port->tcpc, false);
         tcpm_init_vbus(port);   /* also disables charging */
         tcpm_init_vconn(port);
@@ -2170,6 +2205,7 @@ static void run_state_machine(struct tcpm_port *port)
                 port->pwr_opmode = TYPEC_PWR_MODE_USB;
                 port->caps_count = 0;
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 port->explicit_contract = false;
                 tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
                 break;
@@ -2329,6 +2365,7 @@ static void run_state_machine(struct tcpm_port *port)
                 typec_set_pwr_opmode(port->typec_port, TYPEC_PWR_MODE_USB);
                 port->pwr_opmode = TYPEC_PWR_MODE_USB;
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 port->explicit_contract = false;
                 tcpm_set_state(port, SNK_DISCOVERY, 0);
                 break;
@@ -2496,6 +2533,7 @@ static void run_state_machine(struct tcpm_port *port)
         /* Soft_Reset states */
         case SOFT_RESET:
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 tcpm_pd_send_control(port, PD_CTRL_ACCEPT);
                 if (port->pwr_role == TYPEC_SOURCE)
                         tcpm_set_state(port, SRC_SEND_CAPABILITIES, 0);
@@ -2504,6 +2542,7 @@ static void run_state_machine(struct tcpm_port *port)
                 break;
         case SOFT_RESET_SEND:
                 port->message_id = 0;
+                port->rx_msgid = -1;
                 if (tcpm_pd_send_control(port, PD_CTRL_SOFT_RESET))
                         tcpm_set_state_cond(port, hard_reset_state(port), 0);
                 else
@@ -2568,6 +2607,14 @@ static void run_state_machine(struct tcpm_port *port)
                 break;
         case PR_SWAP_SRC_SNK_SOURCE_OFF:
                 tcpm_set_cc(port, TYPEC_CC_RD);
+                /*
+                 * USB-PD standard, 6.2.1.4, Port Power Role:
+                 * "During the Power Role Swap Sequence, for the initial Source
+                 * Port, the Port Power Role field shall be set to Sink in the
+                 * PS_RDY Message indicating that the initial Source’s power
+                 * supply is turned off"
+                 */
+                tcpm_set_pwr_role(port, TYPEC_SINK);
                 if (tcpm_pd_send_control(port, PD_CTRL_PS_RDY)) {
                         tcpm_set_state(port, ERROR_RECOVERY, 0);
                         break;
@@ -2575,7 +2622,6 @@ static void run_state_machine(struct tcpm_port *port)
                 tcpm_set_state_cond(port, SNK_UNATTACHED, PD_T_PS_SOURCE_ON);
                 break;
         case PR_SWAP_SRC_SNK_SINK_ON:
-                tcpm_set_pwr_role(port, TYPEC_SINK);
                 tcpm_swap_complete(port, 0);
                 tcpm_set_state(port, SNK_STARTUP, 0);
                 break;
@@ -2587,8 +2633,15 @@ static void run_state_machine(struct tcpm_port *port)
         case PR_SWAP_SNK_SRC_SOURCE_ON:
                 tcpm_set_cc(port, tcpm_rp_cc(port));
                 tcpm_set_vbus(port, true);
-                tcpm_pd_send_control(port, PD_CTRL_PS_RDY);
+                /*
+                 * USB PD standard, 6.2.1.4:
+                 * "Subsequent Messages initiated by the Policy Engine,
+                 * such as the PS_RDY Message sent to indicate that Vbus
+                 * is ready, will have the Port Power Role field set to
+                 * Source."
+                 */
                 tcpm_set_pwr_role(port, TYPEC_SOURCE);
+                tcpm_pd_send_control(port, PD_CTRL_PS_RDY);
                 tcpm_swap_complete(port, 0);
                 tcpm_set_state(port, SRC_STARTUP, 0);
                 break;
@@ -3292,6 +3345,20 @@ static int tcpm_copy_pdos(u32 *dest_pdo, const u32 *src_pdo,
         return nr_pdo;
 }
 
+static int tcpm_copy_vdos(u32 *dest_vdo, const u32 *src_vdo,
+                          unsigned int nr_vdo)
+{
+        unsigned int i;
+
+        if (nr_vdo > VDO_MAX_OBJECTS)
+                nr_vdo = VDO_MAX_OBJECTS;
+
+        for (i = 0; i < nr_vdo; i++)
+                dest_vdo[i] = src_vdo[i];
+
+        return nr_vdo;
+}
+
 void tcpm_update_source_capabilities(struct tcpm_port *port, const u32 *pdo,
                                      unsigned int nr_pdo)
 {
@@ -3382,6 +3449,8 @@ struct tcpm_port *tcpm_register_port(struct device *dev, struct tcpc_dev *tcpc)
                                           tcpc->config->nr_src_pdo);
         port->nr_snk_pdo = tcpm_copy_pdos(port->snk_pdo, tcpc->config->snk_pdo,
                                           tcpc->config->nr_snk_pdo);
+        port->nr_snk_vdo = tcpm_copy_vdos(port->snk_vdo, tcpc->config->snk_vdo,
+                                          tcpc->config->nr_snk_vdo);
 
         port->max_snk_mv = tcpc->config->max_snk_mv;
         port->max_snk_ma = tcpc->config->max_snk_ma;
diff --git a/drivers/staging/typec/tcpm.h b/drivers/staging/typec/tcpm.h
index 969b365e6549..19c307d31a5a 100644
--- a/drivers/staging/typec/tcpm.h
+++ b/drivers/staging/typec/tcpm.h
@@ -60,6 +60,9 @@ struct tcpc_config {
         const u32 *snk_pdo;
         unsigned int nr_snk_pdo;
 
+        const u32 *snk_vdo;
+        unsigned int nr_snk_vdo;
+
         unsigned int max_snk_mv;
         unsigned int max_snk_ma;
         unsigned int max_snk_mw;
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
index 988ee61fb4a7..d04db3f55519 100644
--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
+++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c
@@ -502,8 +502,15 @@ create_pagelist(char __user *buf, size_t count, unsigned short type,
          */
         sg_init_table(scatterlist, num_pages);
         /* Now set the pages for each scatterlist */
-        for (i = 0; i < num_pages; i++)
-                sg_set_page(scatterlist + i, pages[i], PAGE_SIZE, 0);
+        for (i = 0; i < num_pages; i++) {
+                unsigned int len = PAGE_SIZE - offset;
+
+                if (len > count)
+                        len = count;
+                sg_set_page(scatterlist + i, pages[i], len, offset);
+                offset = 0;
+                count -= len;
+        }
 
         dma_buffers = dma_map_sg(g_dev,
                                  scatterlist,
@@ -524,20 +531,20 @@ create_pagelist(char __user *buf, size_t count, unsigned short type,
                 u32 addr = sg_dma_address(sg);
 
                 /* Note: addrs is the address + page_count - 1
-                 * The firmware expects the block to be page
+                 * The firmware expects blocks after the first to be page-
                  * aligned and a multiple of the page size
                  */
                 WARN_ON(len == 0);
-                WARN_ON(len & ~PAGE_MASK);
-                WARN_ON(addr & ~PAGE_MASK);
+                WARN_ON(i && (i != (dma_buffers - 1)) && (len & ~PAGE_MASK));
+                WARN_ON(i && (addr & ~PAGE_MASK));
                 if (k > 0 &&
-                    ((addrs[k - 1] & PAGE_MASK) |
-                        ((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT)
-                    == addr) {
-                        addrs[k - 1] += (len >> PAGE_SHIFT);
-                } else {
-                        addrs[k++] = addr | ((len >> PAGE_SHIFT) - 1);
-                }
+                    ((addrs[k - 1] & PAGE_MASK) +
+                     (((addrs[k - 1] & ~PAGE_MASK) + 1) << PAGE_SHIFT))
+                    == (addr & PAGE_MASK))
+                        addrs[k - 1] += ((len + PAGE_SIZE - 1) >> PAGE_SHIFT);
+                else
+                        addrs[k++] = (addr & PAGE_MASK) |
+                                (((len + PAGE_SIZE - 1) >> PAGE_SHIFT) - 1);
         }
 
         /* Partial cache lines (fragments) require special measures */
diff --git a/drivers/tee/Kconfig b/drivers/tee/Kconfig
index 2330a4eb4e8b..a6df12d88f90 100644
--- a/drivers/tee/Kconfig
+++ b/drivers/tee/Kconfig
@@ -1,6 +1,7 @@
 # Generic Trusted Execution Environment Configuration
 config TEE
         tristate "Trusted Execution Environment support"
+        depends on HAVE_ARM_SMCCC || COMPILE_TEST
         select DMA_SHARED_BUFFER
         select GENERIC_ALLOCATOR
         help
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 1c196f87e9d9..ff04b7f8549f 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -279,7 +279,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                 map = kzalloc(sizeof(*map), GFP_KERNEL);
                 if (!map) {
                         ret = -ENOMEM;
-                        goto err_map_kobj;
+                        goto err_map;
                 }
                 kobject_init(&map->kobj, &map_attr_type);
                 map->mem = mem;
@@ -289,7 +289,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                         goto err_map_kobj;
                 ret = kobject_uevent(&map->kobj, KOBJ_ADD);
                 if (ret)
-                        goto err_map;
+                        goto err_map_kobj;
         }
 
         for (pi = 0; pi < MAX_UIO_PORT_REGIONS; pi++) {
@@ -308,7 +308,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                 portio = kzalloc(sizeof(*portio), GFP_KERNEL);
                 if (!portio) {
                         ret = -ENOMEM;
-                        goto err_portio_kobj;
+                        goto err_portio;
                 }
                 kobject_init(&portio->kobj, &portio_attr_type);
                 portio->port = port;
@@ -319,7 +319,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                         goto err_portio_kobj;
                 ret = kobject_uevent(&portio->kobj, KOBJ_ADD);
                 if (ret)
-                        goto err_portio;
+                        goto err_portio_kobj;
         }
 
         return 0;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index cfc3cff6e8d5..8e6ef671be9b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device *udev,
 
         if (userurb) {          /* Async */
                 if (when == SUBMIT)
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "length %u\n",
                                         userurb, ep, t, d, length);
                 else
-                        dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+                        dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
                                         "actual_length %u status %d\n",
                                         userurb, ep, t, d, length,
                                         timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
         if (as) {
                 int retval;
 
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
                 return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
 
         as = async_getcompleted(ps);
         if (as) {
-                snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+                snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
                 retval = processcompl_compat(as, (void __user * __user *)arg);
                 free_async(as);
         } else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
 #endif
 
         case USBDEVFS_DISCARDURB:
-                snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+                snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
                 ret = proc_unlinkurb(ps, p);
                 break;
 
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 49550790a3cb..5dea98358c05 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1723,7 +1723,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
                 if (retval == 0)
                         retval = -EINPROGRESS;
                 else if (retval != -EIDRM && retval != -EBUSY)
-                        dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+                        dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
                                         urb, retval);
                 usb_put_dev(udev);
         }
@@ -1890,7 +1890,7 @@ rescan:
                 /* kick hcd */
                 unlink1(hcd, urb, -ESHUTDOWN);
                 dev_dbg (hcd->self.controller,
-                        "shutdown urb %p ep%d%s%s\n",
+                        "shutdown urb %pK ep%d%s%s\n",
                         urb, usb_endpoint_num(&ep->desc),
                         is_in ? "in" : "out",
                         ({      char *s;
@@ -2520,6 +2520,7 @@ struct usb_hcd *__usb_create_hcd(const struct hc_driver *driver,
                 hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex),
                                 GFP_KERNEL);
                 if (!hcd->bandwidth_mutex) {
+                        kfree(hcd->address0_mutex);
                         kfree(hcd);
                         dev_dbg(dev, "hcd bandwidth mutex alloc failed\n");
                         return NULL;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 9dca59ef18b3..b8bb20d7acdb 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -362,7 +362,8 @@ static void usb_set_lpm_parameters(struct usb_device *udev)
 }
 
 /* USB 2.0 spec Section 11.24.4.5 */
-static int get_hub_descriptor(struct usb_device *hdev, void *data)
+static int get_hub_descriptor(struct usb_device *hdev,
+                struct usb_hub_descriptor *desc)
 {
         int i, ret, size;
         unsigned dtype;
@@ -378,10 +379,18 @@ static int get_hub_descriptor(struct usb_device *hdev, void *data)
         for (i = 0; i < 3; i++) {
                 ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
                         USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
-                        dtype << 8, 0, data, size,
+                        dtype << 8, 0, desc, size,
                         USB_CTRL_GET_TIMEOUT);
-                if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+                if (hub_is_superspeed(hdev)) {
+                        if (ret == size)
+                                return ret;
+                } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) {
+                        /* Make sure we have the DeviceRemovable field. */
+                        size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1;
+                        if (ret < size)
+                                return -EMSGSIZE;
                         return ret;
+                }
         }
         return -EINVAL;
 }
@@ -1313,7 +1322,7 @@ static int hub_configure(struct usb_hub *hub,
         }
         mutex_init(&hub->status_mutex);
 
-        hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
+        hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL);
         if (!hub->descriptor) {
                 ret = -ENOMEM;
                 goto fail;
@@ -1321,13 +1330,19 @@ static int hub_configure(struct usb_hub *hub,
 
         /* Request the entire hub descriptor.
          * hub->descriptor can handle USB_MAXCHILDREN ports,
-         * but the hub can/will return fewer bytes here.
+         * but a (non-SS) hub can/will return fewer bytes here.
          */
         ret = get_hub_descriptor(hdev, hub->descriptor);
         if (ret < 0) {
                 message = "can't read hub descriptor";
                 goto fail;
-        } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+        }
+
+        maxchild = USB_MAXCHILDREN;
+        if (hub_is_superspeed(hdev))
+                maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+        if (hub->descriptor->bNbrPorts > maxchild) {
                 message = "hub has too many ports!";
                 ret = -ENODEV;
                 goto fail;
diff --git a/drivers/usb/core/of.c b/drivers/usb/core/of.c
index d787f195a9a6..d563cbcf76cf 100644
--- a/drivers/usb/core/of.c
+++ b/drivers/usb/core/of.c
@@ -53,6 +53,9 @@ EXPORT_SYMBOL_GPL(usb_of_get_child_node);
  *
  * Find the companion device from platform bus.
  *
+ * Takes a reference to the returned struct device which needs to be dropped
+ * after use.
+ *
  * Return: On success, a pointer to the companion device, %NULL on failure.
  */
 struct device *usb_of_get_companion_dev(struct device *dev)
diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
index d75cb8c0f7df..47903d510955 100644
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
         if (!urb || !urb->complete)
                 return -EINVAL;
         if (urb->hcpriv) {
-                WARN_ONCE(1, "URB %p submitted while active\n", urb);
+                WARN_ONCE(1, "URB %pK submitted while active\n", urb);
                 return -EBUSY;
         }
 
diff --git a/drivers/usb/dwc3/dwc3-keystone.c b/drivers/usb/dwc3/dwc3-keystone.c
index 72664700b8a2..12ee23f53cdd 100644
--- a/drivers/usb/dwc3/dwc3-keystone.c
+++ b/drivers/usb/dwc3/dwc3-keystone.c
@@ -107,6 +107,10 @@ static int kdwc3_probe(struct platform_device *pdev)
                 return PTR_ERR(kdwc->usbss);
 
         kdwc->clk = devm_clk_get(kdwc->dev, "usb");
+        if (IS_ERR(kdwc->clk)) {
+                dev_err(kdwc->dev, "unable to get usb clock\n");
+                return PTR_ERR(kdwc->clk);
+        }
 
         error = clk_prepare_enable(kdwc->clk);
         if (error < 0) {
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index a15ec71d0423..84a2cebfc712 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -39,6 +39,8 @@
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
 #define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
 #define PCI_DEVICE_ID_INTEL_GLK                 0x31aa
+#define PCI_DEVICE_ID_INTEL_CNPLP               0x9dee
+#define PCI_DEVICE_ID_INTEL_CNPH                0xa36e
 
 #define PCI_INTEL_BXT_DSM_UUID          "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
 #define PCI_INTEL_BXT_FUNC_PMU_PWR      4
@@ -270,6 +272,8 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_GLK), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPLP), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CNPH), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 6f6f0b3be3ad..aea9a5b948b4 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1261,14 +1261,24 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
                                 __dwc3_gadget_start_isoc(dwc, dep, cur_uf);
                                 dep->flags &= ~DWC3_EP_PENDING_REQUEST;
                         }
+                        return 0;
                 }
-                return 0;
+
+                if ((dep->flags & DWC3_EP_BUSY) &&
+                    !(dep->flags & DWC3_EP_MISSED_ISOC)) {
+                        WARN_ON_ONCE(!dep->resource_index);
+                        ret = __dwc3_gadget_kick_transfer(dep,
+                                                          dep->resource_index);
+                }
+
+                goto out;
         }
 
         if (!dwc3_calc_trbs_left(dep))
                 return 0;
 
         ret = __dwc3_gadget_kick_transfer(dep, 0);
+out:
         if (ret == -EBUSY)
                 ret = 0;
 
@@ -3026,6 +3036,15 @@ static irqreturn_t dwc3_check_event_buf(struct dwc3_event_buffer *evt)
                 return IRQ_HANDLED;
         }
 
+        /*
+         * With PCIe legacy interrupt, test shows that top-half irq handler can
+         * be called again after HW interrupt deassertion. Check if bottom-half
+         * irq event handler completes before caching new event to prevent
+         * losing events.
+         */
+        if (evt->flags & DWC3_EVENT_PENDING)
+                return IRQ_HANDLED;
+
         count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
         count &= DWC3_GEVNTCOUNT_MASK;
         if (!count)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 71dd27c0d7f2..47dda3450abd 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1858,12 +1858,12 @@ static int ffs_func_eps_enable(struct ffs_function *func)
                 ep->ep->driver_data = ep;
                 ep->ep->desc = ds;
 
-                comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
-                                USB_DT_ENDPOINT_SIZE);
-                ep->ep->maxburst = comp_desc->bMaxBurst + 1;
-
-                if (needs_comp_desc)
+                if (needs_comp_desc) {
+                        comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+                                        USB_DT_ENDPOINT_SIZE);
+                        ep->ep->maxburst = comp_desc->bMaxBurst + 1;
                         ep->ep->comp_desc = comp_desc;
+                }
 
                 ret = usb_ep_enable(ep->ep);
                 if (likely(!ret)) {
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 000677c991b0..9b0805f55ad7 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -1256,7 +1256,7 @@ static void gserial_console_exit(void)
         struct gscons_info *info = &gscons_info;
 
         unregister_console(&gserial_cons);
-        if (info->console_thread != NULL)
+        if (!IS_ERR_OR_NULL(info->console_thread))
                 kthread_stop(info->console_thread);
         gs_buf_free(&info->con_buf);
 }
diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index c79081952ea0..ccabb51cb98d 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2008,7 +2008,7 @@ ss_hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
         desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/
-        desc->u.ss.DeviceRemovable = 0xffff;
+        desc->u.ss.DeviceRemovable = 0;
 }
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
@@ -2020,8 +2020,8 @@ static inline void hub_descriptor(struct usb_hub_descriptor *desc)
                         HUB_CHAR_INDV_PORT_LPSM |
                         HUB_CHAR_COMMON_OCPM);
         desc->bNbrPorts = 1;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        desc->u.hs.DeviceRemovable[0] = 0;
+        desc->u.hs.DeviceRemovable[1] = 0xff;   /* PortPwrCtrlMask */
 }
 
 static int dummy_hub_control(
diff --git a/drivers/usb/host/ehci-platform.c b/drivers/usb/host/ehci-platform.c
index bc7b9be12f54..f1908ea9fbd8 100644
--- a/drivers/usb/host/ehci-platform.c
+++ b/drivers/usb/host/ehci-platform.c
@@ -384,8 +384,10 @@ static int ehci_platform_resume(struct device *dev)
         }
 
         companion_dev = usb_of_get_companion_dev(hcd->self.controller);
-        if (companion_dev)
+        if (companion_dev) {
                 device_pm_wait_for_dev(hcd->self.controller, companion_dev);
+                put_device(companion_dev);
+        }
 
         ehci_resume(hcd, priv->reset_on_resume);
         return 0;
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index bfa7fa3d2eea..7bf78be1fd32 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td)
                         time = 30;
                         break;
                 default:
-                        time = 300;
+                        time = 50;
                         break;
                 }
 
@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                 pipe = td->pipe;
                 pipe_stop(r8a66597, pipe);
 
+                /* Select a different address or endpoint */
                 new_td = td;
                 do {
                         list_move_tail(&new_td->queue,
@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned long _r8a66597)
                                 new_td = td;
                                 break;
                         }
-                } while (td != new_td && td->address == new_td->address);
+                } while (td != new_td && td->address == new_td->address &&
+                        td->pipe->info.epnum == new_td->pipe->info.epnum);
 
                 start_transfer(r8a66597, new_td);
 
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 5e3e9d4c6956..0dde49c35dd2 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -419,7 +419,7 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
         wait_for_completion(cmd->completion);
 
         if (cmd->status == COMP_COMMAND_ABORTED ||
-                        cmd->status == COMP_STOPPED) {
+            cmd->status == COMP_COMMAND_RING_STOPPED) {
                 xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n");
                 ret = -ETIME;
         }
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index bbe22bcc550a..1f1687e888d6 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -56,7 +56,7 @@ static struct xhci_segment *xhci_segment_alloc(struct xhci_hcd *xhci,
         }
 
         if (max_packet) {
-                seg->bounce_buf = kzalloc(max_packet, flags | GFP_DMA);
+                seg->bounce_buf = kzalloc(max_packet, flags);
                 if (!seg->bounce_buf) {
                         dma_pool_free(xhci->segment_pool, seg->trbs, dma);
                         kfree(seg);
@@ -1724,7 +1724,7 @@ static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags)
         xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
         for (i = 0; i < num_sp; i++) {
                 dma_addr_t dma;
-                void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+                void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
                                 flags);
                 if (!buf)
                         goto fail_sp4;
@@ -2307,10 +2307,11 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
         /* Place limits on the number of roothub ports so that the hub
          * descriptors aren't longer than the USB core will allocate.
          */
-        if (xhci->num_usb3_ports > 15) {
+        if (xhci->num_usb3_ports > USB_SS_MAXPORTS) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
-                                "Limiting USB 3.0 roothub ports to 15.");
-                xhci->num_usb3_ports = 15;
+                                "Limiting USB 3.0 roothub ports to %u.",
+                                USB_SS_MAXPORTS);
+                xhci->num_usb3_ports = USB_SS_MAXPORTS;
         }
         if (xhci->num_usb2_ports > USB_MAXCHILDREN) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_init,
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 7b86508ac8cf..fcf1f3f63e7a 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -52,6 +52,7 @@
 #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI              0x0aa8
 #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI              0x1aa8
 #define PCI_DEVICE_ID_INTEL_APL_XHCI                    0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI                    0x19d0
 
 static const char hcd_name[] = "xhci_hcd";
 
@@ -166,7 +167,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                  pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
                  pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
-                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+                 pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+                 pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
                 xhci->quirks |= XHCI_PME_STUCK_QUIRK;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
@@ -175,7 +177,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
             (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
-             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+             pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+             pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
                 xhci->quirks |= XHCI_MISSING_CAS;
 
         if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index 7c2a9e7c8e0f..c04144b25a67 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -177,7 +177,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
 
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
-                return -ENODEV;
+                return irq;
 
         /*
          * sysdev must point to a device that is known to the system firmware
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 74bf5c60a260..03f63f50afb6 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -323,7 +323,7 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci,
                 if (i_cmd->status != COMP_COMMAND_ABORTED)
                         continue;
 
-                i_cmd->status = COMP_STOPPED;
+                i_cmd->status = COMP_COMMAND_RING_STOPPED;
 
                 xhci_dbg(xhci, "Turn aborted command %p to no-op\n",
                          i_cmd->command_trb);
@@ -641,8 +641,8 @@ static void xhci_giveback_urb_in_irq(struct xhci_hcd *xhci,
         xhci_urb_free_priv(urb_priv);
         usb_hcd_unlink_urb_from_ep(hcd, urb);
         spin_unlock(&xhci->lock);
-        usb_hcd_giveback_urb(hcd, urb, status);
         trace_xhci_urb_giveback(urb);
+        usb_hcd_giveback_urb(hcd, urb, status);
         spin_lock(&xhci->lock);
 }
 
@@ -1380,7 +1380,7 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
         cmd_comp_code = GET_COMP_CODE(le32_to_cpu(event->status));
 
         /* If CMD ring stopped we own the trbs between enqueue and dequeue */
-        if (cmd_comp_code == COMP_STOPPED) {
+        if (cmd_comp_code == COMP_COMMAND_RING_STOPPED) {
                 complete_all(&xhci->cmd_ring_stop_completion);
                 return;
         }
@@ -1436,8 +1436,8 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 break;
         case TRB_CMD_NOOP:
                 /* Is this an aborted command turned to NO-OP? */
-                if (cmd->status == COMP_STOPPED)
-                        cmd_comp_code = COMP_STOPPED;
+                if (cmd->status == COMP_COMMAND_RING_STOPPED)
+                        cmd_comp_code = COMP_COMMAND_RING_STOPPED;
                 break;
         case TRB_RESET_EP:
                 WARN_ON(slot_id != TRB_TO_SLOT_ID(
@@ -2677,11 +2677,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         union xhci_trb *event_ring_deq;
         irqreturn_t ret = IRQ_NONE;
+        unsigned long flags;
         dma_addr_t deq;
         u64 temp_64;
         u32 status;
 
-        spin_lock(&xhci->lock);
+        spin_lock_irqsave(&xhci->lock, flags);
         /* Check if the xHC generated the interrupt, or the irq is shared */
         status = readl(&xhci->op_regs->status);
         if (status == ~(u32)0) {
@@ -2707,12 +2708,9 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
          */
         status |= STS_EINT;
         writel(status, &xhci->op_regs->status);
-        /* FIXME when MSI-X is supported and there are multiple vectors */
-        /* Clear the MSI-X event interrupt status */
 
-        if (hcd->irq) {
+        if (!hcd->msi_enabled) {
                 u32 irq_pending;
-                /* Acknowledge the PCI interrupt */
                 irq_pending = readl(&xhci->ir_set->irq_pending);
                 irq_pending |= IMAN_IP;
                 writel(irq_pending, &xhci->ir_set->irq_pending);
@@ -2757,7 +2755,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
         ret = IRQ_HANDLED;
 
 out:
-        spin_unlock(&xhci->lock);
+        spin_unlock_irqrestore(&xhci->lock, flags);
 
         return ret;
 }
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 2d1310220832..30f47d92a610 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -359,9 +359,10 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                 /* fall back to msi*/
                 ret = xhci_setup_msi(xhci);
 
-        if (!ret)
-                /* hcd->irq is 0, we have MSI */
+        if (!ret) {
+                hcd->msi_enabled = 1;
                 return 0;
+        }
 
         if (!pdev->irq) {
                 xhci_err(xhci, "No msi-x/msi found and no IRQ in BIOS\n");
@@ -1763,7 +1764,7 @@ static int xhci_configure_endpoint_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for configure endpoint command\n");
                 ret = -ETIME;
                 break;
@@ -1813,7 +1814,7 @@ static int xhci_evaluate_context_result(struct xhci_hcd *xhci,
 
         switch (*cmd_status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for evaluate context command\n");
                 ret = -ETIME;
                 break;
@@ -3432,7 +3433,7 @@ static int xhci_discover_or_reset_device(struct usb_hcd *hcd,
         ret = reset_device_cmd->status;
         switch (ret) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout waiting for reset device command\n");
                 ret = -ETIME;
                 goto command_cleanup;
@@ -3817,7 +3818,7 @@ static int xhci_setup_device(struct usb_hcd *hcd, struct usb_device *udev,
          */
         switch (command->status) {
         case COMP_COMMAND_ABORTED:
-        case COMP_STOPPED:
+        case COMP_COMMAND_RING_STOPPED:
                 xhci_warn(xhci, "Timeout while waiting for setup device command\n");
                 ret = -ETIME;
                 break;
diff --git a/drivers/usb/misc/chaoskey.c b/drivers/usb/misc/chaoskey.c
index e9cae4d82af2..15d4e64d3b65 100644
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -192,7 +192,7 @@ static int chaoskey_probe(struct usb_interface *interface,
 
         dev->in_ep = in_ep;
 
-        if (udev->descriptor.idVendor != ALEA_VENDOR_ID)
+        if (le16_to_cpu(udev->descriptor.idVendor) != ALEA_VENDOR_ID)
                 dev->reads_started = 1;
 
         dev->size = size;
diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
index 77569531b78a..83b05a287b0c 100644
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -554,7 +554,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd,
                         info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
 
                         /* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
-                        info.speed = le16_to_cpu(dev->udev->speed);
+                        info.speed = dev->udev->speed;
                         info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
                         info.report_size = dev->report_size;
 
diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
index aa3c280fdf8d..0782ac6f5edf 100644
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -926,6 +926,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
                  USB_MAJOR, dev->minor);
 
 exit:
+        kfree(get_version_reply);
         return retval;
 
 error:
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index 3c6948af726a..f019d80ca9e4 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -973,7 +973,7 @@ sisusbcon_set_origin(struct vc_data *c)
 
         mutex_unlock(&sisusb->lock);
 
-        return 1;
+        return true;
 }
 
 /* Interface routine */
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index ac3a4952abb4..dbe617a735d8 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2780,10 +2780,11 @@ int musb_host_setup(struct musb *musb, int power_budget)
         int ret;
         struct usb_hcd *hcd = musb->hcd;
 
-        MUSB_HST_MODE(musb);
-        musb->xceiv->otg->default_a = 1;
-        musb->xceiv->otg->state = OTG_STATE_A_IDLE;
-
+        if (musb->port_mode == MUSB_PORT_MODE_HOST) {
+                MUSB_HST_MODE(musb);
+                musb->xceiv->otg->default_a = 1;
+                musb->xceiv->otg->state = OTG_STATE_A_IDLE;
+        }
         otg_set_host(musb->xceiv->otg, &hcd->self);
         hcd->self.otg_port = 1;
         musb->xceiv->otg->host = &hcd->self;
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 8b43c4b99f04..7870b37e0ea5 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -219,6 +219,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
         u32                             dma_remaining;
         int                             src_burst, dst_burst;
         u16                             csr;
+        u32                             psize;
         int                             ch;
         s8                              dmareq;
         s8                              sync_dev;
@@ -390,15 +391,19 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
 
         if (chdat->tx) {
                 /* Send transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~0x7ff;
+                psize |= chdat->transfer_packet_sz;
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_TX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
         } else {
                 /* Receive transfer_packet_sz packets at a time */
-                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
-                        chdat->transfer_packet_sz << 16);
+                psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+                psize &= ~(0x7ff << 16);
+                psize |= (chdat->transfer_packet_sz << 16);
+                musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
 
                 musb_writel(ep_conf, TUSB_EP_RX_OFFSET,
                         TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d38780fa8788..aba74f817dc6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -809,10 +809,10 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
         { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-        { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
-                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) },
+        { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) },
         { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
@@ -1527,9 +1527,9 @@ static int set_serial_info(struct tty_struct *tty,
                                         (new_serial.flags & ASYNC_FLAGS));
         priv->custom_divisor = new_serial.custom_divisor;
 
+check_and_exit:
         write_latency_timer(port);
 
-check_and_exit:
         if ((old_priv.flags & ASYNC_SPD_MASK) !=
              (priv->flags & ASYNC_SPD_MASK)) {
                 if ((priv->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 71fb9e59db71..4fcf1cecb6d7 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -882,6 +882,8 @@
 /* Olimex */
 #define OLIMEX_VID                      0x15BA
 #define OLIMEX_ARM_USB_OCD_PID          0x0003
+#define OLIMEX_ARM_USB_TINY_PID 0x0004
+#define OLIMEX_ARM_USB_TINY_H_PID       0x002a
 #define OLIMEX_ARM_USB_OCD_H_PID        0x002b
 
 /*
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 87798e625d6c..6cefb9cb133d 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2336,8 +2336,11 @@ static void change_port_settings(struct tty_struct *tty,
         if (!baud) {
                 /* pick a default, any default... */
                 baud = 9600;
-        } else
+        } else {
+                /* Avoid a zero divisor. */
+                baud = min(baud, 461550);
                 tty_encode_baud_rate(tty, baud, baud);
+        }
 
         edge_port->baud_rate = baud;
         config->wBaudRate = (__u16)((461550L + baud/2) / baud);
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index 73956d48a0c5..f9734a96d516 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -197,6 +197,7 @@ static u8 ir_xbof_change(u8 xbof)
 static int ir_startup(struct usb_serial *serial)
 {
         struct usb_irda_cs_descriptor *irda_desc;
+        int rates;
 
         irda_desc = irda_usb_find_class_desc(serial, 0);
         if (!irda_desc) {
@@ -205,18 +206,20 @@ static int ir_startup(struct usb_serial *serial)
                 return -ENODEV;
         }
 
+        rates = le16_to_cpu(irda_desc->wBaudRate);
+
         dev_dbg(&serial->dev->dev,
                 "%s - Baud rates supported:%s%s%s%s%s%s%s%s%s\n",
                 __func__,
-                (irda_desc->wBaudRate & USB_IRDA_BR_2400) ? " 2400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_9600) ? " 9600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_19200) ? " 19200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_38400) ? " 38400" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_57600) ? " 57600" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_115200) ? " 115200" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_576000) ? " 576000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_1152000) ? " 1152000" : "",
-                (irda_desc->wBaudRate & USB_IRDA_BR_4000000) ? " 4000000" : "");
+                (rates & USB_IRDA_BR_2400) ? " 2400" : "",
+                (rates & USB_IRDA_BR_9600) ? " 9600" : "",
+                (rates & USB_IRDA_BR_19200) ? " 19200" : "",
+                (rates & USB_IRDA_BR_38400) ? " 38400" : "",
+                (rates & USB_IRDA_BR_57600) ? " 57600" : "",
+                (rates & USB_IRDA_BR_115200) ? " 115200" : "",
+                (rates & USB_IRDA_BR_576000) ? " 576000" : "",
+                (rates & USB_IRDA_BR_1152000) ? " 1152000" : "",
+                (rates & USB_IRDA_BR_4000000) ? " 4000000" : "");
 
         switch (irda_desc->bmAdditionalBOFs) {
         case USB_IRDA_AB_48:
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index edbc81f205c2..70f346f1aa86 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct tty_struct *tty,
                 return -ENOMEM;
 
         divisor = mct_u232_calculate_baud_rate(serial, value, &speed);
-        put_unaligned_le32(cpu_to_le32(divisor), buf);
+        put_unaligned_le32(divisor, buf);
         rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
                                 MCT_U232_SET_BAUD_RATE_REQUEST,
                                 MCT_U232_SET_REQUEST_TYPE,
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index af67a0de6b5d..3bf61acfc26b 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -281,6 +281,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE922_USBCFG0             0x1042
 #define TELIT_PRODUCT_LE922_USBCFG3             0x1043
 #define TELIT_PRODUCT_LE922_USBCFG5             0x1045
+#define TELIT_PRODUCT_ME910                     0x1100
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
@@ -640,6 +641,11 @@ static const struct option_blacklist_info simcom_sim7100e_blacklist = {
         .reserved = BIT(5) | BIT(6),
 };
 
+static const struct option_blacklist_info telit_me910_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(3),
+};
+
 static const struct option_blacklist_info telit_le910_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(2),
@@ -1235,6 +1241,8 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+                .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
                 .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 38b3f0d8cd58..fd509ed6cf70 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_SWI(0x1199, 0x9071)},   /* Sierra Wireless MC74xx */
         {DEVICE_SWI(0x1199, 0x9078)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x1199, 0x9079)},   /* Sierra Wireless EM74xx */
+        {DEVICE_SWI(0x1199, 0x907a)},   /* Sierra Wireless EM74xx QDL */
+        {DEVICE_SWI(0x1199, 0x907b)},   /* Sierra Wireless EM74xx */
         {DEVICE_SWI(0x413c, 0x81a2)},   /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a3)},   /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
         {DEVICE_SWI(0x413c, 0x81a4)},   /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c
index 369f3c24815a..44af719194b2 100644
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -446,6 +446,10 @@ struct ms_lib_ctrl {
 #define SD_BLOCK_LEN  9
 
 struct ene_ub6250_info {
+
+        /* I/O bounce buffer */
+        u8              *bbuf;
+
         /* for 6250 code */
         struct SD_STATUS        SD_Status;
         struct MS_STATUS        MS_Status;
@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_data *us, unsigned char flag);
 
 static void ene_ub6250_info_destructor(void *extra)
 {
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra;
+
         if (!extra)
                 return;
+        kfree(info->bbuf);
 }
 
 static int ene_send_scsi_cmd(struct us_data *us, u8 fDir, void *buf, int use_sg)
@@ -860,8 +867,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
                 u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
         u32 bn = PhyBlockAddr * 0x20 + PageNum;
 
         result = ene_load_bincode(us, MS_RW_PATTERN);
@@ -901,7 +909,7 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         bcb->CDB[2]     = (unsigned char)(PhyBlockAddr>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -910,9 +918,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr,
         ExtraDat->status0  = 0x10;  /* Not yet,fireware support */
 
         ExtraDat->status1  = 0x00;  /* Not yet,fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1332,8 +1340,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
                                 u8 PageNum, struct ms_lib_type_extdat *ExtraDat)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+        struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
         int result;
-        u8 ExtBuf[4];
 
         memset(bcb, 0, sizeof(struct bulk_cb_wrap));
         bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
@@ -1347,7 +1356,7 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         bcb->CDB[2]     = (unsigned char)(PhyBlock>>16);
         bcb->CDB[6]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
@@ -1355,9 +1364,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock,
         ExtraDat->intr     = 0x80;  /* Not yet, waiting for fireware support */
         ExtraDat->status0  = 0x10;  /* Not yet, waiting for fireware support */
         ExtraDat->status1  = 0x00;  /* Not yet, waiting for fireware support */
-        ExtraDat->ovrflg   = ExtBuf[0];
-        ExtraDat->mngflg   = ExtBuf[1];
-        ExtraDat->logadr   = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+        ExtraDat->ovrflg   = bbuf[0];
+        ExtraDat->mngflg   = bbuf[1];
+        ExtraDat->logadr   = memstick_logaddr(bbuf[2], bbuf[3]);
 
         return USB_STOR_TRANSPORT_GOOD;
 }
@@ -1556,9 +1565,9 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
         u16 PhyBlock, newblk, i;
         u16 LogStart, LogEnde;
         struct ms_lib_type_extdat extdat;
-        u8 buf[0x200];
         u32 count = 0, index = 0;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         for (PhyBlock = 0; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {
                 ms_lib_phy_to_log_range(PhyBlock, &LogStart, &LogEnde);
@@ -1572,14 +1581,16 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st)
                         }
 
                         if (count == PhyBlock) {
-                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, &buf);
+                                ms_lib_read_extrablock(us, PhyBlock, 0, 0x80,
+                                                bbuf);
                                 count += 0x80;
                         }
                         index = (PhyBlock % 0x80) * 4;
 
-                        extdat.ovrflg = buf[index];
-                        extdat.mngflg = buf[index+1];
-                        extdat.logadr = memstick_logaddr(buf[index+2], buf[index+3]);
+                        extdat.ovrflg = bbuf[index];
+                        extdat.mngflg = bbuf[index+1];
+                        extdat.logadr = memstick_logaddr(bbuf[index+2],
+                                        bbuf[index+3]);
 
                         if ((extdat.ovrflg & MS_REG_OVR_BKST) != MS_REG_OVR_BKST_OK) {
                                 ms_lib_setacquired_errorblock(us, PhyBlock);
@@ -2062,9 +2073,9 @@ static int ene_ms_init(struct us_data *us)
 {
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         int result;
-        u8 buf[0x200];
         u16 MSP_BlockSize, MSP_UserAreaBlocks;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         printk(KERN_INFO "transport --- ENE_MSInit\n");
 
@@ -2083,13 +2094,13 @@ static int ene_ms_init(struct us_data *us)
         bcb->CDB[0]     = 0xF1;
         bcb->CDB[1]     = 0x01;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 printk(KERN_ERR "Execution MS Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
         /* the same part to test ENE */
-        info->MS_Status = *(struct MS_STATUS *)&buf[0];
+        info->MS_Status = *(struct MS_STATUS *) bbuf;
 
         if (info->MS_Status.Insert && info->MS_Status.Ready) {
                 printk(KERN_INFO "Insert     = %x\n", info->MS_Status.Insert);
@@ -2098,15 +2109,15 @@ static int ene_ms_init(struct us_data *us)
                 printk(KERN_INFO "IsMSPHG    = %x\n", info->MS_Status.IsMSPHG);
                 printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP);
                 if (info->MS_Status.IsMSPro) {
-                        MSP_BlockSize      = (buf[6] << 8) | buf[7];
-                        MSP_UserAreaBlocks = (buf[10] << 8) | buf[11];
+                        MSP_BlockSize      = (bbuf[6] << 8) | bbuf[7];
+                        MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
                         info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
                 } else {
                         ms_card_init(us); /* Card is MS (to ms.c)*/
                 }
                 usb_stor_dbg(us, "MS Init Code OK !!\n");
         } else {
-                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "MS Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
@@ -2116,9 +2127,9 @@ static int ene_ms_init(struct us_data *us)
 static int ene_sd_init(struct us_data *us)
 {
         int result;
-        u8  buf[0x200];
         struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+        u8 *bbuf = info->bbuf;
 
         usb_stor_dbg(us, "transport --- ENE_SDInit\n");
         /* SD Init Part-1 */
@@ -2152,17 +2163,17 @@ static int ene_sd_init(struct us_data *us)
         bcb->Flags              = US_BULK_FLAG_IN;
         bcb->CDB[0]             = 0xF1;
 
-        result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+        result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_dbg(us, "Execution SD Init Code Fail !!\n");
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
-        info->SD_Status =  *(struct SD_STATUS *)&buf[0];
+        info->SD_Status =  *(struct SD_STATUS *) bbuf;
         if (info->SD_Status.Insert && info->SD_Status.Ready) {
                 struct SD_STATUS *s = &info->SD_Status;
 
-                ene_get_card_status(us, (unsigned char *)&buf);
+                ene_get_card_status(us, bbuf);
                 usb_stor_dbg(us, "Insert     = %x\n", s->Insert);
                 usb_stor_dbg(us, "Ready      = %x\n", s->Ready);
                 usb_stor_dbg(us, "IsMMC      = %x\n", s->IsMMC);
@@ -2170,7 +2181,7 @@ static int ene_sd_init(struct us_data *us)
                 usb_stor_dbg(us, "HiSpeed    = %x\n", s->HiSpeed);
                 usb_stor_dbg(us, "WtP        = %x\n", s->WtP);
         } else {
-                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", buf[0]);
+                usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]);
                 return USB_STOR_TRANSPORT_ERROR;
         }
         return USB_STOR_TRANSPORT_GOOD;
@@ -2180,13 +2191,15 @@ static int ene_sd_init(struct us_data *us)
 static int ene_init(struct us_data *us)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+        u8 *bbuf = info->bbuf;
 
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, bbuf);
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
+        misc_reg03 = bbuf[0];
         if (misc_reg03 & 0x01) {
                 if (!info->SD_Status.Ready) {
                         result = ene_sd_init(us);
@@ -2303,8 +2316,9 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                          const struct usb_device_id *id)
 {
         int result;
-        u8  misc_reg03 = 0;
+        u8  misc_reg03;
         struct us_data *us;
+        struct ene_ub6250_info *info;
 
         result = usb_stor_probe1(&us, intf, id,
                    (id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list,
@@ -2313,11 +2327,16 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* FIXME: where should the code alloc extra buf ? */
-        if (!us->extra) {
-                us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
-                if (!us->extra)
-                        return -ENOMEM;
-                us->extra_destructor = ene_ub6250_info_destructor;
+        us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
+        if (!us->extra)
+                return -ENOMEM;
+        us->extra_destructor = ene_ub6250_info_destructor;
+
+        info = (struct ene_ub6250_info *)(us->extra);
+        info->bbuf = kmalloc(512, GFP_KERNEL);
+        if (!info->bbuf) {
+                kfree(us->extra);
+                return -ENOMEM;
         }
 
         us->transport_name = "ene_ub6250";
@@ -2329,12 +2348,13 @@ static int ene_ub6250_probe(struct usb_interface *intf,
                 return result;
 
         /* probe card type */
-        result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+        result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
         if (result != USB_STOR_XFER_GOOD) {
                 usb_stor_disconnect(intf);
                 return USB_STOR_TRANSPORT_ERROR;
         }
 
+        misc_reg03 = info->bbuf[0];
         if (!(misc_reg03 & 0x01)) {
                 pr_info("ums_eneub6250: This driver only supports SD/MS cards. "
                         "It does not support SM cards.\n");
diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
index 5d8b2c261940..0585078638db 100644
--- a/drivers/usb/usbip/vhci_hcd.c
+++ b/drivers/usb/usbip/vhci_hcd.c
@@ -235,14 +235,19 @@ done:
 
 static inline void hub_descriptor(struct usb_hub_descriptor *desc)
 {
+        int width;
+
         memset(desc, 0, sizeof(*desc));
         desc->bDescriptorType = USB_DT_HUB;
-        desc->bDescLength = 9;
         desc->wHubCharacteristics = cpu_to_le16(
                 HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM);
+
         desc->bNbrPorts = VHCI_HC_PORTS;
-        desc->u.hs.DeviceRemovable[0] = 0xff;
-        desc->u.hs.DeviceRemovable[1] = 0xff;
+        BUILD_BUG_ON(VHCI_HC_PORTS > USB_MAXCHILDREN);
+        width = desc->bNbrPorts / 8 + 1;
+        desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width;
+        memset(&desc->u.hs.DeviceRemovable[0], 0, width);
+        memset(&desc->u.hs.DeviceRemovable[width], 0xff, width);
 }
 
 static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c
index 6345e85822a4..a50cf45e530f 100644
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -341,6 +341,7 @@ error_submit_ep1:
 static
 int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
 {
+        struct usb_device *udev = interface_to_usbdev(iface);
         struct i1480_usb *i1480_usb;
         struct i1480 *i1480;
         struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
                         iface->cur_altsetting->desc.bInterfaceNumber);
                 goto error;
         }
-        if (iface->num_altsetting > 1
-            && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) {
+        if (iface->num_altsetting > 1 &&
+                        le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) {
                 /* Need altsetting #1 [HW QUIRK] or EP1 won't work */
                 result = usb_set_interface(interface_to_usbdev(iface), 0, 1);
                 if (result < 0)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 52a70ee6014f..8b9049dac094 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -452,7 +452,7 @@ config DAVINCI_WATCHDOG
 
 config ORION_WATCHDOG
         tristate "Orion watchdog"
-        depends on ARCH_ORION5X || ARCH_DOVE || MACH_DOVE || ARCH_MVEBU || COMPILE_TEST
+        depends on ARCH_ORION5X || ARCH_DOVE || MACH_DOVE || ARCH_MVEBU || (COMPILE_TEST && !ARCH_EBSA110)
         depends on ARM
         select WATCHDOG_CORE
         help
diff --git a/drivers/watchdog/bcm_kona_wdt.c b/drivers/watchdog/bcm_kona_wdt.c
index 6fce17d5b9f1..a5775dfd8d5f 100644
--- a/drivers/watchdog/bcm_kona_wdt.c
+++ b/drivers/watchdog/bcm_kona_wdt.c
@@ -304,6 +304,8 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev)
         if (!wdt)
                 return -ENOMEM;
 
+        spin_lock_init(&wdt->lock);
+
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         wdt->base = devm_ioremap_resource(dev, res);
         if (IS_ERR(wdt->base))
@@ -316,7 +318,6 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        spin_lock_init(&wdt->lock);
         platform_set_drvdata(pdev, wdt);
         watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt);
         bcm_kona_wdt_wdd.parent = &pdev->dev;
diff --git a/drivers/watchdog/cadence_wdt.c b/drivers/watchdog/cadence_wdt.c
index 8d61e8bfe60b..86e0b5d2e761 100644
--- a/drivers/watchdog/cadence_wdt.c
+++ b/drivers/watchdog/cadence_wdt.c
@@ -49,7 +49,7 @@
 /* Counter maximum value */
 #define CDNS_WDT_COUNTER_MAX 0xFFF
 
-static int wdt_timeout = CDNS_WDT_DEFAULT_TIMEOUT;
+static int wdt_timeout;
 static int nowayout = WATCHDOG_NOWAYOUT;
 
 module_param(wdt_timeout, int, 0);
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 347f0389b089..c4f65873bfa4 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -306,16 +306,15 @@ static int iTCO_wdt_ping(struct watchdog_device *wd_dev)
 
         iTCO_vendor_pre_keepalive(p->smi_res, wd_dev->timeout);
 
+        /* Reset the timeout status bit so that the timer
+         * needs to count down twice again before rebooting */
+        outw(0x0008, TCO1_STS(p));      /* write 1 to clear bit */
+
         /* Reload the timer by writing to the TCO Timer Counter register */
-        if (p->iTCO_version >= 2) {
+        if (p->iTCO_version >= 2)
                 outw(0x01, TCO_RLD(p));
-        } else if (p->iTCO_version == 1) {
-                /* Reset the timeout status bit so that the timer
-                 * needs to count down twice again before rebooting */
-                outw(0x0008, TCO1_STS(p));      /* write 1 to clear bit */
-
+        else if (p->iTCO_version == 1)
                 outb(0x01, TCO_RLD(p));
-        }
 
         spin_unlock(&p->io_lock);
         return 0;
@@ -328,11 +327,8 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t)
         unsigned char val8;
         unsigned int tmrval;
 
-        tmrval = seconds_to_ticks(p, t);
-
-        /* For TCO v1 the timer counts down twice before rebooting */
-        if (p->iTCO_version == 1)
-                tmrval /= 2;
+        /* The timer counts down twice before rebooting */
+        tmrval = seconds_to_ticks(p, t) / 2;
 
         /* from the specs: */
         /* "Values of 0h-3h are ignored and should not be attempted" */
@@ -385,6 +381,8 @@ static unsigned int iTCO_wdt_get_timeleft(struct watchdog_device *wd_dev)
                 spin_lock(&p->io_lock);
                 val16 = inw(TCO_RLD(p));
                 val16 &= 0x3ff;
+                if (!(inw(TCO1_STS(p)) & 0x0008))
+                        val16 += (inw(TCOv2_TMR(p)) & 0x3ff);
                 spin_unlock(&p->io_lock);
 
                 time_left = ticks_to_seconds(p, val16);
diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
index 99ebf6ea3de6..5615f4013924 100644
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface,
                 return -ENODEV;
         }
 
+        if (iface_desc->desc.bNumEndpoints < 1)
+                return -ENODEV;
+
         /* check out the endpoint: it has to be Interrupt & IN */
         endpoint = &iface_desc->endpoint[0].desc;
 
diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
index f709962018ac..362fd229786d 100644
--- a/drivers/watchdog/sama5d4_wdt.c
+++ b/drivers/watchdog/sama5d4_wdt.c
@@ -6,6 +6,7 @@
  * Licensed under GPLv2.
  */
 
+#include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
@@ -29,6 +30,7 @@ struct sama5d4_wdt {
         struct watchdog_device  wdd;
         void __iomem            *reg_base;
         u32                     mr;
+        unsigned long           last_ping;
 };
 
 static int wdt_timeout = WDT_DEFAULT_TIMEOUT;
@@ -44,11 +46,34 @@ MODULE_PARM_DESC(nowayout,
         "Watchdog cannot be stopped once started (default="
         __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
+#define wdt_enabled (!(wdt->mr & AT91_WDT_WDDIS))
+
 #define wdt_read(wdt, field) \
         readl_relaxed((wdt)->reg_base + (field))
 
-#define wdt_write(wtd, field, val) \
-        writel_relaxed((val), (wdt)->reg_base + (field))
+/* 4 slow clock periods is 4/32768 = 122.07µs*/
+#define WDT_DELAY       usecs_to_jiffies(123)
+
+static void wdt_write(struct sama5d4_wdt *wdt, u32 field, u32 val)
+{
+        /*
+         * WDT_CR and WDT_MR must not be modified within three slow clock
+         * periods following a restart of the watchdog performed by a write
+         * access in WDT_CR.
+         */
+        while (time_before(jiffies, wdt->last_ping + WDT_DELAY))
+                usleep_range(30, 125);
+        writel_relaxed(val, wdt->reg_base + field);
+        wdt->last_ping = jiffies;
+}
+
+static void wdt_write_nosleep(struct sama5d4_wdt *wdt, u32 field, u32 val)
+{
+        if (time_before(jiffies, wdt->last_ping + WDT_DELAY))
+                udelay(123);
+        writel_relaxed(val, wdt->reg_base + field);
+        wdt->last_ping = jiffies;
+}
 
 static int sama5d4_wdt_start(struct watchdog_device *wdd)
 {
@@ -89,7 +114,16 @@ static int sama5d4_wdt_set_timeout(struct watchdog_device *wdd,
         wdt->mr &= ~AT91_WDT_WDD;
         wdt->mr |= AT91_WDT_SET_WDV(value);
         wdt->mr |= AT91_WDT_SET_WDD(value);
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr);
+
+        /*
+         * WDDIS has to be 0 when updating WDD/WDV. The datasheet states: When
+         * setting the WDDIS bit, and while it is set, the fields WDV and WDD
+         * must not be modified.
+         * If the watchdog is enabled, then the timeout can be updated. Else,
+         * wait that the user enables it.
+         */
+        if (wdt_enabled)
+                wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~AT91_WDT_WDDIS);
 
         wdd->timeout = timeout;
 
@@ -145,23 +179,21 @@ static int of_sama5d4_wdt_init(struct device_node *np, struct sama5d4_wdt *wdt)
 
 static int sama5d4_wdt_init(struct sama5d4_wdt *wdt)
 {
-        struct watchdog_device *wdd = &wdt->wdd;
-        u32 value = WDT_SEC2TICKS(wdd->timeout);
         u32 reg;
-
         /*
-         * Because the fields WDV and WDD must not be modified when the WDDIS
-         * bit is set, so clear the WDDIS bit before writing the WDT_MR.
+         * When booting and resuming, the bootloader may have changed the
+         * watchdog configuration.
+         * If the watchdog is already running, we can safely update it.
+         * Else, we have to disable it properly.
          */
-        reg = wdt_read(wdt, AT91_WDT_MR);
-        reg &= ~AT91_WDT_WDDIS;
-        wdt_write(wdt, AT91_WDT_MR, reg);
-
-        wdt->mr |= AT91_WDT_SET_WDD(value);
-        wdt->mr |= AT91_WDT_SET_WDV(value);
-
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr);
-
+        if (wdt_enabled) {
+                wdt_write_nosleep(wdt, AT91_WDT_MR, wdt->mr);
+        } else {
+                reg = wdt_read(wdt, AT91_WDT_MR);
+                if (!(reg & AT91_WDT_WDDIS))
+                        wdt_write_nosleep(wdt, AT91_WDT_MR,
+                                          reg | AT91_WDT_WDDIS);
+        }
         return 0;
 }
 
@@ -172,6 +204,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
         struct resource *res;
         void __iomem *regs;
         u32 irq = 0;
+        u32 timeout;
         int ret;
 
         wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
@@ -184,6 +217,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
         wdd->ops = &sama5d4_wdt_ops;
         wdd->min_timeout = MIN_WDT_TIMEOUT;
         wdd->max_timeout = MAX_WDT_TIMEOUT;
+        wdt->last_ping = jiffies;
 
         watchdog_set_drvdata(wdd, wdt);
 
@@ -221,6 +255,11 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        timeout = WDT_SEC2TICKS(wdd->timeout);
+
+        wdt->mr |= AT91_WDT_SET_WDD(timeout);
+        wdt->mr |= AT91_WDT_SET_WDV(timeout);
+
         ret = sama5d4_wdt_init(wdt);
         if (ret)
                 return ret;
@@ -263,9 +302,7 @@ static int sama5d4_wdt_resume(struct device *dev)
 {
         struct sama5d4_wdt *wdt = dev_get_drvdata(dev);
 
-        wdt_write(wdt, AT91_WDT_MR, wdt->mr & ~AT91_WDT_WDDIS);
-        if (wdt->mr & AT91_WDT_WDDIS)
-                wdt_write(wdt, AT91_WDT_MR, wdt->mr);
+        sama5d4_wdt_init(wdt);
 
         return 0;
 }
diff --git a/drivers/watchdog/wdt_pci.c b/drivers/watchdog/wdt_pci.c
index 48b2c058b009..bc7addc2dc06 100644
--- a/drivers/watchdog/wdt_pci.c
+++ b/drivers/watchdog/wdt_pci.c
@@ -332,7 +332,7 @@ static irqreturn_t wdtpci_interrupt(int irq, void *dev_id)
                 pr_crit("Would Reboot\n");
 #else
                 pr_crit("Initiating system reboot\n");
-                emergency_restart(NULL);
+                emergency_restart();
 #endif
 #else
                 pr_crit("Reset in 5ms\n");
diff --git a/drivers/watchdog/zx2967_wdt.c b/drivers/watchdog/zx2967_wdt.c
index e290d5a13a6d..c98252733c30 100644
--- a/drivers/watchdog/zx2967_wdt.c
+++ b/drivers/watchdog/zx2967_wdt.c
@@ -211,10 +211,8 @@ static int zx2967_wdt_probe(struct platform_device *pdev)
 
         base = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         wdt->reg_base = devm_ioremap_resource(dev, base);
-        if (IS_ERR(wdt->reg_base)) {
-                dev_err(dev, "ioremap failed\n");
+        if (IS_ERR(wdt->reg_base))
                 return PTR_ERR(wdt->reg_base);
-        }
 
         zx2967_wdt_reset_sysctrl(dev);
 
diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
index 26d77f9f8c12..2dcbd5698884 100644
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -817,7 +817,7 @@ static int ext2_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
         iomap->bdev = bdev;
         iomap->offset = (u64)first_block << blkbits;
         if (blk_queue_dax(bdev->bd_queue))
-                iomap->dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+                iomap->dax_dev = fs_dax_get_by_host(bdev->bd_disk->disk_name);
         else
                 iomap->dax_dev = NULL;
 
@@ -841,7 +841,7 @@ static int
 ext2_iomap_end(struct inode *inode, loff_t offset, loff_t length,
                 ssize_t written, unsigned flags, struct iomap *iomap)
 {
-        put_dax(iomap->dax_dev);
+        fs_put_dax(iomap->dax_dev);
         if (iomap->type == IOMAP_MAPPED &&
             written < length &&
             (flags & IOMAP_WRITE))
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 5834c4d76be8..1bd0bfa547f6 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3412,7 +3412,7 @@ retry:
         bdev = inode->i_sb->s_bdev;
         iomap->bdev = bdev;
         if (blk_queue_dax(bdev->bd_queue))
-                iomap->dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+                iomap->dax_dev = fs_dax_get_by_host(bdev->bd_disk->disk_name);
         else
                 iomap->dax_dev = NULL;
         iomap->offset = first_block << blkbits;
@@ -3447,7 +3447,7 @@ static int ext4_iomap_end(struct inode *inode, loff_t offset, loff_t length,
         int blkbits = inode->i_blkbits;
         bool truncate = false;
 
-        put_dax(iomap->dax_dev);
+        fs_put_dax(iomap->dax_dev);
         if (!(flags & IOMAP_WRITE) || (flags & IOMAP_FAULT))
                 return 0;
 
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 5a1b58f8fef4..65c88379a3a1 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -975,8 +975,15 @@ static int fuse_bdi_init(struct fuse_conn *fc, struct super_block *sb)
         int err;
         char *suffix = "";
 
-        if (sb->s_bdev)
+        if (sb->s_bdev) {
                 suffix = "-fuseblk";
+                /*
+                 * sb->s_bdi points to blkdev's bdi however we want to redirect
+                 * it to our private bdi...
+                 */
+                bdi_put(sb->s_bdi);
+                sb->s_bdi = &noop_backing_dev_info;
+        }
         err = super_setup_bdi_name(sb, "%u:%u%s", MAJOR(fc->dev),
                                    MINOR(fc->dev), suffix);
         if (err)
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index a63f61c256bd..94e5bdf7304c 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -1068,7 +1068,7 @@ xfs_file_iomap_begin(
         /* optionally associate a dax device with the iomap bdev */
         bdev = iomap->bdev;
         if (blk_queue_dax(bdev->bd_queue))
-                iomap->dax_dev = dax_get_by_host(bdev->bd_disk->disk_name);
+                iomap->dax_dev = fs_dax_get_by_host(bdev->bd_disk->disk_name);
         else
                 iomap->dax_dev = NULL;
 
@@ -1149,7 +1149,7 @@ xfs_file_iomap_end(
         unsigned                flags,
         struct iomap            *iomap)
 {
-        put_dax(iomap->dax_dev);
+        fs_put_dax(iomap->dax_dev);
         if ((flags & IOMAP_WRITE) && iomap->type == IOMAP_DELALLOC)
                 return xfs_file_iomap_end_delalloc(XFS_I(inode), offset,
                                 length, written, iomap);
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 97b8d3728b31..ef718586321c 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -195,7 +195,10 @@ struct vgic_dist {
                 /* either a GICv2 CPU interface */
                 gpa_t                   vgic_cpu_base;
                 /* or a number of GICv3 redistributor regions */
-                gpa_t                   vgic_redist_base;
+                struct {
+                        gpa_t           vgic_redist_base;
+                        gpa_t           vgic_redist_free_offset;
+                };
         };
 
         /* distributor enabled */
diff --git a/include/linux/dax.h b/include/linux/dax.h
index 00ebac854bb7..5ec1f6c47716 100644
--- a/include/linux/dax.h
+++ b/include/linux/dax.h
@@ -18,6 +18,20 @@ struct dax_operations {
                         void **, pfn_t *);
 };
 
+#if IS_ENABLED(CONFIG_DAX)
+struct dax_device *dax_get_by_host(const char *host);
+void put_dax(struct dax_device *dax_dev);
+#else
+static inline struct dax_device *dax_get_by_host(const char *host)
+{
+        return NULL;
+}
+
+static inline void put_dax(struct dax_device *dax_dev)
+{
+}
+#endif
+
 int bdev_dax_pgoff(struct block_device *, sector_t, size_t, pgoff_t *pgoff);
 #if IS_ENABLED(CONFIG_FS_DAX)
 int __bdev_dax_supported(struct super_block *sb, int blocksize);
@@ -25,23 +39,29 @@ static inline int bdev_dax_supported(struct super_block *sb, int blocksize)
 {
         return __bdev_dax_supported(sb, blocksize);
 }
+
+static inline struct dax_device *fs_dax_get_by_host(const char *host)
+{
+        return dax_get_by_host(host);
+}
+
+static inline void fs_put_dax(struct dax_device *dax_dev)
+{
+        put_dax(dax_dev);
+}
+
 #else
 static inline int bdev_dax_supported(struct super_block *sb, int blocksize)
 {
         return -EOPNOTSUPP;
 }
-#endif
 
-#if IS_ENABLED(CONFIG_DAX)
-struct dax_device *dax_get_by_host(const char *host);
-void put_dax(struct dax_device *dax_dev);
-#else
-static inline struct dax_device *dax_get_by_host(const char *host)
+static inline struct dax_device *fs_dax_get_by_host(const char *host)
 {
         return NULL;
 }
 
-static inline void put_dax(struct dax_device *dax_dev)
+static inline void fs_put_dax(struct dax_device *dax_dev)
 {
 }
 #endif
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index 30f90c1a0aaf..541df0b5b815 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -349,6 +349,9 @@ extern int proc_kprobes_optimization_handler(struct ctl_table *table,
                                              int write, void __user *buffer,
                                              size_t *length, loff_t *ppos);
 #endif
+extern void wait_for_kprobe_optimizer(void);
+#else
+static inline void wait_for_kprobe_optimizer(void) { }
 #endif /* CONFIG_OPTPROBES */
 #ifdef CONFIG_KPROBES_ON_FTRACE
 extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index be378cf47fcc..b3044c2c62cb 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -294,7 +294,7 @@ int xt_match_to_user(const struct xt_entry_match *m,
 int xt_target_to_user(const struct xt_entry_target *t,
                       struct xt_entry_target __user *u);
 int xt_data_to_user(void __user *dst, const void *src,
-                    int usersize, int size);
+                    int usersize, int size, int aligned_size);
 
 void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                                  struct xt_counters_info *info, bool compat);
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index a30efb437e6d..e0cbf17af780 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -125,4 +125,9 @@ extern unsigned int ebt_do_table(struct sk_buff *skb,
 /* True if the target is not a standard target */
 #define INVALID_TARGET (info->target < -NUM_STANDARD_TARGETS || info->target >= 0)
 
+static inline bool ebt_invalid_target(int target)
+{
+        return (target < -NUM_STANDARD_TARGETS || target >= 0);
+}
+
 #endif
diff --git a/include/linux/nvme-fc-driver.h b/include/linux/nvme-fc-driver.h
index 0db37158a61d..6c8c5d8041b7 100644
--- a/include/linux/nvme-fc-driver.h
+++ b/include/linux/nvme-fc-driver.h
@@ -27,8 +27,8 @@
 
 /* FC Port role bitmask - can merge with FC Port Roles in fc transport */
 #define FC_PORT_ROLE_NVME_INITIATOR     0x10
-#define FC_PORT_ROLE_NVME_TARGET        0x11
-#define FC_PORT_ROLE_NVME_DISCOVERY     0x12
+#define FC_PORT_ROLE_NVME_TARGET        0x20
+#define FC_PORT_ROLE_NVME_DISCOVERY     0x40
 
 
 /**
@@ -642,15 +642,7 @@ enum {
                  * sequence in one LLDD operation. Errors during Data
                  * sequence transmit must not allow RSP sequence to be sent.
                  */
-        NVMET_FCTGTFEAT_NEEDS_CMD_CPUSCHED = (1 << 1),
-                /* Bit 1: When 0, the LLDD will deliver FCP CMD
-                 * on the CPU it should be affinitized to. Thus work will
-                 * be scheduled on the cpu received on. When 1, the LLDD
-                 * may not deliver the CMD on the CPU it should be worked
-                 * on. The transport should pick a cpu to schedule the work
-                 * on.
-                 */
-        NVMET_FCTGTFEAT_CMD_IN_ISR = (1 << 2),
+        NVMET_FCTGTFEAT_CMD_IN_ISR = (1 << 1),
                 /* Bit 2: When 0, the LLDD is calling the cmd rcv handler
                  * in a non-isr context, allowing the transport to finish
                  * op completion in the calling context. When 1, the LLDD
@@ -658,7 +650,7 @@ enum {
                  * requiring the transport to transition to a workqueue
                  * for op completion.
                  */
-        NVMET_FCTGTFEAT_OPDONE_IN_ISR = (1 << 3),
+        NVMET_FCTGTFEAT_OPDONE_IN_ISR = (1 << 2),
                 /* Bit 3: When 0, the LLDD is calling the op done handler
                  * in a non-isr context, allowing the transport to finish
                  * op completion in the calling context. When 1, the LLDD
diff --git a/include/linux/of_irq.h b/include/linux/of_irq.h
index ec6b11deb773..1e0deb8e8494 100644
--- a/include/linux/of_irq.h
+++ b/include/linux/of_irq.h
@@ -8,7 +8,7 @@
 #include <linux/ioport.h>
 #include <linux/of.h>
 
-typedef int const (*of_irq_init_cb_t)(struct device_node *, struct device_node *);
+typedef int (*of_irq_init_cb_t)(struct device_node *, struct device_node *);
 
 /*
  * Workarounds only applied to 32bit powermac machines
diff --git a/include/linux/soc/renesas/rcar-rst.h b/include/linux/soc/renesas/rcar-rst.h
index a18e0783946b..787e7ad53d45 100644
--- a/include/linux/soc/renesas/rcar-rst.h
+++ b/include/linux/soc/renesas/rcar-rst.h
@@ -1,6 +1,11 @@
 #ifndef __LINUX_SOC_RENESAS_RCAR_RST_H__
 #define __LINUX_SOC_RENESAS_RCAR_RST_H__
 
+#if defined(CONFIG_ARCH_RCAR_GEN1) || defined(CONFIG_ARCH_RCAR_GEN2) || \
+    defined(CONFIG_ARCH_R8A7795) || defined(CONFIG_ARCH_R8A7796)
 int rcar_rst_read_mode_pins(u32 *mode);
+#else
+static inline int rcar_rst_read_mode_pins(u32 *mode) { return -ENODEV; }
+#endif
 
 #endif /* __LINUX_SOC_RENESAS_RCAR_RST_H__ */
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index a469999a106d..50398b69ca44 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -148,6 +148,7 @@ struct usb_hcd {
         unsigned                rh_registered:1;/* is root hub registered? */
         unsigned                rh_pollable:1;  /* may we poll the root hub? */
         unsigned                msix_enabled:1; /* driver has MSI-X enabled? */
+        unsigned                msi_enabled:1;  /* driver has MSI enabled? */
         unsigned                remove_phy:1;   /* auto-remove USB phy */
 
         /* The next flag is a stopgap, to be removed when all the HCDs
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index e04fa7691e5d..c519bb5b5bb8 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -9,6 +9,7 @@
 
 #ifndef _NF_CONNTRACK_HELPER_H
 #define _NF_CONNTRACK_HELPER_H
+#include <linux/refcount.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_extend.h>
 #include <net/netfilter/nf_conntrack_expect.h>
@@ -26,6 +27,7 @@ struct nf_conntrack_helper {
         struct hlist_node hnode;        /* Internal use. */
 
         char name[NF_CT_HELPER_NAME_LEN]; /* name of the module */
+        refcount_t refcnt;
         struct module *me;              /* pointer to self */
         const struct nf_conntrack_expect_policy *expect_policy;
 
@@ -79,6 +81,8 @@ struct nf_conntrack_helper *__nf_conntrack_helper_find(const char *name,
 struct nf_conntrack_helper *nf_conntrack_helper_try_module_get(const char *name,
                                                                u16 l3num,
                                                                u8 protonum);
+void nf_conntrack_helper_put(struct nf_conntrack_helper *helper);
+
 void nf_ct_helper_init(struct nf_conntrack_helper *helper,
                        u16 l3num, u16 protonum, const char *name,
                        u16 default_port, u16 spec_port, u32 id,
diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 028faec8fc27..8a8bab8d7b15 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -176,7 +176,7 @@ struct nft_data_desc {
 int nft_data_init(const struct nft_ctx *ctx,
                   struct nft_data *data, unsigned int size,
                   struct nft_data_desc *desc, const struct nlattr *nla);
-void nft_data_uninit(const struct nft_data *data, enum nft_data_types type);
+void nft_data_release(const struct nft_data *data, enum nft_data_types type);
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
                   enum nft_data_types type, unsigned int len);
 
diff --git a/include/uapi/linux/usb/ch11.h b/include/uapi/linux/usb/ch11.h
index 361297e96f58..576c704e3fb8 100644
--- a/include/uapi/linux/usb/ch11.h
+++ b/include/uapi/linux/usb/ch11.h
@@ -22,6 +22,9 @@
  */
 #define USB_MAXCHILDREN         31
 
+/* See USB 3.1 spec Table 10-5 */
+#define USB_SS_MAXPORTS         15
+
 /*
  * Hub request types
  */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 1eddb713b815..c72cd41f5b8b 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -808,11 +808,15 @@ static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
                 reg_off += reg->aux_off;
         }
 
-        /* skb->data is NET_IP_ALIGN-ed, but for strict alignment checking
-         * we force this to 2 which is universally what architectures use
-         * when they don't set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS.
+        /* For platforms that do not have a Kconfig enabling
+         * CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS the value of
+         * NET_IP_ALIGN is universally set to '2'.  And on platforms
+         * that do set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, we get
+         * to this code only in strict mode where we want to emulate
+         * the NET_IP_ALIGN==2 checking.  Therefore use an
+         * unconditional IP align value of '2'.
          */
-        ip_align = strict ? 2 : NET_IP_ALIGN;
+        ip_align = 2;
         if ((ip_align + reg_off + off) % size != 0) {
                 verbose("misaligned packet access off %d+%d+%d size %d\n",
                         ip_align, reg_off, off, size);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 686be4b73018..c94da688ee9b 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -880,8 +880,8 @@ irq_set_chained_handler_and_data(unsigned int irq, irq_flow_handler_t handle,
         if (!desc)
                 return;
 
-        __irq_do_set_handler(desc, handle, 1, NULL);
         desc->irq_common_data.handler_data = data;
+        __irq_do_set_handler(desc, handle, 1, NULL);
 
         irq_put_desc_busunlock(desc, flags);
 }
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 7367e0ec6f81..2d2d3a568e4e 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -595,7 +595,7 @@ static void kprobe_optimizer(struct work_struct *work)
 }
 
 /* Wait for completing optimization and unoptimization */
-static void wait_for_kprobe_optimizer(void)
+void wait_for_kprobe_optimizer(void)
 {
         mutex_lock(&kprobe_mutex);
 
@@ -2183,6 +2183,12 @@ static int kprobes_module_callback(struct notifier_block *nb,
                                  * The vaddr this probe is installed will soon
                                  * be vfreed buy not synced to disk. Hence,
                                  * disarming the breakpoint isn't needed.
+                                 *
+                                 * Note, this will also move any optimized probes
+                                 * that are pending to be removed from their
+                                 * corresponding lists to the freeing_list and
+                                 * will not be touched by the delayed
+                                 * kprobe_optimizer work handler.
                                  */
                                 kill_kprobe(p);
                         }
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 3b1e0f3ad07f..fa46606f3356 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -1425,7 +1425,7 @@ static unsigned int nr_meta_pages;
  * Numbers of normal and highmem page frames allocated for hibernation image
  * before suspending devices.
  */
-unsigned int alloc_normal, alloc_highmem;
+static unsigned int alloc_normal, alloc_highmem;
 /*
  * Memory bitmap used for marking saveable pages (during hibernation) or
  * hibernation image pages (during restore)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 759f4bd52cd6..803c3bc274c4 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3502,6 +3502,31 @@ asmlinkage __visible void __sched schedule(void)
 }
 EXPORT_SYMBOL(schedule);
 
+/*
+ * synchronize_rcu_tasks() makes sure that no task is stuck in preempted
+ * state (have scheduled out non-voluntarily) by making sure that all
+ * tasks have either left the run queue or have gone into user space.
+ * As idle tasks do not do either, they must not ever be preempted
+ * (schedule out non-voluntarily).
+ *
+ * schedule_idle() is similar to schedule_preempt_disable() except that it
+ * never enables preemption because it does not call sched_submit_work().
+ */
+void __sched schedule_idle(void)
+{
+        /*
+         * As this skips calling sched_submit_work(), which the idle task does
+         * regardless because that function is a nop when the task is in a
+         * TASK_RUNNING state, make sure this isn't used someplace that the
+         * current task can be in any other state. Note, idle is always in the
+         * TASK_RUNNING state.
+         */
+        WARN_ON_ONCE(current->state);
+        do {
+                __schedule(false);
+        } while (need_resched());
+}
+
 #ifdef CONFIG_CONTEXT_TRACKING
 asmlinkage __visible void __sched schedule_user(void)
 {
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 76877a62b5fa..622eed1b7658 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -245,11 +245,10 @@ static void sugov_update_single(struct update_util_data *hook, u64 time,
         sugov_update_commit(sg_policy, time, next_f);
 }
 
-static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu)
+static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time)
 {
         struct sugov_policy *sg_policy = sg_cpu->sg_policy;
         struct cpufreq_policy *policy = sg_policy->policy;
-        u64 last_freq_update_time = sg_policy->last_freq_update_time;
         unsigned long util = 0, max = 1;
         unsigned int j;
 
@@ -265,7 +264,7 @@ static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu)
                  * enough, don't take the CPU into account as it probably is
                  * idle now (and clear iowait_boost for it).
                  */
-                delta_ns = last_freq_update_time - j_sg_cpu->last_update;
+                delta_ns = time - j_sg_cpu->last_update;
                 if (delta_ns > TICK_NSEC) {
                         j_sg_cpu->iowait_boost = 0;
                         continue;
@@ -309,7 +308,7 @@ static void sugov_update_shared(struct update_util_data *hook, u64 time,
                 if (flags & SCHED_CPUFREQ_RT_DL)
                         next_f = sg_policy->policy->cpuinfo.max_freq;
                 else
-                        next_f = sugov_next_freq_shared(sg_cpu);
+                        next_f = sugov_next_freq_shared(sg_cpu, time);
 
                 sugov_update_commit(sg_policy, time, next_f);
         }
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index 2a25a9ec2c6e..ef63adce0c9c 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -265,7 +265,7 @@ static void do_idle(void)
         smp_mb__after_atomic();
 
         sched_ttwu_pending();
-        schedule_preempt_disabled();
+        schedule_idle();
 
         if (unlikely(klp_patch_pending(current)))
                 klp_update_patch_state(current);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 7808ab050599..6dda2aab731e 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1467,6 +1467,8 @@ static inline struct cpuidle_state *idle_get_state(struct rq *rq)
 }
 #endif
 
+extern void schedule_idle(void);
+
 extern void sysrq_sched_debug_show(void);
 extern void sched_init_granularity(void);
 extern void update_max_interval(void);
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index bd8ae8d5ae9c..193c5f5e3f79 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -1662,14 +1662,14 @@ static ssize_t sysfs_blk_trace_attr_store(struct device *dev,
                 goto out;
 
         if (attr == &dev_attr_act_mask) {
-                if (sscanf(buf, "%llx", &value) != 1) {
+                if (kstrtoull(buf, 0, &value)) {
                         /* Assume it is a list of trace category names */
                         ret = blk_trace_str2mask(buf);
                         if (ret < 0)
                                 goto out;
                         value = ret;
                 }
-        } else if (sscanf(buf, "%llu", &value) != 1)
+        } else if (kstrtoull(buf, 0, &value))
                 goto out;
 
         ret = -ENXIO;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 39dca4e86a94..74fdfe9ed3db 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4144,9 +4144,9 @@ unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
         int i, ret = -ENODEV;
         int size;
 
-        if (glob && (strcmp(glob, "*") == 0 || !strlen(glob)))
+        if (!glob || !strlen(glob) || !strcmp(glob, "*"))
                 func_g.search = NULL;
-        else if (glob) {
+        else {
                 int not;
 
                 func_g.type = filter_parse_regex(glob, strlen(glob),
@@ -4256,6 +4256,14 @@ unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
         return ret;
 }
 
+void clear_ftrace_function_probes(struct trace_array *tr)
+{
+        struct ftrace_func_probe *probe, *n;
+
+        list_for_each_entry_safe(probe, n, &tr->func_probes, list)
+                unregister_ftrace_function_probe_func(NULL, tr, probe->probe_ops);
+}
+
 static LIST_HEAD(ftrace_commands);
 static DEFINE_MUTEX(ftrace_cmd_mutex);
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c4536c449021..1122f151466f 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1558,7 +1558,7 @@ static __init int init_trace_selftests(void)
 
         return 0;
 }
-early_initcall(init_trace_selftests);
+core_initcall(init_trace_selftests);
 #else
 static inline int run_tracer_selftest(struct tracer *type)
 {
@@ -2568,7 +2568,36 @@ static inline void ftrace_trace_stack(struct trace_array *tr,
 void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
                    int pc)
 {
-        __ftrace_trace_stack(tr->trace_buffer.buffer, flags, skip, pc, NULL);
+        struct ring_buffer *buffer = tr->trace_buffer.buffer;
+
+        if (rcu_is_watching()) {
+                __ftrace_trace_stack(buffer, flags, skip, pc, NULL);
+                return;
+        }
+
+        /*
+         * When an NMI triggers, RCU is enabled via rcu_nmi_enter(),
+         * but if the above rcu_is_watching() failed, then the NMI
+         * triggered someplace critical, and rcu_irq_enter() should
+         * not be called from NMI.
+         */
+        if (unlikely(in_nmi()))
+                return;
+
+        /*
+         * It is possible that a function is being traced in a
+         * location that RCU is not watching. A call to
+         * rcu_irq_enter() will make sure that it is, but there's
+         * a few internal rcu functions that could be traced
+         * where that wont work either. In those cases, we just
+         * do nothing.
+         */
+        if (unlikely(rcu_irq_enter_disabled()))
+                return;
+
+        rcu_irq_enter_irqson();
+        __ftrace_trace_stack(buffer, flags, skip, pc, NULL);
+        rcu_irq_exit_irqson();
 }
 
 /**
@@ -7550,6 +7579,7 @@ static int instance_rmdir(const char *name)
         }
 
         tracing_set_nop(tr);
+        clear_ftrace_function_probes(tr);
         event_trace_del_tracer(tr);
         ftrace_clear_pids(tr);
         ftrace_destroy_function_files(tr);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 291a1bca5748..39fd77330aab 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -980,6 +980,7 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
 extern int
 unregister_ftrace_function_probe_func(char *glob, struct trace_array *tr,
                                       struct ftrace_probe_ops *ops);
+extern void clear_ftrace_function_probes(struct trace_array *tr);
 
 int register_ftrace_command(struct ftrace_func_command *cmd);
 int unregister_ftrace_command(struct ftrace_func_command *cmd);
@@ -998,6 +999,10 @@ static inline __init int unregister_ftrace_command(char *cmd_name)
 {
         return -EINVAL;
 }
+static inline void clear_ftrace_function_probes(struct trace_array *tr)
+{
+}
+
 /*
  * The ops parameter passed in is usually undefined.
  * This must be a macro.
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 8485f6738a87..c129fca6ec99 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1535,6 +1535,11 @@ static __init int kprobe_trace_self_tests_init(void)
 
 end:
         release_all_trace_kprobes();
+        /*
+         * Wait for the optimizer work to finish. Otherwise it might fiddle
+         * with probes in already freed __init text.
+         */
+        wait_for_kprobe_optimizer();
         if (warn)
                 pr_cont("NG: Some tests are failed. Please check them.\n");
         else
diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c
index 71e85643b3f9..6ad3e043c617 100644
--- a/net/9p/trans_xen.c
+++ b/net/9p/trans_xen.c
@@ -454,8 +454,8 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,
                         goto error_xenbus;
         }
         priv->tag = xenbus_read(xbt, dev->nodename, "tag", NULL);
-        if (!priv->tag) {
-                ret = -EINVAL;
+        if (IS_ERR(priv->tag)) {
+                ret = PTR_ERR(priv->tag);
                 goto error_xenbus;
         }
         ret = xenbus_transaction_end(xbt, 0);
@@ -525,7 +525,7 @@ static struct xenbus_driver xen_9pfs_front_driver = {
         .otherend_changed = xen_9pfs_front_changed,
 };
 
-int p9_trans_xen_init(void)
+static int p9_trans_xen_init(void)
 {
         if (!xen_domain())
                 return -ENODEV;
@@ -537,7 +537,7 @@ int p9_trans_xen_init(void)
 }
 module_init(p9_trans_xen_init);
 
-void p9_trans_xen_exit(void)
+static void p9_trans_xen_exit(void)
 {
         v9fs_unregister_trans(&p9_xen_trans);
         return xenbus_unregister_driver(&xen_9pfs_front_driver);
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index a05027027513..4efd5d54498a 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -173,6 +173,7 @@ static void br_stp_start(struct net_bridge *br)
                 br_debug(br, "using kernel STP\n");
 
                 /* To start timers on any ports left in blocking */
+                mod_timer(&br->hello_timer, jiffies + br->hello_time);
                 br_port_state_selection(br);
         }
 
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index c98b3e5c140a..60b6fe277a8b 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -40,7 +40,7 @@ static void br_hello_timer_expired(unsigned long arg)
         if (br->dev->flags & IFF_UP) {
                 br_config_bpdu_generation(br);
 
-                if (br->stp_enabled != BR_USER_STP)
+                if (br->stp_enabled == BR_KERNEL_STP)
                         mod_timer(&br->hello_timer,
                                   round_jiffies(jiffies + br->hello_time));
         }
diff --git a/net/bridge/netfilter/ebt_arpreply.c b/net/bridge/netfilter/ebt_arpreply.c
index 5929309beaa1..db85230e49c3 100644
--- a/net/bridge/netfilter/ebt_arpreply.c
+++ b/net/bridge/netfilter/ebt_arpreply.c
@@ -68,6 +68,9 @@ static int ebt_arpreply_tg_check(const struct xt_tgchk_param *par)
         if (e->ethproto != htons(ETH_P_ARP) ||
             e->invflags & EBT_IPROTO)
                 return -EINVAL;
+        if (ebt_invalid_target(info->target))
+                return -EINVAL;
+
         return 0;
 }
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 9ec0c9f908fa..9c6e619f452b 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1373,7 +1373,8 @@ static inline int ebt_obj_to_user(char __user *um, const char *_name,
         strlcpy(name, _name, sizeof(name));
         if (copy_to_user(um, name, EBT_FUNCTION_MAXNAMELEN) ||
             put_user(datasize, (int __user *)(um + EBT_FUNCTION_MAXNAMELEN)) ||
-            xt_data_to_user(um + entrysize, data, usersize, datasize))
+            xt_data_to_user(um + entrysize, data, usersize, datasize,
+                            XT_ALIGN(datasize)))
                 return -EFAULT;
 
         return 0;
@@ -1658,7 +1659,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr,
                 if (match->compat_to_user(cm->data, m->data))
                         return -EFAULT;
         } else {
-                if (xt_data_to_user(cm->data, m->data, match->usersize, msize))
+                if (xt_data_to_user(cm->data, m->data, match->usersize, msize,
+                                    COMPAT_XT_ALIGN(msize)))
                         return -EFAULT;
         }
 
@@ -1687,7 +1689,8 @@ static int compat_target_to_user(struct ebt_entry_target *t,
                 if (target->compat_to_user(cm->data, t->data))
                         return -EFAULT;
         } else {
-                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize))
+                if (xt_data_to_user(cm->data, t->data, target->usersize, tsize,
+                                    COMPAT_XT_ALIGN(tsize)))
                         return -EFAULT;
         }
 
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index d54345a06f72..ae96e6f3e0cb 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -641,6 +641,32 @@ void arp_xmit(struct sk_buff *skb)
 }
 EXPORT_SYMBOL(arp_xmit);
 
+static bool arp_is_garp(struct net *net, struct net_device *dev,
+                        int *addr_type, __be16 ar_op,
+                        __be32 sip, __be32 tip,
+                        unsigned char *sha, unsigned char *tha)
+{
+        bool is_garp = tip == sip;
+
+        /* Gratuitous ARP _replies_ also require target hwaddr to be
+         * the same as source.
+         */
+        if (is_garp && ar_op == htons(ARPOP_REPLY))
+                is_garp =
+                        /* IPv4 over IEEE 1394 doesn't provide target
+                         * hardware address field in its ARP payload.
+                         */
+                        tha &&
+                        !memcmp(tha, sha, dev->addr_len);
+
+        if (is_garp) {
+                *addr_type = inet_addr_type_dev_table(net, dev, sip);
+                if (*addr_type != RTN_UNICAST)
+                        is_garp = false;
+        }
+        return is_garp;
+}
+
 /*
  *      Process an arp request.
  */
@@ -837,29 +863,25 @@ static int arp_process(struct net *net, struct sock *sk, struct sk_buff *skb)
 
         n = __neigh_lookup(&arp_tbl, &sip, dev, 0);
 
-        if (IN_DEV_ARP_ACCEPT(in_dev)) {
-                unsigned int addr_type = inet_addr_type_dev_table(net, dev, sip);
+        if (n || IN_DEV_ARP_ACCEPT(in_dev)) {
+                addr_type = -1;
+                is_garp = arp_is_garp(net, dev, &addr_type, arp->ar_op,
+                                      sip, tip, sha, tha);
+        }
 
+        if (IN_DEV_ARP_ACCEPT(in_dev)) {
                 /* Unsolicited ARP is not accepted by default.
                    It is possible, that this option should be enabled for some
                    devices (strip is candidate)
                  */
-                is_garp = tip == sip && addr_type == RTN_UNICAST;
-
-                /* Unsolicited ARP _replies_ also require target hwaddr to be
-                 * the same as source.
-                 */
-                if (is_garp && arp->ar_op == htons(ARPOP_REPLY))
-                        is_garp =
-                                /* IPv4 over IEEE 1394 doesn't provide target
-                                 * hardware address field in its ARP payload.
-                                 */
-                                tha &&
-                                !memcmp(tha, sha, dev->addr_len);
-
                 if (!n &&
-                    ((arp->ar_op == htons(ARPOP_REPLY)  &&
-                                addr_type == RTN_UNICAST) || is_garp))
+                    (is_garp ||
+                     (arp->ar_op == htons(ARPOP_REPLY) &&
+                      (addr_type == RTN_UNICAST ||
+                       (addr_type < 0 &&
+                        /* postpone calculation to as late as possible */
+                        inet_addr_type_dev_table(net, dev, sip) ==
+                                RTN_UNICAST)))))
                         n = __neigh_lookup(&arp_tbl, &sip, dev, 1);
         }
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9a56077eafea..aaf663a1e571 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2320,6 +2320,10 @@ int tcp_disconnect(struct sock *sk, int flags)
         tcp_set_ca_state(sk, TCP_CA_Open);
         tcp_clear_retrans(tp);
         inet_csk_delack_init(sk);
+        /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+         * issue in __tcp_select_window()
+         */
+        icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
         tcp_init_send_head(sk);
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d4a31becbd25..bf8a58a1c32d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1466,6 +1466,11 @@ alloc_new_skb:
                          */
                         alloclen += sizeof(struct frag_hdr);
 
+                        copy = datalen - transhdrlen - fraggap;
+                        if (copy < 0) {
+                                err = -EINVAL;
+                                goto error;
+                        }
                         if (transhdrlen) {
                                 skb = sock_alloc_send_skb(sk,
                                                 alloclen + hh_len,
@@ -1515,13 +1520,9 @@ alloc_new_skb:
                                 data += fraggap;
                                 pskb_trim_unique(skb_prev, maxfraglen);
                         }
-                        copy = datalen - transhdrlen - fraggap;
-
-                        if (copy < 0) {
-                                err = -EINVAL;
-                                kfree_skb(skb);
-                                goto error;
-                        } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
+                        if (copy > 0 &&
+                            getfrag(from, data + transhdrlen, offset,
+                                    copy, fraggap, skb) < 0) {
                                 err = -EFAULT;
                                 kfree_skb(skb);
                                 goto error;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d2d7bdf1d510..ad99c1ceea6f 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -849,10 +849,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
 {
         unsigned int verdict = NF_DROP;
 
-        if (IP_VS_FWD_METHOD(cp) != 0) {
-                pr_err("shouldn't reach here, because the box is on the "
-                       "half connection in the tun/dr module.\n");
-        }
+        if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                goto ignore_cp;
 
         /* Ensure the checksum is correct */
         if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) {
@@ -886,6 +884,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
                 ip_vs_notrack(skb);
         else
                 ip_vs_update_conntrack(skb, cp, 0);
+
+ignore_cp:
         verdict = NF_ACCEPT;
 
 out:
@@ -1385,8 +1385,11 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
          */
         cp = pp->conn_out_get(ipvs, af, skb, &iph);
 
-        if (likely(cp))
+        if (likely(cp)) {
+                if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ)
+                        goto ignore_cp;
                 return handle_response(af, skb, pd, cp, &iph, hooknum);
+        }
 
         /* Check for real-server-started requests */
         if (atomic_read(&ipvs->conn_out_counter)) {
@@ -1444,9 +1447,15 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in
                         }
                 }
         }
+
+out:
         IP_VS_DBG_PKT(12, af, pp, skb, iph.off,
                       "ip_vs_out: packet continues traversal as normal");
         return NF_ACCEPT;
+
+ignore_cp:
+        __ip_vs_conn_put(cp);
+        goto out;
 }
 
 /*
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 3a60efa7799b..7f6100ca63be 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -174,6 +174,10 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 #endif
         if (h != NULL && !try_module_get(h->me))
                 h = NULL;
+        if (h != NULL && !refcount_inc_not_zero(&h->refcnt)) {
+                module_put(h->me);
+                h = NULL;
+        }
 
         rcu_read_unlock();
 
@@ -181,6 +185,13 @@ nf_conntrack_helper_try_module_get(const char *name, u16 l3num, u8 protonum)
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_helper_try_module_get);
 
+void nf_conntrack_helper_put(struct nf_conntrack_helper *helper)
+{
+        refcount_dec(&helper->refcnt);
+        module_put(helper->me);
+}
+EXPORT_SYMBOL_GPL(nf_conntrack_helper_put);
+
 struct nf_conn_help *
 nf_ct_helper_ext_add(struct nf_conn *ct,
                      struct nf_conntrack_helper *helper, gfp_t gfp)
@@ -417,6 +428,7 @@ int nf_conntrack_helper_register(struct nf_conntrack_helper *me)
                         }
                 }
         }
+        refcount_set(&me->refcnt, 1);
         hlist_add_head_rcu(&me->hnode, &nf_ct_helper_hash[h]);
         nf_ct_helper_count++;
 out:
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index dcf561b5c97a..9799a50bc604 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -45,6 +45,8 @@
 #include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/nf_conntrack_timestamp.h>
 #include <net/netfilter/nf_conntrack_labels.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #ifdef CONFIG_NF_NAT_NEEDED
 #include <net/netfilter/nf_nat_core.h>
 #include <net/netfilter/nf_nat_l4proto.h>
@@ -1007,9 +1009,8 @@ static const struct nla_policy tuple_nla_policy[CTA_TUPLE_MAX+1] = {
 
 static int
 ctnetlink_parse_tuple(const struct nlattr * const cda[],
-                      struct nf_conntrack_tuple *tuple,
-                      enum ctattr_type type, u_int8_t l3num,
-                      struct nf_conntrack_zone *zone)
+                      struct nf_conntrack_tuple *tuple, u32 type,
+                      u_int8_t l3num, struct nf_conntrack_zone *zone)
 {
         struct nlattr *tb[CTA_TUPLE_MAX+1];
         int err;
@@ -1828,6 +1829,8 @@ ctnetlink_create_conntrack(struct net *net,
         nf_ct_tstamp_ext_add(ct, GFP_ATOMIC);
         nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC);
         nf_ct_labels_ext_add(ct);
+        nfct_seqadj_ext_add(ct);
+        nfct_synproxy_ext_add(ct);
 
         /* we must add conntrack extensions before confirmation. */
         ct->status |= IPS_CONFIRMED;
@@ -2447,7 +2450,7 @@ static struct nfnl_ct_hook ctnetlink_glue_hook = {
 
 static int ctnetlink_exp_dump_tuple(struct sk_buff *skb,
                                     const struct nf_conntrack_tuple *tuple,
-                                    enum ctattr_expect type)
+                                    u32 type)
 {
         struct nlattr *nest_parms;
 
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index b48d6b5aae8a..ef0be325a0c6 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -409,6 +409,10 @@ nf_nat_setup_info(struct nf_conn *ct,
 {
         struct nf_conntrack_tuple curr_tuple, new_tuple;
 
+        /* Can't setup nat info for confirmed ct. */
+        if (nf_ct_is_confirmed(ct))
+                return NF_ACCEPT;
+
         NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
                      maniptype == NF_NAT_MANIP_DST);
         BUG_ON(nf_nat_initialized(ct, maniptype));
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 559225029740..da314be0c048 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -3367,35 +3367,50 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
         return nf_tables_fill_setelem(args->skb, set, elem);
 }
 
+struct nft_set_dump_ctx {
+        const struct nft_set    *set;
+        struct nft_ctx          ctx;
+};
+
 static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 {
+        struct nft_set_dump_ctx *dump_ctx = cb->data;
         struct net *net = sock_net(skb->sk);
-        u8 genmask = nft_genmask_cur(net);
+        struct nft_af_info *afi;
+        struct nft_table *table;
         struct nft_set *set;
         struct nft_set_dump_args args;
-        struct nft_ctx ctx;
-        struct nlattr *nla[NFTA_SET_ELEM_LIST_MAX + 1];
+        bool set_found = false;
         struct nfgenmsg *nfmsg;
         struct nlmsghdr *nlh;
         struct nlattr *nest;
         u32 portid, seq;
-        int event, err;
+        int event;
 
-        err = nlmsg_parse(cb->nlh, sizeof(struct nfgenmsg), nla,
-                          NFTA_SET_ELEM_LIST_MAX, nft_set_elem_list_policy,
-                          NULL);
-        if (err < 0)
-                return err;
+        rcu_read_lock();
+        list_for_each_entry_rcu(afi, &net->nft.af_info, list) {
+                if (afi != dump_ctx->ctx.afi)
+                        continue;
 
-        err = nft_ctx_init_from_elemattr(&ctx, net, cb->skb, cb->nlh,
-                                         (void *)nla, genmask);
-        if (err < 0)
-                return err;
+                list_for_each_entry_rcu(table, &afi->tables, list) {
+                        if (table != dump_ctx->ctx.table)
+                                continue;
 
-        set = nf_tables_set_lookup(ctx.table, nla[NFTA_SET_ELEM_LIST_SET],
-                                   genmask);
-        if (IS_ERR(set))
-                return PTR_ERR(set);
+                        list_for_each_entry_rcu(set, &table->sets, list) {
+                                if (set == dump_ctx->set) {
+                                        set_found = true;
+                                        break;
+                                }
+                        }
+                        break;
+                }
+                break;
+        }
+
+        if (!set_found) {
+                rcu_read_unlock();
+                return -ENOENT;
+        }
 
         event  = nfnl_msg_type(NFNL_SUBSYS_NFTABLES, NFT_MSG_NEWSETELEM);
         portid = NETLINK_CB(cb->skb).portid;
@@ -3407,11 +3422,11 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
                 goto nla_put_failure;
 
         nfmsg = nlmsg_data(nlh);
-        nfmsg->nfgen_family = ctx.afi->family;
+        nfmsg->nfgen_family = afi->family;
         nfmsg->version      = NFNETLINK_V0;
-        nfmsg->res_id       = htons(ctx.net->nft.base_seq & 0xffff);
+        nfmsg->res_id       = htons(net->nft.base_seq & 0xffff);
 
-        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, ctx.table->name))
+        if (nla_put_string(skb, NFTA_SET_ELEM_LIST_TABLE, table->name))
                 goto nla_put_failure;
         if (nla_put_string(skb, NFTA_SET_ELEM_LIST_SET, set->name))
                 goto nla_put_failure;
@@ -3422,12 +3437,13 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
 
         args.cb                 = cb;
         args.skb                = skb;
-        args.iter.genmask       = nft_genmask_cur(ctx.net);
+        args.iter.genmask       = nft_genmask_cur(net);
         args.iter.skip          = cb->args[0];
         args.iter.count         = 0;
         args.iter.err           = 0;
         args.iter.fn            = nf_tables_dump_setelem;
-        set->ops->walk(&ctx, set, &args.iter);
+        set->ops->walk(&dump_ctx->ctx, set, &args.iter);
+        rcu_read_unlock();
 
         nla_nest_end(skb, nest);
         nlmsg_end(skb, nlh);
@@ -3441,9 +3457,16 @@ static int nf_tables_dump_set(struct sk_buff *skb, struct netlink_callback *cb)
         return skb->len;
 
 nla_put_failure:
+        rcu_read_unlock();
         return -ENOSPC;
 }
 
+static int nf_tables_dump_set_done(struct netlink_callback *cb)
+{
+        kfree(cb->data);
+        return 0;
+}
+
 static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
                                 struct sk_buff *skb, const struct nlmsghdr *nlh,
                                 const struct nlattr * const nla[])
@@ -3465,7 +3488,18 @@ static int nf_tables_getsetelem(struct net *net, struct sock *nlsk,
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct netlink_dump_control c = {
                         .dump = nf_tables_dump_set,
+                        .done = nf_tables_dump_set_done,
                 };
+                struct nft_set_dump_ctx *dump_ctx;
+
+                dump_ctx = kmalloc(sizeof(*dump_ctx), GFP_KERNEL);
+                if (!dump_ctx)
+                        return -ENOMEM;
+
+                dump_ctx->set = set;
+                dump_ctx->ctx = ctx;
+
+                c.data = dump_ctx;
                 return netlink_dump_start(nlsk, skb, nlh, &c);
         }
         return -EOPNOTSUPP;
@@ -3593,9 +3627,9 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 {
         struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
 
-        nft_data_uninit(nft_set_ext_key(ext), NFT_DATA_VALUE);
+        nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
         if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
-                nft_data_uninit(nft_set_ext_data(ext), set->dtype);
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
         if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
                 nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
         if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
@@ -3604,6 +3638,18 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 }
 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
 
+/* Only called from commit path, nft_set_elem_deactivate() already deals with
+ * the refcounting from the preparation phase.
+ */
+static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
+{
+        struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
+                nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+        kfree(elem);
+}
+
 static int nft_setelem_parse_flags(const struct nft_set *set,
                                    const struct nlattr *attr, u32 *flags)
 {
@@ -3815,9 +3861,9 @@ err4:
         kfree(elem.priv);
 err3:
         if (nla[NFTA_SET_ELEM_DATA] != NULL)
-                nft_data_uninit(&data, d2.type);
+                nft_data_release(&data, d2.type);
 err2:
-        nft_data_uninit(&elem.key.val, d1.type);
+        nft_data_release(&elem.key.val, d1.type);
 err1:
         return err;
 }
@@ -3862,6 +3908,53 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk,
         return err;
 }
 
+/**
+ *      nft_data_hold - hold a nft_data item
+ *
+ *      @data: struct nft_data to release
+ *      @type: type of data
+ *
+ *      Hold a nft_data item. NFT_DATA_VALUE types can be silently discarded,
+ *      NFT_DATA_VERDICT bumps the reference to chains in case of NFT_JUMP and
+ *      NFT_GOTO verdicts. This function must be called on active data objects
+ *      from the second phase of the commit protocol.
+ */
+static void nft_data_hold(const struct nft_data *data, enum nft_data_types type)
+{
+        if (type == NFT_DATA_VERDICT) {
+                switch (data->verdict.code) {
+                case NFT_JUMP:
+                case NFT_GOTO:
+                        data->verdict.chain->use++;
+                        break;
+                }
+        }
+}
+
+static void nft_set_elem_activate(const struct net *net,
+                                  const struct nft_set *set,
+                                  struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_hold(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use++;
+}
+
+static void nft_set_elem_deactivate(const struct net *net,
+                                    const struct nft_set *set,
+                                    struct nft_set_elem *elem)
+{
+        const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
+
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
+                nft_data_release(nft_set_ext_data(ext), set->dtype);
+        if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
+                (*nft_set_ext_obj(ext))->use--;
+}
+
 static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
                            const struct nlattr *attr)
 {
@@ -3927,6 +4020,8 @@ static int nft_del_setelem(struct nft_ctx *ctx, struct nft_set *set,
         kfree(elem.priv);
         elem.priv = priv;
 
+        nft_set_elem_deactivate(ctx->net, set, &elem);
+
         nft_trans_elem(trans) = elem;
         list_add_tail(&trans->list, &ctx->net->nft.commit_list);
         return 0;
@@ -3936,7 +4031,7 @@ err4:
 err3:
         kfree(elem.priv);
 err2:
-        nft_data_uninit(&elem.key.val, desc.type);
+        nft_data_release(&elem.key.val, desc.type);
 err1:
         return err;
 }
@@ -4743,8 +4838,8 @@ static void nf_tables_commit_release(struct nft_trans *trans)
                 nft_set_destroy(nft_trans_set(trans));
                 break;
         case NFT_MSG_DELSETELEM:
-                nft_set_elem_destroy(nft_trans_elem_set(trans),
-                                     nft_trans_elem(trans).priv, true);
+                nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
+                                           nft_trans_elem(trans).priv);
                 break;
         case NFT_MSG_DELOBJ:
                 nft_obj_destroy(nft_trans_obj(trans));
@@ -4979,6 +5074,7 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb)
                 case NFT_MSG_DELSETELEM:
                         te = (struct nft_trans_elem *)trans->data;
 
+                        nft_set_elem_activate(net, te->set, &te->elem);
                         te->set->ops->activate(net, te->set, &te->elem);
                         te->set->ndeact--;
 
@@ -5464,7 +5560,7 @@ int nft_data_init(const struct nft_ctx *ctx,
 EXPORT_SYMBOL_GPL(nft_data_init);
 
 /**
- *      nft_data_uninit - release a nft_data item
+ *      nft_data_release - release a nft_data item
  *
  *      @data: struct nft_data to release
  *      @type: type of data
@@ -5472,7 +5568,7 @@ EXPORT_SYMBOL_GPL(nft_data_init);
  *      Release a nft_data item. NFT_DATA_VALUE types can be silently discarded,
  *      all others need to be released by calling this function.
  */
-void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
+void nft_data_release(const struct nft_data *data, enum nft_data_types type)
 {
         if (type < NFT_DATA_VERDICT)
                 return;
@@ -5483,7 +5579,7 @@ void nft_data_uninit(const struct nft_data *data, enum nft_data_types type)
                 WARN_ON(1);
         }
 }
-EXPORT_SYMBOL_GPL(nft_data_uninit);
+EXPORT_SYMBOL_GPL(nft_data_release);
 
 int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data,
                   enum nft_data_types type, unsigned int len)
diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index 950bf6eadc65..be678a323598 100644
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -686,6 +686,7 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                 tuple_set = true;
         }
 
+        ret = -ENOENT;
         list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) {
                 cur = &nlcth->helper;
                 j++;
@@ -699,16 +700,20 @@ static int nfnl_cthelper_del(struct net *net, struct sock *nfnl,
                      tuple.dst.protonum != cur->tuple.dst.protonum))
                         continue;
 
-                found = true;
-                nf_conntrack_helper_unregister(cur);
-                kfree(cur->expect_policy);
+                if (refcount_dec_if_one(&cur->refcnt)) {
+                        found = true;
+                        nf_conntrack_helper_unregister(cur);
+                        kfree(cur->expect_policy);
 
-                list_del(&nlcth->list);
-                kfree(nlcth);
+                        list_del(&nlcth->list);
+                        kfree(nlcth);
+                } else {
+                        ret = -EBUSY;
+                }
         }
 
         /* Make sure we return success if we flush and there is no helpers */
-        return (found || j == 0) ? 0 : -ENOENT;
+        return (found || j == 0) ? 0 : ret;
 }
 
 static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = {
diff --git a/net/netfilter/nft_bitwise.c b/net/netfilter/nft_bitwise.c
index 877d9acd91ef..fff8073e2a56 100644
--- a/net/netfilter/nft_bitwise.c
+++ b/net/netfilter/nft_bitwise.c
@@ -83,17 +83,26 @@ static int nft_bitwise_init(const struct nft_ctx *ctx,
                             tb[NFTA_BITWISE_MASK]);
         if (err < 0)
                 return err;
-        if (d1.len != priv->len)
-                return -EINVAL;
+        if (d1.len != priv->len) {
+                err = -EINVAL;
+                goto err1;
+        }
 
         err = nft_data_init(NULL, &priv->xor, sizeof(priv->xor), &d2,
                             tb[NFTA_BITWISE_XOR]);
         if (err < 0)
-                return err;
-        if (d2.len != priv->len)
-                return -EINVAL;
+                goto err1;
+        if (d2.len != priv->len) {
+                err = -EINVAL;
+                goto err2;
+        }
 
         return 0;
+err2:
+        nft_data_release(&priv->xor, d2.type);
+err1:
+        nft_data_release(&priv->mask, d1.type);
+        return err;
 }
 
 static int nft_bitwise_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
index 2b96effeadc1..c2945eb3397c 100644
--- a/net/netfilter/nft_cmp.c
+++ b/net/netfilter/nft_cmp.c
@@ -201,10 +201,18 @@ nft_cmp_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[])
         if (err < 0)
                 return ERR_PTR(err);
 
+        if (desc.type != NFT_DATA_VALUE) {
+                err = -EINVAL;
+                goto err1;
+        }
+
         if (desc.len <= sizeof(u32) && op == NFT_CMP_EQ)
                 return &nft_cmp_fast_ops;
-        else
-                return &nft_cmp_ops;
+
+        return &nft_cmp_ops;
+err1:
+        nft_data_release(&data, desc.type);
+        return ERR_PTR(-EINVAL);
 }
 
 struct nft_expr_type nft_cmp_type __read_mostly = {
diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index a34ceb38fc55..1678e9e75e8e 100644
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -826,9 +826,9 @@ static void nft_ct_helper_obj_destroy(struct nft_object *obj)
         struct nft_ct_helper_obj *priv = nft_obj_data(obj);
 
         if (priv->helper4)
-                module_put(priv->helper4->me);
+                nf_conntrack_helper_put(priv->helper4);
         if (priv->helper6)
-                module_put(priv->helper6->me);
+                nf_conntrack_helper_put(priv->helper6);
 }
 
 static void nft_ct_helper_obj_eval(struct nft_object *obj,
diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c
index 728baf88295a..4717d7796927 100644
--- a/net/netfilter/nft_immediate.c
+++ b/net/netfilter/nft_immediate.c
@@ -65,7 +65,7 @@ static int nft_immediate_init(const struct nft_ctx *ctx,
         return 0;
 
 err1:
-        nft_data_uninit(&priv->data, desc.type);
+        nft_data_release(&priv->data, desc.type);
         return err;
 }
 
@@ -73,7 +73,8 @@ static void nft_immediate_destroy(const struct nft_ctx *ctx,
                                   const struct nft_expr *expr)
 {
         const struct nft_immediate_expr *priv = nft_expr_priv(expr);
-        return nft_data_uninit(&priv->data, nft_dreg_to_type(priv->dreg));
+
+        return nft_data_release(&priv->data, nft_dreg_to_type(priv->dreg));
 }
 
 static int nft_immediate_dump(struct sk_buff *skb, const struct nft_expr *expr)
diff --git a/net/netfilter/nft_range.c b/net/netfilter/nft_range.c
index 9edc74eedc10..cedb96c3619f 100644
--- a/net/netfilter/nft_range.c
+++ b/net/netfilter/nft_range.c
@@ -102,9 +102,9 @@ static int nft_range_init(const struct nft_ctx *ctx, const struct nft_expr *expr
         priv->len = desc_from.len;
         return 0;
 err2:
-        nft_data_uninit(&priv->data_to, desc_to.type);
+        nft_data_release(&priv->data_to, desc_to.type);
 err1:
-        nft_data_uninit(&priv->data_from, desc_from.type);
+        nft_data_release(&priv->data_from, desc_from.type);
         return err;
 }
 
diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index 8ec086b6b56b..3d3a6df4ce70 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c
@@ -222,7 +222,7 @@ static void nft_hash_walk(const struct nft_ctx *ctx, struct nft_set *set,
         struct nft_set_elem elem;
         int err;
 
-        err = rhashtable_walk_init(&priv->ht, &hti, GFP_KERNEL);
+        err = rhashtable_walk_init(&priv->ht, &hti, GFP_ATOMIC);
         iter->err = err;
         if (err)
                 return;
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8876b7da6884..1770c1d9b37f 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -283,28 +283,30 @@ static int xt_obj_to_user(u16 __user *psize, u16 size,
                        &U->u.user.revision, K->u.kernel.TYPE->revision)
 
 int xt_data_to_user(void __user *dst, const void *src,
-                    int usersize, int size)
+                    int usersize, int size, int aligned_size)
 {
         usersize = usersize ? : size;
         if (copy_to_user(dst, src, usersize))
                 return -EFAULT;
-        if (usersize != size && clear_user(dst + usersize, size - usersize))
+        if (usersize != aligned_size &&
+            clear_user(dst + usersize, aligned_size - usersize))
                 return -EFAULT;
 
         return 0;
 }
 EXPORT_SYMBOL_GPL(xt_data_to_user);
 
-#define XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                             \
+#define XT_DATA_TO_USER(U, K, TYPE)                                     \
         xt_data_to_user(U->data, K->data,                               \
                         K->u.kernel.TYPE->usersize,                     \
-                        C_SIZE ? : K->u.kernel.TYPE->TYPE##size)
+                        K->u.kernel.TYPE->TYPE##size,                   \
+                        XT_ALIGN(K->u.kernel.TYPE->TYPE##size))
 
 int xt_match_to_user(const struct xt_entry_match *m,
                      struct xt_entry_match __user *u)
 {
         return XT_OBJ_TO_USER(u, m, match, 0) ||
-               XT_DATA_TO_USER(u, m, match, 0);
+               XT_DATA_TO_USER(u, m, match);
 }
 EXPORT_SYMBOL_GPL(xt_match_to_user);
 
@@ -312,7 +314,7 @@ int xt_target_to_user(const struct xt_entry_target *t,
                       struct xt_entry_target __user *u)
 {
         return XT_OBJ_TO_USER(u, t, target, 0) ||
-               XT_DATA_TO_USER(u, t, target, 0);
+               XT_DATA_TO_USER(u, t, target);
 }
 EXPORT_SYMBOL_GPL(xt_target_to_user);
 
@@ -611,6 +613,12 @@ void xt_compat_match_from_user(struct xt_entry_match *m, void **dstptr,
 }
 EXPORT_SYMBOL_GPL(xt_compat_match_from_user);
 
+#define COMPAT_XT_DATA_TO_USER(U, K, TYPE, C_SIZE)                      \
+        xt_data_to_user(U->data, K->data,                               \
+                        K->u.kernel.TYPE->usersize,                     \
+                        C_SIZE,                                         \
+                        COMPAT_XT_ALIGN(C_SIZE))
+
 int xt_compat_match_to_user(const struct xt_entry_match *m,
                             void __user **dstptr, unsigned int *size)
 {
@@ -626,7 +634,7 @@ int xt_compat_match_to_user(const struct xt_entry_match *m,
                 if (match->compat_to_user((void __user *)cm->data, m->data))
                         return -EFAULT;
         } else {
-                if (XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
+                if (COMPAT_XT_DATA_TO_USER(cm, m, match, msize - sizeof(*cm)))
                         return -EFAULT;
         }
 
@@ -972,7 +980,7 @@ int xt_compat_target_to_user(const struct xt_entry_target *t,
                 if (target->compat_to_user((void __user *)ct->data, t->data))
                         return -EFAULT;
         } else {
-                if (XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
+                if (COMPAT_XT_DATA_TO_USER(ct, t, target, tsize - sizeof(*ct)))
                         return -EFAULT;
         }
 
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index bb7ad82dcd56..623ef37de886 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -96,7 +96,7 @@ xt_ct_set_helper(struct nf_conn *ct, const char *helper_name,
 
         help = nf_ct_helper_ext_add(ct, helper, GFP_KERNEL);
         if (help == NULL) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                 return -ENOMEM;
         }
 
@@ -263,7 +263,7 @@ out:
 err4:
         help = nfct_help(ct);
         if (help)
-                module_put(help->helper->me);
+                nf_conntrack_helper_put(help->helper);
 err3:
         nf_ct_tmpl_free(ct);
 err2:
@@ -346,7 +346,7 @@ static void xt_ct_tg_destroy(const struct xt_tgdtor_param *par,
         if (ct) {
                 help = nfct_help(ct);
                 if (help)
-                        module_put(help->helper->me);
+                        nf_conntrack_helper_put(help->helper);
 
                 nf_ct_netns_put(par->net, par->family);
 
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index bf602e33c40a..08679ebb3068 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1123,7 +1123,7 @@ static int ovs_ct_add_helper(struct ovs_conntrack_info *info, const char *name,
 
         help = nf_ct_helper_ext_add(info->ct, helper, GFP_KERNEL);
         if (!help) {
-                module_put(helper->me);
+                nf_conntrack_helper_put(helper);
                 return -ENOMEM;
         }
 
@@ -1584,7 +1584,7 @@ void ovs_ct_free_action(const struct nlattr *a)
 static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info)
 {
         if (ct_info->helper)
-                module_put(ct_info->helper->me);
+                nf_conntrack_helper_put(ct_info->helper);
         if (ct_info->ct)
                 nf_ct_tmpl_free(ct_info->ct);
 }
diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c
index dee469fed967..51859b8edd7e 100644
--- a/net/sched/cls_matchall.c
+++ b/net/sched/cls_matchall.c
@@ -203,7 +203,6 @@ static int mall_change(struct net *net, struct sk_buff *in_skb,
 
         *arg = (unsigned long) head;
         rcu_assign_pointer(tp->root, new);
-        call_rcu(&head->rcu, mall_destroy_rcu);
         return 0;
 
 err_replace_hw_filter:
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 6f7f6757ceef..dfc8c51e4d74 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1540,8 +1540,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
         long timeout;
         int err;
         struct vsock_transport_send_notify_data send_data;
-
-        DEFINE_WAIT(wait);
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
 
         sk = sock->sk;
         vsk = vsock_sk(sk);
@@ -1584,11 +1583,10 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
         if (err < 0)
                 goto out;
 
-
         while (total_written < len) {
                 ssize_t written;
 
-                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+                add_wait_queue(sk_sleep(sk), &wait);
                 while (vsock_stream_has_space(vsk) == 0 &&
                        sk->sk_err == 0 &&
                        !(sk->sk_shutdown & SEND_SHUTDOWN) &&
@@ -1597,33 +1595,30 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg,
                         /* Don't wait for non-blocking sockets. */
                         if (timeout == 0) {
                                 err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
 
                         err = transport->notify_send_pre_block(vsk, &send_data);
                         if (err < 0) {
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
 
                         release_sock(sk);
-                        timeout = schedule_timeout(timeout);
+                        timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
                         lock_sock(sk);
                         if (signal_pending(current)) {
                                 err = sock_intr_errno(timeout);
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         } else if (timeout == 0) {
                                 err = -EAGAIN;
-                                finish_wait(sk_sleep(sk), &wait);
+                                remove_wait_queue(sk_sleep(sk), &wait);
                                 goto out_err;
                         }
-
-                        prepare_to_wait(sk_sleep(sk), &wait,
-                                        TASK_INTERRUPTIBLE);
                 }
-                finish_wait(sk_sleep(sk), &wait);
+                remove_wait_queue(sk_sleep(sk), &wait);
 
                 /* These checks occur both as part of and after the loop
                  * conditional since we need to check before and after
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 6dc1eda13b8e..58c05e5d9870 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -175,7 +175,7 @@ ld_flags       = $(LDFLAGS) $(ldflags-y)
 
 dtc_cpp_flags  = -Wp,-MD,$(depfile).pre.tmp -nostdinc                    \
                  -I$(srctree)/arch/$(SRCARCH)/boot/dts                   \
-                 -I$(srctree)/arch/$(SRCARCH)/boot/dts/include           \
+                 -I$(srctree)/scripts/dtc/include-prefixes               \
                  -I$(srctree)/drivers/of/testcase-data                   \
                  -undef -D__DTS__
 
diff --git a/scripts/dtc/checks.c b/scripts/dtc/checks.c
index 5adfc8f52b4f..4b72b530c84f 100644
--- a/scripts/dtc/checks.c
+++ b/scripts/dtc/checks.c
@@ -873,7 +873,7 @@ static void check_simple_bus_reg(struct check *c, struct dt_info *dti, struct no
         while (size--)
                 reg = (reg << 32) | fdt32_to_cpu(*(cells++));
 
-        snprintf(unit_addr, sizeof(unit_addr), "%lx", reg);
+        snprintf(unit_addr, sizeof(unit_addr), "%zx", reg);
         if (!streq(unitname, unit_addr))
                 FAIL(c, dti, "Node %s simple-bus unit address format error, expected \"%s\"",
                      node->fullpath, unit_addr);
diff --git a/scripts/dtc/include-prefixes/arc b/scripts/dtc/include-prefixes/arc
new file mode 120000
index 000000000000..5d21b5a69a11
--- /dev/null
+++ b/scripts/dtc/include-prefixes/arc
@@ -0,0 +1 @@
+../../../arch/arc/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/arm b/scripts/dtc/include-prefixes/arm
new file mode 120000
index 000000000000..eb14d4515a57
--- /dev/null
+++ b/scripts/dtc/include-prefixes/arm
@@ -0,0 +1 @@
+../../../arch/arm/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/arm64 b/scripts/dtc/include-prefixes/arm64
new file mode 120000
index 000000000000..275c42c21d71
--- /dev/null
+++ b/scripts/dtc/include-prefixes/arm64
@@ -0,0 +1 @@
+../../../arch/arm64/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/c6x b/scripts/dtc/include-prefixes/c6x
new file mode 120000
index 000000000000..49ded4cae2be
--- /dev/null
+++ b/scripts/dtc/include-prefixes/c6x
@@ -0,0 +1 @@
+../../../arch/c6x/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/cris b/scripts/dtc/include-prefixes/cris
new file mode 120000
index 000000000000..736d998ba506
--- /dev/null
+++ b/scripts/dtc/include-prefixes/cris
@@ -0,0 +1 @@
+../../../arch/cris/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/dt-bindings b/scripts/dtc/include-prefixes/dt-bindings
new file mode 120000
index 000000000000..04fdbb3af016
--- /dev/null
+++ b/scripts/dtc/include-prefixes/dt-bindings
@@ -0,0 +1 @@
+../../../include/dt-bindings
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/h8300 b/scripts/dtc/include-prefixes/h8300
new file mode 120000
index 000000000000..3bdaa332c54c
--- /dev/null
+++ b/scripts/dtc/include-prefixes/h8300
@@ -0,0 +1 @@
+../../../arch/h8300/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/metag b/scripts/dtc/include-prefixes/metag
new file mode 120000
index 000000000000..87a3c847db8f
--- /dev/null
+++ b/scripts/dtc/include-prefixes/metag
@@ -0,0 +1 @@
+../../../arch/metag/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/microblaze b/scripts/dtc/include-prefixes/microblaze
new file mode 120000
index 000000000000..d9830330a21d
--- /dev/null
+++ b/scripts/dtc/include-prefixes/microblaze
@@ -0,0 +1 @@
+../../../arch/microblaze/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/mips b/scripts/dtc/include-prefixes/mips
new file mode 120000
index 000000000000..ae8d4948dc8d
--- /dev/null
+++ b/scripts/dtc/include-prefixes/mips
@@ -0,0 +1 @@
+../../../arch/mips/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/nios2 b/scripts/dtc/include-prefixes/nios2
new file mode 120000
index 000000000000..51772336d13f
--- /dev/null
+++ b/scripts/dtc/include-prefixes/nios2
@@ -0,0 +1 @@
+../../../arch/nios2/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/openrisc b/scripts/dtc/include-prefixes/openrisc
new file mode 120000
index 000000000000..71c3bc75c560
--- /dev/null
+++ b/scripts/dtc/include-prefixes/openrisc
@@ -0,0 +1 @@
+../../../arch/openrisc/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/powerpc b/scripts/dtc/include-prefixes/powerpc
new file mode 120000
index 000000000000..7cd6ec16e899
--- /dev/null
+++ b/scripts/dtc/include-prefixes/powerpc
@@ -0,0 +1 @@
+../../../arch/powerpc/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/sh b/scripts/dtc/include-prefixes/sh
new file mode 120000
index 000000000000..67d37808c599
--- /dev/null
+++ b/scripts/dtc/include-prefixes/sh
@@ -0,0 +1 @@
+../../../arch/sh/boot/dts
\ No newline at end of file
diff --git a/scripts/dtc/include-prefixes/xtensa b/scripts/dtc/include-prefixes/xtensa
new file mode 120000
index 000000000000..d1eaf6ec7a2b
--- /dev/null
+++ b/scripts/dtc/include-prefixes/xtensa
@@ -0,0 +1 @@
+../../../arch/xtensa/boot/dts
\ No newline at end of file
diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c
index 664b7fe206d6..b11d3920b9a5 100644
--- a/sound/x86/intel_hdmi_audio.c
+++ b/sound/x86/intel_hdmi_audio.c
@@ -1809,10 +1809,6 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev)
         pdata->notify_pending = false;
         spin_unlock_irq(&pdata->lpe_audio_slock);
 
-        /* runtime PM isn't enabled as default, since it won't save much on
-         * BYT/CHT devices; user who want the runtime PM should adjust the
-         * power/ontrol and power/autosuspend_delay_ms sysfs entries instead
-         */
         pm_runtime_use_autosuspend(&pdev->dev);
         pm_runtime_mark_last_busy(&pdev->dev);
         pm_runtime_set_active(&pdev->dev);
diff --git a/tools/power/acpi/.gitignore b/tools/power/acpi/.gitignore
new file mode 100644
index 000000000000..cba3d994995c
--- /dev/null
+++ b/tools/power/acpi/.gitignore
@@ -0,0 +1,4 @@
+acpidbg
+acpidump
+ec
+include
diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest
index 32e6211e1c6e..717581145cfc 100755
--- a/tools/testing/selftests/ftrace/ftracetest
+++ b/tools/testing/selftests/ftrace/ftracetest
@@ -58,7 +58,7 @@ parse_opts() { # opts
     ;;
     --verbose|-v|-vv)
       VERBOSE=$((VERBOSE + 1))
-      [ $1 == '-vv' ] && VERBOSE=$((VERBOSE + 1))
+      [ $1 = '-vv' ] && VERBOSE=$((VERBOSE + 1))
       shift 1
     ;;
     --debug|-d)
diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
index 07bb3e5930b4..aa31368851c9 100644
--- a/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
+++ b/tools/testing/selftests/ftrace/test.d/ftrace/func_event_triggers.tc
@@ -48,7 +48,7 @@ test_event_enabled() {
     e=`cat $EVENT_ENABLE`
     if [ "$e" != $val ]; then
         echo "Expected $val but found $e"
-        exit -1
+        exit 1
     fi
 }
 
diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions
index 9aec6fcb7729..f2019b37370d 100644
--- a/tools/testing/selftests/ftrace/test.d/functions
+++ b/tools/testing/selftests/ftrace/test.d/functions
@@ -34,10 +34,10 @@ reset_ftrace_filter() { # reset all triggers in set_ftrace_filter
     echo > set_ftrace_filter
     grep -v '^#' set_ftrace_filter | while read t; do
         tr=`echo $t | cut -d: -f2`
-        if [ "$tr" == "" ]; then
+        if [ "$tr" = "" ]; then
             continue
         fi
-        if [ $tr == "enable_event" -o $tr == "disable_event" ]; then
+        if [ $tr = "enable_event" -o $tr = "disable_event" ]; then
             tr=`echo $t | cut -d: -f1-4`
             limit=`echo $t | cut -d: -f5`
         else
diff --git a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
index 4c5a061a5b4e..c73db7863adb 100644
--- a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+++ b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
@@ -75,9 +75,13 @@ rmdir foo
 if [ -d foo ]; then
         fail "foo still exists"
 fi
-exit 0
-
 
+mkdir foo
+echo "schedule:enable_event:sched:sched_switch" > foo/set_ftrace_filter
+rmdir foo
+if [ -d foo ]; then
+        fail "foo still exists"
+fi
 
 
 instance_slam() {
diff --git a/tools/testing/selftests/powerpc/tm/.gitignore b/tools/testing/selftests/powerpc/tm/.gitignore
index 427621792229..2f1f7b013293 100644
--- a/tools/testing/selftests/powerpc/tm/.gitignore
+++ b/tools/testing/selftests/powerpc/tm/.gitignore
@@ -11,3 +11,4 @@ tm-signal-context-chk-fpu
 tm-signal-context-chk-gpr
 tm-signal-context-chk-vmx
 tm-signal-context-chk-vsx
+tm-vmx-unavail
diff --git a/tools/testing/selftests/powerpc/tm/Makefile b/tools/testing/selftests/powerpc/tm/Makefile
index 5576ee6a51f2..958c11c14acd 100644
--- a/tools/testing/selftests/powerpc/tm/Makefile
+++ b/tools/testing/selftests/powerpc/tm/Makefile
@@ -2,7 +2,8 @@ SIGNAL_CONTEXT_CHK_TESTS := tm-signal-context-chk-gpr tm-signal-context-chk-fpu
         tm-signal-context-chk-vmx tm-signal-context-chk-vsx
 
 TEST_GEN_PROGS := tm-resched-dscr tm-syscall tm-signal-msr-resv tm-signal-stack \
-        tm-vmxcopy tm-fork tm-tar tm-tmspr $(SIGNAL_CONTEXT_CHK_TESTS)
+        tm-vmxcopy tm-fork tm-tar tm-tmspr tm-vmx-unavail \
+        $(SIGNAL_CONTEXT_CHK_TESTS)
 
 include ../../lib.mk
 
@@ -13,6 +14,7 @@ CFLAGS += -mhtm
 $(OUTPUT)/tm-syscall: tm-syscall-asm.S
 $(OUTPUT)/tm-syscall: CFLAGS += -I../../../../../usr/include
 $(OUTPUT)/tm-tmspr: CFLAGS += -pthread
+$(OUTPUT)/tm-vmx-unavail: CFLAGS += -pthread -m64
 
 SIGNAL_CONTEXT_CHK_TESTS := $(patsubst %,$(OUTPUT)/%,$(SIGNAL_CONTEXT_CHK_TESTS))
 $(SIGNAL_CONTEXT_CHK_TESTS): tm-signal.S
diff --git a/tools/testing/selftests/powerpc/tm/tm-vmx-unavail.c b/tools/testing/selftests/powerpc/tm/tm-vmx-unavail.c
new file mode 100644
index 000000000000..137185ba4937
--- /dev/null
+++ b/tools/testing/selftests/powerpc/tm/tm-vmx-unavail.c
@@ -0,0 +1,118 @@
+/*
+ * Copyright 2017, Michael Neuling, IBM Corp.
+ * Licensed under GPLv2.
+ * Original: Breno Leitao <brenohl@br.ibm.com> &
+ *           Gustavo Bueno Romero <gromero@br.ibm.com>
+ * Edited: Michael Neuling
+ *
+ * Force VMX unavailable during a transaction and see if it corrupts
+ * the checkpointed VMX register state after the abort.
+ */
+
+#include <inttypes.h>
+#include <htmintrin.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <pthread.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#include <pthread.h>
+
+#include "tm.h"
+#include "utils.h"
+
+int passed;
+
+void *worker(void *unused)
+{
+        __int128 vmx0;
+        uint64_t texasr;
+
+        asm goto (
+                "li       3, 1;"  /* Stick non-zero value in VMX0 */
+                "std      3, 0(%[vmx0_ptr]);"
+                "lvx      0, 0, %[vmx0_ptr];"
+
+                /* Wait here a bit so we get scheduled out 255 times */
+                "lis      3, 0x3fff;"
+                "1: ;"
+                "addi     3, 3, -1;"
+                "cmpdi    3, 0;"
+                "bne      1b;"
+
+                /* Kernel will hopefully turn VMX off now */
+
+                "tbegin. ;"
+                "beq      failure;"
+
+                /* Cause VMX unavail. Any VMX instruction */
+                "vaddcuw  0,0,0;"
+
+                "tend. ;"
+                "b        %l[success];"
+
+                /* Check VMX0 sanity after abort */
+                "failure: ;"
+                "lvx       1,  0, %[vmx0_ptr];"
+                "vcmpequb. 2,  0, 1;"
+                "bc        4, 24, %l[value_mismatch];"
+                "b        %l[value_match];"
+                :
+                : [vmx0_ptr] "r"(&vmx0)
+                : "r3"
+                : success, value_match, value_mismatch
+                );
+
+        /* HTM aborted and VMX0 is corrupted */
+value_mismatch:
+        texasr = __builtin_get_texasr();
+
+        printf("\n\n==============\n\n");
+        printf("Failure with error: %lx\n",   _TEXASR_FAILURE_CODE(texasr));
+        printf("Summary error     : %lx\n",   _TEXASR_FAILURE_SUMMARY(texasr));
+        printf("TFIAR exact       : %lx\n\n", _TEXASR_TFIAR_EXACT(texasr));
+
+        passed = 0;
+        return NULL;
+
+        /* HTM aborted but VMX0 is correct */
+value_match:
+//      printf("!");
+        return NULL;
+
+success:
+//      printf(".");
+        return NULL;
+}
+
+int tm_vmx_unavail_test()
+{
+        int threads;
+        pthread_t *thread;
+
+        SKIP_IF(!have_htm());
+
+        passed = 1;
+
+        threads = sysconf(_SC_NPROCESSORS_ONLN) * 4;
+        thread = malloc(sizeof(pthread_t)*threads);
+        if (!thread)
+                return EXIT_FAILURE;
+
+        for (uint64_t i = 0; i < threads; i++)
+                pthread_create(&thread[i], NULL, &worker, NULL);
+
+        for (uint64_t i = 0; i < threads; i++)
+                pthread_join(thread[i], NULL);
+
+        free(thread);
+
+        return passed ? EXIT_SUCCESS : EXIT_FAILURE;
+}
+
+
+int main(int argc, char **argv)
+{
+        return test_harness(tm_vmx_unavail_test, "tm_vmx_unavail_test");
+}
diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c
index bce6037cf01d..32c3295929b0 100644
--- a/virt/kvm/arm/hyp/vgic-v3-sr.c
+++ b/virt/kvm/arm/hyp/vgic-v3-sr.c
@@ -22,7 +22,7 @@
 #include <asm/kvm_hyp.h>
 
 #define vtr_to_max_lr_idx(v)            ((v) & 0xf)
-#define vtr_to_nr_pri_bits(v)           (((u32)(v) >> 29) + 1)
+#define vtr_to_nr_pre_bits(v)           (((u32)(v) >> 26) + 1)
 
 static u64 __hyp_text __gic_v3_get_lr(unsigned int lr)
 {
@@ -135,13 +135,13 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
 
         if (used_lrs) {
                 int i;
-                u32 nr_pri_bits;
+                u32 nr_pre_bits;
 
                 cpu_if->vgic_elrsr = read_gicreg(ICH_ELSR_EL2);
 
                 write_gicreg(0, ICH_HCR_EL2);
                 val = read_gicreg(ICH_VTR_EL2);
-                nr_pri_bits = vtr_to_nr_pri_bits(val);
+                nr_pre_bits = vtr_to_nr_pre_bits(val);
 
                 for (i = 0; i < used_lrs; i++) {
                         if (cpu_if->vgic_elrsr & (1 << i))
@@ -152,7 +152,7 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
                         __gic_v3_set_lr(0, i);
                 }
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         cpu_if->vgic_ap0r[3] = read_gicreg(ICH_AP0R3_EL2);
                         cpu_if->vgic_ap0r[2] = read_gicreg(ICH_AP0R2_EL2);
@@ -162,7 +162,7 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu)
                         cpu_if->vgic_ap0r[0] = read_gicreg(ICH_AP0R0_EL2);
                 }
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         cpu_if->vgic_ap1r[3] = read_gicreg(ICH_AP1R3_EL2);
                         cpu_if->vgic_ap1r[2] = read_gicreg(ICH_AP1R2_EL2);
@@ -198,7 +198,7 @@ void __hyp_text __vgic_v3_restore_state(struct kvm_vcpu *vcpu)
         struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3;
         u64 used_lrs = vcpu->arch.vgic_cpu.used_lrs;
         u64 val;
-        u32 nr_pri_bits;
+        u32 nr_pre_bits;
         int i;
 
         /*
@@ -217,12 +217,12 @@ void __hyp_text __vgic_v3_restore_state(struct kvm_vcpu *vcpu)
         }
 
         val = read_gicreg(ICH_VTR_EL2);
-        nr_pri_bits = vtr_to_nr_pri_bits(val);
+        nr_pre_bits = vtr_to_nr_pre_bits(val);
 
         if (used_lrs) {
                 write_gicreg(cpu_if->vgic_hcr, ICH_HCR_EL2);
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         write_gicreg(cpu_if->vgic_ap0r[3], ICH_AP0R3_EL2);
                         write_gicreg(cpu_if->vgic_ap0r[2], ICH_AP0R2_EL2);
@@ -232,7 +232,7 @@ void __hyp_text __vgic_v3_restore_state(struct kvm_vcpu *vcpu)
                         write_gicreg(cpu_if->vgic_ap0r[0], ICH_AP0R0_EL2);
                 }
 
-                switch (nr_pri_bits) {
+                switch (nr_pre_bits) {
                 case 7:
                         write_gicreg(cpu_if->vgic_ap1r[3], ICH_AP1R3_EL2);
                         write_gicreg(cpu_if->vgic_ap1r[2], ICH_AP1R2_EL2);
diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c
index 313ee646480f..a2d63247d1bb 100644
--- a/virt/kvm/arm/mmu.c
+++ b/virt/kvm/arm/mmu.c
@@ -295,6 +295,13 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size)
         assert_spin_locked(&kvm->mmu_lock);
         pgd = kvm->arch.pgd + stage2_pgd_index(addr);
         do {
+                /*
+                 * Make sure the page table is still active, as another thread
+                 * could have possibly freed the page table, while we released
+                 * the lock.
+                 */
+                if (!READ_ONCE(kvm->arch.pgd))
+                        break;
                 next = stage2_pgd_addr_end(addr, end);
                 if (!stage2_pgd_none(*pgd))
                         unmap_stage2_puds(kvm, pgd, addr, next);
@@ -829,22 +836,22 @@ void stage2_unmap_vm(struct kvm *kvm)
  * Walks the level-1 page table pointed to by kvm->arch.pgd and frees all
  * underlying level-2 and level-3 tables before freeing the actual level-1 table
  * and setting the struct pointer to NULL.
- *
- * Note we don't need locking here as this is only called when the VM is
- * destroyed, which can only be done once.
  */
 void kvm_free_stage2_pgd(struct kvm *kvm)
 {
-        if (kvm->arch.pgd == NULL)
-                return;
+        void *pgd = NULL;
 
         spin_lock(&kvm->mmu_lock);
-        unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+        if (kvm->arch.pgd) {
+                unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+                pgd = READ_ONCE(kvm->arch.pgd);
+                kvm->arch.pgd = NULL;
+        }
         spin_unlock(&kvm->mmu_lock);
 
         /* Free the HW pgd, one page at a time */
-        free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE);
-        kvm->arch.pgd = NULL;
+        if (pgd)
+                free_pages_exact(pgd, S2_PGD_SIZE);
 }
 
 static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,
@@ -1170,11 +1177,13 @@ static void stage2_wp_range(struct kvm *kvm, phys_addr_t addr, phys_addr_t end)
                  * large. Otherwise, we may see kernel panics with
                  * CONFIG_DETECT_HUNG_TASK, CONFIG_LOCKUP_DETECTOR,
                  * CONFIG_LOCKDEP. Additionally, holding the lock too long
-                 * will also starve other vCPUs.
+                 * will also starve other vCPUs. We have to also make sure
+                 * that the page tables are not freed while we released
+                 * the lock.
                  */
-                if (need_resched() || spin_needbreak(&kvm->mmu_lock))
-                        cond_resched_lock(&kvm->mmu_lock);
-
+                cond_resched_lock(&kvm->mmu_lock);
+                if (!READ_ONCE(kvm->arch.pgd))
+                        break;
                 next = stage2_pgd_addr_end(addr, end);
                 if (stage2_pgd_present(*pgd))
                         stage2_wp_puds(pgd, addr, next);
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index dc68e2e424ab..3a0b8999f011 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -242,8 +242,11 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
          * If we are creating a VCPU with a GICv3 we must also register the
          * KVM io device for the redistributor that belongs to this VCPU.
          */
-        if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3)
+        if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
+                mutex_lock(&vcpu->kvm->lock);
                 ret = vgic_register_redist_iodev(vcpu);
+                mutex_unlock(&vcpu->kvm->lock);
+        }
         return ret;
 }
 
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c
index 99da1a207c19..201d5e2e973d 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c
@@ -586,7 +586,7 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
         if (!vgic_v3_check_base(kvm))
                 return -EINVAL;
 
-        rd_base = vgic->vgic_redist_base + kvm_vcpu_get_idx(vcpu) * SZ_64K * 2;
+        rd_base = vgic->vgic_redist_base + vgic->vgic_redist_free_offset;
         sgi_base = rd_base + SZ_64K;
 
         kvm_iodevice_init(&rd_dev->dev, &kvm_io_gic_ops);
@@ -614,11 +614,15 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
         mutex_lock(&kvm->slots_lock);
         ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, sgi_base,
                                       SZ_64K, &sgi_dev->dev);
-        mutex_unlock(&kvm->slots_lock);
-        if (ret)
+        if (ret) {
                 kvm_io_bus_unregister_dev(kvm, KVM_MMIO_BUS,
                                           &rd_dev->dev);
+                goto out;
+        }
 
+        vgic->vgic_redist_free_offset += 2 * SZ_64K;
+out:
+        mutex_unlock(&kvm->slots_lock);
         return ret;
 }
 
@@ -644,10 +648,12 @@ static int vgic_register_all_redist_iodevs(struct kvm *kvm)
 
         if (ret) {
                 /* The current c failed, so we start with the previous one. */
+                mutex_lock(&kvm->slots_lock);
                 for (c--; c >= 0; c--) {
                         vcpu = kvm_get_vcpu(kvm, c);
                         vgic_unregister_redist_iodev(vcpu);
                 }
+                mutex_unlock(&kvm->slots_lock);
         }
 
         return ret;
diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c
index a65757aab6d3..504b4bd0d651 100644
--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -149,6 +149,13 @@ void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
         if (irq->hw) {
                 val |= GICH_LR_HW;
                 val |= irq->hwintid << GICH_LR_PHYSID_CPUID_SHIFT;
+                /*
+                 * Never set pending+active on a HW interrupt, as the
+                 * pending state is kept at the physical distributor
+                 * level.
+                 */
+                if (irq->active && irq_is_pending(irq))
+                        val &= ~GICH_LR_PENDING_BIT;
         } else {
                 if (irq->config == VGIC_CONFIG_LEVEL)
                         val |= GICH_LR_EOI;
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 8fa737edde6f..6fe3f003636a 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -127,6 +127,13 @@ void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr)
         if (irq->hw) {
                 val |= ICH_LR_HW;
                 val |= ((u64)irq->hwintid) << ICH_LR_PHYS_ID_SHIFT;
+                /*
+                 * Never set pending+active on a HW interrupt, as the
+                 * pending state is kept at the physical distributor
+                 * level.
+                 */
+                if (irq->active && irq_is_pending(irq))
+                        val &= ~ICH_LR_PENDING_BIT;
         } else {
                 if (irq->config == VGIC_CONFIG_LEVEL)
                         val |= ICH_LR_EOI;