1819 files changed, 32134 insertions, 12099 deletions

diff --git a/.mailmap b/.mailmap
index 2a91c14c80bf..de22daefd9da 100644
--- a/.mailmap
+++ b/.mailmap
@@ -88,6 +88,7 @@ Kay Sievers <kay.sievers@vrfy.org>
 Kenneth W Chen <kenneth.w.chen@intel.com>
 Konstantin Khlebnikov <koct9i@gmail.com> <k.khlebnikov@samsung.com>
 Koushik <raghavendra.koushik@neterion.com>
+Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski@samsung.com>
 Krzysztof Kozlowski <krzk@kernel.org> <k.kozlowski.k@gmail.com>
 Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
 Leonid I Ananiev <leonid.i.ananiev@intel.com>
@@ -158,6 +159,8 @@ Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
 Viresh Kumar <vireshk@kernel.org> <viresh.kumar@st.com>
 Viresh Kumar <vireshk@kernel.org> <viresh.linux@gmail.com>
 Viresh Kumar <vireshk@kernel.org> <viresh.kumar2@arm.com>
+Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@virtuozzo.com>
+Vladimir Davydov <vdavydov.dev@gmail.com> <vdavydov@parallels.com>
 Takashi YOSHII <takashi.yoshii.zj@renesas.com>
 Yusuke Goda <goda.yusuke@renesas.com>
 Gustavo Padovan <gustavo@las.ic.unicamp.br>
diff --git a/Documentation/ABI/stable/sysfs-devices b/Documentation/ABI/stable/sysfs-devices
index 43f78b88da28..df449d79b563 100644
--- a/Documentation/ABI/stable/sysfs-devices
+++ b/Documentation/ABI/stable/sysfs-devices
@@ -1,7 +1,7 @@
 # Note: This documents additional properties of any device beyond what
 # is documented in Documentation/sysfs-rules.txt
 
-What:           /sys/devices/*/of_path
+What:           /sys/devices/*/of_node
 Date:           February 2015
 Contact:        Device Tree mailing list <devicetree@vger.kernel.org>
 Description:
diff --git a/Documentation/PCI/MSI-HOWTO.txt b/Documentation/PCI/MSI-HOWTO.txt
index c55df2911136..cd9c9f6a7cd9 100644
--- a/Documentation/PCI/MSI-HOWTO.txt
+++ b/Documentation/PCI/MSI-HOWTO.txt
@@ -94,14 +94,11 @@ has a requirements for a minimum number of vectors the driver can pass a
 min_vecs argument set to this limit, and the PCI core will return -ENOSPC
 if it can't meet the minimum number of vectors.
 
-The flags argument should normally be set to 0, but can be used to pass the
-PCI_IRQ_NOMSI and PCI_IRQ_NOMSIX flag in case a device claims to support
-MSI or MSI-X, but the support is broken, or to pass PCI_IRQ_NOLEGACY in
-case the device does not support legacy interrupt lines.
-
-By default this function will spread the interrupts around the available
-CPUs, but this feature can be disabled by passing the PCI_IRQ_NOAFFINITY
-flag.
+The flags argument is used to specify which type of interrupt can be used
+by the device and the driver (PCI_IRQ_LEGACY, PCI_IRQ_MSI, PCI_IRQ_MSIX).
+A convenient short-hand (PCI_IRQ_ALL_TYPES) is also available to ask for
+any possible kind of interrupt.  If the PCI_IRQ_AFFINITY flag is set,
+pci_alloc_irq_vectors() will spread the interrupts around the available CPUs.
 
 To get the Linux IRQ numbers passed to request_irq() and free_irq() and the
 vectors, use the following function:
@@ -131,7 +128,7 @@ larger than the number supported by the device it will automatically be
 capped to the supported limit, so there is no need to query the number of
 vectors supported beforehand:
 
-        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, 0);
+        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, PCI_IRQ_ALL_TYPES)
         if (nvec < 0)
                 goto out_err;
 
@@ -140,7 +137,7 @@ interrupts it can request a particular number of interrupts by passing that
 number to pci_alloc_irq_vectors() function as both 'min_vecs' and
 'max_vecs' parameters:
 
-        ret = pci_alloc_irq_vectors(pdev, nvec, nvec, 0);
+        ret = pci_alloc_irq_vectors(pdev, nvec, nvec, PCI_IRQ_ALL_TYPES);
         if (ret < 0)
                 goto out_err;
 
@@ -148,15 +145,14 @@ The most notorious example of the request type described above is enabling
 the single MSI mode for a device.  It could be done by passing two 1s as
 'min_vecs' and 'max_vecs':
 
-        ret = pci_alloc_irq_vectors(pdev, 1, 1, 0);
+        ret = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_ALL_TYPES);
         if (ret < 0)
                 goto out_err;
 
 Some devices might not support using legacy line interrupts, in which case
-the PCI_IRQ_NOLEGACY flag can be used to fail the request if the platform
-can't provide MSI or MSI-X interrupts:
+the driver can specify that only MSI or MSI-X is acceptable:
 
-        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, PCI_IRQ_NOLEGACY);
+        nvec = pci_alloc_irq_vectors(pdev, 1, nvec, PCI_IRQ_MSI | PCI_IRQ_MSIX);
         if (nvec < 0)
                 goto out_err;
 
diff --git a/Documentation/PCI/pci.txt b/Documentation/PCI/pci.txt
index 123881f62219..77f49dc5be23 100644
--- a/Documentation/PCI/pci.txt
+++ b/Documentation/PCI/pci.txt
@@ -124,7 +124,6 @@ initialization with a pointer to a structure describing the driver
 
 The ID table is an array of struct pci_device_id entries ending with an
 all-zero entry.  Definitions with static const are generally preferred.
-Use of the deprecated macro DEFINE_PCI_DEVICE_TABLE should be avoided.
 
 Each entry consists of:
 
diff --git a/Documentation/arm/CCN.txt b/Documentation/arm/CCN.txt
index ffca443a19b4..15cdb7bc57c3 100644
--- a/Documentation/arm/CCN.txt
+++ b/Documentation/arm/CCN.txt
@@ -18,13 +18,17 @@ and config2 fields of the perf_event_attr structure. The "events"
 directory provides configuration templates for all documented
 events, that can be used with perf tool. For example "xp_valid_flit"
 is an equivalent of "type=0x8,event=0x4". Other parameters must be
-explicitly specified. For events originating from device, "node"
-defines its index. All crosspoint events require "xp" (index),
-"port" (device port number) and "vc" (virtual channel ID) and
-"dir" (direction). Watchpoints (special "event" value 0xfe) also
-require comparator values ("cmp_l" and "cmp_h") and "mask", being
-index of the comparator mask.
+explicitly specified.
 
+For events originating from device, "node" defines its index.
+
+Crosspoint PMU events require "xp" (index), "bus" (bus number)
+and "vc" (virtual channel ID).
+
+Crosspoint watchpoint-based events (special "event" value 0xfe)
+require "xp" and "vc" as as above plus "port" (device port index),
+"dir" (transmit/receive direction), comparator values ("cmp_l"
+and "cmp_h") and "mask", being index of the comparator mask.
 Masks are defined separately from the event description
 (due to limited number of the config values) in the "cmp_mask"
 directory, with first 8 configurable by user and additional
diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt
index 4da60b463995..ccc60324e738 100644
--- a/Documentation/arm64/silicon-errata.txt
+++ b/Documentation/arm64/silicon-errata.txt
@@ -53,6 +53,7 @@ stable kernels.
 | ARM            | Cortex-A57      | #832075         | ARM64_ERRATUM_832075    |
 | ARM            | Cortex-A57      | #852523         | N/A                     |
 | ARM            | Cortex-A57      | #834220         | ARM64_ERRATUM_834220    |
+| ARM            | Cortex-A72      | #853709         | N/A                     |
 | ARM            | MMU-500         | #841119,#826419 | N/A                     |
 |                |                 |                 |                         |
 | Cavium         | ThunderX ITS    | #22375, #24313  | CAVIUM_ERRATUM_22375    |
diff --git a/Documentation/block/queue-sysfs.txt b/Documentation/block/queue-sysfs.txt
index d515d58962b9..2a3904030dea 100644
--- a/Documentation/block/queue-sysfs.txt
+++ b/Documentation/block/queue-sysfs.txt
@@ -14,6 +14,12 @@ add_random (RW)
 This file allows to turn off the disk entropy contribution. Default
 value of this file is '1'(on).
 
+dax (RO)
+--------
+This file indicates whether the device supports Direct Access (DAX),
+used by CPU-addressable storage to bypass the pagecache.  It shows '1'
+if true, '0' if not.
+
 discard_granularity (RO)
 -----------------------
 This shows the size of internal allocation of the device in bytes, if
@@ -46,6 +52,12 @@ hw_sector_size (RO)
 -------------------
 This is the hardware sector size of the device, in bytes.
 
+io_poll (RW)
+------------
+When read, this file shows the total number of block IO polls and how
+many returned success.  Writing '0' to this file will disable polling
+for this device.  Writing any non-zero value will enable this feature.
+
 iostats (RW)
 -------------
 This file is used to control (on/off) the iostats accounting of the
@@ -151,5 +163,11 @@ device state. This means that it might not be safe to toggle the
 setting from "write back" to "write through", since that will also
 eliminate cache flushes issued by the kernel.
 
+write_same_max_bytes (RO)
+-------------------------
+This is the number of bytes the device can write in a single write-same
+command.  A value of '0' means write-same is not supported by this
+device.
+
 
 Jens Axboe <jens.axboe@oracle.com>, February 2009
diff --git a/Documentation/conf.py b/Documentation/conf.py
index 96b7aa66c89c..106ae9c740b9 100644
--- a/Documentation/conf.py
+++ b/Documentation/conf.py
@@ -131,7 +131,7 @@ pygments_style = 'sphinx'
 todo_include_todos = False
 
 primary_domain = 'C'
-highlight_language = 'C'
+highlight_language = 'guess'
 
 # -- Options for HTML output ----------------------------------------------
 
diff --git a/Documentation/cpu-freq/cpufreq-stats.txt b/Documentation/cpu-freq/cpufreq-stats.txt
index fc647492e940..8d9773f23550 100644
--- a/Documentation/cpu-freq/cpufreq-stats.txt
+++ b/Documentation/cpu-freq/cpufreq-stats.txt
@@ -103,7 +103,7 @@ Config Main Menu
         Power management options (ACPI, APM)  --->
                 CPU Frequency scaling  --->
                         [*] CPU Frequency scaling
-                        <*>   CPU frequency translation statistics 
+                        [*]   CPU frequency translation statistics
                         [*]     CPU frequency translation statistics details
 
 
diff --git a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
index bf99e2f24788..205593f56fe7 100644
--- a/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
+++ b/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.txt
@@ -16,6 +16,11 @@ Required properties:
 - vref-supply: The regulator supply ADC reference voltage.
 - #io-channel-cells: Should be 1, see ../iio-bindings.txt
 
+Optional properties:
+- resets: Must contain an entry for each entry in reset-names if need support
+          this option. See ../reset/reset.txt for details.
+- reset-names: Must include the name "saradc-apb".
+
 Example:
         saradc: saradc@2006c000 {
                 compatible = "rockchip,saradc";
@@ -23,6 +28,8 @@ Example:
                 interrupts = <GIC_SPI 26 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 #io-channel-cells = <1>;
                 vref-supply = <&vcc18>;
         };
diff --git a/Documentation/devicetree/bindings/input/touchscreen/silead_gsl1680.txt b/Documentation/devicetree/bindings/input/touchscreen/silead_gsl1680.txt
index 1112e0d794e1..820fee4b77b6 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/silead_gsl1680.txt
+++ b/Documentation/devicetree/bindings/input/touchscreen/silead_gsl1680.txt
@@ -13,6 +13,7 @@ Required properties:
 - touchscreen-size-y      : See touchscreen.txt
 
 Optional properties:
+- firmware-name           : File basename (string) for board specific firmware
 - touchscreen-inverted-x  : See touchscreen.txt
 - touchscreen-inverted-y  : See touchscreen.txt
 - touchscreen-swapped-x-y : See touchscreen.txt
diff --git a/Documentation/devicetree/bindings/mmc/sdhci-st.txt b/Documentation/devicetree/bindings/mmc/sdhci-st.txt
index 88faa91125bf..3cd4c43a3260 100644
--- a/Documentation/devicetree/bindings/mmc/sdhci-st.txt
+++ b/Documentation/devicetree/bindings/mmc/sdhci-st.txt
@@ -10,7 +10,7 @@ Required properties:
                         subsystem (mmcss) inside the FlashSS (available in STiH407 SoC
                         family).
 
-- clock-names:          Should be "mmc".
+- clock-names:          Should be "mmc" and "icn".  (NB: The latter is not compulsory)
                         See: Documentation/devicetree/bindings/resource-names.txt
 - clocks:               Phandle to the clock.
                         See: Documentation/devicetree/bindings/clock/clock-bindings.txt
diff --git a/Documentation/devicetree/bindings/serial/8250.txt b/Documentation/devicetree/bindings/serial/8250.txt
index f5561ac7e17e..936ab5b87324 100644
--- a/Documentation/devicetree/bindings/serial/8250.txt
+++ b/Documentation/devicetree/bindings/serial/8250.txt
@@ -42,9 +42,6 @@ Optional properties:
 - auto-flow-control: one way to enable automatic flow control support. The
   driver is allowed to detect support for the capability even without this
   property.
-- {rts,cts,dtr,dsr,rng,dcd}-gpios: specify a GPIO for RTS/CTS/DTR/DSR/RI/DCD
-  line respectively. It will use specified GPIO instead of the peripheral
-  function pin for the UART feature. If unsure, don't specify this property.
 
 Note:
 * fsl,ns16550:
@@ -66,19 +63,3 @@ Example:
                 interrupts = <10>;
                 reg-shift = <2>;
         };
-
-Example for OMAP UART using GPIO-based modem control signals:
-
-        uart4: serial@49042000 {
-                compatible = "ti,omap3-uart";
-                reg = <0x49042000 0x400>;
-                interrupts = <80>;
-                ti,hwmods = "uart4";
-                clock-frequency = <48000000>;
-                cts-gpios = <&gpio3 5 GPIO_ACTIVE_LOW>;
-                rts-gpios = <&gpio3 6 GPIO_ACTIVE_LOW>;
-                dtr-gpios = <&gpio1 12 GPIO_ACTIVE_LOW>;
-                dsr-gpios = <&gpio1 13 GPIO_ACTIVE_LOW>;
-                dcd-gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
-                rng-gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
-        };
diff --git a/Documentation/devicetree/bindings/sound/nau8810.txt b/Documentation/devicetree/bindings/sound/nau8810.txt
new file mode 100644
index 000000000000..05830e477acd
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/nau8810.txt
@@ -0,0 +1,16 @@
+NAU8810 audio CODEC
+
+This device supports I2C only.
+
+Required properties:
+
+  - compatible : "nuvoton,nau8810"
+
+  - reg : the I2C address of the device.
+
+Example:
+
+codec: nau8810@1a {
+        compatible = "nuvoton,nau8810";
+        reg = <0x1a>;
+};
diff --git a/Documentation/devicetree/bindings/sound/nvidia,tegra-audio-sgtl5000.txt b/Documentation/devicetree/bindings/sound/nvidia,tegra-audio-sgtl5000.txt
new file mode 100644
index 000000000000..5da7da4ea07a
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/nvidia,tegra-audio-sgtl5000.txt
@@ -0,0 +1,42 @@
+NVIDIA Tegra audio complex, with SGTL5000 CODEC
+
+Required properties:
+- compatible : "nvidia,tegra-audio-sgtl5000"
+- clocks : Must contain an entry for each entry in clock-names.
+  See ../clocks/clock-bindings.txt for details.
+- clock-names : Must include the following entries:
+  - pll_a
+  - pll_a_out0
+  - mclk (The Tegra cdev1/extern1 clock, which feeds the CODEC's mclk)
+- nvidia,model : The user-visible name of this sound complex.
+- nvidia,audio-routing : A list of the connections between audio components.
+  Each entry is a pair of strings, the first being the connection's sink,
+  the second being the connection's source. Valid names for sources and
+  sinks are the SGTL5000's pins (as documented in its binding), and the jacks
+  on the board:
+
+  * Headphone Jack
+  * Line In Jack
+  * Mic Jack
+
+- nvidia,i2s-controller : The phandle of the Tegra I2S controller that's
+  connected to the CODEC.
+- nvidia,audio-codec : The phandle of the SGTL5000 audio codec.
+
+Example:
+
+sound {
+        compatible = "toradex,tegra-audio-sgtl5000-apalis_t30",
+                     "nvidia,tegra-audio-sgtl5000";
+        nvidia,model = "Toradex Apalis T30";
+        nvidia,audio-routing =
+                "Headphone Jack", "HP_OUT",
+                "LINE_IN", "Line In Jack",
+                "MIC_IN", "Mic Jack";
+        nvidia,i2s-controller = <&tegra_i2s2>;
+        nvidia,audio-codec = <&sgtl5000>;
+        clocks = <&tegra_car TEGRA30_CLK_PLL_A>,
+                 <&tegra_car TEGRA30_CLK_PLL_A_OUT0>,
+                 <&tegra_car TEGRA30_CLK_EXTERN1>;
+        clock-names = "pll_a", "pll_a_out0", "mclk";
+};
diff --git a/Documentation/devicetree/bindings/sound/omap-mcpdm.txt b/Documentation/devicetree/bindings/sound/omap-mcpdm.txt
index 6f6c2f8e908d..0741dff048dd 100644
--- a/Documentation/devicetree/bindings/sound/omap-mcpdm.txt
+++ b/Documentation/devicetree/bindings/sound/omap-mcpdm.txt
@@ -8,8 +8,6 @@ Required properties:
 - interrupts: Interrupt number for McPDM
 - interrupt-parent: The parent interrupt controller
 - ti,hwmods: Name of the hwmod associated to the McPDM
-- clocks:  phandle for the pdmclk provider, likely <&twl6040>
-- clock-names: Must be "pdmclk"
 
 Example:
 
@@ -21,11 +19,3 @@ mcpdm: mcpdm@40132000 {
         interrupt-parent = <&gic>;
         ti,hwmods = "mcpdm";
 };
-
-In board DTS file the pdmclk needs to be added:
-
-&mcpdm {
-        clocks = <&twl6040>;
-        clock-names = "pdmclk";
-        status = "okay";
-};
diff --git a/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt b/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt
index 48129368d4d9..d9d8635ff94c 100644
--- a/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt
+++ b/Documentation/devicetree/bindings/sound/qcom,apq8016-sbc.txt
@@ -16,6 +16,24 @@ Required properties:
                                 * "spkr-iomux"
 - qcom,model            : Name of the sound card.
 
+- qcom,audio-routing    : A list of the connections between audio components.
+                          Each entry is a pair of strings, the first being the
+                          connection's sink, the second being the connection's
+                          source. Valid names could be power supplies, MicBias
+                          of msm8x16_wcd codec and the jacks on the board:
+
+                          Power supplies:
+                          * MIC BIAS External1
+                          * MIC BIAS External2
+                          * MIC BIAS Internal1
+                          * MIC BIAS Internal2
+
+                          Board connectors:
+                          * Headset Mic
+                          * Secondary Mic",
+                          * DMIC
+                          * Ext Spk
+
 Dai-link subnode properties and subnodes:
 
 Required dai-link subnodes:
@@ -37,6 +55,18 @@ sound: sound {
         reg-names = "mic-iomux", "spkr-iomux";
         qcom,model = "DB410c";
 
+        qcom,audio-routing =
+                "MIC BIAS External1", "Handset Mic",
+                "MIC BIAS Internal2", "Headset Mic",
+                "MIC BIAS External1", "Secondary Mic",
+                "AMIC1", "MIC BIAS External1",
+                "AMIC2", "MIC BIAS Internal2",
+                "AMIC3", "MIC BIAS External1",
+                "DMIC1", "MIC BIAS Internal1",
+                "MIC BIAS Internal1", "Digital Mic1",
+                "DMIC2", "MIC BIAS Internal1",
+                "MIC BIAS Internal1", "Digital Mic2";
+
         /* I2S - Internal codec */
         internal-dai-link@0 {
                 cpu { /* PRIMARY */
diff --git a/Documentation/devicetree/bindings/sound/renesas,rsrc-card.txt b/Documentation/devicetree/bindings/sound/renesas,rsrc-card.txt
deleted file mode 100644
index 255ece3043ad..000000000000
--- a/Documentation/devicetree/bindings/sound/renesas,rsrc-card.txt
+++ /dev/null
@@ -1,75 +0,0 @@
-Renesas Sampling Rate Convert Sound Card:
-
-Renesas Sampling Rate Convert Sound Card specifies audio DAI connections of SoC <-> codec.
-
-Required properties:
-
-- compatible                            : "renesas,rsrc-card{,<board>}"
-                                          Examples with boards are:
-                                            - "renesas,rsrc-card"
-                                            - "renesas,rsrc-card,lager"
-                                            - "renesas,rsrc-card,koelsch"
-Optional properties:
-
-- card_name                             : User specified audio sound card name, one string
-                                          property.
-- cpu                                   : CPU   sub-node
-- codec                                 : CODEC sub-node
-
-Optional subnode properties:
-
-- format                                : CPU/CODEC common audio format.
-                                          "i2s", "right_j", "left_j" , "dsp_a"
-                                          "dsp_b", "ac97", "pdm", "msb", "lsb"
-- frame-master                          : Indicates dai-link frame master.
-                                          phandle to a cpu or codec subnode.
-- bitclock-master                       : Indicates dai-link bit clock master.
-                                          phandle to a cpu or codec subnode.
-- bitclock-inversion                    : bool property. Add this if the
-                                          dai-link uses bit clock inversion.
-- frame-inversion                       : bool property. Add this if the
-                                          dai-link uses frame clock inversion.
-- convert-rate                          : platform specified sampling rate convert
-- convert-channels                      : platform specified converted channel size (2 - 8 ch)
-- audio-prefix                          : see audio-routing
-- audio-routing                         : A list of the connections between audio components.
-                                          Each entry is a pair of strings, the first being the connection's sink,
-                                          the second being the connection's source. Valid names for sources.
-                                          use audio-prefix if some components is using same sink/sources naming.
-                                          it can be used if compatible was "renesas,rsrc-card";
-
-Required CPU/CODEC subnodes properties:
-
-- sound-dai                             : phandle and port of CPU/CODEC
-
-Optional CPU/CODEC subnodes properties:
-
-- clocks / system-clock-frequency       : specify subnode's clock if needed.
-                                          it can be specified via "clocks" if system has
-                                          clock node (= common clock), or "system-clock-frequency"
-                                          (if system doens't support common clock)
-                                          If a clock is specified, it is
-                                          enabled with clk_prepare_enable()
-                                          in dai startup() and disabled with
-                                          clk_disable_unprepare() in dai
-                                          shutdown().
-
-Example
-
-sound {
-        compatible = "renesas,rsrc-card,lager";
-
-        card-name = "rsnd-ak4643";
-        format = "left_j";
-        bitclock-master = <&sndcodec>;
-        frame-master = <&sndcodec>;
-
-        sndcpu: cpu {
-                sound-dai = <&rcar_sound>;
-        };
-
-        sndcodec: codec {
-                sound-dai = <&ak4643>;
-                system-clock-frequency = <11289600>;
-        };
-};
diff --git a/Documentation/devicetree/bindings/sound/rockchip,rk3399-gru-sound.txt b/Documentation/devicetree/bindings/sound/rockchip,rk3399-gru-sound.txt
new file mode 100644
index 000000000000..eac91db07178
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/rockchip,rk3399-gru-sound.txt
@@ -0,0 +1,22 @@
+ROCKCHIP with MAX98357A/RT5514/DA7219 codecs on GRU boards
+
+Required properties:
+- compatible: "rockchip,rk3399-gru-sound"
+- rockchip,cpu: The phandle of the Rockchip I2S controller that's
+  connected to the codecs
+- rockchip,codec: The phandle of the MAX98357A/RT5514/DA7219 codecs
+
+Optional properties:
+- dmic-wakeup-delay-ms : specify delay time (ms) for DMIC ready.
+  If this option is specified, which means it's required dmic need
+  delay for DMIC to ready so that rt5514 can avoid recording before
+  DMIC send valid data
+
+Example:
+
+sound {
+        compatible = "rockchip,rk3399-gru-sound";
+        rockchip,cpu = <&i2s0>;
+        rockchip,codec = <&max98357a &rt5514 &da7219>;
+        dmic-wakeup-delay-ms = <20>;
+};
diff --git a/Documentation/devicetree/bindings/sound/rt5659.txt b/Documentation/devicetree/bindings/sound/rt5659.txt
index 5f79e7fde032..1766e0543fc5 100644
--- a/Documentation/devicetree/bindings/sound/rt5659.txt
+++ b/Documentation/devicetree/bindings/sound/rt5659.txt
@@ -12,6 +12,9 @@ Required properties:
 
 Optional properties:
 
+- clocks: The phandle of the master clock to the CODEC
+- clock-names: Should be "mclk"
+
 - realtek,in1-differential
 - realtek,in3-differential
 - realtek,in4-differential
diff --git a/Documentation/devicetree/bindings/sound/rt5660.txt b/Documentation/devicetree/bindings/sound/rt5660.txt
new file mode 100644
index 000000000000..30be5f921930
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/rt5660.txt
@@ -0,0 +1,47 @@
+RT5660 audio CODEC
+
+This device supports I2C only.
+
+Required properties:
+
+- compatible : "realtek,rt5660".
+
+- reg : The I2C address of the device.
+
+Optional properties:
+
+- clocks: The phandle of the master clock to the CODEC
+- clock-names: Should be "mclk"
+
+- realtek,in1-differential
+- realtek,in3-differential
+  Boolean. Indicate MIC1/3 input are differential, rather than single-ended.
+
+- realtek,poweroff-in-suspend
+  Boolean. If the codec will be powered off in suspend, the resume should be
+  added delay time for waiting codec power ready.
+
+- realtek,dmic1-data-pin
+  0: dmic1 is not used
+  1: using GPIO2 pin as dmic1 data pin
+  2: using IN1P pin as dmic1 data pin
+
+Pins on the device (for linking into audio routes) for RT5660:
+
+  * DMIC L1
+  * DMIC R1
+  * IN1P
+  * IN1N
+  * IN2P
+  * IN3P
+  * IN3N
+  * SPO
+  * LOUTL
+  * LOUTR
+
+Example:
+
+rt5660 {
+        compatible = "realtek,rt5660";
+        reg = <0x1c>;
+};
diff --git a/Documentation/devicetree/bindings/sound/rt5663.txt b/Documentation/devicetree/bindings/sound/rt5663.txt
new file mode 100644
index 000000000000..7d3c974c6e2e
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/rt5663.txt
@@ -0,0 +1,30 @@
+RT5663/RT5668 audio CODEC
+
+This device supports I2C only.
+
+Required properties:
+
+- compatible : One of "realtek,rt5663" or "realtek,rt5668".
+
+- reg : The I2C address of the device.
+
+- interrupts : The CODEC's interrupt output.
+
+Optional properties:
+
+Pins on the device (for linking into audio routes) for RT5663/RT5668:
+
+  * IN1P
+  * IN1N
+  * IN2P
+  * IN2N
+  * HPOL
+  * HPOR
+
+Example:
+
+codec: rt5663@12 {
+        compatible = "realtek,rt5663";
+        reg = <0x12>;
+        interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
+};
diff --git a/Documentation/devicetree/bindings/sound/simple-card.txt b/Documentation/devicetree/bindings/sound/simple-card.txt
index 59d862801e59..c7a93931fad2 100644
--- a/Documentation/devicetree/bindings/sound/simple-card.txt
+++ b/Documentation/devicetree/bindings/sound/simple-card.txt
@@ -22,6 +22,8 @@ Optional properties:
                                           headphones are attached.
 - simple-audio-card,mic-det-gpio        : Reference to GPIO that signals when
                                           a microphone is attached.
+- simple-audio-card,aux-devs            : List of phandles pointing to auxiliary devices, such
+                                          as amplifiers, to be added to the sound card.
 
 Optional subnodes:
 
@@ -162,3 +164,38 @@ sound {
                 };
         };
 };
+
+Example 3 - route audio from IMX6 SSI2 through TLV320DAC3100 codec
+through TPA6130A2 amplifier to headphones:
+
+&i2c0 {
+        codec: tlv320dac3100@18 {
+                compatible = "ti,tlv320dac3100";
+                ...
+        }
+
+        amp: tpa6130a2@60 {
+                compatible = "ti,tpa6130a2";
+                ...
+        }
+}
+
+sound {
+        compatible = "simple-audio-card";
+        ...
+        simple-audio-card,widgets =
+                "Headphone", "Headphone Jack";
+        simple-audio-card,routing =
+                "Headphone Jack", "HPLEFT",
+                "Headphone Jack", "HPRIGHT",
+                "LEFTIN", "HPL",
+                "RIGHTIN", "HPR";
+        simple-audio-card,aux-devs = <&amp>;
+        simple-audio-card,cpu {
+                sound-dai = <&ssi2>;
+        };
+        simple-audio-card,codec {
+                sound-dai = <&codec>;
+                clocks = ...
+        };
+};
diff --git a/Documentation/devicetree/bindings/sound/simple-scu-card.txt b/Documentation/devicetree/bindings/sound/simple-scu-card.txt
new file mode 100644
index 000000000000..d6fe47ed09af
--- /dev/null
+++ b/Documentation/devicetree/bindings/sound/simple-scu-card.txt
@@ -0,0 +1,110 @@
+ASoC simple SCU Sound Card
+
+Simple-Card specifies audio DAI connections of SoC <-> codec.
+
+Required properties:
+
+- compatible                            : "simple-scu-audio-card"
+                                          "renesas,rsrc-card"
+
+Optional properties:
+
+- simple-audio-card,name                : User specified audio sound card name, one string
+                                          property.
+- simple-audio-card,cpu                 : CPU   sub-node
+- simple-audio-card,codec               : CODEC sub-node
+
+Optional subnode properties:
+
+- simple-audio-card,format              : CPU/CODEC common audio format.
+                                          "i2s", "right_j", "left_j" , "dsp_a"
+                                          "dsp_b", "ac97", "pdm", "msb", "lsb"
+- simple-audio-card,frame-master        : Indicates dai-link frame master.
+                                          phandle to a cpu or codec subnode.
+- simple-audio-card,bitclock-master     : Indicates dai-link bit clock master.
+                                          phandle to a cpu or codec subnode.
+- simple-audio-card,bitclock-inversion  : bool property. Add this if the
+                                          dai-link uses bit clock inversion.
+- simple-audio-card,frame-inversion     : bool property. Add this if the
+                                          dai-link uses frame clock inversion.
+- simple-audio-card,convert-rate        : platform specified sampling rate convert
+- simple-audio-card,convert-channels    : platform specified converted channel size (2 - 8 ch)
+- simple-audio-card,prefix              : see audio-routing
+- simple-audio-card,routing             : A list of the connections between audio components.
+                                          Each entry is a pair of strings, the first being the connection's sink,
+                                          the second being the connection's source. Valid names for sources.
+                                          use audio-prefix if some components is using same sink/sources naming.
+                                          it can be used if compatible was "renesas,rsrc-card";
+
+Required CPU/CODEC subnodes properties:
+
+- sound-dai                             : phandle and port of CPU/CODEC
+
+Optional CPU/CODEC subnodes properties:
+
+- clocks / system-clock-frequency       : specify subnode's clock if needed.
+                                          it can be specified via "clocks" if system has
+                                          clock node (= common clock), or "system-clock-frequency"
+                                          (if system doens't support common clock)
+                                          If a clock is specified, it is
+                                          enabled with clk_prepare_enable()
+                                          in dai startup() and disabled with
+                                          clk_disable_unprepare() in dai
+                                          shutdown().
+
+Example 1. Sampling Rate Covert
+
+sound {
+        compatible = "simple-scu-audio-card";
+
+        simple-audio-card,name = "rsnd-ak4643";
+        simple-audio-card,format = "left_j";
+        simple-audio-card,format = "left_j";
+        simple-audio-card,bitclock-master = <&sndcodec>;
+        simple-audio-card,frame-master = <&sndcodec>;
+
+        simple-audio-card,convert-rate = <48000>; /* see audio_clk_a */
+
+        simple-audio-card,prefix = "ak4642";
+        simple-audio-card,routing = "ak4642 Playback", "DAI0 Playback",
+                        "DAI0 Capture", "ak4642 Capture";
+
+        sndcpu: simple-audio-card,cpu {
+                sound-dai = <&rcar_sound>;
+        };
+
+        sndcodec: simple-audio-card,codec {
+                sound-dai = <&ak4643>;
+                system-clock-frequency = <11289600>;
+        };
+};
+
+Example 2. 2 CPU 1 Codec
+
+sound {
+        compatible = "renesas,rsrc-card";
+
+        card-name = "rsnd-ak4643";
+        format = "left_j";
+        bitclock-master = <&dpcmcpu>;
+        frame-master = <&dpcmcpu>;
+
+        convert-rate = <48000>;  /* see audio_clk_a */
+
+        audio-prefix = "ak4642";
+        audio-routing = "ak4642 Playback", "DAI0 Playback",
+                        "ak4642 Playback", "DAI1 Playback";
+
+        dpcmcpu: cpu@0 {
+                sound-dai = <&rcar_sound 0>;
+        };
+
+        cpu@1 {
+                sound-dai = <&rcar_sound 1>;
+        };
+
+        codec {
+                sound-dai = <&ak4643>;
+                clocks = <&audio_clock>;
+        };
+};
diff --git a/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt b/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt
index 16bcdfb6760e..745dc62f76ea 100644
--- a/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt
+++ b/Documentation/devicetree/bindings/sound/st,sti-asoc-card.txt
@@ -11,7 +11,9 @@ Documentation/devicetree/bindings/sound/simple-card.txt.
 ---------------------------------------
 
 Required properties:
-  - compatible: "st,sti-uni-player" or "st,sti-uni-reader"
+  - compatible: "st,stih407-uni-player-hdmi", "st,stih407-uni-player-pcm-out",
+                "st,stih407-uni-player-dac", "st,stih407-uni-player-spdif",
+                "st,stih407-uni-reader-pcm_in", "st,stih407-uni-reader-hdmi",
 
   - st,syscfg: phandle to boot-device system configuration registers
 
@@ -33,32 +35,24 @@ Required properties:
         "tx" for "st,sti-uni-player" compatibility
         "rx" for "st,sti-uni-reader" compatibility
 
-  - st,version: IP version integrated in SOC.
-
-  - dai-name: DAI name that describes the IP.
-
-  - st,mode: IP working mode depending on associated codec.
-        "HDMI" connected to HDMI codec and support IEC HDMI formats (player only).
-        "SPDIF" connected to SPDIF codec and support SPDIF formats (player only).
-        "PCM" PCM standard mode for I2S or TDM bus.
-        "TDM" TDM mode for TDM bus.
-
 Required properties ("st,sti-uni-player" compatibility only):
   - clocks: CPU_DAI IP clock source, listed in the same order than the
             CPU_DAI properties.
 
-  - st,uniperiph-id: internal SOC IP instance ID.
-
 Optional properties:
   - pinctrl-0: defined for CPU_DAI@1 and CPU_DAI@4 to describe I2S PIOs for
                external codecs connection.
 
   - pinctrl-names: should contain only one value - "default".
 
+  - st,tdm-mode: to declare to set TDM mode for unireader and uniplayer IPs.
+        Only compartible with IPs in charge of the external I2S/TDM bus.
+        Should be declared depending on associated codec.
+
 Example:
 
-        sti_uni_player1: sti-uni-player@1 {
-                compatible = "st,sti-uni-player";
+        sti_uni_player1: sti-uni-player@0x8D81000 {
+                compatible = "st,stih407-uni-player-hdmi";
                 status = "okay";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
@@ -66,15 +60,12 @@ Example:
                 reg = <0x8D81000 0x158>;
                 interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>;
                 dmas = <&fdma0 3 0 1>;
-                st,dai-name = "Uni Player #1 (I2S)";
                 dma-names = "tx";
-                st,uniperiph-id = <1>;
-                st,version = <5>;
-                st,mode = "TDM";
+                st,tdm-mode = <1>;
         };
 
-        sti_uni_player2: sti-uni-player@2 {
-                compatible = "st,sti-uni-player";
+        sti_uni_player2: sti-uni-player@0x8D82000 {
+                compatible = "st,stih407-uni-player-pcm-out";
                 status = "okay";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
@@ -82,15 +73,11 @@ Example:
                 reg = <0x8D82000 0x158>;
                 interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>;
                 dmas = <&fdma0 4 0 1>;
-                dai-name = "Uni Player #2 (DAC)";
                 dma-names = "tx";
-                st,uniperiph-id = <2>;
-                st,version = <5>;
-                st,mode = "PCM";
         };
 
-        sti_uni_player3: sti-uni-player@3 {
-                compatible = "st,sti-uni-player";
+        sti_uni_player3: sti-uni-player@0x8D85000 {
+                compatible = "st,stih407-uni-player-spdif";
                 status = "okay";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
@@ -99,14 +86,10 @@ Example:
                 interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>;
                 dmas = <&fdma0 7 0 1>;
                 dma-names = "tx";
-                dai-name = "Uni Player #3 (SPDIF)";
-                st,uniperiph-id = <3>;
-                st,version = <5>;
-                st,mode = "SPDIF";
         };
 
-        sti_uni_reader1: sti-uni-reader@1 {
-                compatible = "st,sti-uni-reader";
+        sti_uni_reader1: sti-uni-reader@0x8D84000 {
+                compatible = "st,stih407-uni-reader-hdmi";
                 status = "disabled";
                 #sound-dai-cells = <0>;
                 st,syscfg = <&syscfg_core>;
@@ -114,9 +97,6 @@ Example:
                 interrupts = <GIC_SPI 88 IRQ_TYPE_NONE>;
                 dmas = <&fdma0 6 0 1>;
                 dma-names = "rx";
-                dai-name = "Uni Reader #1 (HDMI RX)";
-                st,version = <3>;
-                st,mode = "PCM";
         };
 
 2) sti-sas-codec: internal audio codec IPs driver
diff --git a/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt b/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt
index 13503aa505a9..0230c4d20506 100644
--- a/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt
+++ b/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt
@@ -9,6 +9,7 @@ Required properties:
 
   - compatible          : should be one of the following:
     - "allwinner,sun4i-a10-spdif": for the Allwinner A10 SoC
+    - "allwinner,sun6i-a31-spdif": for the Allwinner A31 SoC
 
   - reg                 : Offset and length of the register set for the device.
 
@@ -25,6 +26,8 @@ Required properties:
         "apb"             clock for the spdif bus.
         "spdif"           clock for spdif controller.
 
+  - resets              : reset specifier for the ahb reset (A31 and newer only)
+
 Example:
 
 spdif: spdif@01c21000 {
diff --git a/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt b/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt
index eff12be5e789..9340d2ddcc54 100644
--- a/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt
+++ b/Documentation/devicetree/bindings/sound/tlv320aic31xx.txt
@@ -11,6 +11,7 @@ Required properties:
     "ti,tlv320aic3110" - TLV320AIC3110 (stereo speaker amp, no MiniDSP)
     "ti,tlv320aic3120" - TLV320AIC3120 (mono speaker amp, MiniDSP)
     "ti,tlv320aic3111" - TLV320AIC3111 (stereo speaker amp, MiniDSP)
+    "ti,tlv320dac3100" - TLV320DAC3100 (no ADC, mono speaker amp, no MiniDSP)
 
 - reg - <int> -  I2C slave address
 - HPVDD-supply, SPRVDD-supply, SPLVDD-supply, AVDD-supply, IOVDD-supply,
@@ -37,9 +38,11 @@ CODEC output pins:
   * MICBIAS
 
 CODEC input pins:
-  * MIC1LP
-  * MIC1RP
-  * MIC1LM
+  * MIC1LP, devices with ADC
+  * MIC1RP, devices with ADC
+  * MIC1LM, devices with ADC
+  * AIN1, devices without ADC
+  * AIN2, devices without ADC
 
 The pins can be used in referring sound node's audio-routing property.
 
diff --git a/Documentation/devicetree/bindings/thermal/thermal.txt b/Documentation/devicetree/bindings/thermal/thermal.txt
index 41b817f7b670..88b6ea1ad290 100644
--- a/Documentation/devicetree/bindings/thermal/thermal.txt
+++ b/Documentation/devicetree/bindings/thermal/thermal.txt
@@ -62,7 +62,7 @@ For more examples of cooling devices, refer to the example sections below.
 Required properties:
 - #cooling-cells:       Used to provide cooling device specific information
   Type: unsigned        while referring to it. Must be at least 2, in order
-  Size: one cell        to specify minimum and maximum cooling state used
+  Size: one cell        to specify minimum and maximum cooling state used
                         in the reference. The first cell is the minimum
                         cooling state requested and the second cell is
                         the maximum cooling state requested in the reference.
@@ -119,7 +119,7 @@ Required properties:
 Optional property:
 - contribution:         The cooling contribution to the thermal zone of the
   Type: unsigned        referred cooling device at the referred trip point.
-  Size: one cell        The contribution is a ratio of the sum
+  Size: one cell        The contribution is a ratio of the sum
                         of all cooling contributions within a thermal zone.
 
 Note: Using the THERMAL_NO_LIMIT (-1UL) constant in the cooling-device phandle
@@ -145,7 +145,7 @@ Required properties:
   Size: one cell
 
 - thermal-sensors:      A list of thermal sensor phandles and sensor specifier
-  Type: list of         used while monitoring the thermal zone.
+  Type: list of         used while monitoring the thermal zone.
   phandles + sensor
   specifier
 
@@ -473,7 +473,7 @@ thermal-zones {
                                   <&adc>;       /* pcb north */
 
                 /* hotspot = 100 * bandgap - 120 * adc + 484 */
-                coefficients =          <100    -120    484>;
+                coefficients =          <100    -120    484>;
 
                 trips {
                         ...
@@ -502,7 +502,7 @@ from the ADC sensor. The binding would be then:
         thermal-sensors =  <&adc>;
 
                 /* hotspot = 1 * adc + 6000 */
-        coefficients =          <1      6000>;
+        coefficients =          <1      6000>;
 
 (d) - Board thermal
 
diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
index d6259c786316..bcbf9710e4af 100644
--- a/Documentation/filesystems/overlayfs.txt
+++ b/Documentation/filesystems/overlayfs.txt
@@ -183,12 +183,10 @@ The copy_up operation essentially creates a new, identical file and
 moves it over to the old name.  The new file may be on a different
 filesystem, so both st_dev and st_ino of the file may change.
 
-Any open files referring to this inode will access the old data and
-metadata.  Similarly any file locks obtained before copy_up will not
-apply to the copied up file.
+Any open files referring to this inode will access the old data.
 
-On a file opened with O_RDONLY fchmod(2), fchown(2), futimesat(2) and
-fsetxattr(2) will fail with EROFS.
+Any file locks (and leases) obtained before copy_up will not apply
+to the copied up file.
 
 If a file with multiple hard links is copied up, then this will
 "break" the link.  Changes will not be propagated to other names
diff --git a/Documentation/hwmon/ftsteutates b/Documentation/hwmon/ftsteutates
index 2a1bf69c6a26..8c10a916de20 100644
--- a/Documentation/hwmon/ftsteutates
+++ b/Documentation/hwmon/ftsteutates
@@ -19,5 +19,5 @@ enhancements. It can monitor up to 4 voltages, 16 temperatures and
 implemented in this driver.
 
 Specification of the chip can be found here:
-ftp:///pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/BMC-Teutates_Specification_V1.21.pdf
-ftp:///pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/Fujitsu_mainboards-1-Sensors_HowTo-en-US.pdf
+ftp://ftp.ts.fujitsu.com/pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/BMC-Teutates_Specification_V1.21.pdf
+ftp://ftp.ts.fujitsu.com/pub/Mainboard-OEM-Sales/Services/Software&Tools/Linux_SystemMonitoring&Watchdog&GPIO/Fujitsu_mainboards-1-Sensors_HowTo-en-US.pdf
diff --git a/Documentation/i2c/slave-interface b/Documentation/i2c/slave-interface
index 80807adb8ded..7e2a228f21bc 100644
--- a/Documentation/i2c/slave-interface
+++ b/Documentation/i2c/slave-interface
@@ -145,6 +145,11 @@ If you want to add slave support to the bus driver:
 
 * Catch the slave interrupts and send appropriate i2c_slave_events to the backend.
 
+Note that most hardware supports being master _and_ slave on the same bus. So,
+if you extend a bus driver, please make sure that the driver supports that as
+well. In almost all cases, slave support does not need to disable the master
+functionality.
+
 Check the i2c-rcar driver as an example.
 
 
diff --git a/Documentation/kernel-documentation.rst b/Documentation/kernel-documentation.rst
index c4eb5049da39..391decc66a18 100644
--- a/Documentation/kernel-documentation.rst
+++ b/Documentation/kernel-documentation.rst
@@ -366,8 +366,6 @@ Domain`_ references.
 Cross-referencing from reStructuredText
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-.. highlight:: none
-
 To cross-reference the functions and types defined in the kernel-doc comments
 from reStructuredText documents, please use the `Sphinx C Domain`_
 references. For example::
@@ -390,8 +388,6 @@ For further details, please refer to the `Sphinx C Domain`_ documentation.
 Function documentation
 ----------------------
 
-.. highlight:: c
-
 The general format of a function and function-like macro kernel-doc comment is::
 
   /**
@@ -572,8 +568,6 @@ DocBook XML [DEPRECATED]
 Converting DocBook to Sphinx
 ----------------------------
 
-.. highlight:: none
-
 Over time, we expect all of the documents under ``Documentation/DocBook`` to be
 converted to Sphinx and reStructuredText. For most DocBook XML documents, a good
 enough solution is to use the simple ``Documentation/sphinx/tmplcvt`` script,
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 46c030a49186..a4f4d693e2c1 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -3032,6 +3032,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                                 PAGE_SIZE is used as alignment.
                                 PCI-PCI bridge can be specified, if resource
                                 windows need to be expanded.
+                                To specify the alignment for several
+                                instances of a device, the PCI vendor,
+                                device, subvendor, and subdevice may be
+                                specified, e.g., 4096@pci:8086:9c22:103c:198f
                 ecrc=           Enable/disable PCIe ECRC (transaction layer
                                 end-to-end CRC checking).
                                 bios: Use BIOS/firmware settings. This is the
diff --git a/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
index 04ee90099676..201d4839931c 100644
--- a/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-adap-g-log-addrs.rst
@@ -144,7 +144,7 @@ logical address types are already defined will return with error ``EBUSY``.
 
        -  ``flags``
 
-       -  Flags. No flags are defined yet, so set this to 0.
+       -  Flags. See :ref:`cec-log-addrs-flags` for a list of available flags.
 
     -  .. row 7
 
@@ -201,6 +201,25 @@ logical address types are already defined will return with error ``EBUSY``.
           give the CEC framework more information about the device type, even
           though the framework won't use it directly in the CEC message.
 
+.. _cec-log-addrs-flags:
+
+.. flat-table:: Flags for struct cec_log_addrs
+    :header-rows:  0
+    :stub-columns: 0
+    :widths:       3 1 4
+
+
+    -  .. _`CEC-LOG-ADDRS-FL-ALLOW-UNREG-FALLBACK`:
+
+       -  ``CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK``
+
+       -  1
+
+       -  By default if no logical address of the requested type can be claimed, then
+          it will go back to the unconfigured state. If this flag is set, then it will
+          fallback to the Unregistered logical address. Note that if the Unregistered
+          logical address was explicitly requested, then this flag has no effect.
+
 .. _cec-versions:
 
 .. flat-table:: CEC Versions
diff --git a/Documentation/media/uapi/cec/cec-ioc-dqevent.rst b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
index 7a6d6d00ce19..2e1e73928396 100644
--- a/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
+++ b/Documentation/media/uapi/cec/cec-ioc-dqevent.rst
@@ -64,7 +64,8 @@ it is guaranteed that the state did change in between the two events.
 
        -  ``phys_addr``
 
-       -  The current physical address.
+       -  The current physical address. This is ``CEC_PHYS_ADDR_INVALID`` if no
+          valid physical address is set.
 
     -  .. row 2
 
@@ -72,7 +73,10 @@ it is guaranteed that the state did change in between the two events.
 
        -  ``log_addr_mask``
 
-       -  The current set of claimed logical addresses.
+       -  The current set of claimed logical addresses. This is 0 if no logical
+          addresses are claimed or if ``phys_addr`` is ``CEC_PHYS_ADDR_INVALID``.
+          If bit 15 is set (``1 << CEC_LOG_ADDR_UNREGISTERED``) then this device
+          has the unregistered logical address. In that case all other bits are 0.
 
 
 
diff --git a/Documentation/networking/dsa/dsa.txt b/Documentation/networking/dsa/dsa.txt
index 9d05ed7f7da5..f20c884c048a 100644
--- a/Documentation/networking/dsa/dsa.txt
+++ b/Documentation/networking/dsa/dsa.txt
@@ -587,26 +587,6 @@ of DSA, would be the its port-based VLAN, used by the associated bridge device.
 TODO
 ====
 
-The platform device problem
----------------------------
-DSA is currently implemented as a platform device driver which is far from ideal
-as was discussed in this thread:
-
-http://permalink.gmane.org/gmane.linux.network/329848
-
-This basically prevents the device driver model to be properly used and applied,
-and support non-MDIO, non-MMIO Ethernet connected switches.
-
-Another problem with the platform device driver approach is that it prevents the
-use of a modular switch drivers build due to a circular dependency, illustrated
-here:
-
-http://comments.gmane.org/gmane.linux.network/345803
-
-Attempts of reworking this has been done here:
-
-https://lwn.net/Articles/643149/
-
 Making SWITCHDEV and DSA converge towards an unified codebase
 -------------------------------------------------------------
 
diff --git a/Documentation/networking/rxrpc.txt b/Documentation/networking/rxrpc.txt
index 16a924c486bf..70c926ae212d 100644
--- a/Documentation/networking/rxrpc.txt
+++ b/Documentation/networking/rxrpc.txt
@@ -790,13 +790,12 @@ The kernel interface functions are as follows:
      Data messages can have their contents extracted with the usual bunch of
      socket buffer manipulation functions.  A data message can be determined to
      be the last one in a sequence with rxrpc_kernel_is_data_last().  When a
-     data message has been used up, rxrpc_kernel_data_delivered() should be
-     called on it..
+     data message has been used up, rxrpc_kernel_data_consumed() should be
+     called on it.
 
-     Non-data messages should be handled to rxrpc_kernel_free_skb() to dispose
-     of.  It is possible to get extra refs on all types of message for later
-     freeing, but this may pin the state of a call until the message is finally
-     freed.
+     Messages should be handled to rxrpc_kernel_free_skb() to dispose of.  It
+     is possible to get extra refs on all types of message for later freeing,
+     but this may pin the state of a call until the message is finally freed.
 
  (*) Accept an incoming call.
 
@@ -821,12 +820,14 @@ The kernel interface functions are as follows:
      Other errors may be returned if the call had been aborted (-ECONNABORTED)
      or had timed out (-ETIME).
 
- (*) Record the delivery of a data message and free it.
+ (*) Record the delivery of a data message.
 
-        void rxrpc_kernel_data_delivered(struct sk_buff *skb);
+        void rxrpc_kernel_data_consumed(struct rxrpc_call *call,
+                                        struct sk_buff *skb);
 
-     This is used to record a data message as having been delivered and to
-     update the ACK state for the call.  The socket buffer will be freed.
+     This is used to record a data message as having been consumed and to
+     update the ACK state for the call.  The message must still be passed to
+     rxrpc_kernel_free_skb() for disposal by the caller.
 
  (*) Free a message.
 
diff --git a/Documentation/power/basic-pm-debugging.txt b/Documentation/power/basic-pm-debugging.txt
index b96098ccfe69..708f87f78a75 100644
--- a/Documentation/power/basic-pm-debugging.txt
+++ b/Documentation/power/basic-pm-debugging.txt
@@ -164,7 +164,32 @@ load n/2 modules more and try again.
 Again, if you find the offending module(s), it(they) must be unloaded every time
 before hibernation, and please report the problem with it(them).
 
-c) Advanced debugging
+c) Using the "test_resume" hibernation option
+
+/sys/power/disk generally tells the kernel what to do after creating a
+hibernation image.  One of the available options is "test_resume" which
+causes the just created image to be used for immediate restoration.  Namely,
+after doing:
+
+# echo test_resume > /sys/power/disk
+# echo disk > /sys/power/state
+
+a hibernation image will be created and a resume from it will be triggered
+immediately without involving the platform firmware in any way.
+
+That test can be used to check if failures to resume from hibernation are
+related to bad interactions with the platform firmware.  That is, if the above
+works every time, but resume from actual hibernation does not work or is
+unreliable, the platform firmware may be responsible for the failures.
+
+On architectures and platforms that support using different kernels to restore
+hibernation images (that is, the kernel used to read the image from storage and
+load it into memory is different from the one included in the image) or support
+kernel address space randomization, it also can be used to check if failures
+to resume may be related to the differences between the restore and image
+kernels.
+
+d) Advanced debugging
 
 In case that hibernation does not work on your system even in the minimal
 configuration and compiling more drivers as modules is not practical or some
diff --git a/Documentation/power/interface.txt b/Documentation/power/interface.txt
index f1f0f59a7c47..974916ff6608 100644
--- a/Documentation/power/interface.txt
+++ b/Documentation/power/interface.txt
@@ -1,75 +1,76 @@
-Power Management Interface
-
-
-The power management subsystem provides a unified sysfs interface to 
-userspace, regardless of what architecture or platform one is
-running. The interface exists in /sys/power/ directory (assuming sysfs
-is mounted at /sys). 
-
-/sys/power/state controls system power state. Reading from this file
-returns what states are supported, which is hard-coded to 'freeze',
-'standby' (Power-On Suspend), 'mem' (Suspend-to-RAM), and 'disk'
-(Suspend-to-Disk). 
-
-Writing to this file one of those strings causes the system to
-transition into that state. Please see the file
-Documentation/power/states.txt for a description of each of those
-states.
-
-
-/sys/power/disk controls the operating mode of the suspend-to-disk
-mechanism. Suspend-to-disk can be handled in several ways. We have a
-few options for putting the system to sleep - using the platform driver
-(e.g. ACPI or other suspend_ops), powering off the system or rebooting the
-system (for testing).
-
-Additionally, /sys/power/disk can be used to turn on one of the two testing
-modes of the suspend-to-disk mechanism: 'testproc' or 'test'.  If the
-suspend-to-disk mechanism is in the 'testproc' mode, writing 'disk' to
-/sys/power/state will cause the kernel to disable nonboot CPUs and freeze
-tasks, wait for 5 seconds, unfreeze tasks and enable nonboot CPUs.  If it is
-in the 'test' mode, writing 'disk' to /sys/power/state will cause the kernel
-to disable nonboot CPUs and freeze tasks, shrink memory, suspend devices, wait
-for 5 seconds, resume devices, unfreeze tasks and enable nonboot CPUs.  Then,
-we are able to look in the log messages and work out, for example, which code
-is being slow and which device drivers are misbehaving.
-
-Reading from this file will display all supported modes and the currently
-selected one in brackets, for example
-
-        [shutdown] reboot test testproc
-
-Writing to this file will accept one of
-
-       'platform' (only if the platform supports it)
-       'shutdown'
-       'reboot'
-       'testproc'
-       'test'
-
-/sys/power/image_size controls the size of the image created by
-the suspend-to-disk mechanism.  It can be written a string
-representing a non-negative integer that will be used as an upper
-limit of the image size, in bytes.  The suspend-to-disk mechanism will
-do its best to ensure the image size will not exceed that number.  However,
-if this turns out to be impossible, it will try to suspend anyway using the
-smallest image possible.  In particular, if "0" is written to this file, the
-suspend image will be as small as possible.
-
-Reading from this file will display the current image size limit, which
-is set to 2/5 of available RAM by default.
-
-/sys/power/pm_trace controls the code which saves the last PM event point in
-the RTC across reboots, so that you can debug a machine that just hangs
-during suspend (or more commonly, during resume).  Namely, the RTC is only
-used to save the last PM event point if this file contains '1'.  Initially it
-contains '0' which may be changed to '1' by writing a string representing a
-nonzero integer into it.
-
-To use this debugging feature you should attempt to suspend the machine, then
-reboot it and run
-
-        dmesg -s 1000000 | grep 'hash matches'
-
-CAUTION: Using it will cause your machine's real-time (CMOS) clock to be
-set to a random invalid time after a resume.
+Power Management Interface for System Sleep
+
+Copyright (c) 2016 Intel Corp., Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+The power management subsystem provides userspace with a unified sysfs interface
+for system sleep regardless of the underlying system architecture or platform.
+The interface is located in the /sys/power/ directory (assuming that sysfs is
+mounted at /sys).
+
+/sys/power/state is the system sleep state control file.
+
+Reading from it returns a list of supported sleep states, encoded as:
+
+'freeze' (Suspend-to-Idle)
+'standby' (Power-On Suspend)
+'mem' (Suspend-to-RAM)
+'disk' (Suspend-to-Disk)
+
+Suspend-to-Idle is always supported.  Suspend-to-Disk is always supported
+too as long the kernel has been configured to support hibernation at all
+(ie. CONFIG_HIBERNATION is set in the kernel configuration file).  Support
+for Suspend-to-RAM and Power-On Suspend depends on the capabilities of the
+platform.
+
+If one of the strings listed in /sys/power/state is written to it, the system
+will attempt to transition into the corresponding sleep state.  Refer to
+Documentation/power/states.txt for a description of each of those states.
+
+/sys/power/disk controls the operating mode of hibernation (Suspend-to-Disk).
+Specifically, it tells the kernel what to do after creating a hibernation image.
+
+Reading from it returns a list of supported options encoded as:
+
+'platform' (put the system into sleep using a platform-provided method)
+'shutdown' (shut the system down)
+'reboot' (reboot the system)
+'suspend' (trigger a Suspend-to-RAM transition)
+'test_resume' (resume-after-hibernation test mode)
+
+The currently selected option is printed in square brackets.
+
+The 'platform' option is only available if the platform provides a special
+mechanism to put the system to sleep after creating a hibernation image (ACPI
+does that, for example).  The 'suspend' option is available if Suspend-to-RAM
+is supported.  Refer to Documentation/power/basic_pm_debugging.txt for the
+description of the 'test_resume' option.
+
+To select an option, write the string representing it to /sys/power/disk.
+
+/sys/power/image_size controls the size of hibernation images.
+
+It can be written a string representing a non-negative integer that will be
+used as a best-effort upper limit of the image size, in bytes.  The hibernation
+core will do its best to ensure that the image size will not exceed that number.
+However, if that turns out to be impossible to achieve, a hibernation image will
+still be created and its size will be as small as possible.  In particular,
+writing '0' to this file will enforce hibernation images to be as small as
+possible.
+
+Reading from this file returns the current image size limit, which is set to
+around 2/5 of available RAM by default.
+
+/sys/power/pm_trace controls the PM trace mechanism saving the last suspend
+or resume event point in the RTC across reboots.
+
+It helps to debug hard lockups or reboots due to device driver failures that
+occur during system suspend or resume (which is more common) more effectively.
+
+If /sys/power/pm_trace contains '1', the fingerprint of each suspend/resume
+event point in turn will be stored in the RTC memory (overwriting the actual
+RTC information), so it will survive a system crash if one occurs right after
+storing it and it can be used later to identify the driver that caused the crash
+to happen (see Documentation/power/s2ram.txt for more information).
+
+Initially it contains '0' which may be changed to '1' by writing a string
+representing a nonzero integer into it.
diff --git a/Documentation/powerpc/transactional_memory.txt b/Documentation/powerpc/transactional_memory.txt
index ba0a2a4a54ba..e32fdbb4c9a7 100644
--- a/Documentation/powerpc/transactional_memory.txt
+++ b/Documentation/powerpc/transactional_memory.txt
@@ -167,6 +167,8 @@ signal will be rolled back anyway.
 For signals taken in non-TM or suspended mode, we use the
 normal/non-checkpointed stack pointer.
 
+Any transaction initiated inside a sighandler and suspended on return
+from the sighandler to the kernel will get reclaimed and discarded.
 
 Failure cause codes used by kernel
 ==================================
diff --git a/Documentation/rapidio/mport_cdev.txt b/Documentation/rapidio/mport_cdev.txt
index 6e491a662461..a53f786ee2e9 100644
--- a/Documentation/rapidio/mport_cdev.txt
+++ b/Documentation/rapidio/mport_cdev.txt
@@ -80,6 +80,10 @@ functionality of their platform when planning to use this driver:
 
 III. Module parameters
 
+- 'dma_timeout' - DMA transfer completion timeout (in msec, default value 3000).
+        This parameter set a maximum completion wait time for SYNC mode DMA
+        transfer requests and for RIO_WAIT_FOR_ASYNC ioctl requests.
+
 - 'dbg_level' - This parameter allows to control amount of debug information
         generated by this device driver. This parameter is formed by set of
         bit masks that correspond to the specific functional blocks.
diff --git a/Documentation/sphinx-static/theme_overrides.css b/Documentation/sphinx-static/theme_overrides.css
index 3a2ac4bcfd78..e88461c4c1e6 100644
--- a/Documentation/sphinx-static/theme_overrides.css
+++ b/Documentation/sphinx-static/theme_overrides.css
@@ -42,11 +42,12 @@
     caption a.headerlink { opacity: 0; }
     caption a.headerlink:hover { opacity: 1; }
 
-    /* inline literal: drop the borderbox and red color */
+    /* inline literal: drop the borderbox, padding and red color */
 
     code, .rst-content tt, .rst-content code {
         color: inherit;
         border: none;
+        padding: unset;
         background: inherit;
         font-size: 85%;
     }
diff --git a/MAINTAINERS b/MAINTAINERS
index 20bb1d00098c..01bff8ea28d8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -798,6 +798,7 @@ M:	Laura Abbott <labbott@redhat.com>
 M:      Sumit Semwal <sumit.semwal@linaro.org>
 L:      devel@driverdev.osuosl.org
 S:      Supported
+F:      Documentation/devicetree/bindings/staging/ion/
 F:      drivers/staging/android/ion
 F:      drivers/staging/android/uapi/ion.h
 F:      drivers/staging/android/uapi/ion_test.h
@@ -881,6 +882,15 @@ S:	Supported
 F:      drivers/gpu/drm/arc/
 F:      Documentation/devicetree/bindings/display/snps,arcpgu.txt
 
+ARM ARCHITECTED TIMER DRIVER
+M:      Mark Rutland <mark.rutland@arm.com>
+M:      Marc Zyngier <marc.zyngier@arm.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/include/asm/arch_timer.h
+F:      arch/arm64/include/asm/arch_timer.h
+F:      drivers/clocksource/arm_arch_timer.c
+
 ARM HDLCD DRM DRIVER
 M:      Liviu Dudau <liviu.dudau@arm.com>
 S:      Supported
@@ -1004,6 +1014,7 @@ N:	meson
 ARM/Annapurna Labs ALPINE ARCHITECTURE
 M:      Tsahee Zidenberg <tsahee@annapurnalabs.com>
 M:      Antoine Tenart <antoine.tenart@free-electrons.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-alpine/
 F:      arch/arm/boot/dts/alpine*
@@ -1613,7 +1624,8 @@ N:	rockchip
 
 ARM/SAMSUNG EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene@kernel.org>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+R:      Javier Martinez Canillas <javier@osg.samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
@@ -1633,7 +1645,6 @@ F:	drivers/*/*s3c64xx*
 F:      drivers/*/*s5pv210*
 F:      drivers/memory/samsung/*
 F:      drivers/soc/samsung/*
-F:      drivers/spi/spi-s3c*
 F:      Documentation/arm/Samsung/
 F:      Documentation/devicetree/bindings/arm/samsung/
 F:      Documentation/devicetree/bindings/sram/samsung-sram.txt
@@ -1821,6 +1832,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-stericsson.git
 ARM/UNIPHIER ARCHITECTURE
 M:      Masahiro Yamada <yamada.masahiro@socionext.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-uniphier.git
 S:      Maintained
 F:      arch/arm/boot/dts/uniphier*
 F:      arch/arm/include/asm/hardware/cache-uniphier.h
@@ -2474,7 +2486,7 @@ F:	include/net/bluetooth/
 BONDING DRIVER
 M:      Jay Vosburgh <j.vosburgh@gmail.com>
 M:      Veaceslav Falico <vfalico@gmail.com>
-M:      Andy Gospodarek <gospo@cumulusnetworks.com>
+M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/bonding/
 S:      Supported
@@ -2489,7 +2501,7 @@ S:	Supported
 F:      kernel/bpf/
 
 BROADCOM B44 10/100 ETHERNET DRIVER
-M:      Gary Zambrano <zambrano@broadcom.com>
+M:      Michael Chan <michael.chan@broadcom.com>
 L:      netdev@vger.kernel.org
 S:      Supported
 F:      drivers/net/ethernet/broadcom/b44.*
@@ -3237,7 +3249,7 @@ F:	kernel/cpuset.c
 CONTROL GROUP - MEMORY RESOURCE CONTROLLER (MEMCG)
 M:      Johannes Weiner <hannes@cmpxchg.org>
 M:      Michal Hocko <mhocko@kernel.org>
-M:      Vladimir Davydov <vdavydov@virtuozzo.com>
+M:      Vladimir Davydov <vdavydov.dev@gmail.com>
 L:      cgroups@vger.kernel.org
 L:      linux-mm@kvack.org
 S:      Maintained
@@ -3258,7 +3270,7 @@ S:	Maintained
 F:      drivers/net/wan/cosa*
 
 CPMAC ETHERNET DRIVER
-M:      Florian Fainelli <florian@openwrt.org>
+M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ethernet/ti/cpmac.c
@@ -4524,6 +4536,12 @@ L:	linux-edac@vger.kernel.org
 S:      Maintained
 F:      drivers/edac/sb_edac.c
 
+EDAC-SKYLAKE
+M:      Tony Luck <tony.luck@intel.com>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      drivers/edac/skx_edac.c
+
 EDAC-XGENE
 APPLIED MICRO (APM) X-GENE SOC EDAC
 M:     Loc Ho <lho@apm.com>
@@ -6085,7 +6103,7 @@ S:	Supported
 F:      drivers/cpufreq/intel_pstate.c
 
 INTEL FRAMEBUFFER DRIVER (excluding 810 and 815)
-M:      Maik Broemme <mbroemme@plusserver.de>
+M:      Maik Broemme <mbroemme@libmpq.org>
 L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      Documentation/fb/intelfb.txt
@@ -7448,7 +7466,8 @@ F:	Documentation/devicetree/bindings/sound/max9860.txt
 F:      sound/soc/codecs/max9860.*
 
 MAXIM MUIC CHARGER DRIVERS FOR EXYNOS BASED BOARDS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-pm@vger.kernel.org
 S:      Supported
 F:      drivers/power/max14577_charger.c
@@ -7464,7 +7483,8 @@ F:	include/dt-bindings/*/*max77802.h
 
 MAXIM PMIC AND MUIC DRIVERS FOR EXYNOS BASED BOARDS
 M:      Chanwoo Choi <cw00.choi@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 S:      Supported
 F:      drivers/*/max14577*.c
@@ -7654,7 +7674,7 @@ L:	linux-rdma@vger.kernel.org
 S:      Supported
 W:      https://github.com/SoftRoCE/rxe-dev/wiki/rxe-dev:-Home
 Q:      http://patchwork.kernel.org/project/linux-rdma/list/
-F:      drivers/infiniband/hw/rxe/
+F:      drivers/infiniband/sw/rxe/
 F:      include/uapi/rdma/rdma_user_rxe.h
 
 MEMBARRIER SUPPORT
@@ -8141,6 +8161,15 @@ S:	Maintained
 W:      https://fedorahosted.org/dropwatch/
 F:      net/core/drop_monitor.c
 
+NETWORKING [DSA]
+M:      Andrew Lunn <andrew@lunn.ch>
+M:      Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+M:      Florian Fainelli <f.fainelli@gmail.com>
+S:      Maintained
+F:      net/dsa/
+F:      include/net/dsa.h
+F:      drivers/net/dsa/
+
 NETWORKING [GENERAL]
 M:      "David S. Miller" <davem@davemloft.net>
 L:      netdev@vger.kernel.org
@@ -9230,7 +9259,7 @@ F:	drivers/pinctrl/sh-pfc/
 
 PIN CONTROLLER - SAMSUNG
 M:      Tomasz Figa <tomasz.figa@gmail.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
@@ -10163,7 +10192,7 @@ S:	Maintained
 F:      drivers/platform/x86/samsung-laptop.c
 
 SAMSUNG AUDIO (ASoC) DRIVERS
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
 M:      Sangbeom Kim <sbkim73@samsung.com>
 M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -10178,7 +10207,8 @@ F:	drivers/video/fbdev/s3c-fb.c
 
 SAMSUNG MULTIFUNCTION PMIC DEVICE DRIVERS
 M:      Sangbeom Kim <sbkim73@samsung.com>
-M:      Krzysztof Kozlowski <k.kozlowski@samsung.com>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
 L:      linux-kernel@vger.kernel.org
 L:      linux-samsung-soc@vger.kernel.org
 S:      Supported
@@ -10237,6 +10267,17 @@ S:	Supported
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 F:      drivers/clk/samsung/
 
+SAMSUNG SPI DRIVERS
+M:      Kukjin Kim <kgene@kernel.org>
+M:      Krzysztof Kozlowski <krzk@kernel.org>
+M:      Andi Shyti <andi.shyti@samsung.com>
+L:      linux-spi@vger.kernel.org
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+S:      Maintained
+F:      Documentation/devicetree/bindings/spi/spi-samsung.txt
+F:      drivers/spi/spi-s3c*
+F:      include/linux/platform_data/spi-s3c64xx.h
+
 SAMSUNG SXGBE DRIVERS
 M:      Byungho An <bh74.an@samsung.com>
 M:      Girish K S <ks.giri@samsung.com>
@@ -11216,12 +11257,8 @@ S:	Odd Fixes
 F:      drivers/staging/vt665?/
 
 STAGING - WILC1000 WIFI DRIVER
-M:      Johnny Kim <johnny.kim@atmel.com>
-M:      Austin Shin <austin.shin@atmel.com>
-M:      Chris Park <chris.park@atmel.com>
-M:      Tony Cho <tony.cho@atmel.com>
-M:      Glen Lee <glen.lee@atmel.com>
-M:      Leo Kim <leo.kim@atmel.com>
+M:      Aditya Shankar <aditya.shankar@microchip.com>
+M:      Ganesh Krishna <ganesh.krishna@microchip.com>
 L:      linux-wireless@vger.kernel.org
 S:      Supported
 F:      drivers/staging/wilc1000/
@@ -12541,7 +12578,7 @@ F:	include/linux/if_*vlan.h
 F:      net/8021q/
 
 VLYNQ BUS
-M:      Florian Fainelli <florian@openwrt.org>
+M:      Florian Fainelli <f.fainelli@gmail.com>
 L:      openwrt-devel@lists.openwrt.org (subscribers-only)
 S:      Maintained
 F:      drivers/vlynq/vlynq.c
diff --git a/Makefile b/Makefile
index 70de1448c571..ce2ddb3fec98 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 4
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc8
 NAME = Psychotic Stoned Sheep
 
 # *DOCUMENTATION*
@@ -635,13 +635,6 @@ endif
 # Tell gcc to never replace conditional load with a non-conditional one
 KBUILD_CFLAGS   += $(call cc-option,--param=allow-store-data-races=0)
 
-PHONY += gcc-plugins
-gcc-plugins: scripts_basic
-ifdef CONFIG_GCC_PLUGINS
-        $(Q)$(MAKE) $(build)=scripts/gcc-plugins
-endif
-        @:
-
 include scripts/Makefile.gcc-plugins
 
 ifdef CONFIG_READABLE_ASM
diff --git a/arch/Kconfig b/arch/Kconfig
index bd8056b5b246..fd6e9712af81 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -336,17 +336,6 @@ config HAVE_ARCH_SECCOMP_FILTER
             results in the system call being skipped immediately.
           - seccomp syscall wired up
 
-          For best performance, an arch should use seccomp_phase1 and
-          seccomp_phase2 directly.  It should call seccomp_phase1 for all
-          syscalls if TIF_SECCOMP is set, but seccomp_phase1 does not
-          need to be called from a ptrace-safe context.  It must then
-          call seccomp_phase2 if seccomp_phase1 returns anything other
-          than SECCOMP_PHASE1_OK or SECCOMP_PHASE1_SKIP.
-
-          As an additional optimization, an arch may provide seccomp_data
-          directly to seccomp_phase1; this avoids multiple calls
-          to the syscall_xyz helpers for every syscall.
-
 config SECCOMP_FILTER
         def_bool y
         depends on HAVE_ARCH_SECCOMP_FILTER && SECCOMP && NET
@@ -461,6 +450,15 @@ config CC_STACKPROTECTOR_STRONG
 
 endchoice
 
+config HAVE_ARCH_WITHIN_STACK_FRAMES
+        bool
+        help
+          An architecture should select this if it can walk the kernel stack
+          frames to determine if an object is part of either the arguments
+          or local variables (i.e. that it excludes saved return addresses,
+          and similar) by implementing an inline arch_within_stack_frames(),
+          which is used by CONFIG_HARDENED_USERCOPY.
+
 config HAVE_CONTEXT_TRACKING
         bool
         help
diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index c419b43c461d..466e42e96bfa 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -371,14 +371,6 @@ __copy_tofrom_user_nocheck(void *to, const void *from, long len)
         return __cu_len;
 }
 
-extern inline long
-__copy_tofrom_user(void *to, const void *from, long len, const void __user *validate)
-{
-        if (__access_ok((unsigned long)validate, len, get_fs()))
-                len = __copy_tofrom_user_nocheck(to, from, len);
-        return len;
-}
-
 #define __copy_to_user(to, from, n)                                     \
 ({                                                                      \
         __chk_user_ptr(to);                                             \
@@ -393,17 +385,22 @@ __copy_tofrom_user(void *to, const void *from, long len, const void __user *vali
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
 
-
 extern inline long
 copy_to_user(void __user *to, const void *from, long n)
 {
-        return __copy_tofrom_user((__force void *)to, from, n, to);
+        if (likely(__access_ok((unsigned long)to, n, get_fs())))
+                n = __copy_tofrom_user_nocheck((__force void *)to, from, n);
+        return n;
 }
 
 extern inline long
 copy_from_user(void *to, const void __user *from, long n)
 {
-        return __copy_tofrom_user(to, (__force void *)from, n, from);
+        if (likely(__access_ok((unsigned long)from, n, get_fs())))
+                n = __copy_tofrom_user_nocheck(to, (__force void *)from, n);
+        else
+                memset(to, 0, n);
+        return n;
 }
 
 extern void __do_clear_user(void);
diff --git a/arch/arc/include/asm/entry.h b/arch/arc/include/asm/entry.h
index ad7860c5ce15..51597f344a62 100644
--- a/arch/arc/include/asm/entry.h
+++ b/arch/arc/include/asm/entry.h
@@ -142,7 +142,7 @@
 
 #ifdef CONFIG_ARC_CURR_IN_REG
         ; Retrieve orig r25 and save it with rest of callee_regs
-        ld.as   r12, [r12, PT_user_r25]
+        ld      r12, [r12, PT_user_r25]
         PUSH    r12
 #else
         PUSH    r25
@@ -198,7 +198,7 @@
 
         ; SP is back to start of pt_regs
 #ifdef CONFIG_ARC_CURR_IN_REG
-        st.as   r12, [sp, PT_user_r25]
+        st      r12, [sp, PT_user_r25]
 #endif
 .endm
 
diff --git a/arch/arc/include/asm/irqflags-compact.h b/arch/arc/include/asm/irqflags-compact.h
index c1d36458bfb7..4c6eed80cd8b 100644
--- a/arch/arc/include/asm/irqflags-compact.h
+++ b/arch/arc/include/asm/irqflags-compact.h
@@ -188,10 +188,10 @@ static inline int arch_irqs_disabled(void)
 .endm
 
 .macro IRQ_ENABLE  scratch
+        TRACE_ASM_IRQ_ENABLE
         lr      \scratch, [status32]
         or      \scratch, \scratch, (STATUS_E1_MASK | STATUS_E2_MASK)
         flag    \scratch
-        TRACE_ASM_IRQ_ENABLE
 .endm
 
 #endif  /* __ASSEMBLY__ */
diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
index 0f92d97432a2..89eeb3720051 100644
--- a/arch/arc/include/asm/pgtable.h
+++ b/arch/arc/include/asm/pgtable.h
@@ -280,7 +280,7 @@ static inline void pmd_set(pmd_t *pmdp, pte_t *ptep)
 
 #define pte_page(pte)           pfn_to_page(pte_pfn(pte))
 #define mk_pte(page, prot)      pfn_pte(page_to_pfn(page), prot)
-#define pfn_pte(pfn, prot)      (__pte(((pte_t)(pfn) << PAGE_SHIFT) | pgprot_val(prot)))
+#define pfn_pte(pfn, prot)      __pte(((pfn) << PAGE_SHIFT) | pgprot_val(prot))
 
 /* Don't use virt_to_pfn for macros below: could cause truncations for PAE40*/
 #define pte_pfn(pte)            (pte_val(pte) >> PAGE_SHIFT)
diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h
index a78d5670884f..41faf17cd28d 100644
--- a/arch/arc/include/asm/uaccess.h
+++ b/arch/arc/include/asm/uaccess.h
@@ -83,7 +83,10 @@
         "2:     ;nop\n"                         \
         "       .section .fixup, \"ax\"\n"      \
         "       .align 4\n"                     \
-        "3:     mov %0, %3\n"                   \
+        "3:     # return -EFAULT\n"             \
+        "       mov %0, %3\n"                   \
+        "       # zero out dst ptr\n"           \
+        "       mov %1,  0\n"                   \
         "       j   2b\n"                       \
         "       .previous\n"                    \
         "       .section __ex_table, \"a\"\n"   \
@@ -101,7 +104,11 @@
         "2:     ;nop\n"                         \
         "       .section .fixup, \"ax\"\n"      \
         "       .align 4\n"                     \
-        "3:     mov %0, %3\n"                   \
+        "3:     # return -EFAULT\n"             \
+        "       mov %0, %3\n"                   \
+        "       # zero out dst ptr\n"           \
+        "       mov %1,  0\n"                   \
+        "       mov %R1, 0\n"                   \
         "       j   2b\n"                       \
         "       .previous\n"                    \
         "       .section __ex_table, \"a\"\n"   \
diff --git a/arch/arc/include/uapi/asm/elf.h b/arch/arc/include/uapi/asm/elf.h
index 0f99ac8fcbb2..0037a587320d 100644
--- a/arch/arc/include/uapi/asm/elf.h
+++ b/arch/arc/include/uapi/asm/elf.h
@@ -13,8 +13,15 @@
 
 /* Machine specific ELF Hdr flags */
 #define EF_ARC_OSABI_MSK        0x00000f00
-#define EF_ARC_OSABI_ORIG       0x00000000   /* MUST be zero for back-compat */
-#define EF_ARC_OSABI_CURRENT    0x00000300   /* v3 (no legacy syscalls) */
+
+#define EF_ARC_OSABI_V3         0x00000300   /* v3 (no legacy syscalls) */
+#define EF_ARC_OSABI_V4         0x00000400   /* v4 (64bit data any reg align) */
+
+#if __GNUC__ < 6
+#define EF_ARC_OSABI_CURRENT    EF_ARC_OSABI_V3
+#else
+#define EF_ARC_OSABI_CURRENT    EF_ARC_OSABI_V4
+#endif
 
 typedef unsigned long elf_greg_t;
 typedef unsigned long elf_fpregset_t;
diff --git a/arch/arc/kernel/arcksyms.c b/arch/arc/kernel/arcksyms.c
index 4d9e77724bed..000dd041ab42 100644
--- a/arch/arc/kernel/arcksyms.c
+++ b/arch/arc/kernel/arcksyms.c
@@ -28,6 +28,7 @@ extern void __muldf3(void);
 extern void __divdf3(void);
 extern void __floatunsidf(void);
 extern void __floatunsisf(void);
+extern void __udivdi3(void);
 
 EXPORT_SYMBOL(__ashldi3);
 EXPORT_SYMBOL(__ashrdi3);
@@ -45,6 +46,7 @@ EXPORT_SYMBOL(__muldf3);
 EXPORT_SYMBOL(__divdf3);
 EXPORT_SYMBOL(__floatunsidf);
 EXPORT_SYMBOL(__floatunsisf);
+EXPORT_SYMBOL(__udivdi3);
 
 /* ARC optimised assembler routines */
 EXPORT_SYMBOL(memset);
diff --git a/arch/arc/kernel/process.c b/arch/arc/kernel/process.c
index b5db9e7fd649..be1972bd2729 100644
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -199,7 +199,7 @@ int elf_check_arch(const struct elf32_hdr *x)
         }
 
         eflags = x->e_flags;
-        if ((eflags & EF_ARC_OSABI_MSK) < EF_ARC_OSABI_CURRENT) {
+        if ((eflags & EF_ARC_OSABI_MSK) != EF_ARC_OSABI_CURRENT) {
                 pr_err("ABI mismatch - you need newer toolchain\n");
                 force_sigsegv(SIGSEGV, current);
                 return 0;
diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
index a946400a86d0..f52a0d0dc462 100644
--- a/arch/arc/kernel/setup.c
+++ b/arch/arc/kernel/setup.c
@@ -291,8 +291,10 @@ static char *arc_extn_mumbojumbo(int cpu_id, char *buf, int len)
                                cpu->dccm.base_addr, TO_KB(cpu->dccm.sz),
                                cpu->iccm.base_addr, TO_KB(cpu->iccm.sz));
 
-        n += scnprintf(buf + n, len - n,
-                       "OS ABI [v3]\t: no-legacy-syscalls\n");
+        n += scnprintf(buf + n, len - n, "OS ABI [v%d]\t: %s\n",
+                        EF_ARC_OSABI_CURRENT >> 8,
+                        EF_ARC_OSABI_CURRENT == EF_ARC_OSABI_V3 ?
+                        "no-legacy-syscalls" : "64-bit data any register aligned");
 
         return buf;
 }
diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
index 5a294b2c3cb3..0b10efe3a6a7 100644
--- a/arch/arc/mm/cache.c
+++ b/arch/arc/mm/cache.c
@@ -921,6 +921,15 @@ void arc_cache_init(void)
 
         printk(arc_cache_mumbojumbo(0, str, sizeof(str)));
 
+        /*
+         * Only master CPU needs to execute rest of function:
+         *  - Assume SMP so all cores will have same cache config so
+         *    any geomtry checks will be same for all
+         *  - IOC setup / dma callbacks only need to be setup once
+         */
+        if (cpu)
+                return;
+
         if (IS_ENABLED(CONFIG_ARC_HAS_ICACHE)) {
                 struct cpuinfo_arc_cache *ic = &cpuinfo_arc700[cpu].icache;
 
diff --git a/arch/arc/mm/highmem.c b/arch/arc/mm/highmem.c
index 04f83322c9fd..77ff64a874a1 100644
--- a/arch/arc/mm/highmem.c
+++ b/arch/arc/mm/highmem.c
@@ -61,6 +61,7 @@ void *kmap(struct page *page)
 
         return kmap_high(page);
 }
+EXPORT_SYMBOL(kmap);
 
 void *kmap_atomic(struct page *page)
 {
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 2d601d769a1c..a9c4e48bb7ec 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -35,6 +35,7 @@ config ARM
         select HARDIRQS_SW_RESEND
         select HAVE_ARCH_AUDITSYSCALL if (AEABI && !OABI_COMPAT)
         select HAVE_ARCH_BITREVERSE if (CPU_32v7M || CPU_32v7) && !CPU_32v6
+        select HAVE_ARCH_HARDENED_USERCOPY
         select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL && !CPU_ENDIAN_BE32 && MMU
         select HAVE_ARCH_KGDB if !CPU_ENDIAN_BE32 && MMU
         select HAVE_ARCH_MMAP_RND_BITS if MMU
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 56ea5c60b318..61f6ccc19cfa 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -260,12 +260,14 @@ machdirs := $(patsubst %,arch/arm/mach-%/,$(machine-y))
 platdirs := $(patsubst %,arch/arm/plat-%/,$(sort $(plat-y)))
 
 ifneq ($(CONFIG_ARCH_MULTIPLATFORM),y)
+ifneq ($(CONFIG_ARM_SINGLE_ARMV7M),y)
 ifeq ($(KBUILD_SRC),)
 KBUILD_CPPFLAGS += $(patsubst %,-I%include,$(machdirs) $(platdirs))
 else
 KBUILD_CPPFLAGS += $(patsubst %,-I$(srctree)/%include,$(machdirs) $(platdirs))
 endif
 endif
+endif
 
 export  TEXT_OFFSET GZFLAGS MMUEXT
 
diff --git a/arch/arm/boot/dts/am335x-baltos.dtsi b/arch/arm/boot/dts/am335x-baltos.dtsi
index c8609d8d2c55..b689172632ef 100644
--- a/arch/arm/boot/dts/am335x-baltos.dtsi
+++ b/arch/arm/boot/dts/am335x-baltos.dtsi
@@ -226,7 +226,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
         };
 };
 
diff --git a/arch/arm/boot/dts/am335x-igep0033.dtsi b/arch/arm/boot/dts/am335x-igep0033.dtsi
index df63484ef9b3..e7d9ca1305fa 100644
--- a/arch/arm/boot/dts/am335x-igep0033.dtsi
+++ b/arch/arm/boot/dts/am335x-igep0033.dtsi
@@ -161,7 +161,7 @@
 
                 #address-cells = <1>;
                 #size-cells = <1>;
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 /* MTD partition table */
                 partition@0 {
diff --git a/arch/arm/boot/dts/am335x-phycore-som.dtsi b/arch/arm/boot/dts/am335x-phycore-som.dtsi
index 86f773165d5c..1263c9d4cba3 100644
--- a/arch/arm/boot/dts/am335x-phycore-som.dtsi
+++ b/arch/arm/boot/dts/am335x-phycore-som.dtsi
@@ -197,7 +197,7 @@
                 gpmc,wr-access-ns = <30>;
                 gpmc,wr-data-mux-bus-ns = <0>;
 
-                elm_id = <&elm>;
+                ti,elm-id = <&elm>;
 
                 #address-cells = <1>;
                 #size-cells = <1>;
diff --git a/arch/arm/boot/dts/arm-realview-pbx-a9.dts b/arch/arm/boot/dts/arm-realview-pbx-a9.dts
index db808f92dd79..90d00b407f85 100644
--- a/arch/arm/boot/dts/arm-realview-pbx-a9.dts
+++ b/arch/arm/boot/dts/arm-realview-pbx-a9.dts
@@ -70,13 +70,12 @@
                  * associativity as these may be erroneously set
                  * up by boot loader(s).
                  */
-                cache-size = <1048576>; // 1MB
-                cache-sets = <4096>;
+                cache-size = <131072>; // 128KB
+                cache-sets = <512>;
                 cache-line-size = <32>;
                 arm,parity-disable;
-                arm,tag-latency = <1>;
-                arm,data-latency = <1 1>;
-                arm,dirty-latency = <1>;
+                arm,tag-latency = <1 1 1>;
+                arm,data-latency = <1 1 1>;
         };
 
         scu: scu@1f000000 {
diff --git a/arch/arm/boot/dts/armada-388-clearfog.dts b/arch/arm/boot/dts/armada-388-clearfog.dts
index 2e0556af6e5e..d3e6bd805006 100644
--- a/arch/arm/boot/dts/armada-388-clearfog.dts
+++ b/arch/arm/boot/dts/armada-388-clearfog.dts
@@ -390,12 +390,12 @@
 
                         port@0 {
                                 reg = <0>;
-                                label = "lan1";
+                                label = "lan5";
                         };
 
                         port@1 {
                                 reg = <1>;
-                                label = "lan2";
+                                label = "lan4";
                         };
 
                         port@2 {
@@ -405,12 +405,12 @@
 
                         port@3 {
                                 reg = <3>;
-                                label = "lan4";
+                                label = "lan2";
                         };
 
                         port@4 {
                                 reg = <4>;
-                                label = "lan5";
+                                label = "lan1";
                         };
 
                         port@5 {
diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
index caf2707680c1..e9b47b2bbc33 100644
--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
+++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
@@ -2,6 +2,7 @@
 
 / {
         memory {
+                device_type = "memory";
                 reg = <0 0x10000000>;
         };
 
diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi
index b98252232d20..445624a1a1de 100644
--- a/arch/arm/boot/dts/bcm283x.dtsi
+++ b/arch/arm/boot/dts/bcm283x.dtsi
@@ -2,7 +2,6 @@
 #include <dt-bindings/clock/bcm2835.h>
 #include <dt-bindings/clock/bcm2835-aux.h>
 #include <dt-bindings/gpio/gpio.h>
-#include "skeleton.dtsi"
 
 /* This include file covers the common peripherals and configuration between
  * bcm2835 and bcm2836 implementations, leaving the CPU configuration to
@@ -13,6 +12,8 @@
         compatible = "brcm,bcm2835";
         model = "BCM2835";
         interrupt-parent = <&intc>;
+        #address-cells = <1>;
+        #size-cells = <1>;
 
         chosen {
                 bootargs = "earlyprintk console=ttyAMA0";
diff --git a/arch/arm/boot/dts/exynos5410-odroidxu.dts b/arch/arm/boot/dts/exynos5410-odroidxu.dts
index d9499310a301..f6d135245a4b 100644
--- a/arch/arm/boot/dts/exynos5410-odroidxu.dts
+++ b/arch/arm/boot/dts/exynos5410-odroidxu.dts
@@ -447,14 +447,11 @@
         samsung,dw-mshc-ciu-div = <3>;
         samsung,dw-mshc-sdr-timing = <0 4>;
         samsung,dw-mshc-ddr-timing = <0 2>;
-        samsung,dw-mshc-hs400-timing = <0 2>;
-        samsung,read-strobe-delay = <90>;
         pinctrl-names = "default";
         pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus1 &sd0_bus4 &sd0_bus8 &sd0_cd>;
         bus-width = <8>;
         cap-mmc-highspeed;
         mmc-hs200-1_8v;
-        mmc-hs400-1_8v;
         vmmc-supply = <&ldo20_reg>;
         vqmmc-supply = <&ldo11_reg>;
 };
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index b620ac884cfd..b13b0b2db881 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -243,7 +243,7 @@
                                         clocks = <&clks IMX6QDL_CLK_SPDIF_GCLK>, <&clks IMX6QDL_CLK_OSC>,
                                                  <&clks IMX6QDL_CLK_SPDIF>, <&clks IMX6QDL_CLK_ASRC>,
                                                  <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_ESAI_EXTAL>,
-                                                 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_MLB>,
+                                                 <&clks IMX6QDL_CLK_IPG>, <&clks IMX6QDL_CLK_DUMMY>,
                                                  <&clks IMX6QDL_CLK_DUMMY>, <&clks IMX6QDL_CLK_SPBA>;
                                         clock-names = "core",  "rxtx0",
                                                       "rxtx1", "rxtx2",
diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
index 96ea936eeeb0..240a2864d044 100644
--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
+++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
@@ -64,7 +64,7 @@
         cd-gpios = <&gpio7 11 GPIO_ACTIVE_LOW>;
         no-1-8-v;
         keep-power-in-suspend;
-        enable-sdio-wakup;
+        wakeup-source;
         status = "okay";
 };
 
diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
index 95ee268ed510..2f33c463cbce 100644
--- a/arch/arm/boot/dts/imx7d-sdb.dts
+++ b/arch/arm/boot/dts/imx7d-sdb.dts
@@ -131,7 +131,7 @@
                 ti,y-min = /bits/ 16 <0>;
                 ti,y-max = /bits/ 16 <0>;
                 ti,pressure-max = /bits/ 16 <0>;
-                ti,x-plat-ohms = /bits/ 16 <400>;
+                ti,x-plate-ohms = /bits/ 16 <400>;
                 wakeup-source;
         };
 };
diff --git a/arch/arm/boot/dts/integratorap.dts b/arch/arm/boot/dts/integratorap.dts
index cf06e32ee108..4b34b54e09a1 100644
--- a/arch/arm/boot/dts/integratorap.dts
+++ b/arch/arm/boot/dts/integratorap.dts
@@ -42,7 +42,7 @@
         };
 
         syscon {
-                compatible = "arm,integrator-ap-syscon";
+                compatible = "arm,integrator-ap-syscon", "syscon";
                 reg = <0x11000000 0x100>;
                 interrupt-parent = <&pic>;
                 /* These are the logical module IRQs */
diff --git a/arch/arm/boot/dts/integratorcp.dts b/arch/arm/boot/dts/integratorcp.dts
index d43f15b4f79a..79430fbfec3b 100644
--- a/arch/arm/boot/dts/integratorcp.dts
+++ b/arch/arm/boot/dts/integratorcp.dts
@@ -94,7 +94,7 @@
         };
 
         syscon {
-                compatible = "arm,integrator-cp-syscon";
+                compatible = "arm,integrator-cp-syscon", "syscon";
                 reg = <0xcb000000 0x100>;
         };
 
diff --git a/arch/arm/boot/dts/keystone.dtsi b/arch/arm/boot/dts/keystone.dtsi
index 00cb314d5e4d..e23f46d15c80 100644
--- a/arch/arm/boot/dts/keystone.dtsi
+++ b/arch/arm/boot/dts/keystone.dtsi
@@ -70,14 +70,6 @@
                 cpu_on          = <0x84000003>;
         };
 
-        psci {
-                compatible      = "arm,psci";
-                method          = "smc";
-                cpu_suspend     = <0x84000001>;
-                cpu_off         = <0x84000002>;
-                cpu_on          = <0x84000003>;
-        };
-
         soc {
                 #address-cells = <1>;
                 #size-cells = <1>;
diff --git a/arch/arm/boot/dts/kirkwood-ib62x0.dts b/arch/arm/boot/dts/kirkwood-ib62x0.dts
index ef84d8699a76..5bf62897014c 100644
--- a/arch/arm/boot/dts/kirkwood-ib62x0.dts
+++ b/arch/arm/boot/dts/kirkwood-ib62x0.dts
@@ -113,7 +113,7 @@
 
         partition@e0000 {
                 label = "u-boot environment";
-                reg = <0xe0000 0x100000>;
+                reg = <0xe0000 0x20000>;
         };
 
         partition@100000 {
diff --git a/arch/arm/boot/dts/kirkwood-openrd.dtsi b/arch/arm/boot/dts/kirkwood-openrd.dtsi
index e4ecab112601..7175511a92da 100644
--- a/arch/arm/boot/dts/kirkwood-openrd.dtsi
+++ b/arch/arm/boot/dts/kirkwood-openrd.dtsi
@@ -116,6 +116,10 @@
         };
 };
 
+&pciec {
+        status = "okay";
+};
+
 &pcie0 {
         status = "okay";
 };
diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
index 365f39ff58bb..0ff1c2de95bf 100644
--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
+++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
@@ -35,10 +35,15 @@
         ranges = <0 0 0x00000000 0x1000000>;    /* CS0: 16MB for NAND */
 
         nand@0,0 {
-                linux,mtd-name = "micron,mt29f4g16abbda3w";
+                compatible = "ti,omap2-nand";
                 reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
+                interrupt-parent = <&gpmc>;
+                interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
+                             <1 IRQ_TYPE_NONE>; /* termcount */
+                linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
@@ -54,10 +59,6 @@
                 gpmc,wr-access-ns = <40>;
                 gpmc,wr-data-mux-bus-ns = <0>;
                 gpmc,device-width = <2>;
-
-                gpmc,page-burst-access-ns = <5>;
-                gpmc,cycle2cycle-delay-ns = <50>;
-
                 #address-cells = <1>;
                 #size-cells = <1>;
 
diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
index 5e9a13c0eaf7..1c2c74655416 100644
--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
+++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi
@@ -46,6 +46,7 @@
                 linux,mtd-name = "micron,mt29f4g16abbda3w";
                 nand-bus-width = <16>;
                 ti,nand-ecc-opt = "bch8";
+                rb-gpios = <&gpmc 0 GPIO_ACTIVE_HIGH>; /* gpmc_wait0 */
                 gpmc,sync-clk-ps = <0>;
                 gpmc,cs-on-ns = <0>;
                 gpmc,cs-rd-off-ns = <44>;
diff --git a/arch/arm/boot/dts/omap3-overo-base.dtsi b/arch/arm/boot/dts/omap3-overo-base.dtsi
index de256fa8da48..3e946cac55f3 100644
--- a/arch/arm/boot/dts/omap3-overo-base.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-base.dtsi
@@ -223,7 +223,9 @@
 };
 
 &gpmc {
-        ranges = <0 0 0x00000000 0x20000000>;
+        ranges = <0 0 0x30000000 0x1000000>,    /* CS0 */
+                 <4 0 0x2b000000 0x1000000>,    /* CS4 */
+                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
 
         nand@0,0 {
                 compatible = "ti,omap2-nand";
diff --git a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
index 7df27926ead2..4f4c6efbd518 100644
--- a/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-chestnut43-common.dtsi
@@ -55,8 +55,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
index 9e24b6a1d07b..1b304e2f1bd2 100644
--- a/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobi-common.dtsi
@@ -27,8 +27,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
index 334109e14613..82e98ee3023a 100644
--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
+++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi
@@ -15,9 +15,6 @@
 #include "omap-gpmc-smsc9221.dtsi"
 
 &gpmc {
-        ranges = <4 0 0x2b000000 0x1000000>,    /* CS4 */
-                 <5 0 0x2c000000 0x1000000>;    /* CS5 */
-
         smsc1: ethernet@gpmc {
                 reg = <5 0 0xff>;
                 interrupt-parent = <&gpio6>;
diff --git a/arch/arm/boot/dts/rk3066a.dtsi b/arch/arm/boot/dts/rk3066a.dtsi
index c0ba86c3a2ab..0d0dae3a1694 100644
--- a/arch/arm/boot/dts/rk3066a.dtsi
+++ b/arch/arm/boot/dts/rk3066a.dtsi
@@ -197,6 +197,8 @@
                 clock-names = "saradc", "apb_pclk";
                 interrupts = <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
                 #io-channel-cells = <1>;
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
index cd33f0170890..91c4b3c7a8d5 100644
--- a/arch/arm/boot/dts/rk3288.dtsi
+++ b/arch/arm/boot/dts/rk3288.dtsi
@@ -279,6 +279,8 @@
                 #io-channel-cells = <1>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm/boot/dts/rk3xxx.dtsi b/arch/arm/boot/dts/rk3xxx.dtsi
index 99bbcc2c9b89..e2cd683b4e4b 100644
--- a/arch/arm/boot/dts/rk3xxx.dtsi
+++ b/arch/arm/boot/dts/rk3xxx.dtsi
@@ -399,6 +399,8 @@
                 #io-channel-cells = <1>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm/boot/dts/stih407-family.dtsi b/arch/arm/boot/dts/stih407-family.dtsi
index d294e82447a2..8b063ab10c19 100644
--- a/arch/arm/boot/dts/stih407-family.dtsi
+++ b/arch/arm/boot/dts/stih407-family.dtsi
@@ -550,8 +550,9 @@
                         interrupt-names = "mmcirq";
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_mmc0>;
-                        clock-names = "mmc";
-                        clocks = <&clk_s_c0_flexgen CLK_MMC_0>;
+                        clock-names = "mmc", "icn";
+                        clocks = <&clk_s_c0_flexgen CLK_MMC_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
                         bus-width = <8>;
                         non-removable;
                 };
@@ -565,8 +566,9 @@
                         interrupt-names = "mmcirq";
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_sd1>;
-                        clock-names = "mmc";
-                        clocks = <&clk_s_c0_flexgen CLK_MMC_1>;
+                        clock-names = "mmc", "icn";
+                        clocks = <&clk_s_c0_flexgen CLK_MMC_1>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_HVA>;
                         resets = <&softreset STIH407_MMC1_SOFTRESET>;
                         bus-width = <4>;
                 };
diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi
index 18ed1ad10d32..40318869c733 100644
--- a/arch/arm/boot/dts/stih410.dtsi
+++ b/arch/arm/boot/dts/stih410.dtsi
@@ -41,7 +41,8 @@
                         compatible = "st,st-ohci-300x";
                         reg = <0x9a03c00 0x100>;
                         interrupts = <GIC_SPI 180 IRQ_TYPE_NONE>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT0_SOFTRESET>;
                         reset-names = "power", "softreset";
@@ -57,7 +58,8 @@
                         interrupts = <GIC_SPI 151 IRQ_TYPE_NONE>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_usb0>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT0_SOFTRESET>;
                         reset-names = "power", "softreset";
@@ -71,7 +73,8 @@
                         compatible = "st,st-ohci-300x";
                         reg = <0x9a83c00 0x100>;
                         interrupts = <GIC_SPI 181 IRQ_TYPE_NONE>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT1_SOFTRESET>;
                         reset-names = "power", "softreset";
@@ -87,7 +90,8 @@
                         interrupts = <GIC_SPI 153 IRQ_TYPE_NONE>;
                         pinctrl-names = "default";
                         pinctrl-0 = <&pinctrl_usb1>;
-                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>;
+                        clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>,
+                                 <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>;
                         resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>,
                                  <&softreset STIH407_USB2_PORT1_SOFTRESET>;
                         reset-names = "power", "softreset";
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index e012890e0cf2..a17ba0243db3 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -84,7 +84,7 @@
                         trips {
                                 cpu_alert0: cpu_alert0 {
                                         /* milliCelsius */
-                                        temperature = <850000>;
+                                        temperature = <85000>;
                                         hysteresis = <2000>;
                                         type = "passive";
                                 };
diff --git a/arch/arm/boot/dts/tegra114-dalmore.dts b/arch/arm/boot/dts/tegra114-dalmore.dts
index 1dfc492cc004..1444fbd543e7 100644
--- a/arch/arm/boot/dts/tegra114-dalmore.dts
+++ b/arch/arm/boot/dts/tegra114-dalmore.dts
@@ -897,7 +897,7 @@
                 palmas: tps65913@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <0 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <0 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-roth.dts b/arch/arm/boot/dts/tegra114-roth.dts
index 70cf40996c3f..966a7fc044af 100644
--- a/arch/arm/boot/dts/tegra114-roth.dts
+++ b/arch/arm/boot/dts/tegra114-roth.dts
@@ -802,7 +802,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/boot/dts/tegra114-tn7.dts b/arch/arm/boot/dts/tegra114-tn7.dts
index 17dd14545862..a161fa1dfb61 100644
--- a/arch/arm/boot/dts/tegra114-tn7.dts
+++ b/arch/arm/boot/dts/tegra114-tn7.dts
@@ -63,7 +63,7 @@
                 palmas: pmic@58 {
                         compatible = "ti,palmas";
                         reg = <0x58>;
-                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_LOW>;
+                        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
 
                         #interrupt-cells = <2>;
                         interrupt-controller;
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 0e97b4b871f9..6c7b06854fce 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -140,7 +140,7 @@ static struct locomo_dev_info locomo_devices[] = {
 
 static void locomo_handler(struct irq_desc *desc)
 {
-        struct locomo *lchip = irq_desc_get_chip_data(desc);
+        struct locomo *lchip = irq_desc_get_handler_data(desc);
         int req, i;
 
         /* Acknowledge the parent IRQ */
@@ -200,8 +200,7 @@ static void locomo_setup_irq(struct locomo *lchip)
          * Install handler for IRQ_LOCOMO_HW.
          */
         irq_set_irq_type(lchip->irq, IRQ_TYPE_EDGE_FALLING);
-        irq_set_chip_data(lchip->irq, lchip);
-        irq_set_chained_handler(lchip->irq, locomo_handler);
+        irq_set_chained_handler_and_data(lchip->irq, locomo_handler, lchip);
 
         /* Install handlers for IRQ_LOCOMO_* */
         for ( ; irq <= lchip->irq_base + 3; irq++) {
diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
index fb0a0a4dfea4..2e076c492005 100644
--- a/arch/arm/common/sa1111.c
+++ b/arch/arm/common/sa1111.c
@@ -472,8 +472,8 @@ static int sa1111_setup_irq(struct sa1111 *sachip, unsigned irq_base)
          * specifies that S0ReadyInt and S1ReadyInt should be '1'.
          */
         sa1111_writel(0, irqbase + SA1111_INTPOL0);
-        sa1111_writel(SA1111_IRQMASK_HI(IRQ_S0_READY_NINT) |
-                      SA1111_IRQMASK_HI(IRQ_S1_READY_NINT),
+        sa1111_writel(BIT(IRQ_S0_READY_NINT & 31) |
+                      BIT(IRQ_S1_READY_NINT & 31),
                       irqbase + SA1111_INTPOL1);
 
         /* clear all IRQs */
@@ -754,7 +754,7 @@ static int __sa1111_probe(struct device *me, struct resource *mem, int irq)
         if (sachip->irq != NO_IRQ) {
                 ret = sa1111_setup_irq(sachip, pd->irq_base);
                 if (ret)
-                        goto err_unmap;
+                        goto err_clk;
         }
 
 #ifdef CONFIG_ARCH_SA1100
@@ -799,6 +799,8 @@ static int __sa1111_probe(struct device *me, struct resource *mem, int irq)
 
         return 0;
 
+ err_clk:
+        clk_disable(sachip->clk);
  err_unmap:
         iounmap(sachip->base);
  err_clk_unprep:
@@ -869,9 +871,9 @@ struct sa1111_save_data {
 
 #ifdef CONFIG_PM
 
-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
+static int sa1111_suspend_noirq(struct device *dev)
 {
-        struct sa1111 *sachip = platform_get_drvdata(dev);
+        struct sa1111 *sachip = dev_get_drvdata(dev);
         struct sa1111_save_data *save;
         unsigned long flags;
         unsigned int val;
@@ -934,9 +936,9 @@ static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
  *      restored by their respective drivers, and must be called
  *      via LDM after this function.
  */
-static int sa1111_resume(struct platform_device *dev)
+static int sa1111_resume_noirq(struct device *dev)
 {
-        struct sa1111 *sachip = platform_get_drvdata(dev);
+        struct sa1111 *sachip = dev_get_drvdata(dev);
         struct sa1111_save_data *save;
         unsigned long flags, id;
         void __iomem *base;
@@ -952,7 +954,7 @@ static int sa1111_resume(struct platform_device *dev)
         id = sa1111_readl(sachip->base + SA1111_SKID);
         if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
                 __sa1111_remove(sachip);
-                platform_set_drvdata(dev, NULL);
+                dev_set_drvdata(dev, NULL);
                 kfree(save);
                 return 0;
         }
@@ -1003,8 +1005,8 @@ static int sa1111_resume(struct platform_device *dev)
 }
 
 #else
-#define sa1111_suspend NULL
-#define sa1111_resume  NULL
+#define sa1111_suspend_noirq NULL
+#define sa1111_resume_noirq  NULL
 #endif
 
 static int sa1111_probe(struct platform_device *pdev)
@@ -1017,7 +1019,7 @@ static int sa1111_probe(struct platform_device *pdev)
                 return -EINVAL;
         irq = platform_get_irq(pdev, 0);
         if (irq < 0)
-                return -ENXIO;
+                return irq;
 
         return __sa1111_probe(&pdev->dev, mem, irq);
 }
@@ -1038,6 +1040,11 @@ static int sa1111_remove(struct platform_device *pdev)
         return 0;
 }
 
+static struct dev_pm_ops sa1111_pm_ops = {
+        .suspend_noirq = sa1111_suspend_noirq,
+        .resume_noirq = sa1111_resume_noirq,
+};
+
 /*
  *      Not sure if this should be on the system bus or not yet.
  *      We really want some way to register a system device at
@@ -1050,10 +1057,9 @@ static int sa1111_remove(struct platform_device *pdev)
 static struct platform_driver sa1111_device_driver = {
         .probe          = sa1111_probe,
         .remove         = sa1111_remove,
-        .suspend        = sa1111_suspend,
-        .resume         = sa1111_resume,
         .driver         = {
                 .name   = "sa1111",
+                .pm     = &sa1111_pm_ops,
         },
 };
 
diff --git a/arch/arm/configs/aspeed_g4_defconfig b/arch/arm/configs/aspeed_g4_defconfig
index b6e54ee9bdbd..ca39c04fec6b 100644
--- a/arch/arm/configs/aspeed_g4_defconfig
+++ b/arch/arm/configs/aspeed_g4_defconfig
@@ -58,7 +58,7 @@ CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_FIRMWARE_MEMMAP=y
 CONFIG_FANOTIFY=y
-CONFIG_PRINTK_TIME=1
+CONFIG_PRINTK_TIME=y
 CONFIG_DYNAMIC_DEBUG=y
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_PAGE_POISONING=y
diff --git a/arch/arm/configs/aspeed_g5_defconfig b/arch/arm/configs/aspeed_g5_defconfig
index 892605167357..4f366b0370e9 100644
--- a/arch/arm/configs/aspeed_g5_defconfig
+++ b/arch/arm/configs/aspeed_g5_defconfig
@@ -59,7 +59,7 @@ CONFIG_SERIAL_OF_PLATFORM=y
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_FIRMWARE_MEMMAP=y
 CONFIG_FANOTIFY=y
-CONFIG_PRINTK_TIME=1
+CONFIG_PRINTK_TIME=y
 CONFIG_DYNAMIC_DEBUG=y
 CONFIG_STRIP_ASM_SYMS=y
 CONFIG_PAGE_POISONING=y
diff --git a/arch/arm/configs/keystone_defconfig b/arch/arm/configs/keystone_defconfig
index 71b42e66488a..78cd2f197e01 100644
--- a/arch/arm/configs/keystone_defconfig
+++ b/arch/arm/configs/keystone_defconfig
@@ -161,6 +161,7 @@ CONFIG_USB_MON=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_STORAGE=y
 CONFIG_USB_DWC3=y
+CONFIG_NOP_USB_XCEIV=y
 CONFIG_KEYSTONE_USB_PHY=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
index 2c8665cd9dc5..ea3566fb92e2 100644
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -781,7 +781,7 @@ CONFIG_MXS_DMA=y
 CONFIG_DMA_BCM2835=y
 CONFIG_DMA_OMAP=y
 CONFIG_QCOM_BAM_DMA=y
-CONFIG_XILINX_VDMA=y
+CONFIG_XILINX_DMA=y
 CONFIG_DMA_SUN6I=y
 CONFIG_STAGING=y
 CONFIG_SENSORS_ISL29018=y
diff --git a/arch/arm/crypto/aes-ce-glue.c b/arch/arm/crypto/aes-ce-glue.c
index da3c0428507b..aef022a87c53 100644
--- a/arch/arm/crypto/aes-ce-glue.c
+++ b/arch/arm/crypto/aes-ce-glue.c
@@ -284,7 +284,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
                 err = blkcipher_walk_done(desc, &walk,
                                           walk.nbytes % AES_BLOCK_SIZE);
         }
-        if (nbytes) {
+        if (walk.nbytes % AES_BLOCK_SIZE) {
                 u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 __aligned(8) tail[AES_BLOCK_SIZE];
diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
index d0131ee6f6af..3f82e9da7cec 100644
--- a/arch/arm/include/asm/pgtable-2level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
@@ -47,6 +47,7 @@
 #define PMD_SECT_WB             (PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
 #define PMD_SECT_MINICACHE      (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE)
 #define PMD_SECT_WBWA           (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
+#define PMD_SECT_CACHE_MASK     (PMD_SECT_TEX(1) | PMD_SECT_CACHEABLE | PMD_SECT_BUFFERABLE)
 #define PMD_SECT_NONSHARED_DEV  (PMD_SECT_TEX(2))
 
 /*
diff --git a/arch/arm/include/asm/pgtable-3level-hwdef.h b/arch/arm/include/asm/pgtable-3level-hwdef.h
index f8f1cff62065..4cd664abfcd3 100644
--- a/arch/arm/include/asm/pgtable-3level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-3level-hwdef.h
@@ -62,6 +62,7 @@
 #define PMD_SECT_WT             (_AT(pmdval_t, 2) << 2) /* normal inner write-through */
 #define PMD_SECT_WB             (_AT(pmdval_t, 3) << 2) /* normal inner write-back */
 #define PMD_SECT_WBWA           (_AT(pmdval_t, 7) << 2) /* normal inner write-alloc */
+#define PMD_SECT_CACHE_MASK     (_AT(pmdval_t, 7) << 2)
 
 /*
  * + Level 3 descriptor (PTE)
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
index 62a6f65029e6..a93c0f99acf7 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
@@ -480,7 +480,10 @@ arm_copy_from_user(void *to, const void __user *from, unsigned long n);
 static inline unsigned long __must_check
 __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        unsigned int __ua_flags = uaccess_save_and_enable();
+        unsigned int __ua_flags;
+
+        check_object_size(to, n, false);
+        __ua_flags = uaccess_save_and_enable();
         n = arm_copy_from_user(to, from, n);
         uaccess_restore(__ua_flags);
         return n;
@@ -495,11 +498,15 @@ static inline unsigned long __must_check
 __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
 #ifndef CONFIG_UACCESS_WITH_MEMCPY
-        unsigned int __ua_flags = uaccess_save_and_enable();
+        unsigned int __ua_flags;
+
+        check_object_size(from, n, true);
+        __ua_flags = uaccess_save_and_enable();
         n = arm_copy_to_user(to, from, n);
         uaccess_restore(__ua_flags);
         return n;
 #else
+        check_object_size(from, n, true);
         return arm_copy_to_user(to, from, n);
 #endif
 }
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index bc5f50799d75..9f157e7c51e7 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -295,6 +295,7 @@ __und_svc_fault:
         bl      __und_fault
 
 __und_svc_finish:
+        get_thread_info tsk
         ldr     r5, [sp, #S_PSR]                @ Get SVC cpsr
         svc_exit r5                             @ return from exception
  UNWIND(.fnend          )
diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
index 0b1e4a93d67e..15d073ae5da2 100644
--- a/arch/arm/kernel/hyp-stub.S
+++ b/arch/arm/kernel/hyp-stub.S
@@ -142,6 +142,19 @@ ARM_BE8(orr	r7, r7, #(1 << 25))     @ HSCTLR.EE
         and     r7, #0x1f               @ Preserve HPMN
         mcr     p15, 4, r7, c1, c1, 1   @ HDCR
 
+        @ Make sure NS-SVC is initialised appropriately
+        mrc     p15, 0, r7, c1, c0, 0   @ SCTLR
+        orr     r7, #(1 << 5)           @ CP15 barriers enabled
+        bic     r7, #(3 << 7)           @ Clear SED/ITD for v8 (RES0 for v7)
+        bic     r7, #(3 << 19)          @ WXN and UWXN disabled
+        mcr     p15, 0, r7, c1, c0, 0   @ SCTLR
+
+        mrc     p15, 0, r7, c0, c0, 0   @ MIDR
+        mcr     p15, 4, r7, c0, c0, 0   @ VPIDR
+
+        mrc     p15, 0, r7, c0, c0, 5   @ MPIDR
+        mcr     p15, 4, r7, c0, c0, 5   @ VMPIDR
+
 #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER)
         @ make CNTP_* and CNTPCT accessible from PL1
         mrc     p15, 0, r7, c0, c1, 1   @ ID_PFR1
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
index 087acb569b63..5f221acd21ae 100644
--- a/arch/arm/kernel/sys_oabi-compat.c
+++ b/arch/arm/kernel/sys_oabi-compat.c
@@ -279,8 +279,12 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,
         mm_segment_t fs;
         long ret, err, i;
 
-        if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event)))
+        if (maxevents <= 0 ||
+                        maxevents > (INT_MAX/sizeof(*kbuf)) ||
+                        maxevents > (INT_MAX/sizeof(*events)))
                 return -EINVAL;
+        if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents))
+                return -EFAULT;
         kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL);
         if (!kbuf)
                 return -ENOMEM;
@@ -317,6 +321,8 @@ asmlinkage long sys_oabi_semtimedop(int semid,
 
         if (nsops < 1 || nsops > SEMOPM)
                 return -EINVAL;
+        if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops))
+                return -EFAULT;
         sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
         if (!sops)
                 return -ENOMEM;
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index d94bb9093ead..c94b90d43772 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -158,8 +158,6 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
 {
         int i;
 
-        kvm_free_stage2_pgd(kvm);
-
         for (i = 0; i < KVM_MAX_VCPUS; ++i) {
                 if (kvm->vcpus[i]) {
                         kvm_arch_vcpu_free(kvm->vcpus[i]);
@@ -1009,9 +1007,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
 
         switch (ioctl) {
         case KVM_CREATE_IRQCHIP: {
+                int ret;
                 if (!vgic_present)
                         return -ENXIO;
-                return kvm_vgic_create(kvm, KVM_DEV_TYPE_ARM_VGIC_V2);
+                mutex_lock(&kvm->lock);
+                ret = kvm_vgic_create(kvm, KVM_DEV_TYPE_ARM_VGIC_V2);
+                mutex_unlock(&kvm->lock);
+                return ret;
         }
         case KVM_ARM_SET_DEVICE_ADDR: {
                 struct kvm_arm_device_addr dev_addr;
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index bda27b6b1aa2..e9a5c0e0c115 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -1309,7 +1309,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
         smp_rmb();
 
         pfn = gfn_to_pfn_prot(kvm, gfn, write_fault, &writable);
-        if (is_error_pfn(pfn))
+        if (is_error_noslot_pfn(pfn))
                 return -EFAULT;
 
         if (kvm_is_device_pfn(pfn)) {
@@ -1714,7 +1714,8 @@ int kvm_mmu_init(void)
                  kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL));
 
         if (hyp_idmap_start >= kern_hyp_va(PAGE_OFFSET) &&
-            hyp_idmap_start <  kern_hyp_va(~0UL)) {
+            hyp_idmap_start <  kern_hyp_va(~0UL) &&
+            hyp_idmap_start != (unsigned long)__hyp_idmap_text_start) {
                 /*
                  * The idmap page is intersecting with the VA space,
                  * it is not safe to continue further.
@@ -1893,6 +1894,7 @@ void kvm_arch_memslots_updated(struct kvm *kvm, struct kvm_memslots *slots)
 
 void kvm_arch_flush_shadow_all(struct kvm *kvm)
 {
+        kvm_free_stage2_pgd(kvm);
 }
 
 void kvm_arch_flush_shadow_memslot(struct kvm *kvm,
diff --git a/arch/arm/mach-clps711x/Kconfig b/arch/arm/mach-clps711x/Kconfig
index dc7c6edeab39..61284b9389cf 100644
--- a/arch/arm/mach-clps711x/Kconfig
+++ b/arch/arm/mach-clps711x/Kconfig
@@ -1,13 +1,13 @@
 menuconfig ARCH_CLPS711X
         bool "Cirrus Logic EP721x/EP731x-based"
         depends on ARCH_MULTI_V4T
-        select ARCH_REQUIRE_GPIOLIB
         select AUTO_ZRELADDR
         select CLKSRC_OF
         select CLPS711X_TIMER
         select COMMON_CLK
         select CPU_ARM720T
         select GENERIC_CLOCKEVENTS
+        select GPIOLIB
         select MFD_SYSCON
         select OF_IRQ
         select USE_OF
diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c
index 3750575c73c5..06332f626565 100644
--- a/arch/arm/mach-exynos/suspend.c
+++ b/arch/arm/mach-exynos/suspend.c
@@ -255,6 +255,12 @@ static int __init exynos_pmu_irq_init(struct device_node *node,
                 return -ENOMEM;
         }
 
+        /*
+         * Clear the OF_POPULATED flag set in of_irq_init so that
+         * later the Exynos PMU platform device won't be skipped.
+         */
+        of_node_clear_flag(node, OF_POPULATED);
+
         return 0;
 }
 
diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
index fd8720532471..0df062d8b2c9 100644
--- a/arch/arm/mach-imx/gpc.c
+++ b/arch/arm/mach-imx/gpc.c
@@ -271,6 +271,12 @@ static int __init imx_gpc_init(struct device_node *node,
         for (i = 0; i < IMR_NUM; i++)
                 writel_relaxed(~0, gpc_base + GPC_IMR1 + i * 4);
 
+        /*
+         * Clear the OF_POPULATED flag set in of_irq_init so that
+         * later the GPC power domain driver will not be skipped.
+         */
+        of_node_clear_flag(node, OF_POPULATED);
+
         return 0;
 }
 IRQCHIP_DECLARE(imx_gpc, "fsl,imx6q-gpc", imx_gpc_init);
diff --git a/arch/arm/mach-imx/mach-imx6ul.c b/arch/arm/mach-imx/mach-imx6ul.c
index 5d9bfab279dd..6bb7d9cf1e38 100644
--- a/arch/arm/mach-imx/mach-imx6ul.c
+++ b/arch/arm/mach-imx/mach-imx6ul.c
@@ -64,6 +64,7 @@ static void __init imx6ul_init_machine(void)
         if (parent == NULL)
                 pr_warn("failed to initialize soc device\n");
 
+        of_platform_default_populate(NULL, NULL, parent);
         imx6ul_enet_init();
         imx_anatop_init();
         imx6ul_pm_init();
diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
index 58924b3844df..fe708e26d021 100644
--- a/arch/arm/mach-imx/pm-imx6.c
+++ b/arch/arm/mach-imx/pm-imx6.c
@@ -295,7 +295,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
                 val &= ~BM_CLPCR_SBYOS;
                 if (cpu_is_imx6sl())
                         val |= BM_CLPCR_BYPASS_PMIC_READY;
-                if (cpu_is_imx6sl() || cpu_is_imx6sx())
+                if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
                         val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
                 else
                         val |= BM_CLPCR_BYP_MMDC_CH1_LPM_HS;
@@ -310,7 +310,7 @@ int imx6_set_lpm(enum mxc_cpu_pwr_mode mode)
                 val |= 0x3 << BP_CLPCR_STBY_COUNT;
                 val |= BM_CLPCR_VSTBY;
                 val |= BM_CLPCR_SBYOS;
-                if (cpu_is_imx6sl())
+                if (cpu_is_imx6sl() || cpu_is_imx6sx())
                         val |= BM_CLPCR_BYPASS_PMIC_READY;
                 if (cpu_is_imx6sl() || cpu_is_imx6sx() || cpu_is_imx6ul())
                         val |= BM_CLPCR_BYP_MMDC_CH0_LPM_HS;
diff --git a/arch/arm/mach-mvebu/Makefile b/arch/arm/mach-mvebu/Makefile
index e53c6cfcab51..6c6497e80a7b 100644
--- a/arch/arm/mach-mvebu/Makefile
+++ b/arch/arm/mach-mvebu/Makefile
@@ -1,5 +1,4 @@
-ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/$(src)/include \
-        -I$(srctree)/arch/arm/plat-orion/include
+ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/arch/arm/plat-orion/include
 
 AFLAGS_coherency_ll.o           := -Wa,-march=armv7-a
 CFLAGS_pmsu.o                   := -march=armv7-a
diff --git a/arch/arm/mach-omap2/cm33xx.c b/arch/arm/mach-omap2/cm33xx.c
index c073fb57dd13..6f2d0aec0513 100644
--- a/arch/arm/mach-omap2/cm33xx.c
+++ b/arch/arm/mach-omap2/cm33xx.c
@@ -220,9 +220,6 @@ static int am33xx_cm_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -246,9 +243,6 @@ static int am33xx_cm_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(inst, clkctrl_offs) ==
                                 CLKCTRL_IDLEST_DISABLED),
                                 MAX_MODULE_READY_TIME, i);
diff --git a/arch/arm/mach-omap2/cminst44xx.c b/arch/arm/mach-omap2/cminst44xx.c
index 2c0e07ed6b99..2ab27ade136a 100644
--- a/arch/arm/mach-omap2/cminst44xx.c
+++ b/arch/arm/mach-omap2/cminst44xx.c
@@ -278,9 +278,6 @@ static int omap4_cminst_wait_module_ready(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout(_is_module_ready(part, inst, clkctrl_offs),
                           MAX_MODULE_READY_TIME, i);
 
@@ -304,9 +301,6 @@ static int omap4_cminst_wait_module_idle(u8 part, s16 inst, u16 clkctrl_offs,
 {
         int i = 0;
 
-        if (!clkctrl_offs)
-                return 0;
-
         omap_test_timeout((_clkctrl_idlest(part, inst, clkctrl_offs) ==
                            CLKCTRL_IDLEST_DISABLED),
                           MAX_MODULE_DISABLE_TIME, i);
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 5b709383381c..1052b29697b8 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1053,6 +1053,10 @@ static int _omap4_wait_target_disable(struct omap_hwmod *oh)
         if (oh->flags & HWMOD_NO_IDLEST)
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         return omap_cm_wait_module_idle(oh->clkdm->prcm_partition,
                                         oh->clkdm->cm_inst,
                                         oh->prcm.omap4.clkctrl_offs, 0);
@@ -2971,6 +2975,10 @@ static int _omap4_wait_target_ready(struct omap_hwmod *oh)
         if (!_find_mpu_rt_port(oh))
                 return 0;
 
+        if (!oh->prcm.omap4.clkctrl_offs &&
+            !(oh->prcm.omap4.flags & HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET))
+                return 0;
+
         /* XXX check module SIDLEMODE, hardreset status */
 
         return omap_cm_wait_module_ready(oh->clkdm->prcm_partition,
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 4041bad79a9a..78904017f18c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -443,8 +443,12 @@ struct omap_hwmod_omap2_prcm {
  * HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT: Some IP blocks don't have a PRCM
  *     module-level context loss register associated with them; this
  *     flag bit should be set in those cases
+ * HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET: Some IP blocks have a valid CLKCTRL
+ *      offset of zero; this flag bit should be set in those cases to
+ *      distinguish from hwmods that have no clkctrl offset.
  */
 #define HWMOD_OMAP4_NO_CONTEXT_LOSS_BIT         (1 << 0)
+#define HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET         (1 << 1)
 
 /**
  * struct omap_hwmod_omap4_prcm - OMAP4-specific PRCM data
diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
index 55c5878577f4..e2d84aa7f595 100644
--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
@@ -29,6 +29,7 @@
 #define CLKCTRL(oh, clkctrl) ((oh).prcm.omap4.clkctrl_offs = (clkctrl))
 #define RSTCTRL(oh, rstctrl) ((oh).prcm.omap4.rstctrl_offs = (rstctrl))
 #define RSTST(oh, rstst) ((oh).prcm.omap4.rstst_offs = (rstst))
+#define PRCM_FLAGS(oh, flag) ((oh).prcm.omap4.flags = (flag))
 
 /*
  * 'l3' class
@@ -1296,6 +1297,7 @@ static void omap_hwmod_am33xx_clkctrl(void)
         CLKCTRL(am33xx_i2c1_hwmod, AM33XX_CM_WKUP_I2C0_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_wd_timer1_hwmod, AM33XX_CM_WKUP_WDT1_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_rtc_hwmod, AM33XX_CM_RTC_RTC_CLKCTRL_OFFSET);
+        PRCM_FLAGS(am33xx_rtc_hwmod, HWMOD_OMAP4_ZERO_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_mmc2_hwmod, AM33XX_CM_PER_MMC2_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_gpmc_hwmod, AM33XX_CM_PER_GPMC_CLKCTRL_OFFSET);
         CLKCTRL(am33xx_l4_ls_hwmod, AM33XX_CM_PER_L4LS_CLKCTRL_OFFSET);
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index d72ee6185d5e..1cc4a6f3954e 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -722,8 +722,20 @@ static struct omap_hwmod omap3xxx_dss_dispc_hwmod = {
  * display serial interface controller
  */
 
+static struct omap_hwmod_class_sysconfig omap3xxx_dsi_sysc = {
+        .rev_offs       = 0x0000,
+        .sysc_offs      = 0x0010,
+        .syss_offs      = 0x0014,
+        .sysc_flags     = (SYSC_HAS_AUTOIDLE | SYSC_HAS_CLOCKACTIVITY |
+                           SYSC_HAS_ENAWAKEUP | SYSC_HAS_SIDLEMODE |
+                           SYSC_HAS_SOFTRESET | SYSS_HAS_RESET_STATUS),
+        .idlemodes      = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
+        .sysc_fields    = &omap_hwmod_sysc_type1,
+};
+
 static struct omap_hwmod_class omap3xxx_dsi_hwmod_class = {
         .name = "dsi",
+        .sysc   = &omap3xxx_dsi_sysc,
 };
 
 static struct omap_hwmod_irq_info omap3xxx_dsi1_irqs[] = {
diff --git a/arch/arm/mach-oxnas/Kconfig b/arch/arm/mach-oxnas/Kconfig
index 567496bd250a..29100beb2e7f 100644
--- a/arch/arm/mach-oxnas/Kconfig
+++ b/arch/arm/mach-oxnas/Kconfig
@@ -11,11 +11,13 @@ if ARCH_OXNAS
 
 config MACH_OX810SE
         bool "Support OX810SE Based Products"
+        select ARCH_HAS_RESET_CONTROLLER
         select COMMON_CLK_OXNAS
         select CPU_ARM926T
         select MFD_SYSCON
         select OXNAS_RPS_TIMER
         select PINCTRL_OXNAS
+        select RESET_CONTROLLER
         select RESET_OXNAS
         select VERSATILE_FPGA_IRQ
         help
diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c
index dc109dc3a622..10bfdb169366 100644
--- a/arch/arm/mach-pxa/corgi.c
+++ b/arch/arm/mach-pxa/corgi.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/module.h>       /* symbol_get ; symbol_put */
 #include <linux/init.h>
 #include <linux/platform_device.h>
 #include <linux/major.h>
diff --git a/arch/arm/mach-pxa/idp.c b/arch/arm/mach-pxa/idp.c
index c410d84b243d..66070acaa888 100644
--- a/arch/arm/mach-pxa/idp.c
+++ b/arch/arm/mach-pxa/idp.c
@@ -83,7 +83,8 @@ static struct resource smc91x_resources[] = {
 };
 
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_32BIT | SMC91X_USE_DMA | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_USE_DMA | SMC91X_NOWAIT,
 };
 
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
index 7245f3359564..d6159f8ef0c2 100644
--- a/arch/arm/mach-pxa/lubbock.c
+++ b/arch/arm/mach-pxa/lubbock.c
@@ -137,6 +137,18 @@ static struct pxa2xx_udc_mach_info udc_info __initdata = {
         // no D+ pullup; lubbock can't connect/disconnect in software
 };
 
+static void lubbock_init_pcmcia(void)
+{
+        struct clk *clk;
+
+        /* Add an alias for the SA1111 PCMCIA clock */
+        clk = clk_get_sys("pxa2xx-pcmcia", NULL);
+        if (!IS_ERR(clk)) {
+                clkdev_create(clk, NULL, "1800");
+                clk_put(clk);
+        }
+}
+
 static struct resource sa1111_resources[] = {
         [0] = {
                 .start  = 0x10000000,
@@ -467,6 +479,8 @@ static void __init lubbock_init(void)
         pxa_set_btuart_info(NULL);
         pxa_set_stuart_info(NULL);
 
+        lubbock_init_pcmcia();
+
         clk_add_alias("SA1111_CLK", NULL, "GPIO11_CLK", NULL);
         pxa_set_udc_info(&udc_info);
         pxa_set_fb_info(NULL, &sharp_lm8v31);
diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
index 1080580b1343..2c150bfc0cd5 100644
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -13,6 +13,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/module.h>       /* symbol_get ; symbol_put */
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/gpio_keys.h>
diff --git a/arch/arm/mach-pxa/xcep.c b/arch/arm/mach-pxa/xcep.c
index 3f06cd90567a..056369ef250e 100644
--- a/arch/arm/mach-pxa/xcep.c
+++ b/arch/arm/mach-pxa/xcep.c
@@ -120,7 +120,8 @@ static struct resource smc91x_resources[] = {
 };
 
 static struct smc91x_platdata xcep_smc91x_info = {
-        .flags  = SMC91X_USE_32BIT | SMC91X_NOWAIT | SMC91X_USE_DMA,
+        .flags  = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                  SMC91X_NOWAIT | SMC91X_USE_DMA,
 };
 
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-realview/Makefile b/arch/arm/mach-realview/Makefile
index dae8d86ef4cc..404882130956 100644
--- a/arch/arm/mach-realview/Makefile
+++ b/arch/arm/mach-realview/Makefile
@@ -1,8 +1,7 @@
 #
 # Makefile for the linux kernel.
 #
-ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/$(src)/include \
-        -I$(srctree)/arch/arm/plat-versatile/include
+ccflags-$(CONFIG_ARCH_MULTIPLATFORM) := -I$(srctree)/arch/arm/plat-versatile/include
 
 obj-y                                   := core.o
 obj-$(CONFIG_REALVIEW_DT)               += realview-dt.o
diff --git a/arch/arm/mach-realview/core.c b/arch/arm/mach-realview/core.c
index baf174542e36..a0ead0ae23d6 100644
--- a/arch/arm/mach-realview/core.c
+++ b/arch/arm/mach-realview/core.c
@@ -93,7 +93,8 @@ static struct smsc911x_platform_config smsc911x_config = {
 };
 
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
 };
 
 static struct platform_device realview_eth_device = {
diff --git a/arch/arm/mach-s3c24xx/mach-mini2440.c b/arch/arm/mach-s3c24xx/mach-mini2440.c
index a8521684a7f5..13999c1c46cf 100644
--- a/arch/arm/mach-s3c24xx/mach-mini2440.c
+++ b/arch/arm/mach-s3c24xx/mach-mini2440.c
@@ -497,9 +497,28 @@ static struct i2c_board_info mini2440_i2c_devs[] __initdata = {
         },
 };
 
+static struct uda134x_platform_data s3c24xx_uda134x = {
+        .l3 = {
+                .gpio_clk = S3C2410_GPB(4),
+                .gpio_data = S3C2410_GPB(3),
+                .gpio_mode = S3C2410_GPB(2),
+                .use_gpios = 1,
+                .data_hold = 1,
+                .data_setup = 1,
+                .clock_high = 1,
+                .mode_hold = 1,
+                .mode = 1,
+                .mode_setup = 1,
+        },
+        .model = UDA134X_UDA1341,
+};
+
 static struct platform_device uda1340_codec = {
                 .name = "uda134x-codec",
                 .id = -1,
+                .dev = {
+                        .platform_data  = &s3c24xx_uda134x,
+                },
 };
 
 static struct platform_device *mini2440_devices[] __initdata = {
diff --git a/arch/arm/mach-s5pv210/Makefile b/arch/arm/mach-s5pv210/Makefile
index 72b9e9671507..fa7fb716e388 100644
--- a/arch/arm/mach-s5pv210/Makefile
+++ b/arch/arm/mach-s5pv210/Makefile
@@ -5,7 +5,7 @@
 #
 # Licensed under GPLv2
 
-ccflags-$(CONFIG_ARCH_MULTIPLATFORM) += -I$(srctree)/$(src)/include -I$(srctree)/arch/arm/plat-samsung/include
+ccflags-$(CONFIG_ARCH_MULTIPLATFORM) += -I$(srctree)/arch/arm/plat-samsung/include
 
 # Core
 
diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c
index cbf53bb9c814..0db46895c82a 100644
--- a/arch/arm/mach-sa1100/clock.c
+++ b/arch/arm/mach-sa1100/clock.c
@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(struct clk *clk)
 }
 
 static struct clkops clk_36864_ops = {
+        .enable         = clk_cpu_enable,
+        .disable        = clk_cpu_disable,
         .get_rate       = clk_36864_get_rate,
 };
 
@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[] = {
         CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
 };
 
-static int __init sa11xx_clk_init(void)
+int __init sa11xx_clk_init(void)
 {
         clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
         return 0;
 }
-core_initcall(sa11xx_clk_init);
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index 345e63f4eb71..3e09beddb6e8 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -34,6 +34,7 @@
 
 #include <mach/hardware.h>
 #include <mach/irqs.h>
+#include <mach/reset.h>
 
 #include "generic.h"
 #include <clocksource/pxa.h>
@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
 
 void sa11x0_restart(enum reboot_mode mode, const char *cmd)
 {
+        clear_reset_status(RESET_STATUS_ALL);
+
         if (mode == REBOOT_SOFT) {
                 /* Jump into ROM at address 0 */
                 soft_restart(0);
@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void)
         sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
 
         sa1100_init_gpio();
+        sa11xx_clk_init();
 }
 
 /*
diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
index 0d92e119b36b..68199b603ff7 100644
--- a/arch/arm/mach-sa1100/generic.h
+++ b/arch/arm/mach-sa1100/generic.h
@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
 #else
 static inline int sa11x0_pm_init(void) { return 0; }
 #endif
+
+int sa11xx_clk_init(void);
diff --git a/arch/arm/mach-sa1100/pleb.c b/arch/arm/mach-sa1100/pleb.c
index 1525d7b5f1b7..88149f85bc49 100644
--- a/arch/arm/mach-sa1100/pleb.c
+++ b/arch/arm/mach-sa1100/pleb.c
@@ -45,7 +45,7 @@ static struct resource smc91x_resources[] = {
 };
 
 static struct smc91x_platdata smc91x_platdata = {
-        .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_16BIT | SMC91X_USE_8BIT | SMC91X_NOWAIT,
 };
 
 static struct platform_device smc91x_device = {
diff --git a/arch/arm/mach-shmobile/platsmp.c b/arch/arm/mach-shmobile/platsmp.c
index f3dba6f356e2..02e21bceb085 100644
--- a/arch/arm/mach-shmobile/platsmp.c
+++ b/arch/arm/mach-shmobile/platsmp.c
@@ -40,5 +40,8 @@ bool shmobile_smp_cpu_can_disable(unsigned int cpu)
 bool __init shmobile_smp_init_fallback_ops(void)
 {
         /* fallback on PSCI/smp_ops if no other DT based method is detected */
+        if (!IS_ENABLED(CONFIG_SMP))
+                return false;
+
         return platform_can_secondary_boot() ? true : false;
 }
diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
index 62437b57813e..73e3adbc1330 100644
--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
@@ -41,39 +41,26 @@
 
 #define REGULATOR_IRQ_MASK      BIT(2)  /* IRQ2, active low */
 
-static void __iomem *irqc;
-
-static const u8 da9063_mask_regs[] = {
-        DA9063_REG_IRQ_MASK_A,
-        DA9063_REG_IRQ_MASK_B,
-        DA9063_REG_IRQ_MASK_C,
-        DA9063_REG_IRQ_MASK_D,
-};
-
-/* DA9210 System Control and Event Registers */
+/* start of DA9210 System Control and Event Registers */
 #define DA9210_REG_MASK_A               0x54
-#define DA9210_REG_MASK_B               0x55
-
-static const u8 da9210_mask_regs[] = {
-        DA9210_REG_MASK_A,
-        DA9210_REG_MASK_B,
-};
-
-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
-                             unsigned int nregs)
-{
-        unsigned int i;
 
-        dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
+static void __iomem *irqc;
 
-        for (i = 0; i < nregs; i++) {
-                int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
-                if (error) {
-                        dev_err(&client->dev, "i2c error %d\n", error);
-                        return;
-                }
-        }
-}
+/* first byte sets the memory pointer, following are consecutive reg values */
+static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff };
+static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
+
+static struct i2c_msg da9xxx_msgs[2] = {
+        {
+                .addr = 0x58,
+                .len = ARRAY_SIZE(da9063_irq_clr),
+                .buf = da9063_irq_clr,
+        }, {
+                .addr = 0x68,
+                .len = ARRAY_SIZE(da9210_irq_clr),
+                .buf = da9210_irq_clr,
+        },
+};
 
 static int regulator_quirk_notify(struct notifier_block *nb,
                                   unsigned long action, void *data)
@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct notifier_block *nb,
         client = to_i2c_client(dev);
         dev_dbg(dev, "Detected %s\n", client->name);
 
-        if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
-                da9xxx_mask_irqs(client, da9063_mask_regs,
-                                 ARRAY_SIZE(da9063_mask_regs));
-        else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
-                da9xxx_mask_irqs(client, da9210_mask_regs,
-                                 ARRAY_SIZE(da9210_mask_regs));
+        if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
+            (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
+                int ret;
+
+                dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
+                ret = i2c_transfer(client->adapter, da9xxx_msgs, ARRAY_SIZE(da9xxx_msgs));
+                if (ret != ARRAY_SIZE(da9xxx_msgs))
+                        dev_err(&client->dev, "i2c error %d\n", ret);
+        }
 
         mon = ioread32(irqc + IRQC_MONITOR);
         if (mon & REGULATOR_IRQ_MASK)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 62f4d01941f7..30fe03f95c85 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -137,7 +137,7 @@ void __init init_default_cache_policy(unsigned long pmd)
 
         initial_pmd_value = pmd;
 
-        pmd &= PMD_SECT_TEX(1) | PMD_SECT_BUFFERABLE | PMD_SECT_CACHEABLE;
+        pmd &= PMD_SECT_CACHE_MASK;
 
         for (i = 0; i < ARRAY_SIZE(cache_policies); i++)
                 if (cache_policies[i].pmd == pmd) {
@@ -728,7 +728,8 @@ static void *__init late_alloc(unsigned long sz)
 {
         void *ptr = (void *)__get_free_pages(PGALLOC_GFP, get_order(sz));
 
-        BUG_ON(!ptr);
+        if (!ptr || !pgtable_page_ctor(virt_to_page(ptr)))
+                BUG();
         return ptr;
 }
 
@@ -1155,10 +1156,19 @@ void __init sanity_check_meminfo(void)
 {
         phys_addr_t memblock_limit = 0;
         int highmem = 0;
-        phys_addr_t vmalloc_limit = __pa(vmalloc_min - 1) + 1;
+        u64 vmalloc_limit;
         struct memblock_region *reg;
         bool should_use_highmem = false;
 
+        /*
+         * Let's use our own (unoptimized) equivalent of __pa() that is
+         * not affected by wrap-arounds when sizeof(phys_addr_t) == 4.
+         * The result is used as the upper bound on physical memory address
+         * and may itself be outside the valid range for which phys_addr_t
+         * and therefore __pa() is defined.
+         */
+        vmalloc_limit = (u64)(uintptr_t)vmalloc_min - PAGE_OFFSET + PHYS_OFFSET;
+
         for_each_memblock(memory, reg) {
                 phys_addr_t block_start = reg->base;
                 phys_addr_t block_end = reg->base + reg->size;
@@ -1183,10 +1193,11 @@ void __init sanity_check_meminfo(void)
                         if (reg->size > size_limit) {
                                 phys_addr_t overlap_size = reg->size - size_limit;
 
-                                pr_notice("Truncating RAM at %pa-%pa to -%pa",
-                                          &block_start, &block_end, &vmalloc_limit);
-                                memblock_remove(vmalloc_limit, overlap_size);
+                                pr_notice("Truncating RAM at %pa-%pa",
+                                          &block_start, &block_end);
                                 block_end = vmalloc_limit;
+                                pr_cont(" to -%pa", &block_end);
+                                memblock_remove(vmalloc_limit, overlap_size);
                                 should_use_highmem = true;
                         }
                 }
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index a7123b4e129d..d00d52c9de3e 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -16,6 +16,7 @@
 #include <asm/hwcap.h>
 #include <asm/pgtable-hwdef.h>
 #include <asm/pgtable.h>
+#include <asm/memory.h>
 
 #include "proc-macros.S"
 
diff --git a/arch/arm/xen/enlighten.c b/arch/arm/xen/enlighten.c
index b0b82f5ea338..f193414d0f6f 100644
--- a/arch/arm/xen/enlighten.c
+++ b/arch/arm/xen/enlighten.c
@@ -50,7 +50,7 @@ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
 static struct vcpu_info __percpu *xen_vcpu_info;
 
 /* Linux <-> Xen vCPU id mapping */
-DEFINE_PER_CPU(int, xen_vcpu_id) = -1;
+DEFINE_PER_CPU(uint32_t, xen_vcpu_id);
 EXPORT_PER_CPU_SYMBOL(xen_vcpu_id);
 
 /* These are unused until we support booting "pre-ballooned" */
@@ -170,9 +170,6 @@ static int xen_starting_cpu(unsigned int cpu)
         pr_info("Xen: initializing cpu%d\n", cpu);
         vcpup = per_cpu_ptr(xen_vcpu_info, cpu);
 
-        /* Direct vCPU id mapping for ARM guests. */
-        per_cpu(xen_vcpu_id, cpu) = cpu;
-
         info.mfn = virt_to_gfn(vcpup);
         info.offset = xen_offset_in_page(vcpup);
 
@@ -330,6 +327,7 @@ static int __init xen_guest_init(void)
 {
         struct xen_add_to_physmap xatp;
         struct shared_info *shared_info_page = NULL;
+        int cpu;
 
         if (!xen_domain())
                 return 0;
@@ -380,7 +378,8 @@ static int __init xen_guest_init(void)
                 return -ENOMEM;
 
         /* Direct vCPU id mapping for ARM guests. */
-        per_cpu(xen_vcpu_id, 0) = 0;
+        for_each_possible_cpu(cpu)
+                per_cpu(xen_vcpu_id, cpu) = cpu;
 
         xen_auto_xlat_grant_frames.count = gnttab_max_grant_frames();
         if (xen_xlate_map_ballooned_pages(&xen_auto_xlat_grant_frames.pfn,
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 69c8787bec7d..bc3f00f586f1 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -54,6 +54,7 @@ config ARM64
         select HAVE_ALIGNED_STRUCT_PAGE if SLUB
         select HAVE_ARCH_AUDITSYSCALL
         select HAVE_ARCH_BITREVERSE
+        select HAVE_ARCH_HARDENED_USERCOPY
         select HAVE_ARCH_HUGE_VMAP
         select HAVE_ARCH_JUMP_LABEL
         select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP && !(ARM64_16K_PAGES && ARM64_VA_BITS_48)
diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
index bb2616b16157..be5d824ebdba 100644
--- a/arch/arm64/Kconfig.platforms
+++ b/arch/arm64/Kconfig.platforms
@@ -8,7 +8,7 @@ config ARCH_SUNXI
 
 config ARCH_ALPINE
         bool "Annapurna Labs Alpine platform"
-        select ALPINE_MSI
+        select ALPINE_MSI if PCI
         help
           This enables support for the Annapurna Labs Alpine
           Soc family.
@@ -66,7 +66,7 @@ config ARCH_LG1K
 config ARCH_HISI
         bool "Hisilicon SoC Family"
         select ARM_TIMER_SP804
-        select HISILICON_IRQ_MBIGEN
+        select HISILICON_IRQ_MBIGEN if PCI
         help
           This enables support for Hisilicon ARMv8 SoC family
 
diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
index 445aa678f914..c2b9bcb0ef61 100644
--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
+++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi
@@ -255,10 +255,10 @@
                 /* Local timer */
                 timer {
                         compatible = "arm,armv8-timer";
-                        interrupts = <1 13 0xf01>,
-                                     <1 14 0xf01>,
-                                     <1 11 0xf01>,
-                                     <1 10 0xf01>;
+                        interrupts = <1 13 0xf08>,
+                                     <1 14 0xf08>,
+                                     <1 11 0xf08>,
+                                     <1 10 0xf08>;
                 };
 
                 timer0: timer0@ffc03000 {
diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
index e502c24b0ac7..bf6c8d051002 100644
--- a/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
+++ b/arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi
@@ -102,13 +102,13 @@
         timer {
                 compatible = "arm,armv8-timer";
                 interrupts = <GIC_PPI 13
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 14
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 11
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>,
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 10
-                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_EDGE_RISING)>;
+                        (GIC_CPU_MASK_RAW(0xff) | IRQ_TYPE_LEVEL_LOW)>;
         };
 
         xtal: xtal-clk {
diff --git a/arch/arm64/boot/dts/apm/apm-storm.dtsi b/arch/arm64/boot/dts/apm/apm-storm.dtsi
index f1c2c713f9b0..c29dab9d1834 100644
--- a/arch/arm64/boot/dts/apm/apm-storm.dtsi
+++ b/arch/arm64/boot/dts/apm/apm-storm.dtsi
@@ -110,10 +110,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 0 0xff01>,      /* Secure Phys IRQ */
-                             <1 13 0xff01>,     /* Non-secure Phys IRQ */
-                             <1 14 0xff01>,     /* Virt IRQ */
-                             <1 15 0xff01>;     /* Hyp IRQ */
+                interrupts = <1 0 0xff08>,      /* Secure Phys IRQ */
+                             <1 13 0xff08>,     /* Non-secure Phys IRQ */
+                             <1 14 0xff08>,     /* Virt IRQ */
+                             <1 15 0xff08>;     /* Hyp IRQ */
                 clock-frequency = <50000000>;
         };
 
diff --git a/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi b/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi
new file mode 120000
index 000000000000..3937b77cb310
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm2835-rpi.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm2835-rpi.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
index 6f47dd2bb1db..7841b724e340 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
+++ b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
@@ -1,7 +1,7 @@
 /dts-v1/;
 #include "bcm2837.dtsi"
-#include "../../../../arm/boot/dts/bcm2835-rpi.dtsi"
-#include "../../../../arm/boot/dts/bcm283x-rpi-smsc9514.dtsi"
+#include "bcm2835-rpi.dtsi"
+#include "bcm283x-rpi-smsc9514.dtsi"
 
 / {
         compatible = "raspberrypi,3-model-b", "brcm,bcm2837";
diff --git a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
index f2a31d06845d..8216bbb29fe0 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm2837.dtsi
@@ -1,4 +1,4 @@
-#include "../../../../arm/boot/dts/bcm283x.dtsi"
+#include "bcm283x.dtsi"
 
 / {
         compatible = "brcm,bcm2836";
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi
new file mode 120000
index 000000000000..dca7c057d5a5
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x-rpi-smsc9514.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x-rpi-smsc9514.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/bcm283x.dtsi b/arch/arm64/boot/dts/broadcom/bcm283x.dtsi
new file mode 120000
index 000000000000..5f54e4cab99b
--- /dev/null
+++ b/arch/arm64/boot/dts/broadcom/bcm283x.dtsi
@@ -0,0 +1 @@
+../../../../arm/boot/dts/bcm283x.dtsi
\ No newline at end of file
diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi
index f53b0955bfd3..d4a12fad8afd 100644
--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
@@ -88,13 +88,13 @@
         timer {
                 compatible = "arm,armv8-timer";
                 interrupts = <GIC_PPI 13 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 14 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 11 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>,
+                              IRQ_TYPE_LEVEL_LOW)>,
                              <GIC_PPI 10 (GIC_CPU_MASK_RAW(0xff) |
-                              IRQ_TYPE_EDGE_RISING)>;
+                              IRQ_TYPE_LEVEL_LOW)>;
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
index 2eb9b225f0bc..04dc8a8d1539 100644
--- a/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
+++ b/arch/arm64/boot/dts/cavium/thunder-88xx.dtsi
@@ -354,10 +354,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0xff01>,
-                             <1 14 0xff01>,
-                             <1 11 0xff01>,
-                             <1 10 0xff01>;
+                interrupts = <1 13 4>,
+                             <1 14 4>,
+                             <1 11 4>,
+                             <1 10 4>;
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
index 299f3ce969ab..c528dd52ba2d 100644
--- a/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
+++ b/arch/arm64/boot/dts/exynos/exynos7-espresso.dts
@@ -12,6 +12,7 @@
 /dts-v1/;
 #include "exynos7.dtsi"
 #include <dt-bindings/interrupt-controller/irq.h>
+#include <dt-bindings/clock/samsung,s2mps11.h>
 
 / {
         model = "Samsung Exynos7 Espresso board based on EXYNOS7";
@@ -43,6 +44,8 @@
 
 &rtc {
         status = "okay";
+        clocks = <&clock_ccore PCLK_RTC>, <&s2mps15_osc S2MPS11_CLK_AP>;
+        clock-names = "rtc", "rtc_src";
 };
 
 &watchdog {
diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index ca663dfe5189..162831546e18 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -473,10 +473,10 @@
 
                 timer {
                         compatible = "arm,armv8-timer";
-                        interrupts = <1 13 0xff01>,
-                                     <1 14 0xff01>,
-                                     <1 11 0xff01>,
-                                     <1 10 0xff01>;
+                        interrupts = <1 13 0xff08>,
+                                     <1 14 0xff08>,
+                                     <1 11 0xff08>,
+                                     <1 10 0xff08>;
                 };
 
                 pmu_system_controller: system-controller@105c0000 {
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
index e669fbd7f9c3..a67e210e2019 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi
@@ -119,10 +119,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0x1>, /* Physical Secure PPI */
-                             <1 14 0x1>, /* Physical Non-Secure PPI */
-                             <1 11 0x1>, /* Virtual PPI */
-                             <1 10 0x1>; /* Hypervisor PPI */
+                interrupts = <1 13 0xf08>, /* Physical Secure PPI */
+                             <1 14 0xf08>, /* Physical Non-Secure PPI */
+                             <1 11 0xf08>, /* Virtual PPI */
+                             <1 10 0xf08>; /* Hypervisor PPI */
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
index 21023a388c29..e3b6034ea5d9 100644
--- a/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-ls2080a.dtsi
@@ -191,10 +191,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0x8>, /* Physical Secure PPI, active-low */
-                             <1 14 0x8>, /* Physical Non-Secure PPI, active-low */
-                             <1 11 0x8>, /* Virtual PPI, active-low */
-                             <1 10 0x8>; /* Hypervisor PPI, active-low */
+                interrupts = <1 13 4>, /* Physical Secure PPI, active-low */
+                             <1 14 4>, /* Physical Non-Secure PPI, active-low */
+                             <1 11 4>, /* Virtual PPI, active-low */
+                             <1 10 4>; /* Hypervisor PPI, active-low */
         };
 
         pmu {
diff --git a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
index eab1a42fb934..c2a6745f168c 100644
--- a/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-ap806.dtsi
@@ -122,10 +122,10 @@
 
                         timer {
                                 compatible = "arm,armv8-timer";
-                                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
-                                             <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
-                                             <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>,
-                                             <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
+                                interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                                             <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                                             <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+                                             <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>;
                         };
 
                         odmi: odmi@300000 {
diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
index d02a900378e1..4f44d1191bfd 100644
--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi
@@ -270,6 +270,8 @@
                 #io-channel-cells = <1>;
                 clocks = <&cru SCLK_SARADC>, <&cru PCLK_SARADC>;
                 clock-names = "saradc", "apb_pclk";
+                resets = <&cru SRST_SARADC>;
+                reset-names = "saradc-apb";
                 status = "disabled";
         };
 
diff --git a/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi b/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
index c223915f0907..d73bdc8c9115 100644
--- a/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
+++ b/arch/arm64/boot/dts/socionext/uniphier-ph1-ld20.dtsi
@@ -129,10 +129,10 @@
 
         timer {
                 compatible = "arm,armv8-timer";
-                interrupts = <1 13 0xf01>,
-                             <1 14 0xf01>,
-                             <1 11 0xf01>,
-                             <1 10 0xf01>;
+                interrupts = <1 13 4>,
+                             <1 14 4>,
+                             <1 11 4>,
+                             <1 10 4>;
         };
 
         soc {
diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
index e595f22e7e4b..3e2e51fbd2bc 100644
--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
@@ -65,10 +65,10 @@
         timer {
                 compatible = "arm,armv8-timer";
                 interrupt-parent = <&gic>;
-                interrupts = <1 13 0xf01>,
-                             <1 14 0xf01>,
-                             <1 11 0xf01>,
-                             <1 10 0xf01>;
+                interrupts = <1 13 0xf08>,
+                             <1 14 0xf08>,
+                             <1 11 0xf08>,
+                             <1 10 0xf08>;
         };
 
         amba_apu {
diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig
index 0555b7caaf2c..eadf4855ad2d 100644
--- a/arch/arm64/configs/defconfig
+++ b/arch/arm64/configs/defconfig
@@ -1,4 +1,3 @@
-# CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
 CONFIG_AUDIT=y
@@ -15,10 +14,14 @@ CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_MEMCG=y
 CONFIG_MEMCG_SWAP=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CGROUP_PIDS=y
 CONFIG_CGROUP_HUGETLB=y
-# CONFIG_UTS_NS is not set
-# CONFIG_IPC_NS is not set
-# CONFIG_NET_NS is not set
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
@@ -71,6 +74,7 @@ CONFIG_PREEMPT=y
 CONFIG_KSM=y
 CONFIG_TRANSPARENT_HUGEPAGE=y
 CONFIG_CMA=y
+CONFIG_SECCOMP=y
 CONFIG_XEN=y
 CONFIG_KEXEC=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
@@ -84,10 +88,37 @@ CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
 CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
 CONFIG_IP_PNP=y
 CONFIG_IP_PNP_DHCP=y
 CONFIG_IP_PNP_BOOTP=y
-# CONFIG_IPV6 is not set
+CONFIG_IPV6=m
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=m
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_MANGLE=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
 CONFIG_BPF_JIT=y
 CONFIG_CFG80211=m
 CONFIG_MAC80211=m
@@ -103,6 +134,7 @@ CONFIG_MTD=y
 CONFIG_MTD_M25P80=y
 CONFIG_MTD_SPI_NOR=y
 CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=m
 CONFIG_VIRTIO_BLK=y
 CONFIG_SRAM=y
 # CONFIG_SCSI_PROC_FS is not set
@@ -120,7 +152,10 @@ CONFIG_SATA_SIL24=y
 CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_OF_PLATFORM=y
 CONFIG_NETDEVICES=y
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
 CONFIG_TUN=y
+CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_AMD_XGBE=y
 CONFIG_NET_XGENE=y
@@ -350,12 +385,16 @@ CONFIG_EXYNOS_ADC=y
 CONFIG_PWM_SAMSUNG=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=m
+CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA=y
 CONFIG_AUTOFS4_FS=y
-CONFIG_FUSE_FS=y
-CONFIG_CUSE=y
+CONFIG_FUSE_FS=m
+CONFIG_CUSE=m
+CONFIG_OVERLAY_FS=m
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
 CONFIG_HUGETLBFS=y
diff --git a/arch/arm64/crypto/aes-glue.c b/arch/arm64/crypto/aes-glue.c
index 5c888049d061..6b2aa0fd6cd0 100644
--- a/arch/arm64/crypto/aes-glue.c
+++ b/arch/arm64/crypto/aes-glue.c
@@ -216,7 +216,7 @@ static int ctr_encrypt(struct blkcipher_desc *desc, struct scatterlist *dst,
                 err = blkcipher_walk_done(desc, &walk,
                                           walk.nbytes % AES_BLOCK_SIZE);
         }
-        if (nbytes) {
+        if (walk.nbytes % AES_BLOCK_SIZE) {
                 u8 *tdst = walk.dst.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 *tsrc = walk.src.virt.addr + blocks * AES_BLOCK_SIZE;
                 u8 __aligned(8) tail[AES_BLOCK_SIZE];
diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
index 4b6b3f72a215..b71420a12f26 100644
--- a/arch/arm64/include/asm/debug-monitors.h
+++ b/arch/arm64/include/asm/debug-monitors.h
@@ -61,8 +61,6 @@
 
 #define AARCH64_BREAK_KGDB_DYN_DBG      \
         (AARCH64_BREAK_MON | (KGDB_DYN_DBG_BRK_IMM << 5))
-#define KGDB_DYN_BRK_INS_BYTE(x)        \
-        ((AARCH64_BREAK_KGDB_DYN_DBG >> (8 * (x))) & 0xff)
 
 #define CACHE_FLUSH_IS_SAFE             1
 
diff --git a/arch/arm64/include/asm/kprobes.h b/arch/arm64/include/asm/kprobes.h
index 61b49150dfa3..1737aecfcc5e 100644
--- a/arch/arm64/include/asm/kprobes.h
+++ b/arch/arm64/include/asm/kprobes.h
@@ -22,7 +22,6 @@
 
 #define __ARCH_WANT_KPROBES_INSN_SLOT
 #define MAX_INSN_SIZE                   1
-#define MAX_STACK_SIZE                  128
 
 #define flush_insn_slot(p)              do { } while (0)
 #define kretprobe_blacklist_size        0
@@ -47,7 +46,6 @@ struct kprobe_ctlblk {
         struct prev_kprobe prev_kprobe;
         struct kprobe_step_ctx ss_ctx;
         struct pt_regs jprobe_saved_regs;
-        char jprobes_stack[MAX_STACK_SIZE];
 };
 
 void arch_remove_kprobe(struct kprobe *);
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
index 0a456bef8c79..2fee2f59288c 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -199,19 +199,19 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
 #define _percpu_read(pcp)                                               \
 ({                                                                      \
         typeof(pcp) __retval;                                           \
-        preempt_disable();                                              \
+        preempt_disable_notrace();                                      \
         __retval = (typeof(pcp))__percpu_read(raw_cpu_ptr(&(pcp)),      \
                                               sizeof(pcp));             \
-        preempt_enable();                                               \
+        preempt_enable_notrace();                                       \
         __retval;                                                       \
 })
 
 #define _percpu_write(pcp, val)                                         \
 do {                                                                    \
-        preempt_disable();                                              \
+        preempt_disable_notrace();                                      \
         __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val),       \
                                 sizeof(pcp));                           \
-        preempt_enable();                                               \
+        preempt_enable_notrace();                                       \
 } while(0)                                                              \
 
 #define _pcp_protect(operation, pcp, val)                       \
diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h
index e875a5a551d7..89206b568cd4 100644
--- a/arch/arm64/include/asm/spinlock.h
+++ b/arch/arm64/include/asm/spinlock.h
@@ -363,4 +363,14 @@ static inline int arch_read_trylock(arch_rwlock_t *rw)
 #define arch_read_relax(lock)   cpu_relax()
 #define arch_write_relax(lock)  cpu_relax()
 
+/*
+ * Accesses appearing in program order before a spin_lock() operation
+ * can be reordered with accesses inside the critical section, by virtue
+ * of arch_spin_lock being constructed using acquire semantics.
+ *
+ * In cases where this is problematic (e.g. try_to_wake_up), an
+ * smp_mb__before_spinlock() can restore the required ordering.
+ */
+#define smp_mb__before_spinlock()       smp_mb()
+
 #endif /* __ASM_SPINLOCK_H */
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 5e834d10b291..c47257c91b77 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -265,22 +265,25 @@ extern unsigned long __must_check __clear_user(void __user *addr, unsigned long
 static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         kasan_check_write(to, n);
-        return  __arch_copy_from_user(to, from, n);
+        check_object_size(to, n, false);
+        return __arch_copy_from_user(to, from, n);
 }
 
 static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         kasan_check_read(from, n);
-        return  __arch_copy_to_user(to, from, n);
+        check_object_size(from, n, true);
+        return __arch_copy_to_user(to, from, n);
 }
 
 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         kasan_check_write(to, n);
 
-        if (access_ok(VERIFY_READ, from, n))
+        if (access_ok(VERIFY_READ, from, n)) {
+                check_object_size(to, n, false);
                 n = __arch_copy_from_user(to, from, n);
-        else /* security hole - plug it */
+        } else /* security hole - plug it */
                 memset(to, 0, n);
         return n;
 }
@@ -289,8 +292,10 @@ static inline unsigned long __must_check copy_to_user(void __user *to, const voi
 {
         kasan_check_read(from, n);
 
-        if (access_ok(VERIFY_WRITE, to, n))
+        if (access_ok(VERIFY_WRITE, to, n)) {
+                check_object_size(from, n, true);
                 n = __arch_copy_to_user(to, from, n);
+        }
         return n;
 }
 
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 96e4a2b64cc1..441420ca7d08 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -353,6 +353,8 @@ el1_sync:
         lsr     x24, x1, #ESR_ELx_EC_SHIFT      // exception class
         cmp     x24, #ESR_ELx_EC_DABT_CUR       // data abort in EL1
         b.eq    el1_da
+        cmp     x24, #ESR_ELx_EC_IABT_CUR       // instruction abort in EL1
+        b.eq    el1_ia
         cmp     x24, #ESR_ELx_EC_SYS64          // configurable trap
         b.eq    el1_undef
         cmp     x24, #ESR_ELx_EC_SP_ALIGN       // stack alignment exception
@@ -364,6 +366,11 @@ el1_sync:
         cmp     x24, #ESR_ELx_EC_BREAKPT_CUR    // debug exception in EL1
         b.ge    el1_dbg
         b       el1_inv
+
+el1_ia:
+        /*
+         * Fall through to the Data abort case
+         */
 el1_da:
         /*
          * Data abort handling
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index b77f58355da1..3e7b050e99dc 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -757,6 +757,9 @@ ENTRY(__enable_mmu)
         isb
         bl      __create_page_tables            // recreate kernel mapping
 
+        tlbi    vmalle1                         // Remove any stale TLB entries
+        dsb     nsh
+
         msr     sctlr_el1, x19                  // re-enable the MMU
         isb
         ic      iallu                           // flush instructions fetched
diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c
index 21ab5df9fa76..65d81f965e74 100644
--- a/arch/arm64/kernel/hibernate.c
+++ b/arch/arm64/kernel/hibernate.c
@@ -35,6 +35,7 @@
 #include <asm/sections.h>
 #include <asm/smp.h>
 #include <asm/suspend.h>
+#include <asm/sysreg.h>
 #include <asm/virt.h>
 
 /*
@@ -217,12 +218,22 @@ static int create_safe_exec_page(void *src_start, size_t length,
         set_pte(pte, __pte(virt_to_phys((void *)dst) |
                          pgprot_val(PAGE_KERNEL_EXEC)));
 
-        /* Load our new page tables */
-        asm volatile("msr       ttbr0_el1, %0;"
-                     "isb;"
-                     "tlbi      vmalle1is;"
-                     "dsb       ish;"
-                     "isb" : : "r"(virt_to_phys(pgd)));
+        /*
+         * Load our new page tables. A strict BBM approach requires that we
+         * ensure that TLBs are free of any entries that may overlap with the
+         * global mappings we are about to install.
+         *
+         * For a real hibernate/resume cycle TTBR0 currently points to a zero
+         * page, but TLBs may contain stale ASID-tagged entries (e.g. for EFI
+         * runtime services), while for a userspace-driven test_resume cycle it
+         * points to userspace page tables (and we must point it at a zero page
+         * ourselves). Elsewhere we only (un)install the idmap with preemption
+         * disabled, so T0SZ should be as required regardless.
+         */
+        cpu_set_reserved_ttbr0();
+        local_flush_tlb_all();
+        write_sysreg(virt_to_phys(pgd), ttbr0_el1);
+        isb();
 
         *phys_dst_addr = virt_to_phys((void *)dst);
 
@@ -394,6 +405,38 @@ int swsusp_arch_resume(void)
                                           void *, phys_addr_t, phys_addr_t);
 
         /*
+         * Restoring the memory image will overwrite the ttbr1 page tables.
+         * Create a second copy of just the linear map, and use this when
+         * restoring.
+         */
+        tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
+        if (!tmp_pg_dir) {
+                pr_err("Failed to allocate memory for temporary page tables.");
+                rc = -ENOMEM;
+                goto out;
+        }
+        rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
+        if (rc)
+                goto out;
+
+        /*
+         * Since we only copied the linear map, we need to find restore_pblist's
+         * linear map address.
+         */
+        lm_restore_pblist = LMADDR(restore_pblist);
+
+        /*
+         * We need a zero page that is zero before & after resume in order to
+         * to break before make on the ttbr1 page tables.
+         */
+        zero_page = (void *)get_safe_page(GFP_ATOMIC);
+        if (!zero_page) {
+                pr_err("Failed to allocate zero page.");
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        /*
          * Locate the exit code in the bottom-but-one page, so that *NULL
          * still has disastrous affects.
          */
@@ -419,27 +462,6 @@ int swsusp_arch_resume(void)
         __flush_dcache_area(hibernate_exit, exit_size);
 
         /*
-         * Restoring the memory image will overwrite the ttbr1 page tables.
-         * Create a second copy of just the linear map, and use this when
-         * restoring.
-         */
-        tmp_pg_dir = (pgd_t *)get_safe_page(GFP_ATOMIC);
-        if (!tmp_pg_dir) {
-                pr_err("Failed to allocate memory for temporary page tables.");
-                rc = -ENOMEM;
-                goto out;
-        }
-        rc = copy_page_tables(tmp_pg_dir, PAGE_OFFSET, 0);
-        if (rc)
-                goto out;
-
-        /*
-         * Since we only copied the linear map, we need to find restore_pblist's
-         * linear map address.
-         */
-        lm_restore_pblist = LMADDR(restore_pblist);
-
-        /*
          * KASLR will cause the el2 vectors to be in a different location in
          * the resumed kernel. Load hibernate's temporary copy into el2.
          *
@@ -453,12 +475,6 @@ int swsusp_arch_resume(void)
                 __hyp_set_vectors(el2_vectors);
         }
 
-        /*
-         * We need a zero page that is zero before & after resume in order to
-         * to break before make on the ttbr1 page tables.
-         */
-        zero_page = (void *)get_safe_page(GFP_ATOMIC);
-
         hibernate_exit(virt_to_phys(tmp_pg_dir), resume_hdr.ttbr1_el1,
                        resume_hdr.reenter_kernel, lm_restore_pblist,
                        resume_hdr.__hyp_stub_vectors, virt_to_phys(zero_page));
diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
index 8c57f6496e56..e017a9493b92 100644
--- a/arch/arm64/kernel/kgdb.c
+++ b/arch/arm64/kernel/kgdb.c
@@ -19,10 +19,13 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <linux/bug.h>
 #include <linux/irq.h>
 #include <linux/kdebug.h>
 #include <linux/kgdb.h>
 #include <linux/kprobes.h>
+#include <asm/debug-monitors.h>
+#include <asm/insn.h>
 #include <asm/traps.h>
 
 struct dbg_reg_def_t dbg_reg_def[DBG_MAX_REG_NUM] = {
@@ -338,15 +341,24 @@ void kgdb_arch_exit(void)
         unregister_die_notifier(&kgdb_notifier);
 }
 
-/*
- * ARM instructions are always in LE.
- * Break instruction is encoded in LE format
- */
-struct kgdb_arch arch_kgdb_ops = {
-        .gdb_bpt_instr = {
-                KGDB_DYN_BRK_INS_BYTE(0),
-                KGDB_DYN_BRK_INS_BYTE(1),
-                KGDB_DYN_BRK_INS_BYTE(2),
-                KGDB_DYN_BRK_INS_BYTE(3),
-        }
-};
+struct kgdb_arch arch_kgdb_ops;
+
+int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
+{
+        int err;
+
+        BUILD_BUG_ON(AARCH64_INSN_SIZE != BREAK_INSTR_SIZE);
+
+        err = aarch64_insn_read((void *)bpt->bpt_addr, (u32 *)bpt->saved_instr);
+        if (err)
+                return err;
+
+        return aarch64_insn_write((void *)bpt->bpt_addr,
+                        (u32)AARCH64_BREAK_KGDB_DYN_DBG);
+}
+
+int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
+{
+        return aarch64_insn_write((void *)bpt->bpt_addr,
+                        *(u32 *)bpt->saved_instr);
+}
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index bf9768588288..c6b0f40620d8 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -41,18 +41,6 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
 static void __kprobes
 post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *);
 
-static inline unsigned long min_stack_size(unsigned long addr)
-{
-        unsigned long size;
-
-        if (on_irq_stack(addr, raw_smp_processor_id()))
-                size = IRQ_STACK_PTR(raw_smp_processor_id()) - addr;
-        else
-                size = (unsigned long)current_thread_info() + THREAD_START_SP - addr;
-
-        return min(size, FIELD_SIZEOF(struct kprobe_ctlblk, jprobes_stack));
-}
-
 static void __kprobes arch_prepare_ss_slot(struct kprobe *p)
 {
         /* prepare insn slot */
@@ -489,20 +477,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
 {
         struct jprobe *jp = container_of(p, struct jprobe, kp);
         struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
-        long stack_ptr = kernel_stack_pointer(regs);
 
         kcb->jprobe_saved_regs = *regs;
         /*
-         * As Linus pointed out, gcc assumes that the callee
-         * owns the argument space and could overwrite it, e.g.
-         * tailcall optimization. So, to be absolutely safe
-         * we also save and restore enough stack bytes to cover
-         * the argument area.
+         * Since we can't be sure where in the stack frame "stacked"
+         * pass-by-value arguments are stored we just don't try to
+         * duplicate any of the stack. Do not use jprobes on functions that
+         * use more than 64 bytes (after padding each to an 8 byte boundary)
+         * of arguments, or pass individual arguments larger than 16 bytes.
          */
-        kasan_disable_current();
-        memcpy(kcb->jprobes_stack, (void *)stack_ptr,
-               min_stack_size(stack_ptr));
-        kasan_enable_current();
 
         instruction_pointer_set(regs, (unsigned long) jp->entry);
         preempt_disable();
@@ -554,10 +537,6 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
         }
         unpause_graph_tracing();
         *regs = kcb->jprobe_saved_regs;
-        kasan_disable_current();
-        memcpy((void *)stack_addr, kcb->jprobes_stack,
-               min_stack_size(stack_addr));
-        kasan_enable_current();
         preempt_enable_no_resched();
         return 1;
 }
diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
index 9a3aec97ac09..ccf79d849e0a 100644
--- a/arch/arm64/kernel/sleep.S
+++ b/arch/arm64/kernel/sleep.S
@@ -101,12 +101,20 @@ ENTRY(cpu_resume)
         bl      el2_setup               // if in EL2 drop to EL1 cleanly
         /* enable the MMU early - so we can access sleep_save_stash by va */
         adr_l   lr, __enable_mmu        /* __cpu_setup will return here */
-        ldr     x27, =_cpu_resume       /* __enable_mmu will branch here */
+        adr_l   x27, _resume_switched   /* __enable_mmu will branch here */
         adrp    x25, idmap_pg_dir
         adrp    x26, swapper_pg_dir
         b       __cpu_setup
 ENDPROC(cpu_resume)
 
+        .pushsection    ".idmap.text", "ax"
+_resume_switched:
+        ldr     x8, =_cpu_resume
+        br      x8
+ENDPROC(_resume_switched)
+        .ltorg
+        .popsection
+
 ENTRY(_cpu_resume)
         mrs     x1, mpidr_el1
         adrp    x8, mpidr_hash
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 76a6d9263908..3ff173e92582 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -201,12 +201,6 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
         return ret;
 }
 
-static void smp_store_cpu_info(unsigned int cpuid)
-{
-        store_cpu_topology(cpuid);
-        numa_store_cpu_info(cpuid);
-}
-
 /*
  * This is the secondary CPU boot entry.  We're using this CPUs
  * idle thread stack, but a set of temporary page tables.
@@ -254,7 +248,7 @@ asmlinkage void secondary_start_kernel(void)
          */
         notify_cpu_starting(cpu);
 
-        smp_store_cpu_info(cpu);
+        store_cpu_topology(cpu);
 
         /*
          * OK, now it's safe to let the boot CPU continue.  Wait for
@@ -661,9 +655,9 @@ void __init smp_init_cpus(void)
                 acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_INTERRUPT,
                                       acpi_parse_gic_cpu_interface, 0);
 
-        if (cpu_count > NR_CPUS)
-                pr_warn("no. of cores (%d) greater than configured maximum of %d - clipping\n",
-                        cpu_count, NR_CPUS);
+        if (cpu_count > nr_cpu_ids)
+                pr_warn("Number of cores (%d) exceeds configured maximum of %d - clipping\n",
+                        cpu_count, nr_cpu_ids);
 
         if (!bootcpu_valid) {
                 pr_err("missing boot CPU MPIDR, not enabling secondaries\n");
@@ -677,7 +671,7 @@ void __init smp_init_cpus(void)
          * with entries in cpu_logical_map while initializing the cpus.
          * If the cpu set-up fails, invalidate the cpu_logical_map entry.
          */
-        for (i = 1; i < NR_CPUS; i++) {
+        for (i = 1; i < nr_cpu_ids; i++) {
                 if (cpu_logical_map(i) != INVALID_HWID) {
                         if (smp_cpu_setup(i))
                                 cpu_logical_map(i) = INVALID_HWID;
@@ -689,10 +683,13 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
 {
         int err;
         unsigned int cpu;
+        unsigned int this_cpu;
 
         init_cpu_topology();
 
-        smp_store_cpu_info(smp_processor_id());
+        this_cpu = smp_processor_id();
+        store_cpu_topology(this_cpu);
+        numa_store_cpu_info(this_cpu);
 
         /*
          * If UP is mandated by "nosmp" (which implies "maxcpus=0"), don't set
@@ -719,6 +716,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
                         continue;
 
                 set_cpu_present(cpu, true);
+                numa_store_cpu_info(cpu);
         }
 }
 
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index ae7855f16ec2..5a84b4562603 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -256,7 +256,7 @@ static int __hyp_text __guest_run(struct kvm_vcpu *vcpu)
 
         /*
          * We must restore the 32-bit state before the sysregs, thanks
-         * to Cortex-A57 erratum #852523.
+         * to erratum #852523 (Cortex-A57) or #853709 (Cortex-A72).
          */
         __sysreg32_restore_state(vcpu);
         __sysreg_restore_guest_state(guest_ctxt);
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index b0b225ceca18..e51367d159d0 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -823,14 +823,6 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
  * Architected system registers.
  * Important: Must be sorted ascending by Op0, Op1, CRn, CRm, Op2
  *
- * We could trap ID_DFR0 and tell the guest we don't support performance
- * monitoring.  Unfortunately the patch to make the kernel check ID_DFR0 was
- * NAKed, so it will read the PMCR anyway.
- *
- * Therefore we tell the guest we have 0 counters.  Unfortunately, we
- * must always support PMCCNTR (the cycle counter): we just RAZ/WI for
- * all PM registers, which doesn't crash the guest kernel at least.
- *
  * Debug handling: We do trap most, if not all debug related system
  * registers. The implementation is good enough to ensure that a guest
  * can use these with minimal performance degradation. The drawback is
@@ -1360,7 +1352,7 @@ static const struct sys_reg_desc cp15_regs[] = {
         { Op1( 0), CRn(10), CRm( 3), Op2( 1), access_vm_reg, NULL, c10_AMAIR1 },
 
         /* ICC_SRE */
-        { Op1( 0), CRn(12), CRm(12), Op2( 5), trap_raz_wi },
+        { Op1( 0), CRn(12), CRm(12), Op2( 5), access_gic_sre },
 
         { Op1( 0), CRn(13), CRm( 0), Op2( 1), access_vm_reg, NULL, c13_CID },
 
diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index f94b80eb295d..9c3e75df2180 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -242,7 +242,7 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level,
 
 static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
 {
-        pte_t *pte = pte_offset_kernel(pmd, 0);
+        pte_t *pte = pte_offset_kernel(pmd, 0UL);
         unsigned long addr;
         unsigned i;
 
@@ -254,7 +254,7 @@ static void walk_pte(struct pg_state *st, pmd_t *pmd, unsigned long start)
 
 static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
 {
-        pmd_t *pmd = pmd_offset(pud, 0);
+        pmd_t *pmd = pmd_offset(pud, 0UL);
         unsigned long addr;
         unsigned i;
 
@@ -271,7 +271,7 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start)
 
 static void walk_pud(struct pg_state *st, pgd_t *pgd, unsigned long start)
 {
-        pud_t *pud = pud_offset(pgd, 0);
+        pud_t *pud = pud_offset(pgd, 0UL);
         unsigned long addr;
         unsigned i;
 
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index c8beaa0da7df..05d2bd776c69 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -153,6 +153,11 @@ int ptep_set_access_flags(struct vm_area_struct *vma,
 }
 #endif
 
+static bool is_el1_instruction_abort(unsigned int esr)
+{
+        return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_CUR;
+}
+
 /*
  * The kernel tried to access some page that wasn't present.
  */
@@ -161,8 +166,9 @@ static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr,
 {
         /*
          * Are we prepared to handle this kernel fault?
+         * We are almost certainly not prepared to handle instruction faults.
          */
-        if (fixup_exception(regs))
+        if (!is_el1_instruction_abort(esr) && fixup_exception(regs))
                 return;
 
         /*
@@ -267,7 +273,8 @@ static inline bool is_permission_fault(unsigned int esr)
         unsigned int ec       = ESR_ELx_EC(esr);
         unsigned int fsc_type = esr & ESR_ELx_FSC_TYPE;
 
-        return (ec == ESR_ELx_EC_DABT_CUR && fsc_type == ESR_ELx_FSC_PERM);
+        return (ec == ESR_ELx_EC_DABT_CUR && fsc_type == ESR_ELx_FSC_PERM) ||
+               (ec == ESR_ELx_EC_IABT_CUR && fsc_type == ESR_ELx_FSC_PERM);
 }
 
 static bool is_el0_instruction_abort(unsigned int esr)
@@ -312,6 +319,9 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
                 if (regs->orig_addr_limit == KERNEL_DS)
                         die("Accessing user space memory with fs=KERNEL_DS", regs, esr);
 
+                if (is_el1_instruction_abort(esr))
+                        die("Attempting to execute userspace memory", regs, esr);
+
                 if (!search_exception_tables(regs->pc))
                         die("Accessing user space memory outside uaccess.h routines", regs, esr);
         }
diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c
index c7fe3ec70774..5bb15eab6f00 100644
--- a/arch/arm64/mm/numa.c
+++ b/arch/arm64/mm/numa.c
@@ -23,6 +23,8 @@
 #include <linux/module.h>
 #include <linux/of.h>
 
+#include <asm/acpi.h>
+
 struct pglist_data *node_data[MAX_NUMNODES] __read_mostly;
 EXPORT_SYMBOL(node_data);
 nodemask_t numa_nodes_parsed __initdata;
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 5bb61de23201..9d37e967fa19 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -100,7 +100,16 @@ ENTRY(cpu_do_resume)
 
         msr     tcr_el1, x8
         msr     vbar_el1, x9
+
+        /*
+         * __cpu_setup() cleared MDSCR_EL1.MDE and friends, before unmasking
+         * debug exceptions. By restoring MDSCR_EL1 here, we may take a debug
+         * exception. Mask them until local_dbg_restore() in cpu_suspend()
+         * resets them.
+         */
+        disable_dbg
         msr     mdscr_el1, x10
+
         msr     sctlr_el1, x12
         /*
          * Restore oslsr_el1 by writing oslar_el1
diff --git a/arch/avr32/include/asm/uaccess.h b/arch/avr32/include/asm/uaccess.h
index 68cf638faf48..b1ec1fa06463 100644
--- a/arch/avr32/include/asm/uaccess.h
+++ b/arch/avr32/include/asm/uaccess.h
@@ -74,7 +74,7 @@ extern __kernel_size_t __copy_user(void *to, const void *from,
 
 extern __kernel_size_t copy_to_user(void __user *to, const void *from,
                                     __kernel_size_t n);
-extern __kernel_size_t copy_from_user(void *to, const void __user *from,
+extern __kernel_size_t ___copy_from_user(void *to, const void __user *from,
                                       __kernel_size_t n);
 
 static inline __kernel_size_t __copy_to_user(void __user *to, const void *from,
@@ -88,6 +88,15 @@ static inline __kernel_size_t __copy_from_user(void *to,
 {
         return __copy_user(to, (const void __force *)from, n);
 }
+static inline __kernel_size_t copy_from_user(void *to,
+                                               const void __user *from,
+                                               __kernel_size_t n)
+{
+        size_t res = ___copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
+}
 
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
diff --git a/arch/avr32/kernel/avr32_ksyms.c b/arch/avr32/kernel/avr32_ksyms.c
index d93ead02daed..7c6cf14f0985 100644
--- a/arch/avr32/kernel/avr32_ksyms.c
+++ b/arch/avr32/kernel/avr32_ksyms.c
@@ -36,7 +36,7 @@ EXPORT_SYMBOL(copy_page);
 /*
  * Userspace access stuff.
  */
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(___copy_from_user);
 EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(__copy_user);
 EXPORT_SYMBOL(strncpy_from_user);
diff --git a/arch/avr32/lib/copy_user.S b/arch/avr32/lib/copy_user.S
index ea59c04b07de..075373471da1 100644
--- a/arch/avr32/lib/copy_user.S
+++ b/arch/avr32/lib/copy_user.S
@@ -23,13 +23,13 @@
          */
         .text
         .align  1
-        .global copy_from_user
-        .type   copy_from_user, @function
-copy_from_user:
+        .global ___copy_from_user
+        .type   ___copy_from_user, @function
+___copy_from_user:
         branch_if_kernel r8, __copy_user
         ret_if_privileged r8, r11, r10, r10
         rjmp    __copy_user
-        .size   copy_from_user, . - copy_from_user
+        .size   ___copy_from_user, . - ___copy_from_user
 
         .global copy_to_user
         .type   copy_to_user, @function
diff --git a/arch/blackfin/include/asm/uaccess.h b/arch/blackfin/include/asm/uaccess.h
index 12f5d6851bbc..0a2a70096d8b 100644
--- a/arch/blackfin/include/asm/uaccess.h
+++ b/arch/blackfin/include/asm/uaccess.h
@@ -171,11 +171,12 @@ static inline int bad_user_access_length(void)
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (access_ok(VERIFY_READ, from, n))
+        if (likely(access_ok(VERIFY_READ, from, n))) {
                 memcpy(to, (const void __force *)from, n);
-        else
-                return n;
-        return 0;
+                return 0;
+        }
+        memset(to, 0, n);
+        return n;
 }
 
 static inline unsigned long __must_check
diff --git a/arch/blackfin/mach-bf561/boards/cm_bf561.c b/arch/blackfin/mach-bf561/boards/cm_bf561.c
index c6db52ba3a06..10c57771822d 100644
--- a/arch/blackfin/mach-bf561/boards/cm_bf561.c
+++ b/arch/blackfin/mach-bf561/boards/cm_bf561.c
@@ -146,7 +146,8 @@ static struct platform_device hitachi_fb_device = {
 #include <linux/smc91x.h>
 
 static struct smc91x_platdata smc91x_info = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
         .leda = RPC_LED_100_10,
         .ledb = RPC_LED_TX_RX,
 };
diff --git a/arch/blackfin/mach-bf561/boards/ezkit.c b/arch/blackfin/mach-bf561/boards/ezkit.c
index f35525b55819..57d1c43726d9 100644
--- a/arch/blackfin/mach-bf561/boards/ezkit.c
+++ b/arch/blackfin/mach-bf561/boards/ezkit.c
@@ -134,7 +134,8 @@ static struct platform_device net2272_bfin_device = {
 #include <linux/smc91x.h>
 
 static struct smc91x_platdata smc91x_info = {
-        .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
+        .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
+                 SMC91X_NOWAIT,
         .leda = RPC_LED_100_10,
         .ledb = RPC_LED_TX_RX,
 };
diff --git a/arch/cris/include/asm/uaccess.h b/arch/cris/include/asm/uaccess.h
index e3530d0f13ee..56c7d5750abd 100644
--- a/arch/cris/include/asm/uaccess.h
+++ b/arch/cris/include/asm/uaccess.h
@@ -194,30 +194,6 @@ extern unsigned long __copy_user(void __user *to, const void *from, unsigned lon
 extern unsigned long __copy_user_zeroing(void *to, const void __user *from, unsigned long n);
 extern unsigned long __do_clear_user(void __user *to, unsigned long n);
 
-static inline unsigned long
-__generic_copy_to_user(void __user *to, const void *from, unsigned long n)
-{
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __copy_user(to, from, n);
-        return n;
-}
-
-static inline unsigned long
-__generic_copy_from_user(void *to, const void __user *from, unsigned long n)
-{
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_user_zeroing(to, from, n);
-        return n;
-}
-
-static inline unsigned long
-__generic_clear_user(void __user *to, unsigned long n)
-{
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __do_clear_user(to, n);
-        return n;
-}
-
 static inline long
 __strncpy_from_user(char *dst, const char __user *src, long count)
 {
@@ -282,7 +258,7 @@ __constant_copy_from_user(void *to, const void __user *from, unsigned long n)
         else if (n == 24)
                 __asm_copy_from_user_24(to, from, ret);
         else
-                ret = __generic_copy_from_user(to, from, n);
+                ret = __copy_user_zeroing(to, from, n);
 
         return ret;
 }
@@ -333,7 +309,7 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
         else if (n == 24)
                 __asm_copy_to_user_24(to, from, ret);
         else
-                ret = __generic_copy_to_user(to, from, n);
+                ret = __copy_user(to, from, n);
 
         return ret;
 }
@@ -366,26 +342,43 @@ __constant_clear_user(void __user *to, unsigned long n)
         else if (n == 24)
                 __asm_clear_24(to, ret);
         else
-                ret = __generic_clear_user(to, n);
+                ret = __do_clear_user(to, n);
 
         return ret;
 }
 
 
-#define clear_user(to, n)                               \
-        (__builtin_constant_p(n) ?                      \
-         __constant_clear_user(to, n) :                 \
-         __generic_clear_user(to, n))
+static inline size_t clear_user(void __user *to, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
+                return n;
+        if (__builtin_constant_p(n))
+                return __constant_clear_user(to, n);
+        else
+                return __do_clear_user(to, n);
+}
 
-#define copy_from_user(to, from, n)                     \
-        (__builtin_constant_p(n) ?                      \
-         __constant_copy_from_user(to, from, n) :       \
-         __generic_copy_from_user(to, from, n))
+static inline size_t copy_from_user(void *to, const void __user *from, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_READ, from, n))) {
+                memset(to, 0, n);
+                return n;
+        }
+        if (__builtin_constant_p(n))
+                return __constant_copy_from_user(to, from, n);
+        else
+                return __copy_user_zeroing(to, from, n);
+}
 
-#define copy_to_user(to, from, n)                       \
-        (__builtin_constant_p(n) ?                      \
-         __constant_copy_to_user(to, from, n) :         \
-         __generic_copy_to_user(to, from, n))
+static inline size_t copy_to_user(void __user *to, const void *from, size_t n)
+{
+        if (unlikely(!access_ok(VERIFY_WRITE, to, n)))
+                return n;
+        if (__builtin_constant_p(n))
+                return __constant_copy_to_user(to, from, n);
+        else
+                return __copy_user(to, from, n);
+}
 
 /* We let the __ versions of copy_from/to_user inline, because they're often
  * used in fast paths and have only a small space overhead.
diff --git a/arch/frv/include/asm/uaccess.h b/arch/frv/include/asm/uaccess.h
index 3ac9a59d65d4..87d9e34c5df8 100644
--- a/arch/frv/include/asm/uaccess.h
+++ b/arch/frv/include/asm/uaccess.h
@@ -263,19 +263,25 @@ do {							\
 extern long __memset_user(void *dst, unsigned long count);
 extern long __memcpy_user(void *dst, const void *src, unsigned long count);
 
-#define clear_user(dst,count)                   __memset_user(____force(dst), (count))
+#define __clear_user(dst,count)                 __memset_user(____force(dst), (count))
 #define __copy_from_user_inatomic(to, from, n)  __memcpy_user((to), ____force(from), (n))
 #define __copy_to_user_inatomic(to, from, n)    __memcpy_user(____force(to), (from), (n))
 
 #else
 
-#define clear_user(dst,count)                   (memset(____force(dst), 0, (count)), 0)
+#define __clear_user(dst,count)                 (memset(____force(dst), 0, (count)), 0)
 #define __copy_from_user_inatomic(to, from, n)  (memcpy((to), ____force(from), (n)), 0)
 #define __copy_to_user_inatomic(to, from, n)    (memcpy(____force(to), (from), (n)), 0)
 
 #endif
 
-#define __clear_user clear_user
+static inline unsigned long __must_check
+clear_user(void __user *to, unsigned long n)
+{
+        if (likely(__access_ok(to, n)))
+                n = __clear_user(to, n);
+        return n;
+}
 
 static inline unsigned long __must_check
 __copy_to_user(void __user *to, const void *from, unsigned long n)
diff --git a/arch/h8300/include/asm/io.h b/arch/h8300/include/asm/io.h
index 2e221c5f0203..f86918aed9e1 100644
--- a/arch/h8300/include/asm/io.h
+++ b/arch/h8300/include/asm/io.h
@@ -3,6 +3,8 @@
 
 #ifdef __KERNEL__
 
+#include <linux/types.h>
+
 /* H8/300 internal I/O functions */
 
 #define __raw_readb __raw_readb
diff --git a/arch/hexagon/include/asm/uaccess.h b/arch/hexagon/include/asm/uaccess.h
index f000a382bc7f..f61cfb28e9f2 100644
--- a/arch/hexagon/include/asm/uaccess.h
+++ b/arch/hexagon/include/asm/uaccess.h
@@ -103,7 +103,8 @@ static inline long hexagon_strncpy_from_user(char *dst, const char __user *src,
 {
         long res = __strnlen_user(src, n);
 
-        /* return from strnlen can't be zero -- that would be rubbish. */
+        if (unlikely(!res))
+                return -EFAULT;
 
         if (res > n) {
                 copy_from_user(dst, src, n);
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 6a15083cc366..18ca6a9ce566 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -52,6 +52,7 @@ config IA64
         select MODULES_USE_ELF_RELA
         select ARCH_USE_CMPXCHG_LOCKREF
         select HAVE_ARCH_AUDITSYSCALL
+        select HAVE_ARCH_HARDENED_USERCOPY
         default y
         help
           The Itanium Processor Family is Intel's 64-bit successor to
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
index 2189d5ddc1ee..bfe13196f770 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
@@ -241,12 +241,16 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
 static inline unsigned long
 __copy_to_user (void __user *to, const void *from, unsigned long count)
 {
+        check_object_size(from, count, true);
+
         return __copy_user(to, (__force void __user *) from, count);
 }
 
 static inline unsigned long
 __copy_from_user (void *to, const void __user *from, unsigned long count)
 {
+        check_object_size(to, count, false);
+
         return __copy_user((__force void __user *) to, from, count);
 }
 
@@ -258,22 +262,23 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
         const void *__cu_from = (from);                                                 \
         long __cu_len = (n);                                                            \
                                                                                         \
-        if (__access_ok(__cu_to, __cu_len, get_fs()))                                   \
-                __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);   \
+        if (__access_ok(__cu_to, __cu_len, get_fs())) {                                 \
+                check_object_size(__cu_from, __cu_len, true);                   \
+                __cu_len = __copy_user(__cu_to, (__force void __user *)  __cu_from, __cu_len);  \
+        }                                                                               \
         __cu_len;                                                                       \
 })
 
-#define copy_from_user(to, from, n)                                                     \
-({                                                                                      \
-        void *__cu_to = (to);                                                           \
-        const void __user *__cu_from = (from);                                          \
-        long __cu_len = (n);                                                            \
-                                                                                        \
-        __chk_user_ptr(__cu_from);                                                      \
-        if (__access_ok(__cu_from, __cu_len, get_fs()))                                 \
-                __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);   \
-        __cu_len;                                                                       \
-})
+static inline unsigned long
+copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+        check_object_size(to, n, false);
+        if (likely(__access_ok(from, n, get_fs())))
+                n = __copy_user((__force void __user *) to, from, n);
+        else
+                memset(to, 0, n);
+        return n;
+}
 
 #define __copy_in_user(to, from, size)  __copy_user((to), (from), (size))
 
diff --git a/arch/m32r/include/asm/uaccess.h b/arch/m32r/include/asm/uaccess.h
index cac7014daef3..6f8982157a75 100644
--- a/arch/m32r/include/asm/uaccess.h
+++ b/arch/m32r/include/asm/uaccess.h
@@ -219,7 +219,7 @@ extern int fixup_exception(struct pt_regs *regs);
 #define __get_user_nocheck(x, ptr, size)                                \
 ({                                                                      \
         long __gu_err = 0;                                              \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         might_fault();                                                  \
         __get_user_size(__gu_val, (ptr), (size), __gu_err);             \
         (x) = (__force __typeof__(*(ptr)))__gu_val;                     \
diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c
index 2dcee3a88867..9202f82dfce6 100644
--- a/arch/m68k/kernel/signal.c
+++ b/arch/m68k/kernel/signal.c
@@ -213,7 +213,6 @@ static inline int frame_extra_sizes(int f)
 
 static inline void adjustformat(struct pt_regs *regs)
 {
-        ((struct switch_stack *)regs - 1)->a5 = current->mm->start_data;
         /*
          * set format byte to make stack appear modulo 4, which it will
          * be when doing the rte
diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h
index 8282cbce7e39..273e61225c27 100644
--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -204,8 +204,9 @@ extern unsigned long __must_check __copy_user_zeroing(void *to,
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (access_ok(VERIFY_READ, from, n))
+        if (likely(access_ok(VERIFY_READ, from, n)))
                 return __copy_user_zeroing(to, from, n);
+        memset(to, 0, n);
         return n;
 }
 
diff --git a/arch/metag/mm/init.c b/arch/metag/mm/init.c
index 11fa51c89617..c0ec116b3993 100644
--- a/arch/metag/mm/init.c
+++ b/arch/metag/mm/init.c
@@ -390,7 +390,6 @@ void __init mem_init(void)
 
         free_all_bootmem();
         mem_init_print_info(NULL);
-        show_mem(0);
 }
 
 void free_initmem(void)
diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
index 331b0d35f89c..826676778094 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -227,7 +227,7 @@ extern long __user_bad(void);
 
 #define __get_user(x, ptr)                                              \
 ({                                                                      \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         /*unsigned long __gu_ptr = (unsigned long)(ptr);*/              \
         long __gu_err;                                                  \
         switch (sizeof(*(ptr))) {                                       \
@@ -373,10 +373,13 @@ extern long __user_bad(void);
 static inline long copy_from_user(void *to,
                 const void __user *from, unsigned long n)
 {
+        unsigned long res = n;
         might_fault();
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_from_user(to, from, n);
-        return n;
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 #define __copy_to_user(to, from, n)     \
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 26388562e300..212ff92920d2 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -65,6 +65,7 @@ config MIPS
         select ARCH_CLOCKSOURCE_DATA
         select HANDLE_DOMAIN_IRQ
         select HAVE_EXIT_THREAD
+        select HAVE_REGS_AND_STACK_ACCESS_API
 
 menu "Machine selection"
 
diff --git a/arch/mips/Kconfig.debug b/arch/mips/Kconfig.debug
index f0e314ceb8ba..7f975b20b20c 100644
--- a/arch/mips/Kconfig.debug
+++ b/arch/mips/Kconfig.debug
@@ -113,42 +113,6 @@ config SPINLOCK_TEST
         help
           Add several files to the debugfs to test spinlock speed.
 
-if CPU_MIPSR6
-
-choice
-        prompt "Compact branch policy"
-        default MIPS_COMPACT_BRANCHES_OPTIMAL
-
-config MIPS_COMPACT_BRANCHES_NEVER
-        bool "Never (force delay slot branches)"
-        help
-          Pass the -mcompact-branches=never flag to the compiler in order to
-          force it to always emit branches with delay slots, and make no use
-          of the compact branch instructions introduced by MIPSr6. This is
-          useful if you suspect there may be an issue with compact branches in
-          either the compiler or the CPU.
-
-config MIPS_COMPACT_BRANCHES_OPTIMAL
-        bool "Optimal (use where beneficial)"
-        help
-          Pass the -mcompact-branches=optimal flag to the compiler in order for
-          it to make use of compact branch instructions where it deems them
-          beneficial, and use branches with delay slots elsewhere. This is the
-          default compiler behaviour, and should be used unless you have a
-          reason to choose otherwise.
-
-config MIPS_COMPACT_BRANCHES_ALWAYS
-        bool "Always (force compact branches)"
-        help
-          Pass the -mcompact-branches=always flag to the compiler in order to
-          force it to always emit compact branches, making no use of branch
-          instructions with delay slots. This can result in more compact code
-          which may be beneficial in some scenarios.
-
-endchoice
-
-endif # CPU_MIPSR6
-
 config SCACHE_DEBUGFS
         bool "L2 cache debugfs entries"
         depends on DEBUG_FS
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index efd7a9dc93c4..598ab2930fce 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -203,10 +203,6 @@ endif
 toolchain-virt                          := $(call cc-option-yn,$(mips-cflags) -mvirt)
 cflags-$(toolchain-virt)                += -DTOOLCHAIN_SUPPORTS_VIRT
 
-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_NEVER)    += -mcompact-branches=never
-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_OPTIMAL)  += -mcompact-branches=optimal
-cflags-$(CONFIG_MIPS_COMPACT_BRANCHES_ALWAYS)   += -mcompact-branches=always
-
 #
 # Firmware support
 #
diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
index 2e7378467c5c..cc3a1e33a600 100644
--- a/arch/mips/ath79/clock.c
+++ b/arch/mips/ath79/clock.c
@@ -96,7 +96,7 @@ static struct clk * __init ath79_reg_ffclk(const char *name,
         struct clk *clk;
 
         clk = clk_register_fixed_factor(NULL, name, parent_name, 0, mult, div);
-        if (!clk)
+        if (IS_ERR(clk))
                 panic("failed to allocate %s clock structure", name);
 
         return clk;
diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
index b31fbc9d6eae..37a932d9148c 100644
--- a/arch/mips/cavium-octeon/octeon-platform.c
+++ b/arch/mips/cavium-octeon/octeon-platform.c
@@ -1059,7 +1059,7 @@ static int __init octeon_publish_devices(void)
 {
         return of_platform_bus_probe(NULL, octeon_ids, NULL);
 }
-device_initcall(octeon_publish_devices);
+arch_initcall(octeon_publish_devices);
 
 MODULE_AUTHOR("David Daney <ddaney@caviumnetworks.com>");
 MODULE_LICENSE("GPL");
diff --git a/arch/mips/include/asm/asmmacro.h b/arch/mips/include/asm/asmmacro.h
index 56584a659183..83054f79f72a 100644
--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -157,6 +157,7 @@
         ldc1    $f28, THREAD_FPR28(\thread)
         ldc1    $f30, THREAD_FPR30(\thread)
         ctc1    \tmp, fcr31
+        .set    pop
         .endm
 
         .macro  fpu_restore_16odd thread
diff --git a/arch/mips/include/asm/mach-cavium-octeon/mangle-port.h b/arch/mips/include/asm/mach-cavium-octeon/mangle-port.h
index 0cf5ac1f7245..8ff2cbdf2c3e 100644
--- a/arch/mips/include/asm/mach-cavium-octeon/mangle-port.h
+++ b/arch/mips/include/asm/mach-cavium-octeon/mangle-port.h
@@ -15,8 +15,8 @@
 static inline bool __should_swizzle_bits(volatile void *a)
 {
         extern const bool octeon_should_swizzle_table[];
+        u64 did = ((u64)(uintptr_t)a >> 40) & 0xff;
 
-        unsigned long did = ((unsigned long)a >> 40) & 0xff;
         return octeon_should_swizzle_table[did];
 }
 
@@ -29,7 +29,7 @@ static inline bool __should_swizzle_bits(volatile void *a)
 
 #define __should_swizzle_bits(a)        false
 
-static inline bool __should_swizzle_addr(unsigned long p)
+static inline bool __should_swizzle_addr(u64 p)
 {
         /* boot bus? */
         return ((p >> 40) & 0xff) == 0;
diff --git a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
index 2f82bfa3a773..c9f5769dfc8f 100644
--- a/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
+++ b/arch/mips/include/asm/mach-paravirt/kernel-entry-init.h
@@ -11,11 +11,13 @@
 #define CP0_EBASE $15, 1
 
         .macro  kernel_entry_setup
+#ifdef CONFIG_SMP
         mfc0    t0, CP0_EBASE
         andi    t0, t0, 0x3ff           # CPUNum
         beqz    t0, 1f
         # CPUs other than zero goto smp_bootstrap
         j       smp_bootstrap
+#endif /* CONFIG_SMP */
 
 1:
         .endm
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index ea0cd9773914..5f987598054f 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -164,7 +164,7 @@ typedef struct { unsigned long pgprot; } pgprot_t;
  */
 static inline unsigned long ___pa(unsigned long x)
 {
-        if (config_enabled(CONFIG_64BIT)) {
+        if (IS_ENABLED(CONFIG_64BIT)) {
                 /*
                  * For MIPS64 the virtual address may either be in one of
                  * the compatibility segements ckseg0 or ckseg1, or it may
@@ -173,7 +173,7 @@ static inline unsigned long ___pa(unsigned long x)
                 return x < CKSEG0 ? XPHYSADDR(x) : CPHYSADDR(x);
         }
 
-        if (!config_enabled(CONFIG_EVA)) {
+        if (!IS_ENABLED(CONFIG_EVA)) {
                 /*
                  * We're using the standard MIPS32 legacy memory map, ie.
                  * the address x is going to be in kseg0 or kseg1. We can
diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 11b965f98d95..21a2aaba20d5 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -14,6 +14,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/thread_info.h>
+#include <linux/string.h>
 #include <asm/asm-eva.h>
 
 /*
@@ -1170,6 +1171,8 @@ extern size_t __copy_in_user_eva(void *__to, const void *__from, size_t __n);
                         __cu_len = __invoke_copy_from_user(__cu_to,     \
                                                            __cu_from,   \
                                                            __cu_len);   \
+                } else {                                                \
+                        memset(__cu_to, 0, __cu_len);                   \
                 }                                                       \
         }                                                               \
         __cu_len;                                                       \
diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c
index c3372cac6db2..0a7e10b5f9e3 100644
--- a/arch/mips/kernel/mips-r2-to-r6-emul.c
+++ b/arch/mips/kernel/mips-r2-to-r6-emul.c
@@ -1164,7 +1164,9 @@ fpu_emul:
                 regs->regs[31] = r31;
                 regs->cp0_epc = epc;
                 if (!used_math()) {     /* First time FPU user.  */
+                        preempt_disable();
                         err = init_fpu();
+                        preempt_enable();
                         set_used_math();
                 }
                 lose_fpu(1);    /* Save FPU state for the emulator. */
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 7429ad09fbe3..d2d061520a23 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -605,14 +605,14 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value)
                 return -EOPNOTSUPP;
 
         /* Avoid inadvertently triggering emulation */
-        if ((value & PR_FP_MODE_FR) && cpu_has_fpu &&
-            !(current_cpu_data.fpu_id & MIPS_FPIR_F64))
+        if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu &&
+            !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64))
                 return -EOPNOTSUPP;
-        if ((value & PR_FP_MODE_FRE) && cpu_has_fpu && !cpu_has_fre)
+        if ((value & PR_FP_MODE_FRE) && raw_cpu_has_fpu && !cpu_has_fre)
                 return -EOPNOTSUPP;
 
         /* FR = 0 not supported in MIPS R6 */
-        if (!(value & PR_FP_MODE_FR) && cpu_has_fpu && cpu_has_mips_r6)
+        if (!(value & PR_FP_MODE_FR) && raw_cpu_has_fpu && cpu_has_mips_r6)
                 return -EOPNOTSUPP;
 
         /* Proceed with the mode switch */
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 36cf8d65c47d..3be0e6ba2797 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -87,6 +87,13 @@ void __init add_memory_region(phys_addr_t start, phys_addr_t size, long type)
         int x = boot_mem_map.nr_map;
         int i;
 
+        /*
+         * If the region reaches the top of the physical address space, adjust
+         * the size slightly so that (start + size) doesn't overflow
+         */
+        if (start + size - 1 == (phys_addr_t)ULLONG_MAX)
+                --size;
+
         /* Sanity check */
         if (start + size < start) {
                 pr_warn("Trying to add an invalid memory region, skipped\n");
diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
index f95f094f36e4..b0baf48951fa 100644
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -322,6 +322,9 @@ asmlinkage void start_secondary(void)
         cpumask_set_cpu(cpu, &cpu_coherent_mask);
         notify_cpu_starting(cpu);
 
+        cpumask_set_cpu(cpu, &cpu_callin_map);
+        synchronise_count_slave(cpu);
+
         set_cpu_online(cpu, true);
 
         set_cpu_sibling_map(cpu);
@@ -329,10 +332,6 @@ asmlinkage void start_secondary(void)
 
         calculate_cpu_foreign_map();
 
-        cpumask_set_cpu(cpu, &cpu_callin_map);
-
-        synchronise_count_slave(cpu);
-
         /*
          * irq will be enabled in ->smp_finish(), enabling it too early
          * is dangerous.
diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c
index 8452d933a645..1149b30c9aeb 100644
--- a/arch/mips/kernel/uprobes.c
+++ b/arch/mips/kernel/uprobes.c
@@ -222,7 +222,7 @@ int arch_uprobe_exception_notify(struct notifier_block *self,
                 return NOTIFY_DONE;
 
         switch (val) {
-        case DIE_BREAK:
+        case DIE_UPROBE:
                 if (uprobe_pre_sstep_notifier(regs))
                         return NOTIFY_STOP;
                 break;
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
index 9abe447a4b48..f9dbfb14af33 100644
--- a/arch/mips/kernel/vdso.c
+++ b/arch/mips/kernel/vdso.c
@@ -39,16 +39,16 @@ static struct vm_special_mapping vdso_vvar_mapping = {
 static void __init init_vdso_image(struct mips_vdso_image *image)
 {
         unsigned long num_pages, i;
+        unsigned long data_pfn;
 
         BUG_ON(!PAGE_ALIGNED(image->data));
         BUG_ON(!PAGE_ALIGNED(image->size));
 
         num_pages = image->size / PAGE_SIZE;
 
-        for (i = 0; i < num_pages; i++) {
-                image->mapping.pages[i] =
-                        virt_to_page(image->data + (i * PAGE_SIZE));
-        }
+        data_pfn = __phys_to_pfn(__pa_symbol(image->data));
+        for (i = 0; i < num_pages; i++)
+                image->mapping.pages[i] = pfn_to_page(data_pfn + i);
 }
 
 static int __init init_vdso(void)
diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
index 6eb52b9c9818..e788515f766b 100644
--- a/arch/mips/kvm/emulate.c
+++ b/arch/mips/kvm/emulate.c
@@ -1642,8 +1642,14 @@ enum emulation_result kvm_mips_emulate_cache(union mips_instruction inst,
 
         preempt_disable();
         if (KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG0) {
-                if (kvm_mips_host_tlb_lookup(vcpu, va) < 0)
-                        kvm_mips_handle_kseg0_tlb_fault(va, vcpu);
+                if (kvm_mips_host_tlb_lookup(vcpu, va) < 0 &&
+                    kvm_mips_handle_kseg0_tlb_fault(va, vcpu)) {
+                        kvm_err("%s: handling mapped kseg0 tlb fault for %lx, vcpu: %p, ASID: %#lx\n",
+                                __func__, va, vcpu, read_c0_entryhi());
+                        er = EMULATE_FAIL;
+                        preempt_enable();
+                        goto done;
+                }
         } else if ((KVM_GUEST_KSEGX(va) < KVM_GUEST_KSEG0) ||
                    KVM_GUEST_KSEGX(va) == KVM_GUEST_KSEG23) {
                 int index;
@@ -1680,12 +1686,18 @@ enum emulation_result kvm_mips_emulate_cache(union mips_instruction inst,
                                                                 run, vcpu);
                                 preempt_enable();
                                 goto dont_update_pc;
-                        } else {
-                                /*
-                                 * We fault an entry from the guest tlb to the
-                                 * shadow host TLB
-                                 */
-                                kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb);
+                        }
+                        /*
+                         * We fault an entry from the guest tlb to the
+                         * shadow host TLB
+                         */
+                        if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb)) {
+                                kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n",
+                                        __func__, va, index, vcpu,
+                                        read_c0_entryhi());
+                                er = EMULATE_FAIL;
+                                preempt_enable();
+                                goto done;
                         }
                 }
         } else {
@@ -2659,7 +2671,12 @@ enum emulation_result kvm_mips_handle_tlbmiss(u32 cause,
                          * OK we have a Guest TLB entry, now inject it into the
                          * shadow host TLB
                          */
-                        kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb);
+                        if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu, tlb)) {
+                                kvm_err("%s: handling mapped seg tlb fault for %lx, index: %u, vcpu: %p, ASID: %#lx\n",
+                                        __func__, va, index, vcpu,
+                                        read_c0_entryhi());
+                                er = EMULATE_FAIL;
+                        }
                 }
         }
 
diff --git a/arch/mips/kvm/mmu.c b/arch/mips/kvm/mmu.c
index 57319ee57c4f..121008c0fcc9 100644
--- a/arch/mips/kvm/mmu.c
+++ b/arch/mips/kvm/mmu.c
@@ -40,7 +40,7 @@ static int kvm_mips_map_page(struct kvm *kvm, gfn_t gfn)
         srcu_idx = srcu_read_lock(&kvm->srcu);
         pfn = gfn_to_pfn(kvm, gfn);
 
-        if (is_error_pfn(pfn)) {
+        if (is_error_noslot_pfn(pfn)) {
                 kvm_err("Couldn't get pfn for gfn %#llx!\n", gfn);
                 err = -EFAULT;
                 goto out;
@@ -99,7 +99,7 @@ int kvm_mips_handle_kseg0_tlb_fault(unsigned long badvaddr,
         }
 
         gfn = (KVM_GUEST_CPHYSADDR(badvaddr) >> PAGE_SHIFT);
-        if (gfn >= kvm->arch.guest_pmap_npages) {
+        if ((gfn | 1) >= kvm->arch.guest_pmap_npages) {
                 kvm_err("%s: Invalid gfn: %#llx, BadVaddr: %#lx\n", __func__,
                         gfn, badvaddr);
                 kvm_mips_dump_host_tlbs();
@@ -138,35 +138,49 @@ int kvm_mips_handle_mapped_seg_tlb_fault(struct kvm_vcpu *vcpu,
         unsigned long entryhi = 0, entrylo0 = 0, entrylo1 = 0;
         struct kvm *kvm = vcpu->kvm;
         kvm_pfn_t pfn0, pfn1;
+        gfn_t gfn0, gfn1;
+        long tlb_lo[2];
         int ret;
 
-        if ((tlb->tlb_hi & VPN2_MASK) == 0) {
-                pfn0 = 0;
-                pfn1 = 0;
-        } else {
-                if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo[0])
-                                           >> PAGE_SHIFT) < 0)
-                        return -1;
-
-                if (kvm_mips_map_page(kvm, mips3_tlbpfn_to_paddr(tlb->tlb_lo[1])
-                                           >> PAGE_SHIFT) < 0)
-                        return -1;
-
-                pfn0 = kvm->arch.guest_pmap[
-                        mips3_tlbpfn_to_paddr(tlb->tlb_lo[0]) >> PAGE_SHIFT];
-                pfn1 = kvm->arch.guest_pmap[
-                        mips3_tlbpfn_to_paddr(tlb->tlb_lo[1]) >> PAGE_SHIFT];
+        tlb_lo[0] = tlb->tlb_lo[0];
+        tlb_lo[1] = tlb->tlb_lo[1];
+
+        /*
+         * The commpage address must not be mapped to anything else if the guest
+         * TLB contains entries nearby, or commpage accesses will break.
+         */
+        if (!((tlb->tlb_hi ^ KVM_GUEST_COMMPAGE_ADDR) &
+                        VPN2_MASK & (PAGE_MASK << 1)))
+                tlb_lo[(KVM_GUEST_COMMPAGE_ADDR >> PAGE_SHIFT) & 1] = 0;
+
+        gfn0 = mips3_tlbpfn_to_paddr(tlb_lo[0]) >> PAGE_SHIFT;
+        gfn1 = mips3_tlbpfn_to_paddr(tlb_lo[1]) >> PAGE_SHIFT;
+        if (gfn0 >= kvm->arch.guest_pmap_npages ||
+            gfn1 >= kvm->arch.guest_pmap_npages) {
+                kvm_err("%s: Invalid gfn: [%#llx, %#llx], EHi: %#lx\n",
+                        __func__, gfn0, gfn1, tlb->tlb_hi);
+                kvm_mips_dump_guest_tlbs(vcpu);
+                return -1;
         }
 
+        if (kvm_mips_map_page(kvm, gfn0) < 0)
+                return -1;
+
+        if (kvm_mips_map_page(kvm, gfn1) < 0)
+                return -1;
+
+        pfn0 = kvm->arch.guest_pmap[gfn0];
+        pfn1 = kvm->arch.guest_pmap[gfn1];
+
         /* Get attributes from the Guest TLB */
         entrylo0 = mips3_paddr_to_tlbpfn(pfn0 << PAGE_SHIFT) |
                 ((_page_cachable_default >> _CACHE_SHIFT) << ENTRYLO_C_SHIFT) |
-                (tlb->tlb_lo[0] & ENTRYLO_D) |
-                (tlb->tlb_lo[0] & ENTRYLO_V);
+                (tlb_lo[0] & ENTRYLO_D) |
+                (tlb_lo[0] & ENTRYLO_V);
         entrylo1 = mips3_paddr_to_tlbpfn(pfn1 << PAGE_SHIFT) |
                 ((_page_cachable_default >> _CACHE_SHIFT) << ENTRYLO_C_SHIFT) |
-                (tlb->tlb_lo[1] & ENTRYLO_D) |
-                (tlb->tlb_lo[1] & ENTRYLO_V);
+                (tlb_lo[1] & ENTRYLO_D) |
+                (tlb_lo[1] & ENTRYLO_V);
 
         kvm_debug("@ %#lx tlb_lo0: 0x%08lx tlb_lo1: 0x%08lx\n", vcpu->arch.pc,
                   tlb->tlb_lo[0], tlb->tlb_lo[1]);
@@ -354,9 +368,15 @@ u32 kvm_get_inst(u32 *opc, struct kvm_vcpu *vcpu)
                                 local_irq_restore(flags);
                                 return KVM_INVALID_INST;
                         }
-                        kvm_mips_handle_mapped_seg_tlb_fault(vcpu,
-                                                             &vcpu->arch.
-                                                             guest_tlb[index]);
+                        if (kvm_mips_handle_mapped_seg_tlb_fault(vcpu,
+                                                &vcpu->arch.guest_tlb[index])) {
+                                kvm_err("%s: handling mapped seg tlb fault failed for %p, index: %u, vcpu: %p, ASID: %#lx\n",
+                                        __func__, opc, index, vcpu,
+                                        read_c0_entryhi());
+                                kvm_mips_dump_guest_tlbs(vcpu);
+                                local_irq_restore(flags);
+                                return KVM_INVALID_INST;
+                        }
                         inst = *(opc);
                 }
                 local_irq_restore(flags);
diff --git a/arch/mips/math-emu/dsemul.c b/arch/mips/math-emu/dsemul.c
index 72a4642eee2c..4a094f7acb3d 100644
--- a/arch/mips/math-emu/dsemul.c
+++ b/arch/mips/math-emu/dsemul.c
@@ -298,5 +298,6 @@ bool do_dsemulret(struct pt_regs *xcp)
         /* Set EPC to return to post-branch instruction */
         xcp->cp0_epc = current->thread.bd_emu_cont_pc;
         pr_debug("dsemulret to 0x%08lx\n", xcp->cp0_epc);
+        MIPS_FPU_EMU_INC_STATS(ds_emul);
         return true;
 }
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index cd72805b64a7..fa7d8d3790bf 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -800,7 +800,7 @@ static void r4k_flush_icache_range(unsigned long start, unsigned long end)
                  * If address-based cache ops don't require an SMP call, then
                  * use them exclusively for small flushes.
                  */
-                size = start - end;
+                size = end - start;
                 cache_size = icache_size;
                 if (!cpu_has_ic_fills_f_dc) {
                         size *= 2;
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index a5509e7dcad2..2c3749d98f04 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -261,7 +261,6 @@ unsigned __weak platform_maar_init(unsigned num_pairs)
 {
         struct maar_config cfg[BOOT_MEM_MAP_MAX];
         unsigned i, num_configured, num_cfg = 0;
-        phys_addr_t skip;
 
         for (i = 0; i < boot_mem_map.nr_map; i++) {
                 switch (boot_mem_map.map[i].type) {
@@ -272,14 +271,14 @@ unsigned __weak platform_maar_init(unsigned num_pairs)
                         continue;
                 }
 
-                skip = 0x10000 - (boot_mem_map.map[i].addr & 0xffff);
-
+                /* Round lower up */
                 cfg[num_cfg].lower = boot_mem_map.map[i].addr;
-                cfg[num_cfg].lower += skip;
+                cfg[num_cfg].lower = (cfg[num_cfg].lower + 0xffff) & ~0xffff;
 
-                cfg[num_cfg].upper = cfg[num_cfg].lower;
-                cfg[num_cfg].upper += boot_mem_map.map[i].size - 1;
-                cfg[num_cfg].upper -= skip;
+                /* Round upper down */
+                cfg[num_cfg].upper = boot_mem_map.map[i].addr +
+                                        boot_mem_map.map[i].size;
+                cfg[num_cfg].upper = (cfg[num_cfg].upper & ~0xffff) - 1;
 
                 cfg[num_cfg].attrs = MIPS_MAAR_S;
                 num_cfg++;
diff --git a/arch/mn10300/include/asm/uaccess.h b/arch/mn10300/include/asm/uaccess.h
index 20f7bf6de384..d012e877a95a 100644
--- a/arch/mn10300/include/asm/uaccess.h
+++ b/arch/mn10300/include/asm/uaccess.h
@@ -166,6 +166,7 @@ struct __large_struct { unsigned long buf[100]; };
                 "2:\n"                                          \
                 "       .section        .fixup,\"ax\"\n"        \
                 "3:\n\t"                                        \
+                "       mov             0,%1\n"                 \
                 "       mov             %3,%0\n"                \
                 "       jmp             2b\n"                   \
                 "       .previous\n"                            \
diff --git a/arch/mn10300/lib/usercopy.c b/arch/mn10300/lib/usercopy.c
index 7826e6c364e7..ce8899e5e171 100644
--- a/arch/mn10300/lib/usercopy.c
+++ b/arch/mn10300/lib/usercopy.c
@@ -9,7 +9,7 @@
  * as published by the Free Software Foundation; either version
  * 2 of the Licence, or (at your option) any later version.
  */
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
 
 unsigned long
 __generic_copy_to_user(void *to, const void *from, unsigned long n)
@@ -24,6 +24,8 @@ __generic_copy_from_user(void *to, const void *from, unsigned long n)
 {
         if (access_ok(VERIFY_READ, from, n))
                 __copy_user_zeroing(to, from, n);
+        else
+                memset(to, 0, n);
         return n;
 }
 
diff --git a/arch/nios2/include/asm/uaccess.h b/arch/nios2/include/asm/uaccess.h
index caa51ff85a3c..0ab82324c817 100644
--- a/arch/nios2/include/asm/uaccess.h
+++ b/arch/nios2/include/asm/uaccess.h
@@ -102,9 +102,12 @@ extern long __copy_to_user(void __user *to, const void *from, unsigned long n);
 static inline long copy_from_user(void *to, const void __user *from,
                                 unsigned long n)
 {
-        if (!access_ok(VERIFY_READ, from, n))
-                return n;
-        return __copy_from_user(to, from, n);
+        unsigned long res = n;
+        if (access_ok(VERIFY_READ, from, n))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline long copy_to_user(void __user *to, const void *from,
@@ -139,7 +142,7 @@ extern long strnlen_user(const char __user *s, long n);
 
 #define __get_user_unknown(val, size, ptr, err) do {                    \
         err = 0;                                                        \
-        if (copy_from_user(&(val), ptr, size)) {                        \
+        if (__copy_from_user(&(val), ptr, size)) {                      \
                 err = -EFAULT;                                          \
         }                                                               \
         } while (0)
@@ -166,7 +169,7 @@ do {									\
         ({                                                              \
         long __gu_err = -EFAULT;                                        \
         const __typeof__(*(ptr)) __user *__gu_ptr = (ptr);              \
-        unsigned long __gu_val;                                         \
+        unsigned long __gu_val = 0;                                     \
         __get_user_common(__gu_val, sizeof(*(ptr)), __gu_ptr, __gu_err);\
         (x) = (__force __typeof__(x))__gu_val;                          \
         __gu_err;                                                       \
diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h
index a6bd07ca3d6c..5cc6b4f1b795 100644
--- a/arch/openrisc/include/asm/uaccess.h
+++ b/arch/openrisc/include/asm/uaccess.h
@@ -273,28 +273,20 @@ __copy_tofrom_user(void *to, const void *from, unsigned long size);
 static inline unsigned long
 copy_from_user(void *to, const void *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_tofrom_user(to, from, n);
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + n - TASK_SIZE;
-                return __copy_tofrom_user(to, from, n - over) + over;
-        }
-        return n;
+        unsigned long res = n;
+
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_tofrom_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline unsigned long
 copy_to_user(void *to, const void *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_WRITE, to, n))
-                return __copy_tofrom_user(to, from, n);
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + n - TASK_SIZE;
-                return __copy_tofrom_user(to, from, n - over) + over;
-        }
+        if (likely(access_ok(VERIFY_WRITE, to, n)))
+                n = __copy_tofrom_user(to, from, n);
         return n;
 }
 
@@ -303,13 +295,8 @@ extern unsigned long __clear_user(void *addr, unsigned long size);
 static inline __must_check unsigned long
 clear_user(void *addr, unsigned long size)
 {
-
-        if (access_ok(VERIFY_WRITE, addr, size))
-                return __clear_user(addr, size);
-        if ((unsigned long)addr < TASK_SIZE) {
-                unsigned long over = (unsigned long)addr + size - TASK_SIZE;
-                return __clear_user(addr, size - over) + over;
-        }
+        if (likely(access_ok(VERIFY_WRITE, addr, size)))
+                size = __clear_user(addr, size);
         return size;
 }
 
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index cd8778103165..af12c2db9bb8 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -1,6 +1,5 @@
 config PARISC
         def_bool y
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_MIGHT_HAVE_PC_PARPORT
         select HAVE_IDE
         select HAVE_OPROFILE
diff --git a/arch/parisc/configs/c8000_defconfig b/arch/parisc/configs/c8000_defconfig
index 1a8f6f95689e..f6a4c016304b 100644
--- a/arch/parisc/configs/c8000_defconfig
+++ b/arch/parisc/configs/c8000_defconfig
@@ -245,7 +245,6 @@ CONFIG_DEBUG_RT_MUTEXES=y
 CONFIG_PROVE_RCU_DELAY=y
 CONFIG_DEBUG_BLOCK_EXT_DEVT=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_KEYS=y
 # CONFIG_CRYPTO_HW is not set
 CONFIG_FONTS=y
diff --git a/arch/parisc/configs/generic-64bit_defconfig b/arch/parisc/configs/generic-64bit_defconfig
index 7e0792658952..c564e6e1fa23 100644
--- a/arch/parisc/configs/generic-64bit_defconfig
+++ b/arch/parisc/configs/generic-64bit_defconfig
@@ -291,7 +291,6 @@ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 # CONFIG_SCHED_DEBUG is not set
 CONFIG_TIMER_STATS=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_PCBC=m
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index 0f59fd9ca205..482847865dac 100644
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -10,6 +10,7 @@
 #include <asm-generic/uaccess-unaligned.h>
 
 #include <linux/bug.h>
+#include <linux/string.h>
 
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
@@ -208,26 +209,30 @@ unsigned long copy_in_user(void __user *dst, const void __user *src, unsigned lo
 #define __copy_to_user_inatomic __copy_to_user
 #define __copy_from_user_inatomic __copy_from_user
 
-extern void copy_from_user_overflow(void)
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-        __compiletime_error("copy_from_user() buffer size is not provably correct")
-#else
-        __compiletime_warning("copy_from_user() buffer size is not provably correct")
-#endif
-;
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
+
+static inline void copy_user_overflow(int size, unsigned long count)
+{
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
+}
 
 static inline unsigned long __must_check copy_from_user(void *to,
                                           const void __user *from,
                                           unsigned long n)
 {
         int sz = __compiletime_object_size(to);
-        int ret = -EFAULT;
+        unsigned long ret = n;
 
-        if (likely(sz == -1 || !__builtin_constant_p(n) || sz >= n))
+        if (likely(sz == -1 || sz >= n))
                 ret = __copy_from_user(to, from, n);
-        else
-                copy_from_user_overflow();
+        else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
+        else
+                __bad_copy_user();
 
+        if (unlikely(ret))
+                memset(to + (n - ret), 0, ret);
         return ret;
 }
 
diff --git a/arch/parisc/include/uapi/asm/errno.h b/arch/parisc/include/uapi/asm/errno.h
index c0ae62520d15..274d5bc6ecce 100644
--- a/arch/parisc/include/uapi/asm/errno.h
+++ b/arch/parisc/include/uapi/asm/errno.h
@@ -97,10 +97,10 @@
 #define ENOTCONN        235     /* Transport endpoint is not connected */
 #define ESHUTDOWN       236     /* Cannot send after transport endpoint shutdown */
 #define ETOOMANYREFS    237     /* Too many references: cannot splice */
-#define EREFUSED        ECONNREFUSED    /* for HP's NFS apparently */
 #define ETIMEDOUT       238     /* Connection timed out */
 #define ECONNREFUSED    239     /* Connection refused */
-#define EREMOTERELEASE  240     /* Remote peer released connection */
+#define EREFUSED        ECONNREFUSED    /* for HP's NFS apparently */
+#define EREMOTERELEASE  240     /* Remote peer released connection */
 #define EHOSTDOWN       241     /* Host is down */
 #define EHOSTUNREACH    242     /* No route to host */
 
diff --git a/arch/parisc/kernel/processor.c b/arch/parisc/kernel/processor.c
index 5adc339eb7c8..0c2a94a0f751 100644
--- a/arch/parisc/kernel/processor.c
+++ b/arch/parisc/kernel/processor.c
@@ -51,8 +51,6 @@ EXPORT_SYMBOL(_parisc_requires_coherency);
 
 DEFINE_PER_CPU(struct cpuinfo_parisc, cpu_data);
 
-extern int update_cr16_clocksource(void);       /* from time.c */
-
 /*
 **      PARISC CPU driver - claim "device" and initialize CPU data structures.
 **
@@ -228,12 +226,6 @@ static int processor_probe(struct parisc_device *dev)
         }
 #endif
 
-        /* If we've registered more than one cpu,
-         * we'll use the jiffies clocksource since cr16
-         * is not synchronized between CPUs.
-         */
-        update_cr16_clocksource();
-
         return 0;
 }
 
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index 505cf1ac5af2..4b0b963d52a7 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -221,18 +221,6 @@ static struct clocksource clocksource_cr16 = {
         .flags                  = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
-int update_cr16_clocksource(void)
-{
-        /* since the cr16 cycle counters are not synchronized across CPUs,
-           we'll check if we should switch to a safe clocksource: */
-        if (clocksource_cr16.rating != 0 && num_online_cpus() > 1) {
-                clocksource_change_rating(&clocksource_cr16, 0);
-                return 1;
-        }
-
-        return 0;
-}
-
 void __init start_cpu_itimer(void)
 {
         unsigned int cpu = smp_processor_id();
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index ec4047e170a0..927d2ab2ce08 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -166,6 +166,7 @@ config PPC
         select HAVE_LIVEPATCH if HAVE_DYNAMIC_FTRACE_WITH_REGS
         select GENERIC_CPU_AUTOPROBE
         select HAVE_VIRT_CPU_ACCOUNTING
+        select HAVE_ARCH_HARDENED_USERCOPY
 
 config GENERIC_CSUM
         def_bool CPU_LITTLE_ENDIAN
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index ca254546cd05..1934707bf321 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -66,29 +66,28 @@ endif
 UTS_MACHINE := $(OLDARCH)
 
 ifeq ($(CONFIG_CPU_LITTLE_ENDIAN),y)
-override CC     += -mlittle-endian
-ifneq ($(cc-name),clang)
-override CC     += -mno-strict-align
-endif
-override AS     += -mlittle-endian
 override LD     += -EL
-override CROSS32CC += -mlittle-endian
 override CROSS32AS += -mlittle-endian
 LDEMULATION     := lppc
 GNUTARGET       := powerpcle
 MULTIPLEWORD    := -mno-multiple
 KBUILD_CFLAGS_MODULE += $(call cc-option,-mno-save-toc-indirect)
 else
-ifeq ($(call cc-option-yn,-mbig-endian),y)
-override CC     += -mbig-endian
-override AS     += -mbig-endian
-endif
 override LD     += -EB
 LDEMULATION     := ppc
 GNUTARGET       := powerpc
 MULTIPLEWORD    := -mmultiple
 endif
 
+cflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mbig-endian)
+cflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -mlittle-endian
+ifneq ($(cc-name),clang)
+  cflags-$(CONFIG_CPU_LITTLE_ENDIAN)    += -mno-strict-align
+endif
+
+aflags-$(CONFIG_CPU_BIG_ENDIAN)         += $(call cc-option,-mbig-endian)
+aflags-$(CONFIG_CPU_LITTLE_ENDIAN)      += -mlittle-endian
+
 ifeq ($(HAS_BIARCH),y)
 override AS     += -a$(CONFIG_WORD_SIZE)
 override LD     += -m elf$(CONFIG_WORD_SIZE)$(LDEMULATION)
@@ -232,6 +231,9 @@ cpu-as-$(CONFIG_E200)		+= -Wa,-me200
 KBUILD_AFLAGS += $(cpu-as-y)
 KBUILD_CFLAGS += $(cpu-as-y)
 
+KBUILD_AFLAGS += $(aflags-y)
+KBUILD_CFLAGS += $(cflags-y)
+
 head-y                          := arch/powerpc/kernel/head_$(CONFIG_WORD_SIZE).o
 head-$(CONFIG_8xx)              := arch/powerpc/kernel/head_8xx.o
 head-$(CONFIG_40x)              := arch/powerpc/kernel/head_40x.o
diff --git a/arch/powerpc/crypto/crc32c-vpmsum_glue.c b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
index bfe3d37a24ef..9fa046d56eba 100644
--- a/arch/powerpc/crypto/crc32c-vpmsum_glue.c
+++ b/arch/powerpc/crypto/crc32c-vpmsum_glue.c
@@ -4,6 +4,7 @@
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
+#include <linux/cpufeature.h>
 #include <asm/switch_to.h>
 
 #define CHKSUM_BLOCK_SIZE       1
@@ -157,7 +158,7 @@ static void __exit crc32c_vpmsum_mod_fini(void)
         crypto_unregister_shash(&alg);
 }
 
-module_init(crc32c_vpmsum_mod_init);
+module_cpu_feature_match(PPC_MODULE_FEATURE_VEC_CRYPTO, crc32c_vpmsum_mod_init);
 module_exit(crc32c_vpmsum_mod_fini);
 
 MODULE_AUTHOR("Anton Blanchard <anton@samba.org>");
diff --git a/arch/powerpc/include/asm/cpu_has_feature.h b/arch/powerpc/include/asm/cpu_has_feature.h
index 2ef55f8968a2..b312b152461b 100644
--- a/arch/powerpc/include/asm/cpu_has_feature.h
+++ b/arch/powerpc/include/asm/cpu_has_feature.h
@@ -15,7 +15,7 @@ static inline bool early_cpu_has_feature(unsigned long feature)
 #ifdef CONFIG_JUMP_LABEL_FEATURE_CHECKS
 #include <linux/jump_label.h>
 
-#define NUM_CPU_FTR_KEYS        64
+#define NUM_CPU_FTR_KEYS        BITS_PER_LONG
 
 extern struct static_key_true cpu_feature_keys[NUM_CPU_FTR_KEYS];
 
diff --git a/arch/powerpc/include/asm/cpuidle.h b/arch/powerpc/include/asm/cpuidle.h
index 3d7fc06532a1..01b8a13f0224 100644
--- a/arch/powerpc/include/asm/cpuidle.h
+++ b/arch/powerpc/include/asm/cpuidle.h
@@ -19,4 +19,17 @@ extern u64 pnv_first_deep_stop_state;
 
 #endif
 
+/* Idle state entry routines */
+#ifdef  CONFIG_PPC_P7_NAP
+#define IDLE_STATE_ENTER_SEQ(IDLE_INST)                         \
+        /* Magic NAP/SLEEP/WINKLE mode enter sequence */        \
+        std     r0,0(r1);                                       \
+        ptesync;                                                \
+        ld      r0,0(r1);                                       \
+1:      cmp     cr0,r0,r0;                                      \
+        bne     1b;                                             \
+        IDLE_INST;                                              \
+        b       .
+#endif /* CONFIG_PPC_P7_NAP */
+
 #endif
diff --git a/arch/powerpc/include/asm/cputhreads.h b/arch/powerpc/include/asm/cputhreads.h
index 666bef4ebfae..9377bdf42eb8 100644
--- a/arch/powerpc/include/asm/cputhreads.h
+++ b/arch/powerpc/include/asm/cputhreads.h
@@ -3,6 +3,7 @@
 
 #ifndef __ASSEMBLY__
 #include <linux/cpumask.h>
+#include <asm/cpu_has_feature.h>
 
 /*
  * Mapping of threads to cores
diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h
index 57fec8ac7b92..ddf54f5bbdd1 100644
--- a/arch/powerpc/include/asm/feature-fixups.h
+++ b/arch/powerpc/include/asm/feature-fixups.h
@@ -186,6 +186,7 @@ label##3:					       	\
 
 #ifndef __ASSEMBLY__
 void apply_feature_fixups(void);
+void setup_feature_keys(void);
 #endif
 
 #endif /* __ASM_POWERPC_FEATURE_FIXUPS_H */
diff --git a/arch/powerpc/include/asm/hmi.h b/arch/powerpc/include/asm/hmi.h
index 88b4901ac4ee..85b7a1a21e22 100644
--- a/arch/powerpc/include/asm/hmi.h
+++ b/arch/powerpc/include/asm/hmi.h
@@ -21,7 +21,7 @@
 #ifndef __ASM_PPC64_HMI_H__
 #define __ASM_PPC64_HMI_H__
 
-#ifdef CONFIG_PPC_BOOK3S_64
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
 
 #define CORE_TB_RESYNC_REQ_BIT          63
 #define MAX_SUBCORE_PER_CORE            4
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index 148303e7771f..6a6792bb39fb 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -183,11 +183,6 @@ struct paca_struct {
          */
         u16 in_mce;
         u8 hmi_event_available;          /* HMI event is available */
-        /*
-         * Bitmap for sibling subcore status. See kvm/book3s_hv_ras.c for
-         * more details
-         */
-        struct sibling_subcore_state *sibling_subcore_state;
 #endif
 
         /* Stuff for accurate time accounting */
@@ -202,6 +197,13 @@ struct paca_struct {
         struct kvmppc_book3s_shadow_vcpu shadow_vcpu;
 #endif
         struct kvmppc_host_state kvm_hstate;
+#ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
+        /*
+         * Bitmap for sibling subcore status. See kvm/book3s_hv_ras.c for
+         * more details
+         */
+        struct sibling_subcore_state *sibling_subcore_state;
+#endif
 #endif
 };
 
diff --git a/arch/powerpc/include/asm/pci-bridge.h b/arch/powerpc/include/asm/pci-bridge.h
index b5e88e4a171a..c0309c59bed8 100644
--- a/arch/powerpc/include/asm/pci-bridge.h
+++ b/arch/powerpc/include/asm/pci-bridge.h
@@ -301,6 +301,7 @@ extern void pci_process_bridge_OF_ranges(struct pci_controller *hose,
 /* Allocate & free a PCI host bridge structure */
 extern struct pci_controller *pcibios_alloc_controller(struct device_node *dev);
 extern void pcibios_free_controller(struct pci_controller *phb);
+extern void pcibios_free_controller_deferred(struct pci_host_bridge *bridge);
 
 #ifdef CONFIG_PCI
 extern int pcibios_vaddr_is_ioport(void __iomem *address);
diff --git a/arch/powerpc/include/asm/switch_to.h b/arch/powerpc/include/asm/switch_to.h
index 0a74ebe934e1..17c8380673a6 100644
--- a/arch/powerpc/include/asm/switch_to.h
+++ b/arch/powerpc/include/asm/switch_to.h
@@ -75,14 +75,6 @@ static inline void disable_kernel_spe(void)
 static inline void __giveup_spe(struct task_struct *t) { }
 #endif
 
-#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-extern void flush_tmregs_to_thread(struct task_struct *);
-#else
-static inline void flush_tmregs_to_thread(struct task_struct *t)
-{
-}
-#endif
-
 static inline void clear_task_ebb(struct task_struct *t)
 {
 #ifdef CONFIG_PPC_BOOK3S_64
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
index b7c20f0b8fbe..c266227fdd5b 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -308,29 +308,20 @@ extern unsigned long __copy_tofrom_user(void __user *to,
 static inline unsigned long copy_from_user(void *to,
                 const void __user *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_READ, from, n))
+        if (likely(access_ok(VERIFY_READ, from, n))) {
+                check_object_size(to, n, false);
                 return __copy_tofrom_user((__force void __user *)to, from, n);
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + n - TASK_SIZE;
-                return __copy_tofrom_user((__force void __user *)to, from,
-                                n - over) + over;
         }
+        memset(to, 0, n);
         return n;
 }
 
 static inline unsigned long copy_to_user(void __user *to,
                 const void *from, unsigned long n)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_WRITE, to, n))
+        if (access_ok(VERIFY_WRITE, to, n)) {
+                check_object_size(from, n, true);
                 return __copy_tofrom_user(to, (__force void __user *)from, n);
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + n - TASK_SIZE;
-                return __copy_tofrom_user(to, (__force void __user *)from,
-                                n - over) + over;
         }
         return n;
 }
@@ -372,6 +363,9 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
                 if (ret == 0)
                         return 0;
         }
+
+        check_object_size(to, n, false);
+
         return __copy_tofrom_user((__force void __user *)to, from, n);
 }
 
@@ -398,6 +392,9 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
                 if (ret == 0)
                         return 0;
         }
+
+        check_object_size(from, n, true);
+
         return __copy_tofrom_user(to, (__force const void __user *)from, n);
 }
 
@@ -422,10 +419,6 @@ static inline unsigned long clear_user(void __user *addr, unsigned long size)
         might_fault();
         if (likely(access_ok(VERIFY_WRITE, addr, size)))
                 return __clear_user(addr, size);
-        if ((unsigned long)addr < TASK_SIZE) {
-                unsigned long over = (unsigned long)addr + size - TASK_SIZE;
-                return __clear_user(addr, size - over) + over;
-        }
         return size;
 }
 
diff --git a/arch/powerpc/include/asm/xics.h b/arch/powerpc/include/asm/xics.h
index f5f729c11578..f0b238516e9b 100644
--- a/arch/powerpc/include/asm/xics.h
+++ b/arch/powerpc/include/asm/xics.h
@@ -159,6 +159,8 @@ extern void xics_teardown_cpu(void);
 extern void xics_kexec_teardown_cpu(int secondary);
 extern void xics_migrate_irqs_away(void);
 extern void icp_native_eoi(struct irq_data *d);
+extern int xics_set_irq_type(struct irq_data *d, unsigned int flow_type);
+extern int xics_retrigger(struct irq_data *data);
 #ifdef CONFIG_SMP
 extern int xics_get_irq_server(unsigned int virq, const struct cpumask *cpumask,
                                unsigned int strict_check);
diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile
index b2027a5cf508..fe4c075bcf50 100644
--- a/arch/powerpc/kernel/Makefile
+++ b/arch/powerpc/kernel/Makefile
@@ -41,7 +41,7 @@ obj-$(CONFIG_VDSO32)		+= vdso32/
 obj-$(CONFIG_HAVE_HW_BREAKPOINT)        += hw_breakpoint.o
 obj-$(CONFIG_PPC_BOOK3S_64)     += cpu_setup_ppc970.o cpu_setup_pa6t.o
 obj-$(CONFIG_PPC_BOOK3S_64)     += cpu_setup_power.o
-obj-$(CONFIG_PPC_BOOK3S_64)     += mce.o mce_power.o hmi.o
+obj-$(CONFIG_PPC_BOOK3S_64)     += mce.o mce_power.o
 obj-$(CONFIG_PPC_BOOK3E_64)     += exceptions-64e.o idle_book3e.o
 obj-$(CONFIG_PPC64)             += vdso64/
 obj-$(CONFIG_ALTIVEC)           += vecemu.o
diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c
index c9bc78e9c610..7429556eb8df 100644
--- a/arch/powerpc/kernel/eeh.c
+++ b/arch/powerpc/kernel/eeh.c
@@ -168,10 +168,10 @@ static size_t eeh_dump_dev_log(struct eeh_dev *edev, char *buf, size_t len)
         int n = 0, l = 0;
         char buffer[128];
 
-        n += scnprintf(buf+n, len-n, "%04x:%02x:%02x:%01x\n",
+        n += scnprintf(buf+n, len-n, "%04x:%02x:%02x.%01x\n",
                        edev->phb->global_number, pdn->busno,
                        PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn));
-        pr_warn("EEH: of node=%04x:%02x:%02x:%01x\n",
+        pr_warn("EEH: of node=%04x:%02x:%02x.%01x\n",
                 edev->phb->global_number, pdn->busno,
                 PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn));
 
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 6b8bc0dd09d4..5afd03e5e8b8 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -368,13 +368,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
 tabort_syscall:
         /* Firstly we need to enable TM in the kernel */
         mfmsr   r10
-        li      r13, 1
-        rldimi  r10, r13, MSR_TM_LG, 63-MSR_TM_LG
+        li      r9, 1
+        rldimi  r10, r9, MSR_TM_LG, 63-MSR_TM_LG
         mtmsrd  r10, 0
 
         /* tabort, this dooms the transaction, nothing else */
-        li      r13, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
-        TABORT(R13)
+        li      r9, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
+        TABORT(R9)
 
         /*
          * Return directly to userspace. We have corrupted user register state,
@@ -382,8 +382,8 @@ tabort_syscall:
          * resume after the tbegin of the aborted transaction with the
          * checkpointed register state.
          */
-        li      r13, MSR_RI
-        andc    r10, r10, r13
+        li      r9, MSR_RI
+        andc    r10, r10, r9
         mtmsrd  r10, 1
         mtspr   SPRN_SRR0, r11
         mtspr   SPRN_SRR1, r12
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 41091fdf9bd8..bffec73dbffc 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -144,29 +144,14 @@ machine_check_pSeries_1:
          * vector
          */
         SET_SCRATCH0(r13)               /* save r13 */
-#ifdef CONFIG_PPC_P7_NAP
-BEGIN_FTR_SECTION
-        /* Running native on arch 2.06 or later, check if we are
-         * waking up from nap. We only handle no state loss and
-         * supervisor state loss. We do -not- handle hypervisor
-         * state loss at this time.
+        /*
+         * Running native on arch 2.06 or later, we may wakeup from winkle
+         * inside machine check. If yes, then last bit of HSPGR0 would be set
+         * to 1. Hence clear it unconditionally.
          */
-        mfspr   r13,SPRN_SRR1
-        rlwinm. r13,r13,47-31,30,31
-        OPT_GET_SPR(r13, SPRN_CFAR, CPU_FTR_CFAR)
-        beq     9f
-
-        mfspr   r13,SPRN_SRR1
-        rlwinm. r13,r13,47-31,30,31
-        /* waking up from powersave (nap) state */
-        cmpwi   cr1,r13,2
-        /* Total loss of HV state is fatal. let's just stay stuck here */
-        OPT_GET_SPR(r13, SPRN_CFAR, CPU_FTR_CFAR)
-        bgt     cr1,.
-9:
-        OPT_SET_SPR(r13, SPRN_CFAR, CPU_FTR_CFAR)
-END_FTR_SECTION_IFSET(CPU_FTR_HVMODE | CPU_FTR_ARCH_206)
-#endif /* CONFIG_PPC_P7_NAP */
+        GET_PACA(r13)
+        clrrdi  r13,r13,1
+        SET_PACA(r13)
         EXCEPTION_PROLOG_0(PACA_EXMC)
 BEGIN_FTR_SECTION
         b       machine_check_powernv_early
@@ -500,7 +485,23 @@ machine_check_fwnmi:
         EXCEPTION_PROLOG_0(PACA_EXMC)
 machine_check_pSeries_0:
         EXCEPTION_PROLOG_1(PACA_EXMC, KVMTEST, 0x200)
-        EXCEPTION_PROLOG_PSERIES_1(machine_check_common, EXC_STD)
+        /*
+         * The following is essentially EXCEPTION_PROLOG_PSERIES_1 with the
+         * difference that MSR_RI is not enabled, because PACA_EXMC is being
+         * used, so nested machine check corrupts it. machine_check_common
+         * enables MSR_RI.
+         */
+        ld      r12,PACAKBASE(r13)
+        ld      r10,PACAKMSR(r13)
+        xori    r10,r10,MSR_RI
+        mfspr   r11,SPRN_SRR0
+        LOAD_HANDLER(r12, machine_check_common)
+        mtspr   SPRN_SRR0,r12
+        mfspr   r12,SPRN_SRR1
+        mtspr   SPRN_SRR1,r10
+        rfid
+        b       .       /* prevent speculative execution */
+
         KVM_HANDLER_SKIP(PACA_EXMC, EXC_STD, 0x200)
         KVM_HANDLER_SKIP(PACA_EXGEN, EXC_STD, 0x300)
         KVM_HANDLER_SKIP(PACA_EXSLB, EXC_STD, 0x380)
@@ -984,14 +985,17 @@ ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_TYPE_RADIX)
 machine_check_common:
 
         mfspr   r10,SPRN_DAR
-        std     r10,PACA_EXGEN+EX_DAR(r13)
+        std     r10,PACA_EXMC+EX_DAR(r13)
         mfspr   r10,SPRN_DSISR
-        stw     r10,PACA_EXGEN+EX_DSISR(r13)
+        stw     r10,PACA_EXMC+EX_DSISR(r13)
         EXCEPTION_PROLOG_COMMON(0x200, PACA_EXMC)
         FINISH_NAP
         RECONCILE_IRQ_STATE(r10, r11)
-        ld      r3,PACA_EXGEN+EX_DAR(r13)
-        lwz     r4,PACA_EXGEN+EX_DSISR(r13)
+        ld      r3,PACA_EXMC+EX_DAR(r13)
+        lwz     r4,PACA_EXMC+EX_DSISR(r13)
+        /* Enable MSR_RI when finished with PACA_EXMC */
+        li      r10,MSR_RI
+        mtmsrd  r10,1
         std     r3,_DAR(r1)
         std     r4,_DSISR(r1)
         bl      save_nvgprs
@@ -1273,25 +1277,51 @@ machine_check_handle_early:
          * Check if thread was in power saving mode. We come here when any
          * of the following is true:
          * a. thread wasn't in power saving mode
-         * b. thread was in power saving mode with no state loss or
-         *    supervisor state loss
+         * b. thread was in power saving mode with no state loss,
+         *    supervisor state loss or hypervisor state loss.
          *
-         * Go back to nap again if (b) is true.
+         * Go back to nap/sleep/winkle mode again if (b) is true.
          */
         rlwinm. r11,r12,47-31,30,31     /* Was it in power saving mode? */
         beq     4f                      /* No, it wasn;t */
         /* Thread was in power saving mode. Go back to nap again. */
         cmpwi   r11,2
-        bne     3f
-        /* Supervisor state loss */
+        blt     3f
+        /* Supervisor/Hypervisor state loss */
         li      r0,1
         stb     r0,PACA_NAPSTATELOST(r13)
 3:      bl      machine_check_queue_event
         MACHINE_CHECK_HANDLER_WINDUP
         GET_PACA(r13)
         ld      r1,PACAR1(r13)
-        li      r3,PNV_THREAD_NAP
-        b       pnv_enter_arch207_idle_mode
+        /*
+         * Check what idle state this CPU was in and go back to same mode
+         * again.
+         */
+        lbz     r3,PACA_THREAD_IDLE_STATE(r13)
+        cmpwi   r3,PNV_THREAD_NAP
+        bgt     10f
+        IDLE_STATE_ENTER_SEQ(PPC_NAP)
+        /* No return */
+10:
+        cmpwi   r3,PNV_THREAD_SLEEP
+        bgt     2f
+        IDLE_STATE_ENTER_SEQ(PPC_SLEEP)
+        /* No return */
+
+2:
+        /*
+         * Go back to winkle. Please note that this thread was woken up in
+         * machine check from winkle and have not restored the per-subcore
+         * state. Hence before going back to winkle, set last bit of HSPGR0
+         * to 1. This will make sure that if this thread gets woken up
+         * again at reset vector 0x100 then it will get chance to restore
+         * the subcore state.
+         */
+        ori     r13,r13,1
+        SET_PACA(r13)
+        IDLE_STATE_ENTER_SEQ(PPC_WINKLE)
+        /* No return */
 4:
 #endif
         /*
diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
index ba79d15f4ddd..bd739fed26e3 100644
--- a/arch/powerpc/kernel/idle_book3s.S
+++ b/arch/powerpc/kernel/idle_book3s.S
@@ -44,18 +44,6 @@
                                 PSSCR_PSLL_MASK | PSSCR_TR_MASK | \
                                 PSSCR_MTL_MASK
 
-/* Idle state entry routines */
-
-#define IDLE_STATE_ENTER_SEQ(IDLE_INST)                         \
-        /* Magic NAP/SLEEP/WINKLE mode enter sequence */        \
-        std     r0,0(r1);                                       \
-        ptesync;                                                \
-        ld      r0,0(r1);                                       \
-1:      cmp     cr0,r0,r0;                                      \
-        bne     1b;                                             \
-        IDLE_INST;                                              \
-        b       .
-
         .text
 
 /*
@@ -363,8 +351,8 @@ _GLOBAL(power9_idle_stop)
  * cr3 - set to gt if waking up with partial/complete hypervisor state loss
  */
 _GLOBAL(pnv_restore_hyp_resource)
-        ld      r2,PACATOC(r13);
 BEGIN_FTR_SECTION
+        ld      r2,PACATOC(r13);
         /*
          * POWER ISA 3. Use PSSCR to determine if we
          * are waking up from deep idle state
@@ -395,6 +383,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
          */
         clrldi  r5,r13,63
         clrrdi  r13,r13,1
+
+        /* Now that we are sure r13 is corrected, load TOC */
+        ld      r2,PACATOC(r13);
         cmpwi   cr4,r5,1
         mtspr   SPRN_HSPRG0,r13
 
@@ -420,7 +411,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300)
  *
  * r13 - PACA
  * cr3 - gt if waking up with partial/complete hypervisor state loss
- * cr4 - eq if waking up from complete hypervisor state loss.
+ * cr4 - gt or eq if waking up from complete hypervisor state loss.
  */
 _GLOBAL(pnv_wakeup_tb_loss)
         ld      r1,PACAR1(r13)
@@ -462,7 +453,7 @@ lwarx_loop2:
          * At this stage
          * cr2 - eq if first thread to wakeup in core
          * cr3-  gt if waking up with partial/complete hypervisor state loss
-         * cr4 - eq if waking up from complete hypervisor state loss.
+         * cr4 - gt or eq if waking up from complete hypervisor state loss.
          */
 
         ori     r15,r15,PNV_CORE_IDLE_LOCK_BIT
@@ -490,7 +481,7 @@ first_thread_in_subcore:
          * If waking up from sleep, subcore state is not lost. Hence
          * skip subcore state restore
          */
-        bne     cr4,subcore_state_restored
+        blt     cr4,subcore_state_restored
 
         /* Restore per-subcore state */
         ld      r4,_SDR1(r1)
@@ -535,7 +526,7 @@ timebase_resync:
          * If waking up from sleep, per core state is not lost, skip to
          * clear_lock.
          */
-        bne     cr4,clear_lock
+        blt     cr4,clear_lock
 
         /*
          * First thread in the core to wake up and its waking up with
@@ -566,7 +557,7 @@ common_exit:
          * If waking up from sleep, hypervisor state is not lost. Hence
          * skip hypervisor state restore.
          */
-        bne     cr4,hypervisor_state_restored
+        blt     cr4,hypervisor_state_restored
 
         /* Waking up from winkle */
 
diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c
index 3ed8ec09b5c9..e785cc9e1ecd 100644
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -29,7 +29,7 @@
 #include <linux/kprobes.h>
 #include <linux/ptrace.h>
 #include <linux/preempt.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/kdebug.h>
 #include <linux/slab.h>
 #include <asm/code-patching.h>
diff --git a/arch/powerpc/kernel/mce.c b/arch/powerpc/kernel/mce.c
index ef267fd9dd22..5e7ece0fda9f 100644
--- a/arch/powerpc/kernel/mce.c
+++ b/arch/powerpc/kernel/mce.c
@@ -92,7 +92,8 @@ void save_mce_event(struct pt_regs *regs, long handled,
         mce->in_use = 1;
 
         mce->initiator = MCE_INITIATOR_CPU;
-        if (handled)
+        /* Mark it recovered if we have handled it and MSR(RI=1). */
+        if (handled && (regs->msr & MSR_RI))
                 mce->disposition = MCE_DISPOSITION_RECOVERED;
         else
                 mce->disposition = MCE_DISPOSITION_NOT_RECOVERED;
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index a5c0153ede37..e58908066b0e 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -78,6 +78,7 @@ EXPORT_SYMBOL(get_pci_dma_ops);
 static int get_phb_number(struct device_node *dn)
 {
         int ret, phb_id = -1;
+        u32 prop_32;
         u64 prop;
 
         /*
@@ -86,8 +87,10 @@ static int get_phb_number(struct device_node *dn)
          * reading "ibm,opal-phbid", only present in OPAL environment.
          */
         ret = of_property_read_u64(dn, "ibm,opal-phbid", &prop);
-        if (ret)
-                ret = of_property_read_u32_index(dn, "reg", 1, (u32 *)&prop);
+        if (ret) {
+                ret = of_property_read_u32_index(dn, "reg", 1, &prop_32);
+                prop = prop_32;
+        }
 
         if (!ret)
                 phb_id = (int)(prop & (MAX_PHBS - 1));
@@ -151,6 +154,42 @@ void pcibios_free_controller(struct pci_controller *phb)
 EXPORT_SYMBOL_GPL(pcibios_free_controller);
 
 /*
+ * This function is used to call pcibios_free_controller()
+ * in a deferred manner: a callback from the PCI subsystem.
+ *
+ * _*DO NOT*_ call pcibios_free_controller() explicitly if
+ * this is used (or it may access an invalid *phb pointer).
+ *
+ * The callback occurs when all references to the root bus
+ * are dropped (e.g., child buses/devices and their users).
+ *
+ * It's called as .release_fn() of 'struct pci_host_bridge'
+ * which is associated with the 'struct pci_controller.bus'
+ * (root bus) - it expects .release_data to hold a pointer
+ * to 'struct pci_controller'.
+ *
+ * In order to use it, register .release_fn()/release_data
+ * like this:
+ *
+ * pci_set_host_bridge_release(bridge,
+ *                             pcibios_free_controller_deferred
+ *                             (void *) phb);
+ *
+ * e.g. in the pcibios_root_bridge_prepare() callback from
+ * pci_create_root_bus().
+ */
+void pcibios_free_controller_deferred(struct pci_host_bridge *bridge)
+{
+        struct pci_controller *phb = (struct pci_controller *)
+                                         bridge->release_data;
+
+        pr_debug("domain %d, dynamic %d\n", phb->global_number, phb->is_dynamic);
+
+        pcibios_free_controller(phb);
+}
+EXPORT_SYMBOL_GPL(pcibios_free_controller_deferred);
+
+/*
  * The function is used to return the minimal alignment
  * for memory or I/O windows of the associated P2P bridge.
  * By default, 4KiB alignment for I/O windows and 1MiB for
diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c
index 58ccf86415b4..9ee2623e0f67 100644
--- a/arch/powerpc/kernel/process.c
+++ b/arch/powerpc/kernel/process.c
@@ -1074,26 +1074,6 @@ static inline void restore_sprs(struct thread_struct *old_thread,
 #endif
 }
 
-#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
-void flush_tmregs_to_thread(struct task_struct *tsk)
-{
-        /*
-         * Process self tracing is not yet supported through
-         * ptrace interface. Ptrace generic code should have
-         * prevented this from happening in the first place.
-         * Warn once here with the message, if some how it
-         * is attempted.
-         */
-        WARN_ONCE(tsk == current,
-                "Not expecting ptrace on self: TM regs may be incorrect\n");
-
-        /*
-         * If task is not current, it should have been flushed
-         * already to it's thread_struct during __switch_to().
-         */
-}
-#endif
-
 struct task_struct *__switch_to(struct task_struct *prev,
         struct task_struct *new)
 {
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 6ee4b72cda42..d3eff99e938c 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -695,7 +695,7 @@ unsigned char ibm_architecture_vec[] = {
         OV4_MIN_ENT_CAP,                /* minimum VP entitled capacity */
 
         /* option vector 5: PAPR/OF options */
-        VECTOR_LENGTH(18),              /* length */
+        VECTOR_LENGTH(21),              /* length */
         0,                              /* don't ignore, don't halt */
         OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
         OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
@@ -726,8 +726,11 @@ unsigned char ibm_architecture_vec[] = {
         0,
         0,
         OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
-        OV5_FEAT(OV5_PFO_HW_842),
-        OV5_FEAT(OV5_SUB_PROCESSORS),
+        OV5_FEAT(OV5_PFO_HW_842),                               /* Byte 17 */
+        0,                                                      /* Byte 18 */
+        0,                                                      /* Byte 19 */
+        0,                                                      /* Byte 20 */
+        OV5_FEAT(OV5_SUB_PROCESSORS),                           /* Byte 21 */
 
         /* option vector 6: IBM PAPR hints */
         VECTOR_LENGTH(3),               /* length */
@@ -2940,7 +2943,7 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4,
 
         /* Don't print anything after quiesce under OPAL, it crashes OFW */
         if (of_platform != PLATFORM_OPAL) {
-                prom_printf("Booting Linux via __start() ...\n");
+                prom_printf("Booting Linux via __start() @ 0x%lx ...\n", kbase);
                 prom_debug("->dt_header_start=0x%x\n", hdr);
         }
 
diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
index 4f3c5756cc09..bf91658a8a40 100644
--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -38,6 +38,7 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 #include <asm/switch_to.h>
+#include <asm/tm.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/syscalls.h>
@@ -118,6 +119,24 @@ static const struct pt_regs_offset regoffset_table[] = {
         REG_OFFSET_END,
 };
 
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+static void flush_tmregs_to_thread(struct task_struct *tsk)
+{
+        /*
+         * If task is not current, it will have been flushed already to
+         * it's thread_struct during __switch_to().
+         *
+         * A reclaim flushes ALL the state.
+         */
+
+        if (tsk == current && MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(TM_CAUSE_SIGNAL);
+
+}
+#else
+static inline void flush_tmregs_to_thread(struct task_struct *tsk) { }
+#endif
+
 /**
  * regs_query_register_offset() - query register offset from its name
  * @name:       the name of a register
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index c3e861df4b20..24ec3ea4b3a2 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -93,15 +93,16 @@ notrace unsigned long __init early_init(unsigned long dt_ptr)
  * and we are running with enough of the MMU enabled to have our
  * proper kernel virtual addresses
  *
- * Find out what kind of machine we're on and save any data we need
- * from the early boot process (devtree is copied on pmac by prom_init()).
- * This is called very early on the boot process, after a minimal
- * MMU environment has been set up but before MMU_init is called.
+ * We do the initial parsing of the flat device-tree and prepares
+ * for the MMU to be fully initialized.
  */
 extern unsigned int memset_nocache_branch; /* Insn to be replaced by NOP */
 
 notrace void __init machine_init(u64 dt_ptr)
 {
+        /* Configure static keys first, now that we're relocated. */
+        setup_feature_keys();
+
         /* Enable early debugging if any specified (see udbg.h) */
         udbg_early_init();
 
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index eafb9a79e011..7ac8e6eaab5b 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -300,6 +300,7 @@ void __init early_setup(unsigned long dt_ptr)
 
         /* Apply all the dynamic patching */
         apply_feature_fixups();
+        setup_feature_keys();
 
         /* Initialize the hash table or TLB handling */
         early_init_mmu();
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index b6aa378aff63..a7daf749b97f 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -1226,7 +1226,21 @@ long sys_rt_sigreturn(int r3, int r4, int r5, int r6, int r7, int r8,
                 (regs->gpr[1] + __SIGNAL_FRAMESIZE + 16);
         if (!access_ok(VERIFY_READ, rt_sf, sizeof(*rt_sf)))
                 goto bad;
+
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * If there is a transactional state then throw it away.
+         * The purpose of a sigreturn is to destroy all traces of the
+         * signal frame, this includes any transactional state created
+         * within in. We only check for suspended as we can never be
+         * active in the kernel, we are active, there is nothing better to
+         * do than go ahead and Bad Thing later.
+         * The cause is not important as there will never be a
+         * recheckpoint so it's not user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
+
         if (__get_user(tmp, &rt_sf->uc.uc_link))
                 goto bad;
         uc_transact = (struct ucontext __user *)(uintptr_t)tmp;
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 7e49984d4331..70409bb90a95 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -676,7 +676,21 @@ int sys_rt_sigreturn(unsigned long r3, unsigned long r4, unsigned long r5,
         if (__copy_from_user(&set, &uc->uc_sigmask, sizeof(set)))
                 goto badframe;
         set_current_blocked(&set);
+
 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+        /*
+         * If there is a transactional state then throw it away.
+         * The purpose of a sigreturn is to destroy all traces of the
+         * signal frame, this includes any transactional state created
+         * within in. We only check for suspended as we can never be
+         * active in the kernel, we are active, there is nothing better to
+         * do than go ahead and Bad Thing later.
+         * The cause is not important as there will never be a
+         * recheckpoint so it's not user visible.
+         */
+        if (MSR_TM_SUSPENDED(mfmsr()))
+                tm_reclaim_current(0);
+
         if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
                 goto badframe;
         if (MSR_TM_ACTIVE(msr)) {
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
index 25a39052bf6b..9c6f3fd58059 100644
--- a/arch/powerpc/kernel/smp.c
+++ b/arch/powerpc/kernel/smp.c
@@ -830,7 +830,7 @@ int __cpu_disable(void)
 
         /* Update sibling maps */
         base = cpu_first_thread_sibling(cpu);
-        for (i = 0; i < threads_per_core; i++) {
+        for (i = 0; i < threads_per_core && base + i < nr_cpu_ids; i++) {
                 cpumask_clear_cpu(cpu, cpu_sibling_mask(base + i));
                 cpumask_clear_cpu(base + i, cpu_sibling_mask(cpu));
                 cpumask_clear_cpu(cpu, cpu_core_mask(base + i));
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 2cb589264cb7..62859ebe0062 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -25,7 +25,8 @@
 #include <linux/user.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/extable.h>
+#include <linux/module.h>       /* print_modules */
 #include <linux/prctl.h>
 #include <linux/delay.h>
 #include <linux/kprobes.h>
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index 6767605ea8da..4111d30badfa 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -22,6 +22,7 @@
 #include <linux/security.h>
 #include <linux/memblock.h>
 
+#include <asm/cpu_has_feature.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
 #include <asm/mmu.h>
diff --git a/arch/powerpc/kernel/vdso32/Makefile b/arch/powerpc/kernel/vdso32/Makefile
index cbabd143acae..78a7449bf489 100644
--- a/arch/powerpc/kernel/vdso32/Makefile
+++ b/arch/powerpc/kernel/vdso32/Makefile
@@ -30,7 +30,7 @@ CPPFLAGS_vdso32.lds += -P -C -Upowerpc
 $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so
 
 # link rule for the .so file, .lds has to be first
-$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32)
+$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE
         $(call if_changed,vdso32ld)
 
 # strip rule for the .so file
@@ -39,12 +39,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
         $(call if_changed,objcopy)
 
 # assembly rules for the .S files
-$(obj-vdso32): %.o: %.S
+$(obj-vdso32): %.o: %.S FORCE
         $(call if_changed_dep,vdso32as)
 
 # actual build commands
 quiet_cmd_vdso32ld = VDSO32L $@
-      cmd_vdso32ld = $(CROSS32CC) $(c_flags) -Wl,-T $^ -o $@
+      cmd_vdso32ld = $(CROSS32CC) $(c_flags) -o $@ -Wl,-T$(filter %.lds,$^) $(filter %.o,$^)
 quiet_cmd_vdso32as = VDSO32A $@
       cmd_vdso32as = $(CROSS32CC) $(a_flags) -c -o $@ $<
 
diff --git a/arch/powerpc/kernel/vdso64/Makefile b/arch/powerpc/kernel/vdso64/Makefile
index c710802b8fb6..366ae09b14c1 100644
--- a/arch/powerpc/kernel/vdso64/Makefile
+++ b/arch/powerpc/kernel/vdso64/Makefile
@@ -23,7 +23,7 @@ CPPFLAGS_vdso64.lds += -P -C -U$(ARCH)
 $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so
 
 # link rule for the .so file, .lds has to be first
-$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64)
+$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE
         $(call if_changed,vdso64ld)
 
 # strip rule for the .so file
@@ -32,12 +32,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
         $(call if_changed,objcopy)
 
 # assembly rules for the .S files
-$(obj-vdso64): %.o: %.S
+$(obj-vdso64): %.o: %.S FORCE
         $(call if_changed_dep,vdso64as)
 
 # actual build commands
 quiet_cmd_vdso64ld = VDSO64L $@
-      cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@
+      cmd_vdso64ld = $(CC) $(c_flags) -o $@ -Wl,-T$(filter %.lds,$^) $(filter %.o,$^)
 quiet_cmd_vdso64as = VDSO64A $@
       cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $<
 
diff --git a/arch/powerpc/kvm/Makefile b/arch/powerpc/kvm/Makefile
index 1f9e5529e692..855d4b95d752 100644
--- a/arch/powerpc/kvm/Makefile
+++ b/arch/powerpc/kvm/Makefile
@@ -78,6 +78,7 @@ kvm-book3s_64-builtin-xics-objs-$(CONFIG_KVM_XICS) := \
 
 ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
 kvm-book3s_64-builtin-objs-$(CONFIG_KVM_BOOK3S_64_HANDLER) += \
+        book3s_hv_hmi.o \
         book3s_hv_rmhandlers.o \
         book3s_hv_rm_mmu.o \
         book3s_hv_ras.o \
diff --git a/arch/powerpc/kernel/hmi.c b/arch/powerpc/kvm/book3s_hv_hmi.c
index e3f738eb1cac..e3f738eb1cac 100644
--- a/arch/powerpc/kernel/hmi.c
+++ b/arch/powerpc/kvm/book3s_hv_hmi.c
diff --git a/arch/powerpc/kvm/book3s_xics.c b/arch/powerpc/kvm/book3s_xics.c
index a75ba38a2d81..05aa11399a78 100644
--- a/arch/powerpc/kvm/book3s_xics.c
+++ b/arch/powerpc/kvm/book3s_xics.c
@@ -1329,20 +1329,16 @@ static int kvmppc_xics_create(struct kvm_device *dev, u32 type)
         xics->kvm = kvm;
 
         /* Already there ? */
-        mutex_lock(&kvm->lock);
         if (kvm->arch.xics)
                 ret = -EEXIST;
         else
                 kvm->arch.xics = xics;
-        mutex_unlock(&kvm->lock);
 
         if (ret) {
                 kfree(xics);
                 return ret;
         }
 
-        xics_debugfs_init(xics);
-
 #ifdef CONFIG_KVM_BOOK3S_HV_POSSIBLE
         if (cpu_has_feature(CPU_FTR_ARCH_206)) {
                 /* Enable real mode support */
@@ -1354,9 +1350,17 @@ static int kvmppc_xics_create(struct kvm_device *dev, u32 type)
         return 0;
 }
 
+static void kvmppc_xics_init(struct kvm_device *dev)
+{
+        struct kvmppc_xics *xics = (struct kvmppc_xics *)dev->private;
+
+        xics_debugfs_init(xics);
+}
+
 struct kvm_device_ops kvm_xics_ops = {
         .name = "kvm-xics",
         .create = kvmppc_xics_create,
+        .init = kvmppc_xics_init,
         .destroy = kvmppc_xics_free,
         .set_attr = xics_set_attr,
         .get_attr = xics_get_attr,
diff --git a/arch/powerpc/lib/checksum_32.S b/arch/powerpc/lib/checksum_32.S
index d90870a66b60..aa8214f30c92 100644
--- a/arch/powerpc/lib/checksum_32.S
+++ b/arch/powerpc/lib/checksum_32.S
@@ -127,17 +127,19 @@ _GLOBAL(csum_partial_copy_generic)
         stw     r7,12(r1)
         stw     r8,8(r1)
 
-        andi.   r0,r4,1                 /* is destination address even ? */
-        cmplwi  cr7,r0,0
         addic   r12,r6,0
         addi    r6,r4,-4
         neg     r0,r4
         addi    r4,r3,-4
         andi.   r0,r0,CACHELINE_MASK    /* # bytes to start of cache line */
+        crset   4*cr7+eq
         beq     58f
 
         cmplw   0,r5,r0                 /* is this more than total to do? */
         blt     63f                     /* if not much to do */
+        rlwinm  r7,r6,3,0x8
+        rlwnm   r12,r12,r7,0,31 /* odd destination address: rotate one byte */
+        cmplwi  cr7,r7,0        /* is destination address even ? */
         andi.   r8,r0,3                 /* get it word-aligned first */
         mtctr   r8
         beq+    61f
@@ -237,7 +239,7 @@ _GLOBAL(csum_partial_copy_generic)
 66:     addze   r3,r12
         addi    r1,r1,16
         beqlr+  cr7
-        rlwinm  r3,r3,8,0,31    /* swap bytes for odd destination */
+        rlwinm  r3,r3,8,0,31    /* odd destination address: rotate one byte */
         blr
 
 /* read fault */
diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c
index 74145f02ad41..043415f0bdb1 100644
--- a/arch/powerpc/lib/feature-fixups.c
+++ b/arch/powerpc/lib/feature-fixups.c
@@ -188,7 +188,10 @@ void __init apply_feature_fixups(void)
                           &__start___fw_ftr_fixup, &__stop___fw_ftr_fixup);
 #endif
         do_final_fixups();
+}
 
+void __init setup_feature_keys(void)
+{
         /*
          * Initialise jump label. This causes all the cpu/mmu_has_feature()
          * checks to take on their correct polarity based on the current set of
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index a4db22f65021..bb1ffc559f38 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -26,7 +26,7 @@
 #include <linux/mm.h>
 #include <linux/interrupt.h>
 #include <linux/highmem.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 #include <linux/perf_event.h>
diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S
index dfdb90cb4403..9f1983404e1a 100644
--- a/arch/powerpc/mm/slb_low.S
+++ b/arch/powerpc/mm/slb_low.S
@@ -113,7 +113,12 @@ BEGIN_FTR_SECTION
 END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT)
         b       slb_finish_load_1T
 
-0:
+0:      /*
+         * For userspace addresses, make sure this is region 0.
+         */
+        cmpdi   r9, 0
+        bne     8f
+
         /* when using slices, we extract the psize off the slice bitmaps
          * and then we need to get the sllp encoding off the mmu_psize_defs
          * array.
diff --git a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
index 8eb82b043dd8..d93dd4acf40b 100644
--- a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
+++ b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
@@ -528,7 +528,6 @@ static struct platform_driver mpc512x_lpbfifo_driver = {
         .remove = mpc512x_lpbfifo_remove,
         .driver = {
                 .name = DRV_NAME,
-                .owner = THIS_MODULE,
                 .of_match_table = mpc512x_lpbfifo_match,
         },
 };
diff --git a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
index dbcd0303afed..63c5ab6489c9 100644
--- a/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
+++ b/arch/powerpc/platforms/83xx/mcu_mpc8349emitx.c
@@ -222,7 +222,6 @@ static const struct of_device_id mcu_of_match_table[] = {
 static struct i2c_driver mcu_driver = {
         .driver = {
                 .name = "mcu-mpc8349emitx",
-                .owner = THIS_MODULE,
                 .of_match_table = mcu_of_match_table,
         },
         .probe = mcu_probe,
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 5be15cff758d..2975754c65ea 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -496,8 +496,10 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode)
         gang = alloc_spu_gang();
         SPUFS_I(inode)->i_ctx = NULL;
         SPUFS_I(inode)->i_gang = gang;
-        if (!gang)
+        if (!gang) {
+                ret = -ENOMEM;
                 goto out_iput;
+        }
 
         inode->i_op = &simple_dir_inode_operations;
         inode->i_fop = &simple_dir_operations;
diff --git a/arch/powerpc/platforms/embedded6xx/holly.c b/arch/powerpc/platforms/embedded6xx/holly.c
index dafba1057a47..dfd310031549 100644
--- a/arch/powerpc/platforms/embedded6xx/holly.c
+++ b/arch/powerpc/platforms/embedded6xx/holly.c
@@ -26,7 +26,7 @@
 #include <linux/tty.h>
 #include <linux/serial_core.h>
 #include <linux/of_platform.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 
 #include <asm/time.h>
 #include <asm/machdep.h>
diff --git a/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c b/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
index 80804f9916ee..f97bab8e37a2 100644
--- a/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
+++ b/arch/powerpc/platforms/embedded6xx/mpc7448_hpc2.c
@@ -23,7 +23,7 @@
 #include <linux/pci.h>
 #include <linux/kdev_t.h>
 #include <linux/console.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/delay.h>
 #include <linux/irq.h>
 #include <linux/seq_file.h>
diff --git a/arch/powerpc/platforms/pasemi/iommu.c b/arch/powerpc/platforms/pasemi/iommu.c
index 309d9ccccd50..c61667e8bb06 100644
--- a/arch/powerpc/platforms/pasemi/iommu.c
+++ b/arch/powerpc/platforms/pasemi/iommu.c
@@ -187,6 +187,11 @@ static void pci_dma_dev_setup_pasemi(struct pci_dev *dev)
         if (dev->vendor == 0x1959 && dev->device == 0xa007 &&
             !firmware_has_feature(FW_FEATURE_LPAR)) {
                 dev->dev.archdata.dma_ops = &dma_direct_ops;
+                /*
+                 * Set the coherent DMA mask to prevent the iommu
+                 * being used unnecessarily
+                 */
+                dev->dev.coherent_dma_mask = DMA_BIT_MASK(44);
                 return;
         }
 #endif
diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
index 2ee96431f736..4c827826c05e 100644
--- a/arch/powerpc/platforms/powernv/opal-dump.c
+++ b/arch/powerpc/platforms/powernv/opal-dump.c
@@ -370,6 +370,7 @@ static irqreturn_t process_dump(int irq, void *data)
         uint32_t dump_id, dump_size, dump_type;
         struct dump_obj *dump;
         char name[22];
+        struct kobject *kobj;
 
         rc = dump_read_info(&dump_id, &dump_size, &dump_type);
         if (rc != OPAL_SUCCESS)
@@ -381,8 +382,12 @@ static irqreturn_t process_dump(int irq, void *data)
          * that gracefully and not create two conflicting
          * entries.
          */
-        if (kset_find_obj(dump_kset, name))
+        kobj = kset_find_obj(dump_kset, name);
+        if (kobj) {
+                /* Drop reference added by kset_find_obj() */
+                kobject_put(kobj);
                 return 0;
+        }
 
         dump = create_dump_obj(dump_id, dump_size, dump_type);
         if (!dump)
diff --git a/arch/powerpc/platforms/powernv/opal-elog.c b/arch/powerpc/platforms/powernv/opal-elog.c
index 37f959bf392e..f2344cbd2f46 100644
--- a/arch/powerpc/platforms/powernv/opal-elog.c
+++ b/arch/powerpc/platforms/powernv/opal-elog.c
@@ -247,6 +247,7 @@ static irqreturn_t elog_event(int irq, void *data)
         uint64_t elog_type;
         int rc;
         char name[2+16+1];
+        struct kobject *kobj;
 
         rc = opal_get_elog_size(&id, &size, &type);
         if (rc != OPAL_SUCCESS) {
@@ -269,8 +270,12 @@ static irqreturn_t elog_event(int irq, void *data)
          * that gracefully and not create two conflicting
          * entries.
          */
-        if (kset_find_obj(elog_kset, name))
+        kobj = kset_find_obj(elog_kset, name);
+        if (kobj) {
+                /* Drop reference added by kset_find_obj() */
+                kobject_put(kobj);
                 return IRQ_HANDLED;
+        }
 
         create_elog_obj(log_id, elog_size, elog_type);
 
diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c
index e505223b4ec5..ed8bba68a162 100644
--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
@@ -228,7 +228,8 @@ int __init opal_event_init(void)
                 }
 
                 /* Install interrupt handler */
-                rc = request_irq(virq, opal_interrupt, 0, "opal", NULL);
+                rc = request_irq(virq, opal_interrupt, IRQF_TRIGGER_LOW,
+                                 "opal", NULL);
                 if (rc) {
                         irq_dispose_mapping(virq);
                         pr_warn("Error %d requesting irq %d (0x%x)\n",
diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c
index 8b4fc68cebcb..6c9a65b52e63 100644
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -399,6 +399,7 @@ static int opal_recover_mce(struct pt_regs *regs,
 
         if (!(regs->msr & MSR_RI)) {
                 /* If MSR_RI isn't set, we cannot recover */
+                pr_err("Machine check interrupt unrecoverable: MSR(RI=0)\n");
                 recovered = 0;
         } else if (evt->disposition == MCE_DISPOSITION_RECOVERED) {
                 /* Platform corrected itself */
diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
index 6b9528307f62..38a5c657ffd3 100644
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -111,10 +111,24 @@ static int __init iommu_setup(char *str)
 }
 early_param("iommu", iommu_setup);
 
-static inline bool pnv_pci_is_mem_pref_64(unsigned long flags)
+static inline bool pnv_pci_is_m64(struct pnv_phb *phb, struct resource *r)
 {
-        return ((flags & (IORESOURCE_MEM_64 | IORESOURCE_PREFETCH)) ==
-                (IORESOURCE_MEM_64 | IORESOURCE_PREFETCH));
+        /*
+         * WARNING: We cannot rely on the resource flags. The Linux PCI
+         * allocation code sometimes decides to put a 64-bit prefetchable
+         * BAR in the 32-bit window, so we have to compare the addresses.
+         *
+         * For simplicity we only test resource start.
+         */
+        return (r->start >= phb->ioda.m64_base &&
+                r->start < (phb->ioda.m64_base + phb->ioda.m64_size));
+}
+
+static inline bool pnv_pci_is_m64_flags(unsigned long resource_flags)
+{
+        unsigned long flags = (IORESOURCE_MEM_64 | IORESOURCE_PREFETCH);
+
+        return (resource_flags & flags) == flags;
 }
 
 static struct pnv_ioda_pe *pnv_ioda_init_pe(struct pnv_phb *phb, int pe_no)
@@ -142,7 +156,7 @@ static void pnv_ioda_reserve_pe(struct pnv_phb *phb, int pe_no)
 
 static struct pnv_ioda_pe *pnv_ioda_alloc_pe(struct pnv_phb *phb)
 {
-        unsigned long pe = phb->ioda.total_pe_num - 1;
+        long pe;
 
         for (pe = phb->ioda.total_pe_num - 1; pe >= 0; pe--) {
                 if (!test_and_set_bit(pe, phb->ioda.pe_alloc))
@@ -155,11 +169,12 @@ static struct pnv_ioda_pe *pnv_ioda_alloc_pe(struct pnv_phb *phb)
 static void pnv_ioda_free_pe(struct pnv_ioda_pe *pe)
 {
         struct pnv_phb *phb = pe->phb;
+        unsigned int pe_num = pe->pe_number;
 
         WARN_ON(pe->pdev);
 
         memset(pe, 0, sizeof(struct pnv_ioda_pe));
-        clear_bit(pe->pe_number, phb->ioda.pe_alloc);
+        clear_bit(pe_num, phb->ioda.pe_alloc);
 }
 
 /* The default M64 BAR is shared by all PEs */
@@ -229,7 +244,7 @@ static void pnv_ioda_reserve_dev_m64_pe(struct pci_dev *pdev,
         sgsz = phb->ioda.m64_segsize;
         for (i = 0; i <= PCI_ROM_RESOURCE; i++) {
                 r = &pdev->resource[i];
-                if (!r->parent || !pnv_pci_is_mem_pref_64(r->flags))
+                if (!r->parent || !pnv_pci_is_m64(phb, r))
                         continue;
 
                 start = _ALIGN_DOWN(r->start - base, sgsz);
@@ -1877,7 +1892,7 @@ static void pnv_pci_phb3_tce_invalidate(struct pnv_ioda_pe *pe, bool rm,
                                         unsigned shift, unsigned long index,
                                         unsigned long npages)
 {
-        __be64 __iomem *invalidate = pnv_ioda_get_inval_reg(pe->phb, false);
+        __be64 __iomem *invalidate = pnv_ioda_get_inval_reg(pe->phb, rm);
         unsigned long start, end, inc;
 
         /* We'll invalidate DMA address in PE scope */
@@ -2209,7 +2224,7 @@ static long pnv_pci_ioda2_set_window(struct iommu_table_group *table_group,
 
         pnv_pci_link_table_and_group(phb->hose->node, num,
                         tbl, &pe->table_group);
-        pnv_pci_phb3_tce_invalidate_pe(pe);
+        pnv_pci_ioda2_tce_invalidate_pe(pe);
 
         return 0;
 }
@@ -2347,7 +2362,7 @@ static long pnv_pci_ioda2_unset_window(struct iommu_table_group *table_group,
         if (ret)
                 pe_warn(pe, "Unmapping failed, ret = %ld\n", ret);
         else
-                pnv_pci_phb3_tce_invalidate_pe(pe);
+                pnv_pci_ioda2_tce_invalidate_pe(pe);
 
         pnv_pci_unlink_table_and_group(table_group->tables[num], table_group);
 
@@ -2863,7 +2878,7 @@ static void pnv_pci_ioda_fixup_iov_resources(struct pci_dev *pdev)
                 res = &pdev->resource[i + PCI_IOV_RESOURCES];
                 if (!res->flags || res->parent)
                         continue;
-                if (!pnv_pci_is_mem_pref_64(res->flags)) {
+                if (!pnv_pci_is_m64_flags(res->flags)) {
                         dev_warn(&pdev->dev, "Don't support SR-IOV with"
                                         " non M64 VF BAR%d: %pR. \n",
                                  i, res);
@@ -2958,7 +2973,7 @@ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,
                         index++;
                 }
         } else if ((res->flags & IORESOURCE_MEM) &&
-                   !pnv_pci_is_mem_pref_64(res->flags)) {
+                   !pnv_pci_is_m64(phb, res)) {
                 region.start = res->start -
                                phb->hose->mem_offset[0] -
                                phb->ioda.m32_pci_base;
@@ -3083,9 +3098,12 @@ static resource_size_t pnv_pci_window_alignment(struct pci_bus *bus,
                 bridge = bridge->bus->self;
         }
 
-        /* We fail back to M32 if M64 isn't supported */
-        if (phb->ioda.m64_segsize &&
-            pnv_pci_is_mem_pref_64(type))
+        /*
+         * We fall back to M32 if M64 isn't supported. We enforce the M64
+         * alignment for any 64-bit resource, PCIe doesn't care and
+         * bridges only do 64-bit prefetchable anyway.
+         */
+        if (phb->ioda.m64_segsize && pnv_pci_is_m64_flags(type))
                 return phb->ioda.m64_segsize;
         if (type & IORESOURCE_MEM)
                 return phb->ioda.m32_segsize;
@@ -3125,7 +3143,7 @@ static void pnv_pci_fixup_bridge_resources(struct pci_bus *bus,
                 w = NULL;
                 if (r->flags & type & IORESOURCE_IO)
                         w = &hose->io_resource;
-                else if (pnv_pci_is_mem_pref_64(r->flags) &&
+                else if (pnv_pci_is_m64(phb, r) &&
                          (type & IORESOURCE_PREFETCH) &&
                          phb->ioda.m64_segsize)
                         w = &hose->mem_resources[1];
@@ -3392,12 +3410,6 @@ static void pnv_ioda_release_pe(struct pnv_ioda_pe *pe)
         struct pnv_phb *phb = pe->phb;
         struct pnv_ioda_pe *slave, *tmp;
 
-        /* Release slave PEs in compound PE */
-        if (pe->flags & PNV_IODA_PE_MASTER) {
-                list_for_each_entry_safe(slave, tmp, &pe->slaves, list)
-                        pnv_ioda_release_pe(slave);
-        }
-
         list_del(&pe->list);
         switch (phb->type) {
         case PNV_PHB_IODA1:
@@ -3412,7 +3424,26 @@ static void pnv_ioda_release_pe(struct pnv_ioda_pe *pe)
 
         pnv_ioda_release_pe_seg(pe);
         pnv_ioda_deconfigure_pe(pe->phb, pe);
-        pnv_ioda_free_pe(pe);
+
+        /* Release slave PEs in the compound PE */
+        if (pe->flags & PNV_IODA_PE_MASTER) {
+                list_for_each_entry_safe(slave, tmp, &pe->slaves, list) {
+                        list_del(&slave->list);
+                        pnv_ioda_free_pe(slave);
+                }
+        }
+
+        /*
+         * The PE for root bus can be removed because of hotplug in EEH
+         * recovery for fenced PHB error. We need to mark the PE dead so
+         * that it can be populated again in PCI hot add path. The PE
+         * shouldn't be destroyed as it's the global reserved resource.
+         */
+        if (phb->ioda.root_pe_populated &&
+            phb->ioda.root_pe_idx == pe->pe_number)
+                phb->ioda.root_pe_populated = false;
+        else
+                pnv_ioda_free_pe(pe);
 }
 
 static void pnv_pci_release_device(struct pci_dev *pdev)
@@ -3428,7 +3459,17 @@ static void pnv_pci_release_device(struct pci_dev *pdev)
         if (!pdn || pdn->pe_number == IODA_INVALID_PE)
                 return;
 
+        /*
+         * PCI hotplug can happen as part of EEH error recovery. The @pdn
+         * isn't removed and added afterwards in this scenario. We should
+         * set the PE number in @pdn to an invalid one. Otherwise, the PE's
+         * device count is decreased on removing devices while failing to
+         * be increased on adding devices. It leads to unbalanced PE's device
+         * count and eventually make normal PCI hotplug path broken.
+         */
         pe = &phb->ioda.pe_array[pdn->pe_number];
+        pdn->pe_number = IODA_INVALID_PE;
+
         WARN_ON(--pe->device_count < 0);
         if (pe->device_count == 0)
                 pnv_ioda_release_pe(pe);
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 43f7beb2902d..76ec104e88be 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -320,19 +320,6 @@ static int dlpar_remove_device_tree_lmb(struct of_drconf_cell *lmb)
         return dlpar_update_device_tree_lmb(lmb);
 }
 
-static struct memory_block *lmb_to_memblock(struct of_drconf_cell *lmb)
-{
-        unsigned long section_nr;
-        struct mem_section *mem_sect;
-        struct memory_block *mem_block;
-
-        section_nr = pfn_to_section_nr(PFN_DOWN(lmb->base_addr));
-        mem_sect = __nr_to_section(section_nr);
-
-        mem_block = find_memory_block(mem_sect);
-        return mem_block;
-}
-
 #ifdef CONFIG_MEMORY_HOTREMOVE
 static int pseries_remove_memblock(unsigned long base, unsigned int memblock_size)
 {
@@ -420,6 +407,19 @@ static bool lmb_is_removable(struct of_drconf_cell *lmb)
 
 static int dlpar_add_lmb(struct of_drconf_cell *);
 
+static struct memory_block *lmb_to_memblock(struct of_drconf_cell *lmb)
+{
+        unsigned long section_nr;
+        struct mem_section *mem_sect;
+        struct memory_block *mem_block;
+
+        section_nr = pfn_to_section_nr(PFN_DOWN(lmb->base_addr));
+        mem_sect = __nr_to_section(section_nr);
+
+        mem_block = find_memory_block(mem_sect);
+        return mem_block;
+}
+
 static int dlpar_remove_lmb(struct of_drconf_cell *lmb)
 {
         struct memory_block *mem_block;
diff --git a/arch/powerpc/platforms/pseries/pci.c b/arch/powerpc/platforms/pseries/pci.c
index fe16a50700de..09eba5a9929a 100644
--- a/arch/powerpc/platforms/pseries/pci.c
+++ b/arch/powerpc/platforms/pseries/pci.c
@@ -119,6 +119,10 @@ int pseries_root_bridge_prepare(struct pci_host_bridge *bridge)
 
         bus = bridge->bus;
 
+        /* Rely on the pcibios_free_controller_deferred() callback. */
+        pci_set_host_bridge_release(bridge, pcibios_free_controller_deferred,
+                                        (void *) pci_bus_to_host(bus));
+
         dn = pcibios_get_phb_of_node(bus);
         if (!dn)
                 return 0;
diff --git a/arch/powerpc/platforms/pseries/pci_dlpar.c b/arch/powerpc/platforms/pseries/pci_dlpar.c
index 906dbaa97fe2..547fd13e4f8e 100644
--- a/arch/powerpc/platforms/pseries/pci_dlpar.c
+++ b/arch/powerpc/platforms/pseries/pci_dlpar.c
@@ -106,8 +106,11 @@ int remove_phb_dynamic(struct pci_controller *phb)
                 release_resource(res);
         }
 
-        /* Free pci_controller data structure */
-        pcibios_free_controller(phb);
+        /*
+         * The pci_controller data structure is freed by
+         * the pcibios_free_controller_deferred() callback;
+         * see pseries_root_bridge_prepare().
+         */
 
         return 0;
 }
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 4ffcaa6f8670..a39d20e8623d 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -41,7 +41,6 @@
 #include <linux/root_dev.h>
 #include <linux/of.h>
 #include <linux/of_pci.h>
-#include <linux/kexec.h>
 
 #include <asm/mmu.h>
 #include <asm/processor.h>
@@ -66,6 +65,7 @@
 #include <asm/eeh.h>
 #include <asm/reg.h>
 #include <asm/plpar_wrappers.h>
+#include <asm/kexec.h>
 
 #include "pseries.h"
 
diff --git a/arch/powerpc/sysdev/cpm1.c b/arch/powerpc/sysdev/cpm1.c
index 6c110994d902..81d49476c47e 100644
--- a/arch/powerpc/sysdev/cpm1.c
+++ b/arch/powerpc/sysdev/cpm1.c
@@ -534,7 +534,8 @@ struct cpm1_gpio16_chip {
 
 static void cpm1_gpio16_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm1_gpio16_chip *cpm1_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm1_gpio16_chip *cpm1_gc =
+                container_of(mm_gc, struct cpm1_gpio16_chip, mm_gc);
         struct cpm_ioport16 __iomem *iop = mm_gc->regs;
 
         cpm1_gc->cpdata = in_be16(&iop->dat);
@@ -649,7 +650,8 @@ struct cpm1_gpio32_chip {
 
 static void cpm1_gpio32_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm1_gpio32_chip *cpm1_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm1_gpio32_chip *cpm1_gc =
+                container_of(mm_gc, struct cpm1_gpio32_chip, mm_gc);
         struct cpm_ioport32b __iomem *iop = mm_gc->regs;
 
         cpm1_gc->cpdata = in_be32(&iop->dat);
diff --git a/arch/powerpc/sysdev/cpm_common.c b/arch/powerpc/sysdev/cpm_common.c
index 911456d17713..947f42007734 100644
--- a/arch/powerpc/sysdev/cpm_common.c
+++ b/arch/powerpc/sysdev/cpm_common.c
@@ -94,7 +94,8 @@ struct cpm2_gpio32_chip {
 
 static void cpm2_gpio32_save_regs(struct of_mm_gpio_chip *mm_gc)
 {
-        struct cpm2_gpio32_chip *cpm2_gc = gpiochip_get_data(&mm_gc->gc);
+        struct cpm2_gpio32_chip *cpm2_gc =
+                container_of(mm_gc, struct cpm2_gpio32_chip, mm_gc);
         struct cpm2_ioports __iomem *iop = mm_gc->regs;
 
         cpm2_gc->cpdata = in_be32(&iop->dat);
diff --git a/arch/powerpc/sysdev/fsl_rio.c b/arch/powerpc/sysdev/fsl_rio.c
index 68e7c0dd2e45..3cc7cace194a 100644
--- a/arch/powerpc/sysdev/fsl_rio.c
+++ b/arch/powerpc/sysdev/fsl_rio.c
@@ -23,7 +23,7 @@
  */
 
 #include <linux/init.h>
-#include <linux/module.h>
+#include <linux/extable.h>
 #include <linux/types.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
diff --git a/arch/powerpc/sysdev/xics/Kconfig b/arch/powerpc/sysdev/xics/Kconfig
index 0031eda320c3..385e7aa9e273 100644
--- a/arch/powerpc/sysdev/xics/Kconfig
+++ b/arch/powerpc/sysdev/xics/Kconfig
@@ -1,6 +1,7 @@
 config PPC_XICS
        def_bool n
        select PPC_SMP_MUXED_IPI
+       select HARDIRQS_SW_RESEND
 
 config PPC_ICP_NATIVE
        def_bool n
diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
index 57d72f10a97f..9114243fa1b5 100644
--- a/arch/powerpc/sysdev/xics/icp-opal.c
+++ b/arch/powerpc/sysdev/xics/icp-opal.c
@@ -23,10 +23,10 @@
 
 static void icp_opal_teardown_cpu(void)
 {
-        int cpu = smp_processor_id();
+        int hw_cpu = hard_smp_processor_id();
 
         /* Clear any pending IPI */
-        opal_int_set_mfrr(cpu, 0xff);
+        opal_int_set_mfrr(hw_cpu, 0xff);
 }
 
 static void icp_opal_flush_ipi(void)
@@ -101,14 +101,16 @@ static void icp_opal_eoi(struct irq_data *d)
 
 static void icp_opal_cause_ipi(int cpu, unsigned long data)
 {
-        opal_int_set_mfrr(cpu, IPI_PRIORITY);
+        int hw_cpu = get_hard_smp_processor_id(cpu);
+
+        opal_int_set_mfrr(hw_cpu, IPI_PRIORITY);
 }
 
 static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
 {
-        int cpu = smp_processor_id();
+        int hw_cpu = hard_smp_processor_id();
 
-        opal_int_set_mfrr(cpu, 0xff);
+        opal_int_set_mfrr(hw_cpu, 0xff);
 
         return smp_ipi_demux();
 }
diff --git a/arch/powerpc/sysdev/xics/ics-opal.c b/arch/powerpc/sysdev/xics/ics-opal.c
index 27c936c080a6..1c6bf4b66f56 100644
--- a/arch/powerpc/sysdev/xics/ics-opal.c
+++ b/arch/powerpc/sysdev/xics/ics-opal.c
@@ -156,7 +156,9 @@ static struct irq_chip ics_opal_irq_chip = {
         .irq_mask = ics_opal_mask_irq,
         .irq_unmask = ics_opal_unmask_irq,
         .irq_eoi = NULL, /* Patched at init time */
-        .irq_set_affinity = ics_opal_set_affinity
+        .irq_set_affinity = ics_opal_set_affinity,
+        .irq_set_type = xics_set_irq_type,
+        .irq_retrigger = xics_retrigger,
 };
 
 static int ics_opal_map(struct ics *ics, unsigned int virq);
diff --git a/arch/powerpc/sysdev/xics/ics-rtas.c b/arch/powerpc/sysdev/xics/ics-rtas.c
index 3854dd41558d..78ee5c778ef8 100644
--- a/arch/powerpc/sysdev/xics/ics-rtas.c
+++ b/arch/powerpc/sysdev/xics/ics-rtas.c
@@ -163,7 +163,9 @@ static struct irq_chip ics_rtas_irq_chip = {
         .irq_mask = ics_rtas_mask_irq,
         .irq_unmask = ics_rtas_unmask_irq,
         .irq_eoi = NULL, /* Patched at init time */
-        .irq_set_affinity = ics_rtas_set_affinity
+        .irq_set_affinity = ics_rtas_set_affinity,
+        .irq_set_type = xics_set_irq_type,
+        .irq_retrigger = xics_retrigger,
 };
 
 static int ics_rtas_map(struct ics *ics, unsigned int virq)
diff --git a/arch/powerpc/sysdev/xics/xics-common.c b/arch/powerpc/sysdev/xics/xics-common.c
index a795a5f0301c..9d530f479588 100644
--- a/arch/powerpc/sysdev/xics/xics-common.c
+++ b/arch/powerpc/sysdev/xics/xics-common.c
@@ -328,8 +328,12 @@ static int xics_host_map(struct irq_domain *h, unsigned int virq,
 
         pr_devel("xics: map virq %d, hwirq 0x%lx\n", virq, hw);
 
-        /* They aren't all level sensitive but we just don't really know */
-        irq_set_status_flags(virq, IRQ_LEVEL);
+        /*
+         * Mark interrupts as edge sensitive by default so that resend
+         * actually works. The device-tree parsing will turn the LSIs
+         * back to level.
+         */
+        irq_clear_status_flags(virq, IRQ_LEVEL);
 
         /* Don't call into ICS for IPIs */
         if (hw == XICS_IPI) {
@@ -351,13 +355,54 @@ static int xics_host_xlate(struct irq_domain *h, struct device_node *ct,
                            irq_hw_number_t *out_hwirq, unsigned int *out_flags)
 
 {
-        /* Current xics implementation translates everything
-         * to level. It is not technically right for MSIs but this
-         * is irrelevant at this point. We might get smarter in the future
-         */
         *out_hwirq = intspec[0];
-        *out_flags = IRQ_TYPE_LEVEL_LOW;
 
+        /*
+         * If intsize is at least 2, we look for the type in the second cell,
+         * we assume the LSB indicates a level interrupt.
+         */
+        if (intsize > 1) {
+                if (intspec[1] & 1)
+                        *out_flags = IRQ_TYPE_LEVEL_LOW;
+                else
+                        *out_flags = IRQ_TYPE_EDGE_RISING;
+        } else
+                *out_flags = IRQ_TYPE_LEVEL_LOW;
+
+        return 0;
+}
+
+int xics_set_irq_type(struct irq_data *d, unsigned int flow_type)
+{
+        /*
+         * We only support these. This has really no effect other than setting
+         * the corresponding descriptor bits mind you but those will in turn
+         * affect the resend function when re-enabling an edge interrupt.
+         *
+         * Set set the default to edge as explained in map().
+         */
+        if (flow_type == IRQ_TYPE_DEFAULT || flow_type == IRQ_TYPE_NONE)
+                flow_type = IRQ_TYPE_EDGE_RISING;
+
+        if (flow_type != IRQ_TYPE_EDGE_RISING &&
+            flow_type != IRQ_TYPE_LEVEL_LOW)
+                return -EINVAL;
+
+        irqd_set_trigger_type(d, flow_type);
+
+        return IRQ_SET_MASK_OK_NOCOPY;
+}
+
+int xics_retrigger(struct irq_data *data)
+{
+        /*
+         * We need to push a dummy CPPR when retriggering, since the subsequent
+         * EOI will try to pop it. Passing 0 works, as the function hard codes
+         * the priority value anyway.
+         */
+        xics_push_cppr(0);
+
+        /* Tell the core to do a soft retrigger */
         return 0;
 }
 
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 9e607bf2d640..c109f073d454 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -68,7 +68,6 @@ config DEBUG_RODATA
 config S390
         def_bool y
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_GCOV_PROFILE_ALL
@@ -123,6 +122,7 @@ config S390
         select HAVE_ALIGNED_STRUCT_PAGE if SLUB
         select HAVE_ARCH_AUDITSYSCALL
         select HAVE_ARCH_EARLY_PFN_TO_NID
+        select HAVE_ARCH_HARDENED_USERCOPY
         select HAVE_ARCH_JUMP_LABEL
         select CPU_NO_EFFICIENT_FFS if !HAVE_MARCH_Z9_109_FEATURES
         select HAVE_ARCH_SECCOMP_FILTER
@@ -871,4 +871,17 @@ config S390_GUEST
           Select this option if you want to run the kernel as a guest under
           the KVM hypervisor.
 
+config S390_GUEST_OLD_TRANSPORT
+        def_bool y
+        prompt "Guest support for old s390 virtio transport (DEPRECATED)"
+        depends on S390_GUEST
+        help
+          Enable this option to add support for the old s390-virtio
+          transport (i.e. virtio devices NOT based on virtio-ccw). This
+          type of virtio devices is only available on the experimental
+          kuli userspace or with old (< 2.6) qemu. If you are running
+          with a modern version of qemu (which supports virtio-ccw since
+          1.4 and uses it by default since version 2.4), you probably won't
+          need this.
+
 endmenu
diff --git a/arch/s390/boot/compressed/head.S b/arch/s390/boot/compressed/head.S
index f86a4eef28a9..28c4f96a2d9c 100644
--- a/arch/s390/boot/compressed/head.S
+++ b/arch/s390/boot/compressed/head.S
@@ -21,16 +21,21 @@ ENTRY(startup_continue)
         lg      %r15,.Lstack-.LPG1(%r13)
         aghi    %r15,-160
         brasl   %r14,decompress_kernel
-        # setup registers for memory mover & branch to target
+        # Set up registers for memory mover. We move the decompressed image to
+        # 0x11000, starting at offset 0x11000 in the decompressed image so
+        # that code living at 0x11000 in the image will end up at 0x11000 in
+        # memory.
         lgr     %r4,%r2
         lg      %r2,.Loffset-.LPG1(%r13)
         la      %r4,0(%r2,%r4)
         lg      %r3,.Lmvsize-.LPG1(%r13)
         lgr     %r5,%r3
-        # move the memory mover someplace safe
+        # Move the memory mover someplace safe so it doesn't overwrite itself.
         la      %r1,0x200
         mvc     0(mover_end-mover,%r1),mover-.LPG1(%r13)
-        # decompress image is started at 0x11000
+        # When the memory mover is done we pass control to
+        # arch/s390/kernel/head64.S:startup_continue which lives at 0x11000 in
+        # the decompressed image.
         lgr     %r6,%r2
         br      %r1
 mover:
diff --git a/arch/s390/configs/default_defconfig b/arch/s390/configs/default_defconfig
index 889ea3450210..412b1bd21029 100644
--- a/arch/s390/configs/default_defconfig
+++ b/arch/s390/configs/default_defconfig
@@ -602,7 +602,6 @@ CONFIG_FAIL_FUTEX=y
 CONFIG_FAULT_INJECTION_DEBUG_FS=y
 CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_IRQSOFF_TRACER=y
 CONFIG_PREEMPT_TRACER=y
 CONFIG_SCHED_TRACER=y
@@ -678,7 +677,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
diff --git a/arch/s390/configs/gcov_defconfig b/arch/s390/configs/gcov_defconfig
index 1bcfd764910a..bec279eb4b93 100644
--- a/arch/s390/configs/gcov_defconfig
+++ b/arch/s390/configs/gcov_defconfig
@@ -552,7 +552,6 @@ CONFIG_NOTIFIER_ERROR_INJECTION=m
 CONFIG_CPU_NOTIFIER_ERROR_INJECT=m
 CONFIG_PM_NOTIFIER_ERROR_INJECT=m
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_BLK_DEV_IO_TRACE=y
 # CONFIG_KPROBE_EVENT is not set
 CONFIG_TRACE_ENUM_MAP_FILE=y
@@ -616,7 +615,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
diff --git a/arch/s390/configs/performance_defconfig b/arch/s390/configs/performance_defconfig
index 13ff090139c8..1751446a5bbb 100644
--- a/arch/s390/configs/performance_defconfig
+++ b/arch/s390/configs/performance_defconfig
@@ -549,7 +549,6 @@ CONFIG_TIMER_STATS=y
 CONFIG_RCU_TORTURE_TEST=m
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_STACK_TRACER=y
@@ -615,7 +614,7 @@ CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
 CONFIG_CRYPTO_GHASH_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_ASYMMETRIC_KEY_TYPE=y
 CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=m
 CONFIG_X509_CERTIFICATE_PARSER=m
diff --git a/arch/s390/crypto/crc32-vx.c b/arch/s390/crypto/crc32-vx.c
index 577ae1d4ae89..2bad9d837029 100644
--- a/arch/s390/crypto/crc32-vx.c
+++ b/arch/s390/crypto/crc32-vx.c
@@ -51,6 +51,9 @@ u32 crc32c_le_vgfm_16(u32 crc, unsigned char const *buf, size_t size);
                 struct kernel_fpu vxstate;                                  \
                 unsigned long prealign, aligned, remaining;                 \
                                                                             \
+                if (datalen < VX_MIN_LEN + VX_ALIGN_MASK)                   \
+                        return ___crc32_sw(crc, data, datalen);             \
+                                                                            \
                 if ((unsigned long)data & VX_ALIGN_MASK) {                  \
                         prealign = VX_ALIGNMENT -                           \
                                   ((unsigned long)data & VX_ALIGN_MASK);    \
@@ -59,9 +62,6 @@ u32 crc32c_le_vgfm_16(u32 crc, unsigned char const *buf, size_t size);
                         data = (void *)((unsigned long)data + prealign);    \
                 }                                                           \
                                                                             \
-                if (datalen < VX_MIN_LEN)                                   \
-                        return ___crc32_sw(crc, data, datalen);             \
-                                                                            \
                 aligned = datalen & ~VX_ALIGN_MASK;                         \
                 remaining = datalen & VX_ALIGN_MASK;                        \
                                                                             \
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index ccccebeeaaf6..2d40ef0a6295 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -172,7 +172,6 @@ CONFIG_DEBUG_NOTIFIERS=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=60
 CONFIG_RCU_TRACE=y
 CONFIG_LATENCYTOP=y
-CONFIG_DEBUG_STRICT_USER_COPY_CHECKS=y
 CONFIG_SCHED_TRACER=y
 CONFIG_FTRACE_SYSCALLS=y
 CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP=y
@@ -234,7 +233,7 @@ CONFIG_CRYPTO_SHA256_S390=m
 CONFIG_CRYPTO_SHA512_S390=m
 CONFIG_CRYPTO_DES_S390=m
 CONFIG_CRYPTO_AES_S390=m
-CONFIG_CRYPTO_CRC32_S390=m
+CONFIG_CRYPTO_CRC32_S390=y
 CONFIG_CRC7=m
 # CONFIG_XZ_DEC_X86 is not set
 # CONFIG_XZ_DEC_POWERPC is not set
diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h
index 9b49cf1daa8f..52d7c8709279 100644
--- a/arch/s390/include/asm/uaccess.h
+++ b/arch/s390/include/asm/uaccess.h
@@ -266,28 +266,28 @@ int __put_user_bad(void) __attribute__((noreturn));
         __chk_user_ptr(ptr);                                    \
         switch (sizeof(*(ptr))) {                               \
         case 1: {                                               \
-                unsigned char __x;                              \
+                unsigned char __x = 0;                          \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 2: {                                               \
-                unsigned short __x;                             \
+                unsigned short __x = 0;                         \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 4: {                                               \
-                unsigned int __x;                               \
+                unsigned int __x = 0;                           \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
                 break;                                          \
         };                                                      \
         case 8: {                                               \
-                unsigned long long __x;                         \
+                unsigned long long __x = 0;                     \
                 __gu_err = __get_user_fn(&__x, ptr,             \
                                          sizeof(*(ptr)));       \
                 (x) = *(__force __typeof__(*(ptr)) *) &__x;     \
@@ -311,6 +311,14 @@ int __get_user_bad(void) __attribute__((noreturn));
 #define __put_user_unaligned __put_user
 #define __get_user_unaligned __get_user
 
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
+
+static inline void copy_user_overflow(int size, unsigned long count)
+{
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
+}
+
 /**
  * copy_to_user: - Copy a block of data into user space.
  * @to:   Destination address, in user space.
@@ -332,12 +340,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
         return __copy_to_user(to, from, n);
 }
 
-void copy_from_user_overflow(void)
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-__compiletime_warning("copy_from_user() buffer size is not provably correct")
-#endif
-;
-
 /**
  * copy_from_user: - Copy a block of data from user space.
  * @to:   Destination address, in kernel space.
@@ -362,7 +364,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
 
         might_fault();
         if (unlikely(sz != -1 && sz < n)) {
-                copy_from_user_overflow();
+                if (!__builtin_constant_p(n))
+                        copy_user_overflow(sz, n);
+                else
+                        __bad_copy_user();
                 return n;
         }
         return __copy_from_user(to, from, n);
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index 56e4d8234ef2..4431905f8cfa 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -309,7 +309,9 @@ ENTRY(startup_kdump)
         l       %r15,.Lstack-.LPG0(%r13)
         ahi     %r15,-STACK_FRAME_OVERHEAD
         brasl   %r14,verify_facilities
-        /* Continue with startup code in head64.S */
+# For uncompressed images, continue in
+# arch/s390/kernel/head64.S. For compressed images, continue in
+# arch/s390/boot/compressed/head.S.
         jg      startup_continue
 
 .Lstack:
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index ba5f456edaa9..7f7ba5f23f13 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -204,11 +204,9 @@ static void __init conmode_default(void)
 #endif
                 }
         } else if (MACHINE_IS_KVM) {
-                if (sclp.has_vt220 &&
-                    config_enabled(CONFIG_SCLP_VT220_CONSOLE))
+                if (sclp.has_vt220 && IS_ENABLED(CONFIG_SCLP_VT220_CONSOLE))
                         SET_CONSOLE_VT220;
-                else if (sclp.has_linemode &&
-                         config_enabled(CONFIG_SCLP_CONSOLE))
+                else if (sclp.has_linemode && IS_ENABLED(CONFIG_SCLP_CONSOLE))
                         SET_CONSOLE_SCLP;
                 else
                         SET_CONSOLE_HVC;
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 3f3ae4865d57..607ec91966c7 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -1672,6 +1672,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
                                     KVM_SYNC_CRS |
                                     KVM_SYNC_ARCH0 |
                                     KVM_SYNC_PFAULT;
+        kvm_s390_set_prefix(vcpu, 0);
         if (test_kvm_facility(vcpu->kvm, 64))
                 vcpu->run->kvm_valid_regs |= KVM_SYNC_RICCB;
         /* fprs can be synchronized via vrs, even if the guest has no vx. With
@@ -2230,9 +2231,10 @@ int kvm_arch_vcpu_ioctl_set_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
                 return -EINVAL;
         current->thread.fpu.fpc = fpu->fpc;
         if (MACHINE_HAS_VX)
-                convert_fp_to_vx(current->thread.fpu.vxrs, (freg_t *)fpu->fprs);
+                convert_fp_to_vx((__vector128 *) vcpu->run->s.regs.vrs,
+                                 (freg_t *) fpu->fprs);
         else
-                memcpy(current->thread.fpu.fprs, &fpu->fprs, sizeof(fpu->fprs));
+                memcpy(vcpu->run->s.regs.fprs, &fpu->fprs, sizeof(fpu->fprs));
         return 0;
 }
 
@@ -2241,9 +2243,10 @@ int kvm_arch_vcpu_ioctl_get_fpu(struct kvm_vcpu *vcpu, struct kvm_fpu *fpu)
         /* make sure we have the latest values */
         save_fpu_regs();
         if (MACHINE_HAS_VX)
-                convert_vx_to_fp((freg_t *)fpu->fprs, current->thread.fpu.vxrs);
+                convert_vx_to_fp((freg_t *) fpu->fprs,
+                                 (__vector128 *) vcpu->run->s.regs.vrs);
         else
-                memcpy(fpu->fprs, current->thread.fpu.fprs, sizeof(fpu->fprs));
+                memcpy(fpu->fprs, vcpu->run->s.regs.fprs, sizeof(fpu->fprs));
         fpu->fpc = current->thread.fpu.fpc;
         return 0;
 }
@@ -2361,8 +2364,10 @@ retry:
                 rc = gmap_mprotect_notify(vcpu->arch.gmap,
                                           kvm_s390_get_prefix(vcpu),
                                           PAGE_SIZE * 2, PROT_WRITE);
-                if (rc)
+                if (rc) {
+                        kvm_make_request(KVM_REQ_MMU_RELOAD, vcpu);
                         return rc;
+                }
                 goto retry;
         }
 
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index c106488b4137..d8673e243f13 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -584,7 +584,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
                 /* Validity 0x0044 will be checked by SIE */
                 if (rc)
                         goto unpin;
-                scb_s->gvrd = hpa;
+                scb_s->riccbd = hpa;
         }
         return 0;
 unpin:
diff --git a/arch/s390/lib/string.c b/arch/s390/lib/string.c
index e390bbb16443..48352bffbc92 100644
--- a/arch/s390/lib/string.c
+++ b/arch/s390/lib/string.c
@@ -237,11 +237,10 @@ char * strrchr(const char * s, int c)
 EXPORT_SYMBOL(strrchr);
 
 static inline int clcle(const char *s1, unsigned long l1,
-                        const char *s2, unsigned long l2,
-                        int *diff)
+                        const char *s2, unsigned long l2)
 {
         register unsigned long r2 asm("2") = (unsigned long) s1;
-        register unsigned long r3 asm("3") = (unsigned long) l2;
+        register unsigned long r3 asm("3") = (unsigned long) l1;
         register unsigned long r4 asm("4") = (unsigned long) s2;
         register unsigned long r5 asm("5") = (unsigned long) l2;
         int cc;
@@ -252,7 +251,6 @@ static inline int clcle(const char *s1, unsigned long l1,
                       "   srl   %0,28"
                       : "=&d" (cc), "+a" (r2), "+a" (r3),
                         "+a" (r4), "+a" (r5) : : "cc");
-        *diff = *(char *)r2 - *(char *)r4;
         return cc;
 }
 
@@ -270,9 +268,9 @@ char * strstr(const char * s1,const char * s2)
                 return (char *) s1;
         l1 = __strend(s1) - s1;
         while (l1-- >= l2) {
-                int cc, dummy;
+                int cc;
 
-                cc = clcle(s1, l1, s2, l2, &dummy);
+                cc = clcle(s1, l2, s2, l2);
                 if (!cc)
                         return (char *) s1;
                 s1++;
@@ -313,11 +311,11 @@ EXPORT_SYMBOL(memchr);
  */
 int memcmp(const void *cs, const void *ct, size_t n)
 {
-        int ret, diff;
+        int ret;
 
-        ret = clcle(cs, n, ct, n, &diff);
+        ret = clcle(cs, n, ct, n);
         if (ret)
-                ret = diff;
+                ret = ret == 1 ? -1 : 1;
         return ret;
 }
 EXPORT_SYMBOL(memcmp);
diff --git a/arch/s390/lib/uaccess.c b/arch/s390/lib/uaccess.c
index d96596128e9f..f481fcde067b 100644
--- a/arch/s390/lib/uaccess.c
+++ b/arch/s390/lib/uaccess.c
@@ -104,6 +104,7 @@ static inline unsigned long copy_from_user_mvcp(void *x, const void __user *ptr,
 
 unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+        check_object_size(to, n, false);
         if (static_branch_likely(&have_mvcos))
                 return copy_from_user_mvcos(to, from, n);
         return copy_from_user_mvcp(to, from, n);
@@ -177,6 +178,7 @@ static inline unsigned long copy_to_user_mvcs(void __user *ptr, const void *x,
 
 unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+        check_object_size(from, n, true);
         if (static_branch_likely(&have_mvcos))
                 return copy_to_user_mvcos(to, from, n);
         return copy_to_user_mvcs(to, from, n);
diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
index 7104ffb5a67f..af7cf28cf97e 100644
--- a/arch/s390/mm/pageattr.c
+++ b/arch/s390/mm/pageattr.c
@@ -252,6 +252,8 @@ static int change_page_attr(unsigned long addr, unsigned long end,
         int rc = -EINVAL;
         pgd_t *pgdp;
 
+        if (addr == end)
+                return 0;
         if (end >= MODULES_END)
                 return -EINVAL;
         mutex_lock(&cpa_mutex);
diff --git a/arch/score/include/asm/uaccess.h b/arch/score/include/asm/uaccess.h
index 20a3591225cc..01aec8ccde83 100644
--- a/arch/score/include/asm/uaccess.h
+++ b/arch/score/include/asm/uaccess.h
@@ -163,7 +163,7 @@ do {									\
                 __get_user_asm(val, "lw", ptr);                         \
                  break;                                                 \
         case 8:                                                         \
-                if ((copy_from_user((void *)&val, ptr, 8)) == 0)        \
+                if (__copy_from_user((void *)&val, ptr, 8) == 0)        \
                         __gu_err = 0;                                   \
                 else                                                    \
                         __gu_err = -EFAULT;                             \
@@ -188,6 +188,8 @@ do {									\
                                                                         \
         if (likely(access_ok(VERIFY_READ, __gu_ptr, size)))             \
                 __get_user_common((x), size, __gu_ptr);                 \
+        else                                                            \
+                (x) = 0;                                                \
                                                                         \
         __gu_err;                                                       \
 })
@@ -201,6 +203,7 @@ do {									\
                 "2:\n"                                                  \
                 ".section .fixup,\"ax\"\n"                              \
                 "3:li   %0, %4\n"                                       \
+                "li     %1, 0\n"                                        \
                 "j      2b\n"                                           \
                 ".previous\n"                                           \
                 ".section __ex_table,\"a\"\n"                           \
@@ -298,35 +301,34 @@ extern int __copy_tofrom_user(void *to, const void *from, unsigned long len);
 static inline unsigned long
 copy_from_user(void *to, const void *from, unsigned long len)
 {
-        unsigned long over;
+        unsigned long res = len;
 
-        if (access_ok(VERIFY_READ, from, len))
-                return __copy_tofrom_user(to, from, len);
+        if (likely(access_ok(VERIFY_READ, from, len)))
+                res = __copy_tofrom_user(to, from, len);
 
-        if ((unsigned long)from < TASK_SIZE) {
-                over = (unsigned long)from + len - TASK_SIZE;
-                return __copy_tofrom_user(to, from, len - over) + over;
-        }
-        return len;
+        if (unlikely(res))
+                memset(to + (len - res), 0, res);
+
+        return res;
 }
 
 static inline unsigned long
 copy_to_user(void *to, const void *from, unsigned long len)
 {
-        unsigned long over;
-
-        if (access_ok(VERIFY_WRITE, to, len))
-                return __copy_tofrom_user(to, from, len);
+        if (likely(access_ok(VERIFY_WRITE, to, len)))
+                len = __copy_tofrom_user(to, from, len);
 
-        if ((unsigned long)to < TASK_SIZE) {
-                over = (unsigned long)to + len - TASK_SIZE;
-                return __copy_tofrom_user(to, from, len - over) + over;
-        }
         return len;
 }
 
-#define __copy_from_user(to, from, len) \
-                __copy_tofrom_user((to), (from), (len))
+static inline unsigned long
+__copy_from_user(void *to, const void *from, unsigned long len)
+{
+        unsigned long left = __copy_tofrom_user(to, from, len);
+        if (unlikely(left))
+                memset(to + (len - left), 0, left);
+        return left;
+}
 
 #define __copy_to_user(to, from, len)           \
                 __copy_tofrom_user((to), (from), (len))
@@ -340,17 +342,17 @@ __copy_to_user_inatomic(void *to, const void *from, unsigned long len)
 static inline unsigned long
 __copy_from_user_inatomic(void *to, const void *from, unsigned long len)
 {
-        return __copy_from_user(to, from, len);
+        return __copy_tofrom_user(to, from, len);
 }
 
-#define __copy_in_user(to, from, len)   __copy_from_user(to, from, len)
+#define __copy_in_user(to, from, len)   __copy_tofrom_user(to, from, len)
 
 static inline unsigned long
 copy_in_user(void *to, const void *from, unsigned long len)
 {
         if (access_ok(VERIFY_READ, from, len) &&
                       access_ok(VERFITY_WRITE, to, len))
-                return copy_from_user(to, from, len);
+                return __copy_tofrom_user(to, from, len);
 }
 
 /*
diff --git a/arch/sh/include/asm/atomic-llsc.h b/arch/sh/include/asm/atomic-llsc.h
index caea2c45f6c2..1d159ce50f5a 100644
--- a/arch/sh/include/asm/atomic-llsc.h
+++ b/arch/sh/include/asm/atomic-llsc.h
@@ -60,7 +60,7 @@ static inline int atomic_fetch_##op(int i, atomic_t *v)			\
 "       movco.l %0, @%3                                 \n"             \
 "       bf      1b                                      \n"             \
 "       synco                                           \n"             \
-        : "=&z" (temp), "=&z" (res)                                     \
+        : "=&z" (temp), "=&r" (res)                                     \
         : "r" (i), "r" (&v->counter)                                    \
         : "t");                                                         \
                                                                         \
diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
index a49635c51266..92ade79ac427 100644
--- a/arch/sh/include/asm/uaccess.h
+++ b/arch/sh/include/asm/uaccess.h
@@ -151,7 +151,10 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
         __kernel_size_t __copy_size = (__kernel_size_t) n;
 
         if (__copy_size && __access_ok(__copy_from, __copy_size))
-                return __copy_user(to, from, __copy_size);
+                __copy_size = __copy_user(to, from, __copy_size);
+
+        if (unlikely(__copy_size))
+                memset(to + (n - __copy_size), 0, __copy_size);
 
         return __copy_size;
 }
diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
index c01376c76b86..ca5073dd4596 100644
--- a/arch/sh/include/asm/uaccess_64.h
+++ b/arch/sh/include/asm/uaccess_64.h
@@ -24,6 +24,7 @@
 #define __get_user_size(x,ptr,size,retval)                      \
 do {                                                            \
         retval = 0;                                             \
+        x = 0;                                                  \
         switch (size) {                                         \
         case 1:                                                 \
                 retval = __get_user_asm_b((void *)&x,           \
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 546293d9e6c5..59b09600dd32 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -43,6 +43,7 @@ config SPARC
         select OLD_SIGSUSPEND
         select ARCH_HAS_SG_CHAIN
         select CPU_NO_EFFICIENT_FFS
+        select HAVE_ARCH_HARDENED_USERCOPY
 
 config SPARC32
         def_bool !64BIT
diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
index 57aca2792d29..ea55f86d7ccd 100644
--- a/arch/sparc/include/asm/uaccess_32.h
+++ b/arch/sparc/include/asm/uaccess_32.h
@@ -248,23 +248,28 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon
 
 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-        if (n && __access_ok((unsigned long) to, n))
+        if (n && __access_ok((unsigned long) to, n)) {
+                check_object_size(from, n, true);
                 return __copy_user(to, (__force void __user *) from, n);
-        else
+        } else
                 return n;
 }
 
 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+        check_object_size(from, n, true);
         return __copy_user(to, (__force void __user *) from, n);
 }
 
 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-        if (n && __access_ok((unsigned long) from, n))
+        if (n && __access_ok((unsigned long) from, n)) {
+                check_object_size(to, n, false);
                 return __copy_user((__force void __user *) to, from, n);
-        else
+        } else {
+                memset(to, 0, n);
                 return n;
+        }
 }
 
 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
index e9a51d64974d..37a315d0ddd4 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -210,8 +210,11 @@ unsigned long copy_from_user_fixup(void *to, const void __user *from,
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long size)
 {
-        unsigned long ret = ___copy_from_user(to, from, size);
+        unsigned long ret;
 
+        check_object_size(to, size, false);
+
+        ret = ___copy_from_user(to, from, size);
         if (unlikely(ret))
                 ret = copy_from_user_fixup(to, from, size);
 
@@ -227,8 +230,11 @@ unsigned long copy_to_user_fixup(void __user *to, const void *from,
 static inline unsigned long __must_check
 copy_to_user(void __user *to, const void *from, unsigned long size)
 {
-        unsigned long ret = ___copy_to_user(to, from, size);
+        unsigned long ret;
+
+        check_object_size(from, size, true);
 
+        ret = ___copy_to_user(to, from, size);
         if (unlikely(ret))
                 ret = copy_to_user_fixup(to, from, size);
         return ret;
diff --git a/arch/tile/Kconfig b/arch/tile/Kconfig
index 4820a02838ac..78da75b670bc 100644
--- a/arch/tile/Kconfig
+++ b/arch/tile/Kconfig
@@ -4,7 +4,6 @@
 config TILE
         def_bool y
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select ARCH_WANT_FRAME_POINTERS
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
index 0a9c4265763b..a77369e91e54 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
@@ -416,14 +416,13 @@ _copy_from_user(void *to, const void __user *from, unsigned long n)
         return n;
 }
 
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-/*
- * There are still unprovable places in the generic code as of 2.6.34, so this
- * option is not really compatible with -Werror, which is more useful in
- * general.
- */
-extern void copy_from_user_overflow(void)
-        __compiletime_warning("copy_from_user() size is not provably correct");
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
+
+static inline void copy_user_overflow(int size, unsigned long count)
+{
+        WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
+}
 
 static inline unsigned long __must_check copy_from_user(void *to,
                                           const void __user *from,
@@ -433,14 +432,13 @@ static inline unsigned long __must_check copy_from_user(void *to,
 
         if (likely(sz == -1 || sz >= n))
                 n = _copy_from_user(to, from, n);
+        else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
         else
-                copy_from_user_overflow();
+                __bad_copy_user();
 
         return n;
 }
-#else
-#define copy_from_user _copy_from_user
-#endif
 
 #ifdef __tilegx__
 /**
diff --git a/arch/um/include/asm/common.lds.S b/arch/um/include/asm/common.lds.S
index 1dd5bd8a8c59..133055311dce 100644
--- a/arch/um/include/asm/common.lds.S
+++ b/arch/um/include/asm/common.lds.S
@@ -81,7 +81,7 @@
   .altinstr_replacement : { *(.altinstr_replacement) }
   /* .exit.text is discard at runtime, not link time, to deal with references
      from .altinstructions and .eh_frame */
-  .exit.text : { *(.exit.text) }
+  .exit.text : { EXIT_TEXT }
   .exit.data : { *(.exit.data) }
 
   .preinit_array : {
diff --git a/arch/um/kernel/skas/syscall.c b/arch/um/kernel/skas/syscall.c
index ef4b8f949b51..b783ac87d98a 100644
--- a/arch/um/kernel/skas/syscall.c
+++ b/arch/um/kernel/skas/syscall.c
@@ -21,21 +21,17 @@ void handle_syscall(struct uml_pt_regs *r)
         PT_REGS_SET_SYSCALL_RETURN(regs, -ENOSYS);
 
         if (syscall_trace_enter(regs))
-                return;
+                goto out;
 
         /* Do the seccomp check after ptrace; failures should be fast. */
         if (secure_computing(NULL) == -1)
-                return;
+                goto out;
 
-        /* Update the syscall number after orig_ax has potentially been updated
-         * with ptrace.
-         */
-        UPT_SYSCALL_NR(r) = PT_SYSCALL_NR(r->gp);
         syscall = UPT_SYSCALL_NR(r);
-
         if (syscall >= 0 && syscall <= __NR_syscall_max)
                 PT_REGS_SET_SYSCALL_RETURN(regs,
                                 EXECUTE_SYSCALL(syscall, regs));
 
+out:
         syscall_trace_leave(regs);
 }
diff --git a/arch/unicore32/include/asm/mmu_context.h b/arch/unicore32/include/asm/mmu_context.h
index e35632ef23c7..62dfc644c908 100644
--- a/arch/unicore32/include/asm/mmu_context.h
+++ b/arch/unicore32/include/asm/mmu_context.h
@@ -98,7 +98,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
 }
 
 static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
-                bool write, bool foreign)
+                bool write, bool execute, bool foreign)
 {
         /* by default, allow everything */
         return true;
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 5c6e7471b732..2a1f0ce7c59a 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -24,7 +24,6 @@ config X86
         select ARCH_DISCARD_MEMBLOCK
         select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
         select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
-        select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
         select ARCH_HAS_DEVMEM_IS_ALLOWED
         select ARCH_HAS_ELF_RANDOMIZE
         select ARCH_HAS_FAST_MULTIPLIER
@@ -80,6 +79,7 @@ config X86
         select HAVE_ALIGNED_STRUCT_PAGE         if SLUB
         select HAVE_AOUT                        if X86_32
         select HAVE_ARCH_AUDITSYSCALL
+        select HAVE_ARCH_HARDENED_USERCOPY
         select HAVE_ARCH_HUGE_VMAP              if X86_64 || X86_PAE
         select HAVE_ARCH_JUMP_LABEL
         select HAVE_ARCH_KASAN                  if X86_64 && SPARSEMEM_VMEMMAP
@@ -91,6 +91,7 @@ config X86
         select HAVE_ARCH_SOFT_DIRTY             if X86_64
         select HAVE_ARCH_TRACEHOOK
         select HAVE_ARCH_TRANSPARENT_HUGEPAGE
+        select HAVE_ARCH_WITHIN_STACK_FRAMES
         select HAVE_EBPF_JIT                    if X86_64
         select HAVE_CC_STACKPROTECTOR
         select HAVE_CMPXCHG_DOUBLE
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index ff574dad95cc..94dd4a31f5b3 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -1004,79 +1004,87 @@ static efi_status_t alloc_e820ext(u32 nr_desc, struct setup_data **e820ext,
         return status;
 }
 
-static efi_status_t exit_boot(struct boot_params *boot_params,
-                              void *handle, bool is64)
-{
-        struct efi_info *efi = &boot_params->efi_info;
-        unsigned long map_sz, key, desc_size;
-        efi_memory_desc_t *mem_map;
+struct exit_boot_struct {
+        struct boot_params *boot_params;
+        struct efi_info *efi;
         struct setup_data *e820ext;
-        const char *signature;
         __u32 e820ext_size;
-        __u32 nr_desc, prev_nr_desc;
-        efi_status_t status;
-        __u32 desc_version;
-        bool called_exit = false;
-        u8 nr_entries;
-        int i;
-
-        nr_desc = 0;
-        e820ext = NULL;
-        e820ext_size = 0;
-
-get_map:
-        status = efi_get_memory_map(sys_table, &mem_map, &map_sz, &desc_size,
-                                    &desc_version, &key);
-
-        if (status != EFI_SUCCESS)
-                return status;
-
-        prev_nr_desc = nr_desc;
-        nr_desc = map_sz / desc_size;
-        if (nr_desc > prev_nr_desc &&
-            nr_desc > ARRAY_SIZE(boot_params->e820_map)) {
-                u32 nr_e820ext = nr_desc - ARRAY_SIZE(boot_params->e820_map);
-
-                status = alloc_e820ext(nr_e820ext, &e820ext, &e820ext_size);
-                if (status != EFI_SUCCESS)
-                        goto free_mem_map;
+        bool is64;
+};
 
-                efi_call_early(free_pool, mem_map);
-                goto get_map; /* Allocated memory, get map again */
+static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
+                                   struct efi_boot_memmap *map,
+                                   void *priv)
+{
+        static bool first = true;
+        const char *signature;
+        __u32 nr_desc;
+        efi_status_t status;
+        struct exit_boot_struct *p = priv;
+
+        if (first) {
+                nr_desc = *map->buff_size / *map->desc_size;
+                if (nr_desc > ARRAY_SIZE(p->boot_params->e820_map)) {
+                        u32 nr_e820ext = nr_desc -
+                                        ARRAY_SIZE(p->boot_params->e820_map);
+
+                        status = alloc_e820ext(nr_e820ext, &p->e820ext,
+                                               &p->e820ext_size);
+                        if (status != EFI_SUCCESS)
+                                return status;
+                }
+                first = false;
         }
 
-        signature = is64 ? EFI64_LOADER_SIGNATURE : EFI32_LOADER_SIGNATURE;
-        memcpy(&efi->efi_loader_signature, signature, sizeof(__u32));
+        signature = p->is64 ? EFI64_LOADER_SIGNATURE : EFI32_LOADER_SIGNATURE;
+        memcpy(&p->efi->efi_loader_signature, signature, sizeof(__u32));
 
-        efi->efi_systab = (unsigned long)sys_table;
-        efi->efi_memdesc_size = desc_size;
-        efi->efi_memdesc_version = desc_version;
-        efi->efi_memmap = (unsigned long)mem_map;
-        efi->efi_memmap_size = map_sz;
+        p->efi->efi_systab = (unsigned long)sys_table_arg;
+        p->efi->efi_memdesc_size = *map->desc_size;
+        p->efi->efi_memdesc_version = *map->desc_ver;
+        p->efi->efi_memmap = (unsigned long)*map->map;
+        p->efi->efi_memmap_size = *map->map_size;
 
 #ifdef CONFIG_X86_64
-        efi->efi_systab_hi = (unsigned long)sys_table >> 32;
-        efi->efi_memmap_hi = (unsigned long)mem_map >> 32;
+        p->efi->efi_systab_hi = (unsigned long)sys_table_arg >> 32;
+        p->efi->efi_memmap_hi = (unsigned long)*map->map >> 32;
 #endif
 
+        return EFI_SUCCESS;
+}
+
+static efi_status_t exit_boot(struct boot_params *boot_params,
+                              void *handle, bool is64)
+{
+        unsigned long map_sz, key, desc_size, buff_size;
+        efi_memory_desc_t *mem_map;
+        struct setup_data *e820ext;
+        __u32 e820ext_size;
+        efi_status_t status;
+        __u32 desc_version;
+        struct efi_boot_memmap map;
+        struct exit_boot_struct priv;
+
+        map.map =               &mem_map;
+        map.map_size =          &map_sz;
+        map.desc_size =         &desc_size;
+        map.desc_ver =          &desc_version;
+        map.key_ptr =           &key;
+        map.buff_size =         &buff_size;
+        priv.boot_params =      boot_params;
+        priv.efi =              &boot_params->efi_info;
+        priv.e820ext =          NULL;
+        priv.e820ext_size =     0;
+        priv.is64 =             is64;
+
         /* Might as well exit boot services now */
-        status = efi_call_early(exit_boot_services, handle, key);
-        if (status != EFI_SUCCESS) {
-                /*
-                 * ExitBootServices() will fail if any of the event
-                 * handlers change the memory map. In which case, we
-                 * must be prepared to retry, but only once so that
-                 * we're guaranteed to exit on repeated failures instead
-                 * of spinning forever.
-                 */
-                if (called_exit)
-                        goto free_mem_map;
-
-                called_exit = true;
-                efi_call_early(free_pool, mem_map);
-                goto get_map;
-        }
+        status = efi_exit_boot_services(sys_table, handle, &map, &priv,
+                                        exit_boot_func);
+        if (status != EFI_SUCCESS)
+                return status;
 
+        e820ext = priv.e820ext;
+        e820ext_size = priv.e820ext_size;
         /* Historic? */
         boot_params->alt_mem_k = 32 * 1024;
 
@@ -1085,10 +1093,6 @@ get_map:
                 return status;
 
         return EFI_SUCCESS;
-
-free_mem_map:
-        efi_call_early(free_pool, mem_map);
-        return status;
 }
 
 /*
diff --git a/arch/x86/configs/tiny.config b/arch/x86/configs/tiny.config
index 4e2ecfa23c15..4b429df40d7a 100644
--- a/arch/x86/configs/tiny.config
+++ b/arch/x86/configs/tiny.config
@@ -1 +1,3 @@
 CONFIG_NOHIGHMEM=y
+# CONFIG_HIGHMEM4G is not set
+# CONFIG_HIGHMEM64G is not set
diff --git a/arch/x86/crypto/sha256-mb/sha256_mb.c b/arch/x86/crypto/sha256-mb/sha256_mb.c
index 89fa85e8b10c..6f97fb33ae21 100644
--- a/arch/x86/crypto/sha256-mb/sha256_mb.c
+++ b/arch/x86/crypto/sha256-mb/sha256_mb.c
@@ -485,10 +485,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
 
                         req = cast_mcryptd_ctx_to_req(req_ctx);
                         if (irqs_disabled())
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                         else {
                                 local_bh_disable();
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                                 local_bh_enable();
                         }
                 }
diff --git a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
index b691da981cd9..a78a0694ddef 100644
--- a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
+++ b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S
@@ -265,13 +265,14 @@ ENTRY(sha256_mb_mgr_get_comp_job_avx2)
         vpinsrd $1, _args_digest+1*32(state, idx, 4), %xmm0, %xmm0
         vpinsrd $2, _args_digest+2*32(state, idx, 4), %xmm0, %xmm0
         vpinsrd $3, _args_digest+3*32(state, idx, 4), %xmm0, %xmm0
-        movl    _args_digest+4*32(state, idx, 4), tmp2_w
+        vmovd   _args_digest(state , idx, 4) , %xmm0
         vpinsrd $1, _args_digest+5*32(state, idx, 4), %xmm1, %xmm1
         vpinsrd $2, _args_digest+6*32(state, idx, 4), %xmm1, %xmm1
         vpinsrd $3, _args_digest+7*32(state, idx, 4), %xmm1, %xmm1
 
-        vmovdqu %xmm0, _result_digest(job_rax)
-        movl    tmp2_w, _result_digest+1*16(job_rax)
+        vmovdqu %xmm0, _result_digest(job_rax)
+        offset =  (_result_digest + 1*16)
+        vmovdqu %xmm1, offset(job_rax)
 
         pop     %rbx
 
diff --git a/arch/x86/crypto/sha512-mb/sha512_mb.c b/arch/x86/crypto/sha512-mb/sha512_mb.c
index f4cf5b78fd36..d210174a52b0 100644
--- a/arch/x86/crypto/sha512-mb/sha512_mb.c
+++ b/arch/x86/crypto/sha512-mb/sha512_mb.c
@@ -497,10 +497,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
 
                         req = cast_mcryptd_ctx_to_req(req_ctx);
                         if (irqs_disabled())
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                         else {
                                 local_bh_disable();
-                                rctx->complete(&req->base, ret);
+                                req_ctx->complete(&req->base, ret);
                                 local_bh_enable();
                         }
                 }
diff --git a/arch/x86/entry/Makefile b/arch/x86/entry/Makefile
index fe91c25092da..77f28ce9c646 100644
--- a/arch/x86/entry/Makefile
+++ b/arch/x86/entry/Makefile
@@ -5,6 +5,8 @@
 OBJECT_FILES_NON_STANDARD_entry_$(BITS).o   := y
 OBJECT_FILES_NON_STANDARD_entry_64_compat.o := y
 
+CFLAGS_syscall_64.o             += -Wno-override-init
+CFLAGS_syscall_32.o             += -Wno-override-init
 obj-y                           := entry_$(BITS).o thunk_$(BITS).o syscall_$(BITS).o
 obj-y                           += common.o
 
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index b846875aeea6..d172c619c449 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -288,11 +288,15 @@ return_from_SYSCALL_64:
         jne     opportunistic_sysret_failed
 
         /*
-         * SYSRET can't restore RF.  SYSRET can restore TF, but unlike IRET,
-         * restoring TF results in a trap from userspace immediately after
-         * SYSRET.  This would cause an infinite loop whenever #DB happens
-         * with register state that satisfies the opportunistic SYSRET
-         * conditions.  For example, single-stepping this user code:
+         * SYSCALL clears RF when it saves RFLAGS in R11 and SYSRET cannot
+         * restore RF properly. If the slowpath sets it for whatever reason, we
+         * need to restore it correctly.
+         *
+         * SYSRET can restore TF, but unlike IRET, restoring TF results in a
+         * trap from userspace immediately after SYSRET.  This would cause an
+         * infinite loop whenever #DB happens with register state that satisfies
+         * the opportunistic SYSRET conditions.  For example, single-stepping
+         * this user code:
          *
          *           movq       $stuck_here, %rcx
          *           pushfq
@@ -601,9 +605,20 @@ apicinterrupt3 \num trace(\sym) smp_trace(\sym)
 .endm
 #endif
 
+/* Make sure APIC interrupt handlers end up in the irqentry section: */
+#if defined(CONFIG_FUNCTION_GRAPH_TRACER) || defined(CONFIG_KASAN)
+# define PUSH_SECTION_IRQENTRY  .pushsection .irqentry.text, "ax"
+# define POP_SECTION_IRQENTRY   .popsection
+#else
+# define PUSH_SECTION_IRQENTRY
+# define POP_SECTION_IRQENTRY
+#endif
+
 .macro apicinterrupt num sym do_sym
+PUSH_SECTION_IRQENTRY
 apicinterrupt3 \num \sym \do_sym
 trace_apicinterrupt \num \sym
+POP_SECTION_IRQENTRY
 .endm
 
 #ifdef CONFIG_SMP
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index e07a22bb9308..f5f4b3fbbbc2 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -119,8 +119,8 @@ static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =
 {
   [PERF_COUNT_HW_CPU_CYCLES]                    = 0x0076,
   [PERF_COUNT_HW_INSTRUCTIONS]                  = 0x00c0,
-  [PERF_COUNT_HW_CACHE_REFERENCES]              = 0x0080,
-  [PERF_COUNT_HW_CACHE_MISSES]                  = 0x0081,
+  [PERF_COUNT_HW_CACHE_REFERENCES]              = 0x077d,
+  [PERF_COUNT_HW_CACHE_MISSES]                  = 0x077e,
   [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]           = 0x00c2,
   [PERF_COUNT_HW_BRANCH_MISSES]                 = 0x00c3,
   [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]       = 0x00d0, /* "Decoder empty" event */
diff --git a/arch/x86/events/amd/uncore.c b/arch/x86/events/amd/uncore.c
index e6131d4454e6..65577f081d07 100644
--- a/arch/x86/events/amd/uncore.c
+++ b/arch/x86/events/amd/uncore.c
@@ -29,6 +29,8 @@
 
 #define COUNTER_SHIFT           16
 
+static HLIST_HEAD(uncore_unused_list);
+
 struct amd_uncore {
         int id;
         int refcnt;
@@ -39,7 +41,7 @@ struct amd_uncore {
         cpumask_t *active_mask;
         struct pmu *pmu;
         struct perf_event *events[MAX_COUNTERS];
-        struct amd_uncore *free_when_cpu_online;
+        struct hlist_node node;
 };
 
 static struct amd_uncore * __percpu *amd_uncore_nb;
@@ -306,6 +308,7 @@ static int amd_uncore_cpu_up_prepare(unsigned int cpu)
                 uncore_nb->msr_base = MSR_F15H_NB_PERF_CTL;
                 uncore_nb->active_mask = &amd_nb_active_mask;
                 uncore_nb->pmu = &amd_nb_pmu;
+                uncore_nb->id = -1;
                 *per_cpu_ptr(amd_uncore_nb, cpu) = uncore_nb;
         }
 
@@ -319,6 +322,7 @@ static int amd_uncore_cpu_up_prepare(unsigned int cpu)
                 uncore_l2->msr_base = MSR_F16H_L2I_PERF_CTL;
                 uncore_l2->active_mask = &amd_l2_active_mask;
                 uncore_l2->pmu = &amd_l2_pmu;
+                uncore_l2->id = -1;
                 *per_cpu_ptr(amd_uncore_l2, cpu) = uncore_l2;
         }
 
@@ -348,7 +352,7 @@ amd_uncore_find_online_sibling(struct amd_uncore *this,
                         continue;
 
                 if (this->id == that->id) {
-                        that->free_when_cpu_online = this;
+                        hlist_add_head(&this->node, &uncore_unused_list);
                         this = that;
                         break;
                 }
@@ -388,13 +392,23 @@ static int amd_uncore_cpu_starting(unsigned int cpu)
         return 0;
 }
 
+static void uncore_clean_online(void)
+{
+        struct amd_uncore *uncore;
+        struct hlist_node *n;
+
+        hlist_for_each_entry_safe(uncore, n, &uncore_unused_list, node) {
+                hlist_del(&uncore->node);
+                kfree(uncore);
+        }
+}
+
 static void uncore_online(unsigned int cpu,
                           struct amd_uncore * __percpu *uncores)
 {
         struct amd_uncore *uncore = *per_cpu_ptr(uncores, cpu);
 
-        kfree(uncore->free_when_cpu_online);
-        uncore->free_when_cpu_online = NULL;
+        uncore_clean_online();
 
         if (cpu == uncore->cpu)
                 cpumask_set_cpu(cpu, uncore->active_mask);
diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index 0a6e393a2e62..982c9e31daca 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -31,7 +31,17 @@
 struct bts_ctx {
         struct perf_output_handle       handle;
         struct debug_store              ds_back;
-        int                             started;
+        int                             state;
+};
+
+/* BTS context states: */
+enum {
+        /* no ongoing AUX transactions */
+        BTS_STATE_STOPPED = 0,
+        /* AUX transaction is on, BTS tracing is disabled */
+        BTS_STATE_INACTIVE,
+        /* AUX transaction is on, BTS tracing is running */
+        BTS_STATE_ACTIVE,
 };
 
 static DEFINE_PER_CPU(struct bts_ctx, bts_ctx);
@@ -204,6 +214,15 @@ static void bts_update(struct bts_ctx *bts)
 static int
 bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle);
 
+/*
+ * Ordering PMU callbacks wrt themselves and the PMI is done by means
+ * of bts::state, which:
+ *  - is set when bts::handle::event is valid, that is, between
+ *    perf_aux_output_begin() and perf_aux_output_end();
+ *  - is zero otherwise;
+ *  - is ordered against bts::handle::event with a compiler barrier.
+ */
+
 static void __bts_event_start(struct perf_event *event)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
@@ -221,10 +240,13 @@ static void __bts_event_start(struct perf_event *event)
 
         /*
          * local barrier to make sure that ds configuration made it
-         * before we enable BTS
+         * before we enable BTS and bts::state goes ACTIVE
          */
         wmb();
 
+        /* INACTIVE/STOPPED -> ACTIVE */
+        WRITE_ONCE(bts->state, BTS_STATE_ACTIVE);
+
         intel_pmu_enable_bts(config);
 
 }
@@ -251,9 +273,6 @@ static void bts_event_start(struct perf_event *event, int flags)
 
         __bts_event_start(event);
 
-        /* PMI handler: this counter is running and likely generating PMIs */
-        ACCESS_ONCE(bts->started) = 1;
-
         return;
 
 fail_end_stop:
@@ -263,30 +282,34 @@ fail_stop:
         event->hw.state = PERF_HES_STOPPED;
 }
 
-static void __bts_event_stop(struct perf_event *event)
+static void __bts_event_stop(struct perf_event *event, int state)
 {
+        struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
+
+        /* ACTIVE -> INACTIVE(PMI)/STOPPED(->stop()) */
+        WRITE_ONCE(bts->state, state);
+
         /*
          * No extra synchronization is mandated by the documentation to have
          * BTS data stores globally visible.
          */
         intel_pmu_disable_bts();
-
-        if (event->hw.state & PERF_HES_STOPPED)
-                return;
-
-        ACCESS_ONCE(event->hw.state) |= PERF_HES_STOPPED;
 }
 
 static void bts_event_stop(struct perf_event *event, int flags)
 {
         struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
-        struct bts_buffer *buf = perf_get_aux(&bts->handle);
+        struct bts_buffer *buf = NULL;
+        int state = READ_ONCE(bts->state);
 
-        /* PMI handler: don't restart this counter */
-        ACCESS_ONCE(bts->started) = 0;
+        if (state == BTS_STATE_ACTIVE)
+                __bts_event_stop(event, BTS_STATE_STOPPED);
 
-        __bts_event_stop(event);
+        if (state != BTS_STATE_STOPPED)
+                buf = perf_get_aux(&bts->handle);
+
+        event->hw.state |= PERF_HES_STOPPED;
 
         if (flags & PERF_EF_UPDATE) {
                 bts_update(bts);
@@ -296,6 +319,7 @@ static void bts_event_stop(struct perf_event *event, int flags)
                                 bts->handle.head =
                                         local_xchg(&buf->data_size,
                                                    buf->nr_pages << PAGE_SHIFT);
+
                         perf_aux_output_end(&bts->handle, local_xchg(&buf->data_size, 0),
                                             !!local_xchg(&buf->lost, 0));
                 }
@@ -310,8 +334,20 @@ static void bts_event_stop(struct perf_event *event, int flags)
 void intel_bts_enable_local(void)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
+        int state = READ_ONCE(bts->state);
+
+        /*
+         * Here we transition from INACTIVE to ACTIVE;
+         * if we instead are STOPPED from the interrupt handler,
+         * stay that way. Can't be ACTIVE here though.
+         */
+        if (WARN_ON_ONCE(state == BTS_STATE_ACTIVE))
+                return;
+
+        if (state == BTS_STATE_STOPPED)
+                return;
 
-        if (bts->handle.event && bts->started)
+        if (bts->handle.event)
                 __bts_event_start(bts->handle.event);
 }
 
@@ -319,8 +355,15 @@ void intel_bts_disable_local(void)
 {
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
 
+        /*
+         * Here we transition from ACTIVE to INACTIVE;
+         * do nothing for STOPPED or INACTIVE.
+         */
+        if (READ_ONCE(bts->state) != BTS_STATE_ACTIVE)
+                return;
+
         if (bts->handle.event)
-                __bts_event_stop(bts->handle.event);
+                __bts_event_stop(bts->handle.event, BTS_STATE_INACTIVE);
 }
 
 static int
@@ -335,8 +378,6 @@ bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle)
                 return 0;
 
         head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1);
-        if (WARN_ON_ONCE(head != local_read(&buf->head)))
-                return -EINVAL;
 
         phys = &buf->buf[buf->cur_buf];
         space = phys->offset + phys->displacement + phys->size - head;
@@ -403,22 +444,37 @@ bts_buffer_reset(struct bts_buffer *buf, struct perf_output_handle *handle)
 
 int intel_bts_interrupt(void)
 {
+        struct debug_store *ds = this_cpu_ptr(&cpu_hw_events)->ds;
         struct bts_ctx *bts = this_cpu_ptr(&bts_ctx);
         struct perf_event *event = bts->handle.event;
         struct bts_buffer *buf;
         s64 old_head;
-        int err;
+        int err = -ENOSPC, handled = 0;
 
-        if (!event || !bts->started)
-                return 0;
+        /*
+         * The only surefire way of knowing if this NMI is ours is by checking
+         * the write ptr against the PMI threshold.
+         */
+        if (ds && (ds->bts_index >= ds->bts_interrupt_threshold))
+                handled = 1;
+
+        /*
+         * this is wrapped in intel_bts_enable_local/intel_bts_disable_local,
+         * so we can only be INACTIVE or STOPPED
+         */
+        if (READ_ONCE(bts->state) == BTS_STATE_STOPPED)
+                return handled;
 
         buf = perf_get_aux(&bts->handle);
+        if (!buf)
+                return handled;
+
         /*
          * Skip snapshot counters: they don't use the interrupt, but
          * there's no other way of telling, because the pointer will
          * keep moving
          */
-        if (!buf || buf->snapshot)
+        if (buf->snapshot)
                 return 0;
 
         old_head = local_read(&buf->head);
@@ -426,18 +482,27 @@ int intel_bts_interrupt(void)
 
         /* no new data */
         if (old_head == local_read(&buf->head))
-                return 0;
+                return handled;
 
         perf_aux_output_end(&bts->handle, local_xchg(&buf->data_size, 0),
                             !!local_xchg(&buf->lost, 0));
 
         buf = perf_aux_output_begin(&bts->handle, event);
-        if (!buf)
-                return 1;
+        if (buf)
+                err = bts_buffer_reset(buf, &bts->handle);
+
+        if (err) {
+                WRITE_ONCE(bts->state, BTS_STATE_STOPPED);
 
-        err = bts_buffer_reset(buf, &bts->handle);
-        if (err)
-                perf_aux_output_end(&bts->handle, 0, false);
+                if (buf) {
+                        /*
+                         * BTS_STATE_STOPPED should be visible before
+                         * cleared handle::event
+                         */
+                        barrier();
+                        perf_aux_output_end(&bts->handle, 0, false);
+                }
+        }
 
         return 1;
 }
@@ -519,7 +584,8 @@ static __init int bts_init(void)
         if (!boot_cpu_has(X86_FEATURE_DTES64) || !x86_pmu.bts)
                 return -ENODEV;
 
-        bts_pmu.capabilities    = PERF_PMU_CAP_AUX_NO_SG | PERF_PMU_CAP_ITRACE;
+        bts_pmu.capabilities    = PERF_PMU_CAP_AUX_NO_SG | PERF_PMU_CAP_ITRACE |
+                                  PERF_PMU_CAP_EXCLUSIVE;
         bts_pmu.task_ctx_nr     = perf_sw_context;
         bts_pmu.event_init      = bts_event_init;
         bts_pmu.add             = bts_event_add;
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 2cbde2f449aa..4c9a79b9cd69 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -1730,9 +1730,11 @@ static __initconst const u64 knl_hw_cache_extra_regs
  * disabled state if called consecutively.
  *
  * During consecutive calls, the same disable value will be written to related
- * registers, so the PMU state remains unchanged. hw.state in
- * intel_bts_disable_local will remain PERF_HES_STOPPED too in consecutive
- * calls.
+ * registers, so the PMU state remains unchanged.
+ *
+ * intel_bts events don't coexist with intel PMU's BTS events because of
+ * x86_add_exclusive(x86_lbr_exclusive_lbr); there's no need to keep them
+ * disabled around intel PMU's event batching etc, only inside the PMI handler.
  */
 static void __intel_pmu_disable_all(void)
 {
@@ -1742,8 +1744,6 @@ static void __intel_pmu_disable_all(void)
 
         if (test_bit(INTEL_PMC_IDX_FIXED_BTS, cpuc->active_mask))
                 intel_pmu_disable_bts();
-        else
-                intel_bts_disable_local();
 
         intel_pmu_pebs_disable_all();
 }
@@ -1771,8 +1771,7 @@ static void __intel_pmu_enable_all(int added, bool pmi)
                         return;
 
                 intel_pmu_enable_bts(event->hw.config);
-        } else
-                intel_bts_enable_local();
+        }
 }
 
 static void intel_pmu_enable_all(int added)
@@ -2073,6 +2072,7 @@ static int intel_pmu_handle_irq(struct pt_regs *regs)
          */
         if (!x86_pmu.late_ack)
                 apic_write(APIC_LVTPC, APIC_DM_NMI);
+        intel_bts_disable_local();
         __intel_pmu_disable_all();
         handled = intel_pmu_drain_bts_buffer();
         handled += intel_bts_interrupt();
@@ -2172,6 +2172,7 @@ done:
         /* Only restore PMU state when it's active. See x86_pmu_disable(). */
         if (cpuc->enabled)
                 __intel_pmu_enable_all(0, true);
+        intel_bts_enable_local();
 
         /*
          * Only unmask the NMI after the overflow counters
diff --git a/arch/x86/events/intel/cqm.c b/arch/x86/events/intel/cqm.c
index 783c49ddef29..8f82b02934fa 100644
--- a/arch/x86/events/intel/cqm.c
+++ b/arch/x86/events/intel/cqm.c
@@ -458,6 +458,11 @@ static void __intel_cqm_event_count(void *info);
 static void init_mbm_sample(u32 rmid, u32 evt_type);
 static void __intel_mbm_event_count(void *info);
 
+static bool is_cqm_event(int e)
+{
+        return (e == QOS_L3_OCCUP_EVENT_ID);
+}
+
 static bool is_mbm_event(int e)
 {
         return (e >= QOS_MBM_TOTAL_EVENT_ID && e <= QOS_MBM_LOCAL_EVENT_ID);
@@ -1366,6 +1371,10 @@ static int intel_cqm_event_init(struct perf_event *event)
              (event->attr.config > QOS_MBM_LOCAL_EVENT_ID))
                 return -EINVAL;
 
+        if ((is_cqm_event(event->attr.config) && !cqm_enabled) ||
+            (is_mbm_event(event->attr.config) && !mbm_enabled))
+                return -EINVAL;
+
         /* unsupported modes and filters */
         if (event->attr.exclude_user   ||
             event->attr.exclude_kernel ||
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 7ce9f3f669e6..9b983a474253 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1274,18 +1274,18 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
                 struct pebs_record_nhm *p = at;
                 u64 pebs_status;
 
-                /* PEBS v3 has accurate status bits */
+                pebs_status = p->status & cpuc->pebs_enabled;
+                pebs_status &= (1ULL << x86_pmu.max_pebs_events) - 1;
+
+                /* PEBS v3 has more accurate status bits */
                 if (x86_pmu.intel_cap.pebs_format >= 3) {
-                        for_each_set_bit(bit, (unsigned long *)&p->status,
-                                         MAX_PEBS_EVENTS)
+                        for_each_set_bit(bit, (unsigned long *)&pebs_status,
+                                         x86_pmu.max_pebs_events)
                                 counts[bit]++;
 
                         continue;
                 }
 
-                pebs_status = p->status & cpuc->pebs_enabled;
-                pebs_status &= (1ULL << x86_pmu.max_pebs_events) - 1;
-
                 /*
                  * On some CPUs the PEBS status can be zero when PEBS is
                  * racing with clearing of GLOBAL_STATUS.
@@ -1333,8 +1333,11 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs)
                         continue;
 
                 event = cpuc->events[bit];
-                WARN_ON_ONCE(!event);
-                WARN_ON_ONCE(!event->attr.precise_ip);
+                if (WARN_ON_ONCE(!event))
+                        continue;
+
+                if (WARN_ON_ONCE(!event->attr.precise_ip))
+                        continue;
 
                 /* log dropped samples number */
                 if (error[bit])
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 04bb5fb5a8d7..861a7d9cb60f 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1074,6 +1074,11 @@ static void pt_addr_filters_fini(struct perf_event *event)
         event->hw.addr_filters = NULL;
 }
 
+static inline bool valid_kernel_ip(unsigned long ip)
+{
+        return virt_addr_valid(ip) && kernel_ip(ip);
+}
+
 static int pt_event_addr_filters_validate(struct list_head *filters)
 {
         struct perf_addr_filter *filter;
@@ -1081,11 +1086,16 @@ static int pt_event_addr_filters_validate(struct list_head *filters)
 
         list_for_each_entry(filter, filters, entry) {
                 /* PT doesn't support single address triggers */
-                if (!filter->range)
+                if (!filter->range || !filter->size)
                         return -EOPNOTSUPP;
 
-                if (!filter->inode && !kernel_ip(filter->offset))
-                        return -EINVAL;
+                if (!filter->inode) {
+                        if (!valid_kernel_ip(filter->offset))
+                                return -EINVAL;
+
+                        if (!valid_kernel_ip(filter->offset + filter->size))
+                                return -EINVAL;
+                }
 
                 if (++range > pt_cap_get(PT_CAP_num_address_ranges))
                         return -EOPNOTSUPP;
@@ -1111,7 +1121,7 @@ static void pt_event_addr_filters_sync(struct perf_event *event)
                 } else {
                         /* apply the offset */
                         msr_a = filter->offset + offs[range];
-                        msr_b = filter->size + msr_a;
+                        msr_b = filter->size + msr_a - 1;
                 }
 
                 filters->filter[range].msr_a  = msr_a;
diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
index 97a69dbba649..9d35ec0cb8fc 100644
--- a/arch/x86/events/intel/uncore_snb.c
+++ b/arch/x86/events/intel/uncore_snb.c
@@ -100,6 +100,12 @@ static void snb_uncore_msr_init_box(struct intel_uncore_box *box)
         }
 }
 
+static void snb_uncore_msr_enable_box(struct intel_uncore_box *box)
+{
+        wrmsrl(SNB_UNC_PERF_GLOBAL_CTL,
+                SNB_UNC_GLOBAL_CTL_EN | SNB_UNC_GLOBAL_CTL_CORE_ALL);
+}
+
 static void snb_uncore_msr_exit_box(struct intel_uncore_box *box)
 {
         if (box->pmu->pmu_idx == 0)
@@ -127,6 +133,7 @@ static struct attribute_group snb_uncore_format_group = {
 
 static struct intel_uncore_ops snb_uncore_msr_ops = {
         .init_box       = snb_uncore_msr_init_box,
+        .enable_box     = snb_uncore_msr_enable_box,
         .exit_box       = snb_uncore_msr_exit_box,
         .disable_event  = snb_uncore_msr_disable_event,
         .enable_event   = snb_uncore_msr_enable_event,
@@ -192,6 +199,12 @@ static void skl_uncore_msr_init_box(struct intel_uncore_box *box)
         }
 }
 
+static void skl_uncore_msr_enable_box(struct intel_uncore_box *box)
+{
+        wrmsrl(SKL_UNC_PERF_GLOBAL_CTL,
+                SNB_UNC_GLOBAL_CTL_EN | SKL_UNC_GLOBAL_CTL_CORE_ALL);
+}
+
 static void skl_uncore_msr_exit_box(struct intel_uncore_box *box)
 {
         if (box->pmu->pmu_idx == 0)
@@ -200,6 +213,7 @@ static void skl_uncore_msr_exit_box(struct intel_uncore_box *box)
 
 static struct intel_uncore_ops skl_uncore_msr_ops = {
         .init_box       = skl_uncore_msr_init_box,
+        .enable_box     = skl_uncore_msr_enable_box,
         .exit_box       = skl_uncore_msr_exit_box,
         .disable_event  = snb_uncore_msr_disable_event,
         .enable_event   = snb_uncore_msr_enable_event,
diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
index 824e54086e07..8aee83bcf71f 100644
--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -2626,7 +2626,7 @@ void hswep_uncore_cpu_init(void)
 
 static struct intel_uncore_type hswep_uncore_ha = {
         .name           = "ha",
-        .num_counters   = 5,
+        .num_counters   = 4,
         .num_boxes      = 2,
         .perf_ctr_bits  = 48,
         SNBEP_UNCORE_PCI_COMMON_INIT(),
@@ -2645,7 +2645,7 @@ static struct uncore_event_desc hswep_uncore_imc_events[] = {
 
 static struct intel_uncore_type hswep_uncore_imc = {
         .name           = "imc",
-        .num_counters   = 5,
+        .num_counters   = 4,
         .num_boxes      = 8,
         .perf_ctr_bits  = 48,
         .fixed_ctr_bits = 48,
@@ -2691,7 +2691,7 @@ static struct intel_uncore_type hswep_uncore_irp = {
 
 static struct intel_uncore_type hswep_uncore_qpi = {
         .name                   = "qpi",
-        .num_counters           = 5,
+        .num_counters           = 4,
         .num_boxes              = 3,
         .perf_ctr_bits          = 48,
         .perf_ctr               = SNBEP_PCI_PMON_CTR0,
@@ -2773,7 +2773,7 @@ static struct event_constraint hswep_uncore_r3qpi_constraints[] = {
 
 static struct intel_uncore_type hswep_uncore_r3qpi = {
         .name           = "r3qpi",
-        .num_counters   = 4,
+        .num_counters   = 3,
         .num_boxes      = 3,
         .perf_ctr_bits  = 44,
         .constraints    = hswep_uncore_r3qpi_constraints,
@@ -2972,7 +2972,7 @@ static struct intel_uncore_type bdx_uncore_ha = {
 
 static struct intel_uncore_type bdx_uncore_imc = {
         .name           = "imc",
-        .num_counters   = 5,
+        .num_counters   = 4,
         .num_boxes      = 8,
         .perf_ctr_bits  = 48,
         .fixed_ctr_bits = 48,
diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index f5befd4945f2..124357773ffa 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -135,6 +135,7 @@ extern void init_apic_mappings(void);
 void register_lapic_address(unsigned long address);
 extern void setup_boot_APIC_clock(void);
 extern void setup_secondary_APIC_clock(void);
+extern void lapic_update_tsc_freq(void);
 extern int APIC_init_uniprocessor(void);
 
 #ifdef CONFIG_X86_64
@@ -170,6 +171,7 @@ static inline void init_apic_mappings(void) { }
 static inline void disable_local_APIC(void) { }
 # define setup_boot_APIC_clock x86_init_noop
 # define setup_secondary_APIC_clock x86_init_noop
+static inline void lapic_update_tsc_freq(void) { }
 #endif /* !CONFIG_X86_LOCAL_APIC */
 
 #ifdef CONFIG_X86_X2APIC
diff --git a/arch/x86/include/asm/hardirq.h b/arch/x86/include/asm/hardirq.h
index 7178043b0e1d..59405a248fc2 100644
--- a/arch/x86/include/asm/hardirq.h
+++ b/arch/x86/include/asm/hardirq.h
@@ -22,10 +22,6 @@ typedef struct {
 #ifdef CONFIG_SMP
         unsigned int irq_resched_count;
         unsigned int irq_call_count;
-        /*
-         * irq_tlb_count is double-counted in irq_call_count, so it must be
-         * subtracted from irq_call_count when displaying irq_call_count
-         */
         unsigned int irq_tlb_count;
 #endif
 #ifdef CONFIG_X86_THERMAL_VECTOR
diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
index 223042086f4e..737da62bfeb0 100644
--- a/arch/x86/include/asm/init.h
+++ b/arch/x86/include/asm/init.h
@@ -5,10 +5,10 @@ struct x86_mapping_info {
         void *(*alloc_pgt_page)(void *); /* allocate buf for page table */
         void *context;                   /* context for alloc_pgt_page */
         unsigned long pmd_flag;          /* page flag for PMD entry */
-        bool kernel_mapping;             /* kernel mapping or ident mapping */
+        unsigned long offset;            /* ident mapping offset */
 };
 
 int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page,
-                                unsigned long addr, unsigned long end);
+                                unsigned long pstart, unsigned long pend);
 
 #endif /* _ASM_X86_INIT_H */
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index 7e8ec7ae10fa..1cc82ece9ac1 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -145,7 +145,7 @@ static inline int pgd_large(pgd_t pgd) { return 0; }
  *
  * |     ...            | 11| 10|  9|8|7|6|5| 4| 3|2|1|0| <- bit number
  * |     ...            |SW3|SW2|SW1|G|L|D|A|CD|WT|U|W|P| <- bit names
- * | OFFSET (14->63) | TYPE (10-13) |0|X|X|X| X| X|X|X|0| <- swp entry
+ * | OFFSET (14->63) | TYPE (9-13)  |0|X|X|X| X| X|X|X|0| <- swp entry
  *
  * G (8) is aliased and used as a PROT_NONE indicator for
  * !present ptes.  We need to start storing swap entries above
@@ -156,7 +156,7 @@ static inline int pgd_large(pgd_t pgd) { return 0; }
 #define SWP_TYPE_FIRST_BIT (_PAGE_BIT_PROTNONE + 1)
 #define SWP_TYPE_BITS 5
 /* Place the offset above the type: */
-#define SWP_OFFSET_FIRST_BIT (SWP_TYPE_FIRST_BIT + SWP_TYPE_BITS + 1)
+#define SWP_OFFSET_FIRST_BIT (SWP_TYPE_FIRST_BIT + SWP_TYPE_BITS)
 
 #define MAX_SWAPFILES_CHECK() BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > SWP_TYPE_BITS)
 
diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h
index 9c6b890d5e7a..b2988c0ed829 100644
--- a/arch/x86/include/asm/realmode.h
+++ b/arch/x86/include/asm/realmode.h
@@ -58,7 +58,15 @@ extern unsigned char boot_gdt[];
 extern unsigned char secondary_startup_64[];
 #endif
 
+static inline size_t real_mode_size_needed(void)
+{
+        if (real_mode_header)
+                return 0;       /* already allocated. */
+
+        return ALIGN(real_mode_blob_end - real_mode_blob, PAGE_SIZE);
+}
+
+void set_real_mode_mem(phys_addr_t mem, size_t size);
 void reserve_real_mode(void);
-void setup_real_mode(void);
 
 #endif /* _ARCH_X86_REALMODE_H */
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 84b59846154a..8b7c8d8e0852 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -176,6 +176,50 @@ static inline unsigned long current_stack_pointer(void)
         return sp;
 }
 
+/*
+ * Walks up the stack frames to make sure that the specified object is
+ * entirely contained by a single stack frame.
+ *
+ * Returns:
+ *               1 if within a frame
+ *              -1 if placed across a frame boundary (or outside stack)
+ *               0 unable to determine (no frame pointers, etc)
+ */
+static inline int arch_within_stack_frames(const void * const stack,
+                                           const void * const stackend,
+                                           const void *obj, unsigned long len)
+{
+#if defined(CONFIG_FRAME_POINTER)
+        const void *frame = NULL;
+        const void *oldframe;
+
+        oldframe = __builtin_frame_address(1);
+        if (oldframe)
+                frame = __builtin_frame_address(2);
+        /*
+         * low ----------------------------------------------> high
+         * [saved bp][saved ip][args][local vars][saved bp][saved ip]
+         *                     ^----------------^
+         *               allow copies only within here
+         */
+        while (stack <= frame && frame < stackend) {
+                /*
+                 * If obj + len extends past the last frame, this
+                 * check won't pass and the next frame will be 0,
+                 * causing us to bail out and correctly report
+                 * the copy as invalid.
+                 */
+                if (obj + len <= frame)
+                        return obj >= oldframe + 2 * sizeof(void *) ? 1 : -1;
+                oldframe = frame;
+                frame = *(const void * const *)frame;
+        }
+        return -1;
+#else
+        return 0;
+#endif
+}
+
 #else /* !__ASSEMBLY__ */
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 4e5be94e079a..6fa85944af83 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -135,7 +135,14 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
 
 static inline void __native_flush_tlb(void)
 {
+        /*
+         * If current->mm == NULL then we borrow a mm which may change during a
+         * task switch and therefore we must not be preempted while we write CR3
+         * back:
+         */
+        preempt_disable();
         native_write_cr3(native_read_cr3());
+        preempt_enable();
 }
 
 static inline void __native_flush_tlb_global_irq_disabled(void)
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index c03bfb68c503..2131c4ce7d8a 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -433,7 +433,11 @@ do {									\
 #define __get_user_asm_ex(x, addr, itype, rtype, ltype)                 \
         asm volatile("1:        mov"itype" %1,%"rtype"0\n"              \
                      "2:\n"                                             \
-                     _ASM_EXTABLE_EX(1b, 2b)                            \
+                     ".section .fixup,\"ax\"\n"                         \
+                     "3:xor"itype" %"rtype"0,%"rtype"0\n"               \
+                     "  jmp 2b\n"                                       \
+                     ".previous\n"                                      \
+                     _ASM_EXTABLE_EX(1b, 3b)                            \
                      : ltype(x) : "m" (__m(addr)))
 
 #define __put_user_nocheck(x, ptr, size)                        \
@@ -697,44 +701,15 @@ unsigned long __must_check _copy_from_user(void *to, const void __user *from,
 unsigned long __must_check _copy_to_user(void __user *to, const void *from,
                                          unsigned n);
 
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-# define copy_user_diag __compiletime_error
-#else
-# define copy_user_diag __compiletime_warning
-#endif
-
-extern void copy_user_diag("copy_from_user() buffer size is too small")
-copy_from_user_overflow(void);
-extern void copy_user_diag("copy_to_user() buffer size is too small")
-copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
-
-#undef copy_user_diag
-
-#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-
-extern void
-__compiletime_warning("copy_from_user() buffer size is not provably correct")
-__copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
-#define __copy_from_user_overflow(size, count) __copy_from_user_overflow()
-
-extern void
-__compiletime_warning("copy_to_user() buffer size is not provably correct")
-__copy_to_user_overflow(void) __asm__("copy_from_user_overflow");
-#define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
-
-#else
+extern void __compiletime_error("usercopy buffer size is too small")
+__bad_copy_user(void);
 
-static inline void
-__copy_from_user_overflow(int size, unsigned long count)
+static inline void copy_user_overflow(int size, unsigned long count)
 {
         WARN(1, "Buffer overflow detected (%d < %lu)!\n", size, count);
 }
 
-#define __copy_to_user_overflow __copy_from_user_overflow
-
-#endif
-
-static inline unsigned long __must_check
+static __always_inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         int sz = __compiletime_object_size(to);
@@ -743,35 +718,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
 
         kasan_check_write(to, n);
 
-        /*
-         * While we would like to have the compiler do the checking for us
-         * even in the non-constant size case, any false positives there are
-         * a problem (especially when DEBUG_STRICT_USER_COPY_CHECKS, but even
-         * without - the [hopefully] dangerous looking nature of the warning
-         * would make people go look at the respecitive call sites over and
-         * over again just to find that there's no problem).
-         *
-         * And there are cases where it's just not realistic for the compiler
-         * to prove the count to be in range. For example when multiple call
-         * sites of a helper function - perhaps in different source files -
-         * all doing proper range checking, yet the helper function not doing
-         * so again.
-         *
-         * Therefore limit the compile time checking to the constant size
-         * case, and do only runtime checking for non-constant sizes.
-         */
-
-        if (likely(sz < 0 || sz >= n))
+        if (likely(sz < 0 || sz >= n)) {
+                check_object_size(to, n, false);
                 n = _copy_from_user(to, from, n);
-        else if(__builtin_constant_p(n))
-                copy_from_user_overflow();
+        } else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
         else
-                __copy_from_user_overflow(sz, n);
+                __bad_copy_user();
 
         return n;
 }
 
-static inline unsigned long __must_check
+static __always_inline unsigned long __must_check
 copy_to_user(void __user *to, const void *from, unsigned long n)
 {
         int sz = __compiletime_object_size(from);
@@ -780,20 +738,17 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
 
         might_fault();
 
-        /* See the comment in copy_from_user() above. */
-        if (likely(sz < 0 || sz >= n))
+        if (likely(sz < 0 || sz >= n)) {
+                check_object_size(from, n, true);
                 n = _copy_to_user(to, from, n);
-        else if(__builtin_constant_p(n))
-                copy_to_user_overflow();
+        } else if (!__builtin_constant_p(n))
+                copy_user_overflow(sz, n);
         else
-                __copy_to_user_overflow(sz, n);
+                __bad_copy_user();
 
         return n;
 }
 
-#undef __copy_from_user_overflow
-#undef __copy_to_user_overflow
-
 /*
  * We rely on the nested NMI work to allow atomic faults from the NMI path; the
  * nested NMI paths are careful to preserve CR2.
@@ -812,21 +767,21 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
 #define user_access_begin()     __uaccess_begin()
 #define user_access_end()       __uaccess_end()
 
-#define unsafe_put_user(x, ptr)                                         \
-({                                                                              \
+#define unsafe_put_user(x, ptr, err_label)                                      \
+do {                                                                            \
         int __pu_err;                                                           \
         __put_user_size((x), (ptr), sizeof(*(ptr)), __pu_err, -EFAULT);         \
-        __builtin_expect(__pu_err, 0);                                          \
-})
+        if (unlikely(__pu_err)) goto err_label;                                 \
+} while (0)
 
-#define unsafe_get_user(x, ptr)                                         \
-({                                                                              \
+#define unsafe_get_user(x, ptr, err_label)                                      \
+do {                                                                            \
         int __gu_err;                                                           \
         unsigned long __gu_val;                                                 \
         __get_user_size(__gu_val, (ptr), sizeof(*(ptr)), __gu_err, -EFAULT);    \
         (x) = (__force __typeof__(*(ptr)))__gu_val;                             \
-        __builtin_expect(__gu_err, 0);                                          \
-})
+        if (unlikely(__gu_err)) goto err_label;                                 \
+} while (0)
 
 #endif /* _ASM_X86_UACCESS_H */
 
diff --git a/arch/x86/include/asm/uaccess_32.h b/arch/x86/include/asm/uaccess_32.h
index 4b32da24faaf..7d3bdd1ed697 100644
--- a/arch/x86/include/asm/uaccess_32.h
+++ b/arch/x86/include/asm/uaccess_32.h
@@ -37,6 +37,7 @@ unsigned long __must_check __copy_from_user_ll_nocache_nozero
 static __always_inline unsigned long __must_check
 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
 {
+        check_object_size(from, n, true);
         return __copy_to_user_ll(to, from, n);
 }
 
@@ -95,6 +96,7 @@ static __always_inline unsigned long
 __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
         might_fault();
+        check_object_size(to, n, false);
         if (__builtin_constant_p(n)) {
                 unsigned long ret;
 
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 2eac2aa3e37f..673059a109fe 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -54,6 +54,7 @@ int __copy_from_user_nocheck(void *dst, const void __user *src, unsigned size)
 {
         int ret = 0;
 
+        check_object_size(dst, size, false);
         if (!__builtin_constant_p(size))
                 return copy_user_generic(dst, (__force void *)src, size);
         switch (size) {
@@ -119,6 +120,7 @@ int __copy_to_user_nocheck(void __user *dst, const void *src, unsigned size)
 {
         int ret = 0;
 
+        check_object_size(src, size, true);
         if (!__builtin_constant_p(size))
                 return copy_user_generic((__force void *)dst, src, size);
         switch (size) {
diff --git a/arch/x86/include/asm/uv/bios.h b/arch/x86/include/asm/uv/bios.h
index c852590254d5..e652a7cc6186 100644
--- a/arch/x86/include/asm/uv/bios.h
+++ b/arch/x86/include/asm/uv/bios.h
@@ -79,7 +79,7 @@ struct uv_gam_range_entry {
         u16     nasid;          /* HNasid */
         u16     sockid;         /* Socket ID, high bits of APIC ID */
         u16     pnode;          /* Index to MMR and GRU spaces */
-        u32     pxm;            /* ACPI proximity domain number */
+        u32     unused2;
         u32     limit;          /* PA bits 56:26 (UV_GAM_RANGE_SHFT) */
 };
 
@@ -88,7 +88,8 @@ struct uv_gam_range_entry {
 #define UV_SYSTAB_VERSION_UV4           0x400   /* UV4 BIOS base version */
 #define UV_SYSTAB_VERSION_UV4_1         0x401   /* + gpa_shift */
 #define UV_SYSTAB_VERSION_UV4_2         0x402   /* + TYPE_NVRAM/WINDOW/MBOX */
-#define UV_SYSTAB_VERSION_UV4_LATEST    UV_SYSTAB_VERSION_UV4_2
+#define UV_SYSTAB_VERSION_UV4_3         0x403   /* - GAM Range PXM Value */
+#define UV_SYSTAB_VERSION_UV4_LATEST    UV_SYSTAB_VERSION_UV4_3
 
 #define UV_SYSTAB_TYPE_UNUSED           0       /* End of table (offset == 0) */
 #define UV_SYSTAB_TYPE_GAM_PARAMS       1       /* GAM PARAM conversions */
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index 20abd912f0e4..f3e9b2df4b16 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -313,7 +313,7 @@ int lapic_get_maxlvt(void)
 
 /* Clock divisor */
 #define APIC_DIVISOR 16
-#define TSC_DIVISOR  32
+#define TSC_DIVISOR  8
 
 /*
  * This function sets up the local APIC timer, with a timeout of
@@ -565,13 +565,37 @@ static void setup_APIC_timer(void)
                                     CLOCK_EVT_FEAT_DUMMY);
                 levt->set_next_event = lapic_next_deadline;
                 clockevents_config_and_register(levt,
-                                                (tsc_khz / TSC_DIVISOR) * 1000,
+                                                tsc_khz * (1000 / TSC_DIVISOR),
                                                 0xF, ~0UL);
         } else
                 clockevents_register_device(levt);
 }
 
 /*
+ * Install the updated TSC frequency from recalibration at the TSC
+ * deadline clockevent devices.
+ */
+static void __lapic_update_tsc_freq(void *info)
+{
+        struct clock_event_device *levt = this_cpu_ptr(&lapic_events);
+
+        if (!this_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER))
+                return;
+
+        clockevents_update_freq(levt, tsc_khz * (1000 / TSC_DIVISOR));
+}
+
+void lapic_update_tsc_freq(void)
+{
+        /*
+         * The clockevent device's ->mult and ->shift can both be
+         * changed. In order to avoid races, schedule the frequency
+         * update code on each CPU.
+         */
+        on_each_cpu(__lapic_update_tsc_freq, NULL, 0);
+}
+
+/*
  * In this functions we calibrate APIC bus clocks to the external timer.
  *
  * We want to do the calibration only once since we want to have local timer
@@ -1599,6 +1623,9 @@ void __init enable_IR_x2apic(void)
         unsigned long flags;
         int ret, ir_stat;
 
+        if (skip_ioapic_setup)
+                return;
+
         ir_stat = irq_remapping_prepare();
         if (ir_stat < 0 && !x2apic_supported())
                 return;
@@ -2066,7 +2093,6 @@ int generic_processor_info(int apicid, int version)
                 return -EINVAL;
         }
 
-        num_processors++;
         if (apicid == boot_cpu_physical_apicid) {
                 /*
                  * x86_bios_cpu_apicid is required to have processors listed
@@ -2089,10 +2115,13 @@ int generic_processor_info(int apicid, int version)
 
                 pr_warning("APIC: Package limit reached. Processor %d/0x%x ignored.\n",
                            thiscpu, apicid);
+
                 disabled_cpus++;
                 return -ENOSPC;
         }
 
+        num_processors++;
+
         /*
          * Validate version
          */
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index 6368fa69d2af..54f35d988025 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -155,7 +155,7 @@ static void init_x2apic_ldr(void)
 /*
  * At CPU state changes, update the x2apic cluster sibling info.
  */
-int x2apic_prepare_cpu(unsigned int cpu)
+static int x2apic_prepare_cpu(unsigned int cpu)
 {
         if (!zalloc_cpumask_var(&per_cpu(cpus_in_cluster, cpu), GFP_KERNEL))
                 return -ENOMEM;
@@ -168,7 +168,7 @@ int x2apic_prepare_cpu(unsigned int cpu)
         return 0;
 }
 
-int x2apic_dead_cpu(unsigned int this_cpu)
+static int x2apic_dead_cpu(unsigned int this_cpu)
 {
         int cpu;
 
@@ -186,13 +186,18 @@ int x2apic_dead_cpu(unsigned int this_cpu)
 static int x2apic_cluster_probe(void)
 {
         int cpu = smp_processor_id();
+        int ret;
 
         if (!x2apic_mode)
                 return 0;
 
+        ret = cpuhp_setup_state(CPUHP_X2APIC_PREPARE, "X2APIC_PREPARE",
+                                x2apic_prepare_cpu, x2apic_dead_cpu);
+        if (ret < 0) {
+                pr_err("Failed to register X2APIC_PREPARE\n");
+                return 0;
+        }
         cpumask_set_cpu(cpu, per_cpu(cpus_in_cluster, cpu));
-        cpuhp_setup_state(CPUHP_X2APIC_PREPARE, "X2APIC_PREPARE",
-                          x2apic_prepare_cpu, x2apic_dead_cpu);
         return 1;
 }
 
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 09b59adaea3f..cb0673c1e940 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -223,6 +223,11 @@ static int __init uv_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
         if (strncmp(oem_id, "SGI", 3) != 0)
                 return 0;
 
+        if (numa_off) {
+                pr_err("UV: NUMA is off, disabling UV support\n");
+                return 0;
+        }
+
         /* Setup early hub type field in uv_hub_info for Node 0 */
         uv_cpu_info->p_uv_hub_info = &uv_hub_info_node0;
 
@@ -325,7 +330,7 @@ static __init void build_uv_gr_table(void)
         struct uv_gam_range_entry *gre = uv_gre_table;
         struct uv_gam_range_s *grt;
         unsigned long last_limit = 0, ram_limit = 0;
-        int bytes, i, sid, lsid = -1;
+        int bytes, i, sid, lsid = -1, indx = 0, lindx = -1;
 
         if (!gre)
                 return;
@@ -356,11 +361,12 @@ static __init void build_uv_gr_table(void)
                 }
                 sid = gre->sockid - _min_socket;
                 if (lsid < sid) {               /* new range */
-                        grt = &_gr_table[sid];
-                        grt->base = lsid;
+                        grt = &_gr_table[indx];
+                        grt->base = lindx;
                         grt->nasid = gre->nasid;
                         grt->limit = last_limit = gre->limit;
                         lsid = sid;
+                        lindx = indx++;
                         continue;
                 }
                 if (lsid == sid && !ram_limit) {        /* update range */
@@ -371,7 +377,7 @@ static __init void build_uv_gr_table(void)
                 }
                 if (!ram_limit) {               /* non-contiguous ram range */
                         grt++;
-                        grt->base = sid - 1;
+                        grt->base = lindx;
                         grt->nasid = gre->nasid;
                         grt->limit = last_limit = gre->limit;
                         continue;
@@ -1155,19 +1161,18 @@ static void __init decode_gam_rng_tbl(unsigned long ptr)
         for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) {
                 if (!index) {
                         pr_info("UV: GAM Range Table...\n");
-                        pr_info("UV:  # %20s %14s %5s %4s %5s %3s %2s %3s\n",
+                        pr_info("UV:  # %20s %14s %5s %4s %5s %3s %2s\n",
                                 "Range", "", "Size", "Type", "NASID",
-                                "SID", "PN", "PXM");
+                                "SID", "PN");
                 }
                 pr_info(
-                "UV: %2d: 0x%014lx-0x%014lx %5luG %3d   %04x  %02x %02x %3d\n",
+                "UV: %2d: 0x%014lx-0x%014lx %5luG %3d   %04x  %02x %02x\n",
                         index++,
                         (unsigned long)lgre << UV_GAM_RANGE_SHFT,
                         (unsigned long)gre->limit << UV_GAM_RANGE_SHFT,
                         ((unsigned long)(gre->limit - lgre)) >>
                                 (30 - UV_GAM_RANGE_SHFT), /* 64M -> 1G */
-                        gre->type, gre->nasid, gre->sockid,
-                        gre->pnode, gre->pxm);
+                        gre->type, gre->nasid, gre->sockid, gre->pnode);
 
                 lgre = gre->limit;
                 if (sock_min > gre->sockid)
@@ -1286,7 +1291,7 @@ static void __init build_socket_tables(void)
                 _pnode_to_socket[i] = SOCK_EMPTY;
 
         /* fill in pnode/node/addr conversion list values */
-        pr_info("UV: GAM Building socket/pnode/pxm conversion tables\n");
+        pr_info("UV: GAM Building socket/pnode conversion tables\n");
         for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) {
                 if (gre->type == UV_GAM_RANGE_TYPE_HOLE)
                         continue;
@@ -1294,20 +1299,18 @@ static void __init build_socket_tables(void)
                 if (_socket_to_pnode[i] != SOCK_EMPTY)
                         continue;       /* duplicate */
                 _socket_to_pnode[i] = gre->pnode;
-                _socket_to_node[i] = gre->pxm;
 
                 i = gre->pnode - minpnode;
                 _pnode_to_socket[i] = gre->sockid;
 
                 pr_info(
-                "UV: sid:%02x type:%d nasid:%04x pn:%02x pxm:%2d pn2s:%2x\n",
+                "UV: sid:%02x type:%d nasid:%04x pn:%02x pn2s:%2x\n",
                         gre->sockid, gre->type, gre->nasid,
                         _socket_to_pnode[gre->sockid - minsock],
-                        _socket_to_node[gre->sockid - minsock],
                         _pnode_to_socket[gre->pnode - minpnode]);
         }
 
-        /* check socket -> node values */
+        /* Set socket -> node values */
         lnid = -1;
         for_each_present_cpu(cpu) {
                 int nid = cpu_to_node(cpu);
@@ -1318,14 +1321,9 @@ static void __init build_socket_tables(void)
                 lnid = nid;
                 apicid = per_cpu(x86_cpu_to_apicid, cpu);
                 sockid = apicid >> uv_cpuid.socketid_shift;
-                i = sockid - minsock;
-
-                if (nid != _socket_to_node[i]) {
-                        pr_warn(
-                        "UV: %02x: type:%d socket:%02x PXM:%02x != node:%2d\n",
-                                i, sockid, gre->type, _socket_to_node[i], nid);
-                        _socket_to_node[i] = nid;
-                }
+                _socket_to_node[sockid - minsock] = nid;
+                pr_info("UV: sid:%02x: apicid:%04x node:%2d\n",
+                        sockid, apicid, nid);
         }
 
         /* Setup physical blade to pnode translation from GAM Range Table */
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index f5c69d8974e1..b81fe2d63e15 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -669,6 +669,17 @@ static void init_amd_gh(struct cpuinfo_x86 *c)
                 set_cpu_bug(c, X86_BUG_AMD_TLB_MMATCH);
 }
 
+#define MSR_AMD64_DE_CFG        0xC0011029
+
+static void init_amd_ln(struct cpuinfo_x86 *c)
+{
+        /*
+         * Apply erratum 665 fix unconditionally so machines without a BIOS
+         * fix work.
+         */
+        msr_set_bit(MSR_AMD64_DE_CFG, 31);
+}
+
 static void init_amd_bd(struct cpuinfo_x86 *c)
 {
         u64 value;
@@ -726,6 +737,7 @@ static void init_amd(struct cpuinfo_x86 *c)
         case 6:    init_amd_k7(c); break;
         case 0xf:  init_amd_k8(c); break;
         case 0x10: init_amd_gh(c); break;
+        case 0x12: init_amd_ln(c); break;
         case 0x15: init_amd_bd(c); break;
         }
 
diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 27a0228c9cae..620ab06bcf45 100644
--- a/arch/x86/kernel/cpu/microcode/amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -54,6 +54,7 @@ static LIST_HEAD(pcache);
  */
 static u8 *container;
 static size_t container_size;
+static bool ucode_builtin;
 
 static u32 ucode_new_rev;
 static u8 amd_ucode_patch[PATCH_MAX_SIZE];
@@ -281,18 +282,22 @@ static bool __init load_builtin_amd_microcode(struct cpio_data *cp,
 void __init load_ucode_amd_bsp(unsigned int family)
 {
         struct cpio_data cp;
+        bool *builtin;
         void **data;
         size_t *size;
 
 #ifdef CONFIG_X86_32
         data =  (void **)__pa_nodebug(&ucode_cpio.data);
         size = (size_t *)__pa_nodebug(&ucode_cpio.size);
+        builtin = (bool *)__pa_nodebug(&ucode_builtin);
 #else
         data = &ucode_cpio.data;
         size = &ucode_cpio.size;
+        builtin = &ucode_builtin;
 #endif
 
-        if (!load_builtin_amd_microcode(&cp, family))
+        *builtin = load_builtin_amd_microcode(&cp, family);
+        if (!*builtin)
                 cp = find_ucode_in_initrd();
 
         if (!(cp.data && cp.size))
@@ -355,6 +360,7 @@ void load_ucode_amd_ap(void)
         unsigned int cpu = smp_processor_id();
         struct equiv_cpu_entry *eq;
         struct microcode_amd *mc;
+        u8 *cont = container;
         u32 rev, eax;
         u16 eq_id;
 
@@ -371,8 +377,12 @@ void load_ucode_amd_ap(void)
         if (check_current_patch_level(&rev, false))
                 return;
 
+        /* Add CONFIG_RANDOMIZE_MEMORY offset. */
+        if (!ucode_builtin)
+                cont += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+
         eax = cpuid_eax(0x00000001);
-        eq  = (struct equiv_cpu_entry *)(container + CONTAINER_HDR_SZ);
+        eq  = (struct equiv_cpu_entry *)(cont + CONTAINER_HDR_SZ);
 
         eq_id = find_equiv_id(eq, eax);
         if (!eq_id)
@@ -434,6 +444,10 @@ int __init save_microcode_in_initrd_amd(void)
         else
                 container = cont_va;
 
+        /* Add CONFIG_RANDOMIZE_MEMORY offset. */
+        if (!ucode_builtin)
+                container += PAGE_OFFSET - __PAGE_OFFSET_BASE;
+
         eax   = cpuid_eax(0x00000001);
         eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
 
diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
index 680049aa4593..01567aa87503 100644
--- a/arch/x86/kernel/fpu/xstate.c
+++ b/arch/x86/kernel/fpu/xstate.c
@@ -866,105 +866,17 @@ const void *get_xsave_field_ptr(int xsave_state)
         return get_xsave_addr(&fpu->state.xsave, xsave_state);
 }
 
-
-/*
- * Set xfeatures (aka XSTATE_BV) bit for a feature that we want
- * to take out of its "init state".  This will ensure that an
- * XRSTOR actually restores the state.
- */
-static void fpu__xfeature_set_non_init(struct xregs_state *xsave,
-                int xstate_feature_mask)
-{
-        xsave->header.xfeatures |= xstate_feature_mask;
-}
-
-/*
- * This function is safe to call whether the FPU is in use or not.
- *
- * Note that this only works on the current task.
- *
- * Inputs:
- *      @xsave_state: state which is defined in xsave.h (e.g. XFEATURE_MASK_FP,
- *      XFEATURE_MASK_SSE, etc...)
- *      @xsave_state_ptr: a pointer to a copy of the state that you would
- *      like written in to the current task's FPU xsave state.  This pointer
- *      must not be located in the current tasks's xsave area.
- * Output:
- *      address of the state in the xsave area or NULL if the state
- *      is not present or is in its 'init state'.
- */
-static void fpu__xfeature_set_state(int xstate_feature_mask,
-                void *xstate_feature_src, size_t len)
-{
-        struct xregs_state *xsave = &current->thread.fpu.state.xsave;
-        struct fpu *fpu = &current->thread.fpu;
-        void *dst;
-
-        if (!boot_cpu_has(X86_FEATURE_XSAVE)) {
-                WARN_ONCE(1, "%s() attempted with no xsave support", __func__);
-                return;
-        }
-
-        /*
-         * Tell the FPU code that we need the FPU state to be in
-         * 'fpu' (not in the registers), and that we need it to
-         * be stable while we write to it.
-         */
-        fpu__current_fpstate_write_begin();
-
-        /*
-         * This method *WILL* *NOT* work for compact-format
-         * buffers.  If the 'xstate_feature_mask' is unset in
-         * xcomp_bv then we may need to move other feature state
-         * "up" in the buffer.
-         */
-        if (xsave->header.xcomp_bv & xstate_feature_mask) {
-                WARN_ON_ONCE(1);
-                goto out;
-        }
-
-        /* find the location in the xsave buffer of the desired state */
-        dst = __raw_xsave_addr(&fpu->state.xsave, xstate_feature_mask);
-
-        /*
-         * Make sure that the pointer being passed in did not
-         * come from the xsave buffer itself.
-         */
-        WARN_ONCE(xstate_feature_src == dst, "set from xsave buffer itself");
-
-        /* put the caller-provided data in the location */
-        memcpy(dst, xstate_feature_src, len);
-
-        /*
-         * Mark the xfeature so that the CPU knows there is state
-         * in the buffer now.
-         */
-        fpu__xfeature_set_non_init(xsave, xstate_feature_mask);
-out:
-        /*
-         * We are done writing to the 'fpu'.  Reenable preeption
-         * and (possibly) move the fpstate back in to the fpregs.
-         */
-        fpu__current_fpstate_write_end();
-}
-
 #define NR_VALID_PKRU_BITS (CONFIG_NR_PROTECTION_KEYS * 2)
 #define PKRU_VALID_MASK (NR_VALID_PKRU_BITS - 1)
 
 /*
- * This will go out and modify the XSAVE buffer so that PKRU is
- * set to a particular state for access to 'pkey'.
- *
- * PKRU state does affect kernel access to user memory.  We do
- * not modfiy PKRU *itself* here, only the XSAVE state that will
- * be restored in to PKRU when we return back to userspace.
+ * This will go out and modify PKRU register to set the access
+ * rights for @pkey to @init_val.
  */
 int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
                 unsigned long init_val)
 {
-        struct xregs_state *xsave = &tsk->thread.fpu.state.xsave;
-        struct pkru_state *old_pkru_state;
-        struct pkru_state new_pkru_state;
+        u32 old_pkru;
         int pkey_shift = (pkey * PKRU_BITS_PER_PKEY);
         u32 new_pkru_bits = 0;
 
@@ -974,6 +886,15 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
          */
         if (!boot_cpu_has(X86_FEATURE_OSPKE))
                 return -EINVAL;
+        /*
+         * For most XSAVE components, this would be an arduous task:
+         * brining fpstate up to date with fpregs, updating fpstate,
+         * then re-populating fpregs.  But, for components that are
+         * never lazily managed, we can just access the fpregs
+         * directly.  PKRU is never managed lazily, so we can just
+         * manipulate it directly.  Make sure it stays that way.
+         */
+        WARN_ON_ONCE(!use_eager_fpu());
 
         /* Set the bits we need in PKRU:  */
         if (init_val & PKEY_DISABLE_ACCESS)
@@ -984,37 +905,12 @@ int arch_set_user_pkey_access(struct task_struct *tsk, int pkey,
         /* Shift the bits in to the correct place in PKRU for pkey: */
         new_pkru_bits <<= pkey_shift;
 
-        /* Locate old copy of the state in the xsave buffer: */
-        old_pkru_state = get_xsave_addr(xsave, XFEATURE_MASK_PKRU);
-
-        /*
-         * When state is not in the buffer, it is in the init
-         * state, set it manually.  Otherwise, copy out the old
-         * state.
-         */
-        if (!old_pkru_state)
-                new_pkru_state.pkru = 0;
-        else
-                new_pkru_state.pkru = old_pkru_state->pkru;
-
-        /* Mask off any old bits in place: */
-        new_pkru_state.pkru &= ~((PKRU_AD_BIT|PKRU_WD_BIT) << pkey_shift);
-
-        /* Set the newly-requested bits: */
-        new_pkru_state.pkru |= new_pkru_bits;
-
-        /*
-         * We could theoretically live without zeroing pkru.pad.
-         * The current XSAVE feature state definition says that
-         * only bytes 0->3 are used.  But we do not want to
-         * chance leaking kernel stack out to userspace in case a
-         * memcpy() of the whole xsave buffer was done.
-         *
-         * They're in the same cacheline anyway.
-         */
-        new_pkru_state.pad = 0;
+        /* Get old PKRU and mask off any old bits in place: */
+        old_pkru = read_pkru();
+        old_pkru &= ~((PKRU_AD_BIT|PKRU_WD_BIT) << pkey_shift);
 
-        fpu__xfeature_set_state(XFEATURE_MASK_PKRU, &new_pkru_state, sizeof(new_pkru_state));
+        /* Write old part along with new part: */
+        write_pkru(old_pkru | new_pkru_bits);
 
         return 0;
 }
diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
index 2dda0bc4576e..f16c55bfc090 100644
--- a/arch/x86/kernel/head32.c
+++ b/arch/x86/kernel/head32.c
@@ -25,8 +25,6 @@ static void __init i386_default_early_setup(void)
         /* Initialize 32bit specific setup functions */
         x86_init.resources.reserve_resources = i386_reserve_resources;
         x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc;
-
-        reserve_bios_regions();
 }
 
 asmlinkage __visible void __init i386_start_kernel(void)
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 99d48e7d2974..54a2372f5dbb 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -183,7 +183,6 @@ void __init x86_64_start_reservations(char *real_mode_data)
                 copy_bootdata(__va(real_mode_data));
 
         x86_early_init_platform_quirks();
-        reserve_bios_regions();
 
         switch (boot_params.hdr.hardware_subarch) {
         case X86_SUBARCH_INTEL_MID:
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index ed16e58658a4..c6dfd801df97 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -1242,7 +1242,7 @@ irqreturn_t hpet_rtc_interrupt(int irq, void *dev_id)
         memset(&curr_time, 0, sizeof(struct rtc_time));
 
         if (hpet_rtc_flags & (RTC_UIE | RTC_AIE))
-                mc146818_set_time(&curr_time);
+                mc146818_get_time(&curr_time);
 
         if (hpet_rtc_flags & RTC_UIE &&
             curr_time.tm_sec != hpet_prev_update_sec) {
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 61521dc19c10..9f669fdd2010 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -102,8 +102,7 @@ int arch_show_interrupts(struct seq_file *p, int prec)
         seq_puts(p, "  Rescheduling interrupts\n");
         seq_printf(p, "%*s: ", prec, "CAL");
         for_each_online_cpu(j)
-                seq_printf(p, "%10u ", irq_stats(j)->irq_call_count -
-                                        irq_stats(j)->irq_tlb_count);
+                seq_printf(p, "%10u ", irq_stats(j)->irq_call_count);
         seq_puts(p, "  Function call interrupts\n");
         seq_printf(p, "%*s: ", prec, "TLB");
         for_each_online_cpu(j)
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 1d39bfbd26bb..3692249a70f1 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -289,6 +289,7 @@ void __init kvmclock_init(void)
         put_cpu();
 
         x86_platform.calibrate_tsc = kvm_get_tsc_khz;
+        x86_platform.calibrate_cpu = kvm_get_tsc_khz;
         x86_platform.get_wallclock = kvm_get_wallclock;
         x86_platform.set_wallclock = kvm_set_wallclock;
 #ifdef CONFIG_X86_LOCAL_APIC
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index ad5bc9578a73..1acfd76e3e26 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -56,12 +56,12 @@ asm (".pushsection .entry.text, \"ax\"\n"
      ".popsection");
 
 /* identity function, which can be inlined */
-u32 _paravirt_ident_32(u32 x)
+u32 notrace _paravirt_ident_32(u32 x)
 {
         return x;
 }
 
-u64 _paravirt_ident_64(u64 x)
+u64 notrace _paravirt_ident_64(u64 x)
 {
         return x;
 }
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 991b77986d57..0fa60f5f5a16 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -936,8 +936,6 @@ void __init setup_arch(char **cmdline_p)
 
         x86_init.oem.arch_setup();
 
-        kernel_randomize_memory();
-
         iomem_resource.end = (1ULL << boot_cpu_data.x86_phys_bits) - 1;
         setup_memory_map();
         parse_setup_data();
@@ -1055,6 +1053,12 @@ void __init setup_arch(char **cmdline_p)
 
         max_possible_pfn = max_pfn;
 
+        /*
+         * Define random base addresses for memory sections after max_pfn is
+         * defined and before each memory section base is used.
+         */
+        kernel_randomize_memory();
+
 #ifdef CONFIG_X86_32
         /* max_low_pfn get updated here */
         find_low_pfn_range();
@@ -1097,6 +1101,8 @@ void __init setup_arch(char **cmdline_p)
                 efi_find_mirror();
         }
 
+        reserve_bios_regions();
+
         /*
          * The EFI specification says that boot service code won't be called
          * after ExitBootServices(). This is, in fact, a lie.
@@ -1125,7 +1131,15 @@ void __init setup_arch(char **cmdline_p)
 
         early_trap_pf_init();
 
-        setup_real_mode();
+        /*
+         * Update mmu_cr4_features (and, indirectly, trampoline_cr4_features)
+         * with the current CR4 value.  This may not be necessary, but
+         * auditing all the early-boot CR4 manipulation would be needed to
+         * rule it out.
+         */
+        if (boot_cpu_data.cpuid_level >= 0)
+                /* A CPU has %cr4 if and only if it has CPUID. */
+                mmu_cr4_features = __read_cr4();
 
         memblock_set_current_limit(get_max_mapped());
 
@@ -1174,13 +1188,6 @@ void __init setup_arch(char **cmdline_p)
 
         kasan_init();
 
-        if (boot_cpu_data.cpuid_level >= 0) {
-                /* A CPU has %cr4 if and only if it has CPUID */
-                mmu_cr4_features = __read_cr4();
-                if (trampoline_cr4_features)
-                        *trampoline_cr4_features = mmu_cr4_features;
-        }
-
 #ifdef CONFIG_X86_32
         /* sync back kernel address range */
         clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 2a6e84a30a54..4296beb8fdd3 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -100,10 +100,11 @@ EXPORT_PER_CPU_SYMBOL(cpu_info);
 /* Logical package management. We might want to allocate that dynamically */
 static int *physical_to_logical_pkg __read_mostly;
 static unsigned long *physical_package_map __read_mostly;;
-static unsigned long *logical_package_map  __read_mostly;
 static unsigned int max_physical_pkg_id __read_mostly;
 unsigned int __max_logical_packages __read_mostly;
 EXPORT_SYMBOL(__max_logical_packages);
+static unsigned int logical_packages __read_mostly;
+static bool logical_packages_frozen __read_mostly;
 
 /* Maximum number of SMT threads on any online core */
 int __max_smt_threads __read_mostly;
@@ -277,14 +278,14 @@ int topology_update_package_map(unsigned int apicid, unsigned int cpu)
         if (test_and_set_bit(pkg, physical_package_map))
                 goto found;
 
-        new = find_first_zero_bit(logical_package_map, __max_logical_packages);
-        if (new >= __max_logical_packages) {
+        if (logical_packages_frozen) {
                 physical_to_logical_pkg[pkg] = -1;
-                pr_warn("APIC(%x) Package %u exceeds logical package map\n",
+                pr_warn("APIC(%x) Package %u exceeds logical package max\n",
                         apicid, pkg);
                 return -ENOSPC;
         }
-        set_bit(new, logical_package_map);
+
+        new = logical_packages++;
         pr_info("APIC(%x) Converting physical %u to logical package %u\n",
                 apicid, pkg, new);
         physical_to_logical_pkg[pkg] = new;
@@ -341,6 +342,7 @@ static void __init smp_init_package_map(void)
         }
 
         __max_logical_packages = DIV_ROUND_UP(total_cpus, ncpus);
+        logical_packages = 0;
 
         /*
          * Possibly larger than what we need as the number of apic ids per
@@ -352,10 +354,6 @@ static void __init smp_init_package_map(void)
         memset(physical_to_logical_pkg, 0xff, size);
         size = BITS_TO_LONGS(max_physical_pkg_id) * sizeof(unsigned long);
         physical_package_map = kzalloc(size, GFP_KERNEL);
-        size = BITS_TO_LONGS(__max_logical_packages) * sizeof(unsigned long);
-        logical_package_map = kzalloc(size, GFP_KERNEL);
-
-        pr_info("Max logical packages: %u\n", __max_logical_packages);
 
         for_each_present_cpu(cpu) {
                 unsigned int apicid = apic->cpu_present_to_apicid(cpu);
@@ -369,6 +367,15 @@ static void __init smp_init_package_map(void)
                 set_cpu_possible(cpu, false);
                 set_cpu_present(cpu, false);
         }
+
+        if (logical_packages > __max_logical_packages) {
+                pr_warn("Detected more packages (%u), then computed by BIOS data (%u).\n",
+                        logical_packages, __max_logical_packages);
+                logical_packages_frozen = true;
+                __max_logical_packages  = logical_packages;
+        }
+
+        pr_info("Max logical packages: %u\n", __max_logical_packages);
 }
 
 void __init smp_store_boot_cpu_info(void)
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 1ef87e887051..78b9cb5a26af 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -22,6 +22,7 @@
 #include <asm/nmi.h>
 #include <asm/x86_init.h>
 #include <asm/geode.h>
+#include <asm/apic.h>
 
 unsigned int __read_mostly cpu_khz;     /* TSC clocks / usec, not used here */
 EXPORT_SYMBOL(cpu_khz);
@@ -1249,6 +1250,9 @@ static void tsc_refine_calibration_work(struct work_struct *work)
                 (unsigned long)tsc_khz / 1000,
                 (unsigned long)tsc_khz % 1000);
 
+        /* Inform the TSC deadline clockevent devices about the recalibration */
+        lapic_update_tsc_freq();
+
 out:
         if (boot_cpu_has(X86_FEATURE_ART))
                 art_related_clocksource = &clocksource_tsc;
diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
index 6c1ff31d99ff..495c776de4b4 100644
--- a/arch/x86/kernel/uprobes.c
+++ b/arch/x86/kernel/uprobes.c
@@ -357,20 +357,22 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
                 *cursor &= 0xfe;
         }
         /*
-         * Similar treatment for VEX3 prefix.
-         * TODO: add XOP/EVEX treatment when insn decoder supports them
+         * Similar treatment for VEX3/EVEX prefix.
+         * TODO: add XOP treatment when insn decoder supports them
          */
-        if (insn->vex_prefix.nbytes == 3) {
+        if (insn->vex_prefix.nbytes >= 3) {
                 /*
                  * vex2:     c5    rvvvvLpp   (has no b bit)
                  * vex3/xop: c4/8f rxbmmmmm wvvvvLpp
                  * evex:     62    rxbR00mm wvvvv1pp zllBVaaa
-                 *   (evex will need setting of both b and x since
-                 *   in non-sib encoding evex.x is 4th bit of MODRM.rm)
-                 * Setting VEX3.b (setting because it has inverted meaning):
+                 * Setting VEX3.b (setting because it has inverted meaning).
+                 * Setting EVEX.x since (in non-SIB encoding) EVEX.x
+                 * is the 4th bit of MODRM.rm, and needs the same treatment.
+                 * For VEX3-encoded insns, VEX3.x value has no effect in
+                 * non-SIB encoding, the change is superfluous but harmless.
                  */
                 cursor = auprobe->insn + insn_offset_vex_prefix(insn) + 1;
-                *cursor |= 0x20;
+                *cursor |= 0x60;
         }
 
         /*
@@ -415,12 +417,10 @@ static void riprel_analyze(struct arch_uprobe *auprobe, struct insn *insn)
 
         reg = MODRM_REG(insn);  /* Fetch modrm.reg */
         reg2 = 0xff;            /* Fetch vex.vvvv */
-        if (insn->vex_prefix.nbytes == 2)
-                reg2 = insn->vex_prefix.bytes[1];
-        else if (insn->vex_prefix.nbytes == 3)
+        if (insn->vex_prefix.nbytes)
                 reg2 = insn->vex_prefix.bytes[2];
         /*
-         * TODO: add XOP, EXEV vvvv reading.
+         * TODO: add XOP vvvv reading.
          *
          * vex.vvvv field is in bits 6-3, bits are inverted.
          * But in 32-bit mode, high-order bit may be ignored.
diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
index 5f42d038fcb4..c7220ba94aa7 100644
--- a/arch/x86/kvm/ioapic.c
+++ b/arch/x86/kvm/ioapic.c
@@ -109,6 +109,7 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
 {
         bool new_val, old_val;
         struct kvm_ioapic *ioapic = vcpu->kvm->arch.vioapic;
+        struct dest_map *dest_map = &ioapic->rtc_status.dest_map;
         union kvm_ioapic_redirect_entry *e;
 
         e = &ioapic->redirtbl[RTC_GSI];
@@ -117,16 +118,17 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
                 return;
 
         new_val = kvm_apic_pending_eoi(vcpu, e->fields.vector);
-        old_val = test_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+        old_val = test_bit(vcpu->vcpu_id, dest_map->map);
 
         if (new_val == old_val)
                 return;
 
         if (new_val) {
-                __set_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+                __set_bit(vcpu->vcpu_id, dest_map->map);
+                dest_map->vectors[vcpu->vcpu_id] = e->fields.vector;
                 ioapic->rtc_status.pending_eoi++;
         } else {
-                __clear_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map.map);
+                __clear_bit(vcpu->vcpu_id, dest_map->map);
                 ioapic->rtc_status.pending_eoi--;
                 rtc_status_pending_eoi_check_valid(ioapic);
         }
diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c
index 39b91127ef07..cd944435dfbd 100644
--- a/arch/x86/kvm/pmu_amd.c
+++ b/arch/x86/kvm/pmu_amd.c
@@ -23,8 +23,8 @@
 static struct kvm_event_hw_type_mapping amd_event_mapping[] = {
         [0] = { 0x76, 0x00, PERF_COUNT_HW_CPU_CYCLES },
         [1] = { 0xc0, 0x00, PERF_COUNT_HW_INSTRUCTIONS },
-        [2] = { 0x80, 0x00, PERF_COUNT_HW_CACHE_REFERENCES },
-        [3] = { 0x81, 0x00, PERF_COUNT_HW_CACHE_MISSES },
+        [2] = { 0x7d, 0x07, PERF_COUNT_HW_CACHE_REFERENCES },
+        [3] = { 0x7e, 0x07, PERF_COUNT_HW_CACHE_MISSES },
         [4] = { 0xc2, 0x00, PERF_COUNT_HW_BRANCH_INSTRUCTIONS },
         [5] = { 0xc3, 0x00, PERF_COUNT_HW_BRANCH_MISSES },
         [6] = { 0xd0, 0x00, PERF_COUNT_HW_STALLED_CYCLES_FRONTEND },
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a45d8580f91e..5cede40e2552 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -422,6 +422,7 @@ struct nested_vmx {
         struct list_head vmcs02_pool;
         int vmcs02_num;
         u64 vmcs01_tsc_offset;
+        bool change_vmcs01_virtual_x2apic_mode;
         /* L2 must run next, and mustn't decide to exit to L1. */
         bool nested_run_pending;
         /*
@@ -435,6 +436,8 @@ struct nested_vmx {
         bool pi_pending;
         u16 posted_intr_nv;
 
+        unsigned long *msr_bitmap;
+
         struct hrtimer preemption_timer;
         bool preemption_timer_expired;
 
@@ -924,7 +927,6 @@ static unsigned long *vmx_msr_bitmap_legacy;
 static unsigned long *vmx_msr_bitmap_longmode;
 static unsigned long *vmx_msr_bitmap_legacy_x2apic;
 static unsigned long *vmx_msr_bitmap_longmode_x2apic;
-static unsigned long *vmx_msr_bitmap_nested;
 static unsigned long *vmx_vmread_bitmap;
 static unsigned long *vmx_vmwrite_bitmap;
 
@@ -2198,6 +2200,12 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu)
                         new.control) != old.control);
 }
 
+static void decache_tsc_multiplier(struct vcpu_vmx *vmx)
+{
+        vmx->current_tsc_ratio = vmx->vcpu.arch.tsc_scaling_ratio;
+        vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
+}
+
 /*
  * Switches to specified vcpu, until a matching vcpu_put(), but assumes
  * vcpu mutex is already taken.
@@ -2256,10 +2264,8 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
 
         /* Setup TSC multiplier */
         if (kvm_has_tsc_control &&
-            vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio) {
-                vmx->current_tsc_ratio = vcpu->arch.tsc_scaling_ratio;
-                vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
-        }
+            vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio)
+                decache_tsc_multiplier(vmx);
 
         vmx_vcpu_pi_load(vcpu, cpu);
         vmx->host_pkru = read_pkru();
@@ -2508,7 +2514,7 @@ static void vmx_set_msr_bitmap(struct kvm_vcpu *vcpu)
         unsigned long *msr_bitmap;
 
         if (is_guest_mode(vcpu))
-                msr_bitmap = vmx_msr_bitmap_nested;
+                msr_bitmap = to_vmx(vcpu)->nested.msr_bitmap;
         else if (cpu_has_secondary_exec_ctrls() &&
                  (vmcs_read32(SECONDARY_VM_EXEC_CONTROL) &
                   SECONDARY_EXEC_VIRTUALIZE_X2APIC_MODE)) {
@@ -6363,13 +6369,6 @@ static __init int hardware_setup(void)
         if (!vmx_msr_bitmap_longmode_x2apic)
                 goto out4;
 
-        if (nested) {
-                vmx_msr_bitmap_nested =
-                        (unsigned long *)__get_free_page(GFP_KERNEL);
-                if (!vmx_msr_bitmap_nested)
-                        goto out5;
-        }
-
         vmx_vmread_bitmap = (unsigned long *)__get_free_page(GFP_KERNEL);
         if (!vmx_vmread_bitmap)
                 goto out6;
@@ -6392,8 +6391,6 @@ static __init int hardware_setup(void)
 
         memset(vmx_msr_bitmap_legacy, 0xff, PAGE_SIZE);
         memset(vmx_msr_bitmap_longmode, 0xff, PAGE_SIZE);
-        if (nested)
-                memset(vmx_msr_bitmap_nested, 0xff, PAGE_SIZE);
 
         if (setup_vmcs_config(&vmcs_config) < 0) {
                 r = -EIO;
@@ -6529,9 +6526,6 @@ out8:
 out7:
         free_page((unsigned long)vmx_vmread_bitmap);
 out6:
-        if (nested)
-                free_page((unsigned long)vmx_msr_bitmap_nested);
-out5:
         free_page((unsigned long)vmx_msr_bitmap_longmode_x2apic);
 out4:
         free_page((unsigned long)vmx_msr_bitmap_longmode);
@@ -6557,8 +6551,6 @@ static __exit void hardware_unsetup(void)
         free_page((unsigned long)vmx_io_bitmap_a);
         free_page((unsigned long)vmx_vmwrite_bitmap);
         free_page((unsigned long)vmx_vmread_bitmap);
-        if (nested)
-                free_page((unsigned long)vmx_msr_bitmap_nested);
 
         free_kvm_area();
 }
@@ -6995,16 +6987,21 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
                 return 1;
         }
 
+        if (cpu_has_vmx_msr_bitmap()) {
+                vmx->nested.msr_bitmap =
+                                (unsigned long *)__get_free_page(GFP_KERNEL);
+                if (!vmx->nested.msr_bitmap)
+                        goto out_msr_bitmap;
+        }
+
         vmx->nested.cached_vmcs12 = kmalloc(VMCS12_SIZE, GFP_KERNEL);
         if (!vmx->nested.cached_vmcs12)
-                return -ENOMEM;
+                goto out_cached_vmcs12;
 
         if (enable_shadow_vmcs) {
                 shadow_vmcs = alloc_vmcs();
-                if (!shadow_vmcs) {
-                        kfree(vmx->nested.cached_vmcs12);
-                        return -ENOMEM;
-                }
+                if (!shadow_vmcs)
+                        goto out_shadow_vmcs;
                 /* mark vmcs as shadow */
                 shadow_vmcs->revision_id |= (1u << 31);
                 /* init shadow vmcs */
@@ -7024,6 +7021,15 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
         skip_emulated_instruction(vcpu);
         nested_vmx_succeed(vcpu);
         return 1;
+
+out_shadow_vmcs:
+        kfree(vmx->nested.cached_vmcs12);
+
+out_cached_vmcs12:
+        free_page((unsigned long)vmx->nested.msr_bitmap);
+
+out_msr_bitmap:
+        return -ENOMEM;
 }
 
 /*
@@ -7098,6 +7104,10 @@ static void free_nested(struct vcpu_vmx *vmx)
         vmx->nested.vmxon = false;
         free_vpid(vmx->nested.vpid02);
         nested_release_vmcs12(vmx);
+        if (vmx->nested.msr_bitmap) {
+                free_page((unsigned long)vmx->nested.msr_bitmap);
+                vmx->nested.msr_bitmap = NULL;
+        }
         if (enable_shadow_vmcs)
                 free_vmcs(vmx->nested.current_shadow_vmcs);
         kfree(vmx->nested.cached_vmcs12);
@@ -8419,6 +8429,12 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu *vcpu, bool set)
 {
         u32 sec_exec_control;
 
+        /* Postpone execution until vmcs01 is the current VMCS. */
+        if (is_guest_mode(vcpu)) {
+                to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true;
+                return;
+        }
+
         /*
          * There is not point to enable virtualize x2apic without enable
          * apicv
@@ -9472,8 +9488,10 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu,
 {
         int msr;
         struct page *page;
-        unsigned long *msr_bitmap;
+        unsigned long *msr_bitmap_l1;
+        unsigned long *msr_bitmap_l0 = to_vmx(vcpu)->nested.msr_bitmap;
 
+        /* This shortcut is ok because we support only x2APIC MSRs so far. */
         if (!nested_cpu_has_virt_x2apic_mode(vmcs12))
                 return false;
 
@@ -9482,63 +9500,37 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu,
                 WARN_ON(1);
                 return false;
         }
-        msr_bitmap = (unsigned long *)kmap(page);
-        if (!msr_bitmap) {
+        msr_bitmap_l1 = (unsigned long *)kmap(page);
+        if (!msr_bitmap_l1) {
                 nested_release_page_clean(page);
                 WARN_ON(1);
                 return false;
         }
 
+        memset(msr_bitmap_l0, 0xff, PAGE_SIZE);
+
         if (nested_cpu_has_virt_x2apic_mode(vmcs12)) {
                 if (nested_cpu_has_apic_reg_virt(vmcs12))
                         for (msr = 0x800; msr <= 0x8ff; msr++)
                                 nested_vmx_disable_intercept_for_msr(
-                                        msr_bitmap,
-                                        vmx_msr_bitmap_nested,
+                                        msr_bitmap_l1, msr_bitmap_l0,
                                         msr, MSR_TYPE_R);
-                /* TPR is allowed */
-                nested_vmx_disable_intercept_for_msr(msr_bitmap,
-                                vmx_msr_bitmap_nested,
+
+                nested_vmx_disable_intercept_for_msr(
+                                msr_bitmap_l1, msr_bitmap_l0,
                                 APIC_BASE_MSR + (APIC_TASKPRI >> 4),
                                 MSR_TYPE_R | MSR_TYPE_W);
+
                 if (nested_cpu_has_vid(vmcs12)) {
-                        /* EOI and self-IPI are allowed */
                         nested_vmx_disable_intercept_for_msr(
-                                msr_bitmap,
-                                vmx_msr_bitmap_nested,
+                                msr_bitmap_l1, msr_bitmap_l0,
                                 APIC_BASE_MSR + (APIC_EOI >> 4),
                                 MSR_TYPE_W);
                         nested_vmx_disable_intercept_for_msr(
-                                msr_bitmap,
-                                vmx_msr_bitmap_nested,
+                                msr_bitmap_l1, msr_bitmap_l0,
                                 APIC_BASE_MSR + (APIC_SELF_IPI >> 4),
                                 MSR_TYPE_W);
                 }
-        } else {
-                /*
-                 * Enable reading intercept of all the x2apic
-                 * MSRs. We should not rely on vmcs12 to do any
-                 * optimizations here, it may have been modified
-                 * by L1.
-                 */
-                for (msr = 0x800; msr <= 0x8ff; msr++)
-                        __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                msr,
-                                MSR_TYPE_R);
-
-                __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                APIC_BASE_MSR + (APIC_TASKPRI >> 4),
-                                MSR_TYPE_W);
-                __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                APIC_BASE_MSR + (APIC_EOI >> 4),
-                                MSR_TYPE_W);
-                __vmx_enable_intercept_for_msr(
-                                vmx_msr_bitmap_nested,
-                                APIC_BASE_MSR + (APIC_SELF_IPI >> 4),
-                                MSR_TYPE_W);
         }
         kunmap(page);
         nested_release_page_clean(page);
@@ -9957,10 +9949,10 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
         }
 
         if (cpu_has_vmx_msr_bitmap() &&
-            exec_control & CPU_BASED_USE_MSR_BITMAPS) {
-                nested_vmx_merge_msr_bitmap(vcpu, vmcs12);
-                /* MSR_BITMAP will be set by following vmx_set_efer. */
-        } else
+            exec_control & CPU_BASED_USE_MSR_BITMAPS &&
+            nested_vmx_merge_msr_bitmap(vcpu, vmcs12))
+                ; /* MSR_BITMAP will be set by following vmx_set_efer. */
+        else
                 exec_control &= ~CPU_BASED_USE_MSR_BITMAPS;
 
         /*
@@ -10011,6 +10003,8 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
                         vmx->nested.vmcs01_tsc_offset + vmcs12->tsc_offset);
         else
                 vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
+        if (kvm_has_tsc_control)
+                decache_tsc_multiplier(vmx);
 
         if (enable_vpid) {
                 /*
@@ -10767,6 +10761,14 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason,
         else
                 vmcs_set_bits(PIN_BASED_VM_EXEC_CONTROL,
                               PIN_BASED_VMX_PREEMPTION_TIMER);
+        if (kvm_has_tsc_control)
+                decache_tsc_multiplier(vmx);
+
+        if (vmx->nested.change_vmcs01_virtual_x2apic_mode) {
+                vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
+                vmx_set_virtual_x2apic_mode(vcpu,
+                                vcpu->arch.apic_base & X2APIC_ENABLE);
+        }
 
         /* This is needed for same reason as it was needed in prepare_vmcs02 */
         vmx->host_rsp = 0;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 19f9f9e05c2a..699f8726539a 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -2743,16 +2743,16 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
                 if (tsc_delta < 0)
                         mark_tsc_unstable("KVM discovered backwards TSC");
 
-                if (kvm_lapic_hv_timer_in_use(vcpu) &&
-                                kvm_x86_ops->set_hv_timer(vcpu,
-                                        kvm_get_lapic_tscdeadline_msr(vcpu)))
-                        kvm_lapic_switch_to_sw_timer(vcpu);
                 if (check_tsc_unstable()) {
                         u64 offset = kvm_compute_tsc_offset(vcpu,
                                                 vcpu->arch.last_guest_tsc);
                         kvm_x86_ops->write_tsc_offset(vcpu, offset);
                         vcpu->arch.tsc_catchup = 1;
                 }
+                if (kvm_lapic_hv_timer_in_use(vcpu) &&
+                                kvm_x86_ops->set_hv_timer(vcpu,
+                                        kvm_get_lapic_tscdeadline_msr(vcpu)))
+                        kvm_lapic_switch_to_sw_timer(vcpu);
                 /*
                  * On a host with synchronized TSC, there is no need to update
                  * kvmclock on vcpu->cpu migration
diff --git a/arch/x86/lib/hweight.S b/arch/x86/lib/hweight.S
index 02de3d74d2c5..8a602a1e404a 100644
--- a/arch/x86/lib/hweight.S
+++ b/arch/x86/lib/hweight.S
@@ -35,6 +35,7 @@ ENDPROC(__sw_hweight32)
 
 ENTRY(__sw_hweight64)
 #ifdef CONFIG_X86_64
+        pushq   %rdi
         pushq   %rdx
 
         movq    %rdi, %rdx                      # w -> t
@@ -60,6 +61,7 @@ ENTRY(__sw_hweight64)
         shrq    $56, %rax                       # w = w_tmp >> 56
 
         popq    %rdx
+        popq    %rdi
         ret
 #else /* CONFIG_X86_32 */
         /* We're getting an u64 arg in (%eax,%edx): unsigned long hweight64(__u64 w) */
diff --git a/arch/x86/lib/kaslr.c b/arch/x86/lib/kaslr.c
index f7dfeda83e5c..121f59c6ee54 100644
--- a/arch/x86/lib/kaslr.c
+++ b/arch/x86/lib/kaslr.c
@@ -19,7 +19,7 @@
 #include <asm/cpufeature.h>
 #include <asm/setup.h>
 
-#define debug_putstr(v) early_printk(v)
+#define debug_putstr(v) early_printk("%s", v)
 #define has_cpuflag(f) boot_cpu_has(f)
 #define get_boot_seed() kaslr_offset()
 #endif
diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c
index ec21796ac5fd..4473cb4f8b90 100644
--- a/arch/x86/mm/ident_map.c
+++ b/arch/x86/mm/ident_map.c
@@ -3,15 +3,17 @@
  * included by both the compressed kernel and the regular kernel.
  */
 
-static void ident_pmd_init(unsigned long pmd_flag, pmd_t *pmd_page,
+static void ident_pmd_init(struct x86_mapping_info *info, pmd_t *pmd_page,
                            unsigned long addr, unsigned long end)
 {
         addr &= PMD_MASK;
         for (; addr < end; addr += PMD_SIZE) {
                 pmd_t *pmd = pmd_page + pmd_index(addr);
 
-                if (!pmd_present(*pmd))
-                        set_pmd(pmd, __pmd(addr | pmd_flag));
+                if (pmd_present(*pmd))
+                        continue;
+
+                set_pmd(pmd, __pmd((addr - info->offset) | info->pmd_flag));
         }
 }
 
@@ -30,13 +32,13 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
 
                 if (pud_present(*pud)) {
                         pmd = pmd_offset(pud, 0);
-                        ident_pmd_init(info->pmd_flag, pmd, addr, next);
+                        ident_pmd_init(info, pmd, addr, next);
                         continue;
                 }
                 pmd = (pmd_t *)info->alloc_pgt_page(info->context);
                 if (!pmd)
                         return -ENOMEM;
-                ident_pmd_init(info->pmd_flag, pmd, addr, next);
+                ident_pmd_init(info, pmd, addr, next);
                 set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE));
         }
 
@@ -44,14 +46,15 @@ static int ident_pud_init(struct x86_mapping_info *info, pud_t *pud_page,
 }
 
 int kernel_ident_mapping_init(struct x86_mapping_info *info, pgd_t *pgd_page,
-                              unsigned long addr, unsigned long end)
+                              unsigned long pstart, unsigned long pend)
 {
+        unsigned long addr = pstart + info->offset;
+        unsigned long end = pend + info->offset;
         unsigned long next;
         int result;
-        int off = info->kernel_mapping ? pgd_index(__PAGE_OFFSET) : 0;
 
         for (; addr < end; addr = next) {
-                pgd_t *pgd = pgd_page + pgd_index(addr) + off;
+                pgd_t *pgd = pgd_page + pgd_index(addr);
                 pud_t *pud;
 
                 next = (addr & PGDIR_MASK) + PGDIR_SIZE;
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 620928903be3..d28a2d741f9e 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -122,8 +122,18 @@ __ref void *alloc_low_pages(unsigned int num)
         return __va(pfn << PAGE_SHIFT);
 }
 
-/* need 3 4k for initial PMD_SIZE,  3 4k for 0-ISA_END_ADDRESS */
-#define INIT_PGT_BUF_SIZE       (6 * PAGE_SIZE)
+/*
+ * By default need 3 4k for initial PMD_SIZE,  3 4k for 0-ISA_END_ADDRESS.
+ * With KASLR memory randomization, depending on the machine e820 memory
+ * and the PUD alignment. We may need twice more pages when KASLR memory
+ * randomization is enabled.
+ */
+#ifndef CONFIG_RANDOMIZE_MEMORY
+#define INIT_PGD_PAGE_COUNT      6
+#else
+#define INIT_PGD_PAGE_COUNT      12
+#endif
+#define INIT_PGT_BUF_SIZE       (INIT_PGD_PAGE_COUNT * PAGE_SIZE)
 RESERVE_BRK(early_pgt_alloc, INIT_PGT_BUF_SIZE);
 void  __init early_alloc_pgt_buf(void)
 {
diff --git a/arch/x86/mm/kaslr.c b/arch/x86/mm/kaslr.c
index 26dccd6c0df1..bda8d5eef04d 100644
--- a/arch/x86/mm/kaslr.c
+++ b/arch/x86/mm/kaslr.c
@@ -77,7 +77,7 @@ static inline unsigned long get_padding(struct kaslr_memory_region *region)
  */
 static inline bool kaslr_memory_enabled(void)
 {
-        return kaslr_enabled() && !config_enabled(CONFIG_KASAN);
+        return kaslr_enabled() && !IS_ENABLED(CONFIG_KASAN);
 }
 
 /* Initialize base and padding for each memory region randomized with KASLR */
@@ -97,7 +97,7 @@ void __init kernel_randomize_memory(void)
          * add padding if needed (especially for memory hotplug support).
          */
         BUG_ON(kaslr_regions[0].base != &page_offset_base);
-        memory_tb = ((max_pfn << PAGE_SHIFT) >> TB_SHIFT) +
+        memory_tb = DIV_ROUND_UP(max_pfn << PAGE_SHIFT, 1UL << TB_SHIFT) +
                 CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING;
 
         /* Adapt phyiscal memory region size based on available memory */
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 849dc09fa4f0..e3353c97d086 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -917,11 +917,11 @@ static void populate_pte(struct cpa_data *cpa,
         }
 }
 
-static int populate_pmd(struct cpa_data *cpa,
-                        unsigned long start, unsigned long end,
-                        unsigned num_pages, pud_t *pud, pgprot_t pgprot)
+static long populate_pmd(struct cpa_data *cpa,
+                         unsigned long start, unsigned long end,
+                         unsigned num_pages, pud_t *pud, pgprot_t pgprot)
 {
-        unsigned int cur_pages = 0;
+        long cur_pages = 0;
         pmd_t *pmd;
         pgprot_t pmd_pgprot;
 
@@ -991,12 +991,12 @@ static int populate_pmd(struct cpa_data *cpa,
         return num_pages;
 }
 
-static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
-                        pgprot_t pgprot)
+static long populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
+                         pgprot_t pgprot)
 {
         pud_t *pud;
         unsigned long end;
-        int cur_pages = 0;
+        long cur_pages = 0;
         pgprot_t pud_pgprot;
 
         end = start + (cpa->numpages << PAGE_SHIFT);
@@ -1052,7 +1052,7 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
 
         /* Map trailing leftover */
         if (start < end) {
-                int tmp;
+                long tmp;
 
                 pud = pud_offset(pgd, start);
                 if (pud_none(*pud))
@@ -1078,7 +1078,7 @@ static int populate_pgd(struct cpa_data *cpa, unsigned long addr)
         pgprot_t pgprot = __pgprot(_KERNPG_TABLE);
         pud_t *pud = NULL;      /* shut up gcc */
         pgd_t *pgd_entry;
-        int ret;
+        long ret;
 
         pgd_entry = cpa->pgd + pgd_index(addr);
 
@@ -1327,7 +1327,8 @@ static int cpa_process_alias(struct cpa_data *cpa)
 
 static int __change_page_attr_set_clr(struct cpa_data *cpa, int checkalias)
 {
-        int ret, numpages = cpa->numpages;
+        unsigned long numpages = cpa->numpages;
+        int ret;
 
         while (numpages) {
                 /*
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index ecb1b69c1651..170cc4ff057b 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -927,9 +927,10 @@ int track_pfn_copy(struct vm_area_struct *vma)
 }
 
 /*
- * prot is passed in as a parameter for the new mapping. If the vma has a
- * linear pfn mapping for the entire range reserve the entire vma range with
- * single reserve_pfn_range call.
+ * prot is passed in as a parameter for the new mapping. If the vma has
+ * a linear pfn mapping for the entire range, or no vma is provided,
+ * reserve the entire pfn + size range with single reserve_pfn_range
+ * call.
  */
 int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
                     unsigned long pfn, unsigned long addr, unsigned long size)
@@ -938,11 +939,12 @@ int track_pfn_remap(struct vm_area_struct *vma, pgprot_t *prot,
         enum page_cache_mode pcm;
 
         /* reserve the whole chunk starting from paddr */
-        if (addr == vma->vm_start && size == (vma->vm_end - vma->vm_start)) {
+        if (!vma || (addr == vma->vm_start
+                                && size == (vma->vm_end - vma->vm_start))) {
                 int ret;
 
                 ret = reserve_pfn_range(paddr, size, prot, 0);
-                if (!ret)
+                if (ret == 0 && vma)
                         vma->vm_flags |= VM_PAT;
                 return ret;
         }
@@ -997,7 +999,7 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
         resource_size_t paddr;
         unsigned long prot;
 
-        if (!(vma->vm_flags & VM_PAT))
+        if (vma && !(vma->vm_flags & VM_PAT))
                 return;
 
         /* free the chunk starting from pfn or the whole chunk */
@@ -1011,7 +1013,8 @@ void untrack_pfn(struct vm_area_struct *vma, unsigned long pfn,
                 size = vma->vm_end - vma->vm_start;
         }
         free_pfn_range(paddr, size);
-        vma->vm_flags &= ~VM_PAT;
+        if (vma)
+                vma->vm_flags &= ~VM_PAT;
 }
 
 /*
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index 837ea36a837d..6d52b94f4bb9 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -553,15 +553,21 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
 
 /*
- * Broadwell EP Home Agent BARs erroneously return non-zero values when read.
+ * Device [8086:2fc0]
+ * Erratum HSE43
+ * CONFIG_TDP_NOMINAL CSR Implemented at Incorrect Offset
+ * http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v3-spec-update.html
  *
- * See http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
- * entry BDF2.
+ * Devices [8086:6f60,6fa0,6fc0]
+ * Erratum BDF2
+ * PCI BARs in the Home Agent Will Return Non-Zero Values During Enumeration
+ * http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
  */
-static void pci_bdwep_bar(struct pci_dev *dev)
+static void pci_invalid_bar(struct pci_dev *dev)
 {
         dev->non_compliant_bars = 1;
 }
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_bdwep_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_invalid_bar);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_invalid_bar);
diff --git a/arch/x86/pci/vmd.c b/arch/x86/pci/vmd.c
index b814ca675131..7948be342ee9 100644
--- a/arch/x86/pci/vmd.c
+++ b/arch/x86/pci/vmd.c
@@ -41,6 +41,7 @@ static DEFINE_RAW_SPINLOCK(list_lock);
  * @node:       list item for parent traversal.
  * @rcu:        RCU callback item for freeing.
  * @irq:        back pointer to parent.
+ * @enabled:    true if driver enabled IRQ
  * @virq:       the virtual IRQ value provided to the requesting driver.
  *
  * Every MSI/MSI-X IRQ requested for a device in a VMD domain will be mapped to
@@ -50,6 +51,7 @@ struct vmd_irq {
         struct list_head        node;
         struct rcu_head         rcu;
         struct vmd_irq_list     *irq;
+        bool                    enabled;
         unsigned int            virq;
 };
 
@@ -122,7 +124,9 @@ static void vmd_irq_enable(struct irq_data *data)
         unsigned long flags;
 
         raw_spin_lock_irqsave(&list_lock, flags);
+        WARN_ON(vmdirq->enabled);
         list_add_tail_rcu(&vmdirq->node, &vmdirq->irq->irq_list);
+        vmdirq->enabled = true;
         raw_spin_unlock_irqrestore(&list_lock, flags);
 
         data->chip->irq_unmask(data);
@@ -136,8 +140,10 @@ static void vmd_irq_disable(struct irq_data *data)
         data->chip->irq_mask(data);
 
         raw_spin_lock_irqsave(&list_lock, flags);
-        list_del_rcu(&vmdirq->node);
-        INIT_LIST_HEAD_RCU(&vmdirq->node);
+        if (vmdirq->enabled) {
+                list_del_rcu(&vmdirq->node);
+                vmdirq->enabled = false;
+        }
         raw_spin_unlock_irqrestore(&list_lock, flags);
 }
 
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 677e29e29473..8dd3784eb075 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -245,7 +245,7 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
          * text and allocate a new stack because we can't rely on the
          * stack pointer being < 4GB.
          */
-        if (!IS_ENABLED(CONFIG_EFI_MIXED))
+        if (!IS_ENABLED(CONFIG_EFI_MIXED) || efi_is_native())
                 return 0;
 
         /*
diff --git a/arch/x86/platform/efi/quirks.c b/arch/x86/platform/efi/quirks.c
index 4480c06cade7..89d1146f5a6f 100644
--- a/arch/x86/platform/efi/quirks.c
+++ b/arch/x86/platform/efi/quirks.c
@@ -254,6 +254,7 @@ void __init efi_free_boot_services(void)
         for_each_efi_memory_desc(md) {
                 unsigned long long start = md->phys_addr;
                 unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
+                size_t rm_size;
 
                 if (md->type != EFI_BOOT_SERVICES_CODE &&
                     md->type != EFI_BOOT_SERVICES_DATA)
@@ -263,6 +264,26 @@ void __init efi_free_boot_services(void)
                 if (md->attribute & EFI_MEMORY_RUNTIME)
                         continue;
 
+                /*
+                 * Nasty quirk: if all sub-1MB memory is used for boot
+                 * services, we can get here without having allocated the
+                 * real mode trampoline.  It's too late to hand boot services
+                 * memory back to the memblock allocator, so instead
+                 * try to manually allocate the trampoline if needed.
+                 *
+                 * I've seen this on a Dell XPS 13 9350 with firmware
+                 * 1.4.4 with SGX enabled booting Linux via Fedora 24's
+                 * grub2-efi on a hard disk.  (And no, I don't know why
+                 * this happened, but Linux should still try to boot rather
+                 * panicing early.)
+                 */
+                rm_size = real_mode_size_needed();
+                if (rm_size && (start + rm_size) < (1<<20) && size >= rm_size) {
+                        set_real_mode_mem(start, rm_size);
+                        start += rm_size;
+                        size -= rm_size;
+                }
+
                 free_bootmem_late(start, size);
         }
 
diff --git a/arch/x86/platform/uv/bios_uv.c b/arch/x86/platform/uv/bios_uv.c
index 66b2166ea4a1..23f2f3e41c7f 100644
--- a/arch/x86/platform/uv/bios_uv.c
+++ b/arch/x86/platform/uv/bios_uv.c
@@ -187,7 +187,8 @@ EXPORT_SYMBOL_GPL(uv_bios_set_legacy_vga_target);
 void uv_bios_init(void)
 {
         uv_systab = NULL;
-        if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) || !efi.uv_systab) {
+        if ((efi.uv_systab == EFI_INVALID_TABLE_ADDR) ||
+            !efi.uv_systab || efi_runtime_disabled()) {
                 pr_crit("UV: UVsystab: missing\n");
                 return;
         }
@@ -199,12 +200,14 @@ void uv_bios_init(void)
                 return;
         }
 
+        /* Starting with UV4 the UV systab size is variable */
         if (uv_systab->revision >= UV_SYSTAB_VERSION_UV4) {
+                int size = uv_systab->size;
+
                 iounmap(uv_systab);
-                uv_systab = ioremap(efi.uv_systab, uv_systab->size);
+                uv_systab = ioremap(efi.uv_systab, size);
                 if (!uv_systab) {
-                        pr_err("UV: UVsystab: ioremap(%d) failed!\n",
-                                uv_systab->size);
+                        pr_err("UV: UVsystab: ioremap(%d) failed!\n", size);
                         return;
                 }
         }
diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
index f0b5f2d402af..9634557a5444 100644
--- a/arch/x86/power/hibernate_64.c
+++ b/arch/x86/power/hibernate_64.c
@@ -87,7 +87,7 @@ static int set_up_temporary_mappings(void)
         struct x86_mapping_info info = {
                 .alloc_pgt_page = alloc_pgt_page,
                 .pmd_flag       = __PAGE_KERNEL_LARGE_EXEC,
-                .kernel_mapping = true,
+                .offset         = __PAGE_OFFSET,
         };
         unsigned long mstart, mend;
         pgd_t *pgd;
@@ -113,7 +113,7 @@ static int set_up_temporary_mappings(void)
                         return result;
         }
 
-        temp_level4_pgt = (unsigned long)pgd - __PAGE_OFFSET;
+        temp_level4_pgt = __pa(pgd);
         return 0;
 }
 
diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
index 705e3fffb4a1..5db706f14111 100644
--- a/arch/x86/realmode/init.c
+++ b/arch/x86/realmode/init.c
@@ -1,9 +1,11 @@
 #include <linux/io.h>
+#include <linux/slab.h>
 #include <linux/memblock.h>
 
 #include <asm/cacheflush.h>
 #include <asm/pgtable.h>
 #include <asm/realmode.h>
+#include <asm/tlbflush.h>
 
 struct real_mode_header *real_mode_header;
 u32 *trampoline_cr4_features;
@@ -11,25 +13,37 @@ u32 *trampoline_cr4_features;
 /* Hold the pgd entry used on booting additional CPUs */
 pgd_t trampoline_pgd_entry;
 
+void __init set_real_mode_mem(phys_addr_t mem, size_t size)
+{
+        void *base = __va(mem);
+
+        real_mode_header = (struct real_mode_header *) base;
+        printk(KERN_DEBUG "Base memory trampoline at [%p] %llx size %zu\n",
+               base, (unsigned long long)mem, size);
+}
+
 void __init reserve_real_mode(void)
 {
         phys_addr_t mem;
-        unsigned char *base;
-        size_t size = PAGE_ALIGN(real_mode_blob_end - real_mode_blob);
+        size_t size = real_mode_size_needed();
+
+        if (!size)
+                return;
+
+        WARN_ON(slab_is_available());
 
         /* Has to be under 1M so we can execute real-mode AP code. */
         mem = memblock_find_in_range(0, 1<<20, size, PAGE_SIZE);
-        if (!mem)
-                panic("Cannot allocate trampoline\n");
+        if (!mem) {
+                pr_info("No sub-1M memory is available for the trampoline\n");
+                return;
+        }
 
-        base = __va(mem);
         memblock_reserve(mem, size);
-        real_mode_header = (struct real_mode_header *) base;
-        printk(KERN_DEBUG "Base memory trampoline at [%p] %llx size %zu\n",
-               base, (unsigned long long)mem, size);
+        set_real_mode_mem(mem, size);
 }
 
-void __init setup_real_mode(void)
+static void __init setup_real_mode(void)
 {
         u16 real_mode_seg;
         const u32 *rel;
@@ -84,7 +98,7 @@ void __init setup_real_mode(void)
 
         trampoline_header->start = (u64) secondary_startup_64;
         trampoline_cr4_features = &trampoline_header->cr4;
-        *trampoline_cr4_features = __read_cr4();
+        *trampoline_cr4_features = mmu_cr4_features;
 
         trampoline_pgd = (u64 *) __va(real_mode_header->trampoline_pgd);
         trampoline_pgd[0] = trampoline_pgd_entry.pgd;
@@ -100,7 +114,7 @@ void __init setup_real_mode(void)
  * need to mark it executable at do_pre_smp_initcalls() at least,
  * thus run it as a early_initcall().
  */
-static int __init set_real_mode_permissions(void)
+static void __init set_real_mode_permissions(void)
 {
         unsigned char *base = (unsigned char *) real_mode_header;
         size_t size = PAGE_ALIGN(real_mode_blob_end - real_mode_blob);
@@ -119,7 +133,16 @@ static int __init set_real_mode_permissions(void)
         set_memory_nx((unsigned long) base, size >> PAGE_SHIFT);
         set_memory_ro((unsigned long) base, ro_size >> PAGE_SHIFT);
         set_memory_x((unsigned long) text_start, text_size >> PAGE_SHIFT);
+}
+
+static int __init init_real_mode(void)
+{
+        if (!real_mode_header)
+                panic("Real mode trampoline was not allocated");
+
+        setup_real_mode();
+        set_real_mode_permissions();
 
         return 0;
 }
-early_initcall(set_real_mode_permissions);
+early_initcall(init_real_mode);
diff --git a/arch/x86/um/ptrace_32.c b/arch/x86/um/ptrace_32.c
index ebd4dd6ef73b..a7ef7b131e25 100644
--- a/arch/x86/um/ptrace_32.c
+++ b/arch/x86/um/ptrace_32.c
@@ -84,7 +84,10 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         case EAX:
         case EIP:
         case UESP:
+                break;
         case ORIG_EAX:
+                /* Update the syscall number. */
+                UPT_SYSCALL_NR(&child->thread.regs.regs) = value;
                 break;
         case FS:
                 if (value && (value & 3) != 3)
diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c
index faab418876ce..0b5c184dd5b3 100644
--- a/arch/x86/um/ptrace_64.c
+++ b/arch/x86/um/ptrace_64.c
@@ -78,7 +78,11 @@ int putreg(struct task_struct *child, int regno, unsigned long value)
         case RSI:
         case RDI:
         case RBP:
+                break;
+
         case ORIG_RAX:
+                /* Update the syscall number. */
+                UPT_SYSCALL_NR(&child->thread.regs.regs) = value;
                 break;
 
         case FS:
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 8ffb089b19a5..b86ebb1a9a7f 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -118,7 +118,7 @@ DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
 DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 
 /* Linux <-> Xen vCPU id mapping */
-DEFINE_PER_CPU(int, xen_vcpu_id) = -1;
+DEFINE_PER_CPU(uint32_t, xen_vcpu_id);
 EXPORT_PER_CPU_SYMBOL(xen_vcpu_id);
 
 enum xen_domain_type xen_domain_type = XEN_NATIVE;
diff --git a/block/bio.c b/block/bio.c
index f39477538fef..aa7354088008 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -667,18 +667,19 @@ struct bio *bio_clone_bioset(struct bio *bio_src, gfp_t gfp_mask,
         bio->bi_iter.bi_sector  = bio_src->bi_iter.bi_sector;
         bio->bi_iter.bi_size    = bio_src->bi_iter.bi_size;
 
-        if (bio_op(bio) == REQ_OP_DISCARD)
-                goto integrity_clone;
-
-        if (bio_op(bio) == REQ_OP_WRITE_SAME) {
+        switch (bio_op(bio)) {
+        case REQ_OP_DISCARD:
+        case REQ_OP_SECURE_ERASE:
+                break;
+        case REQ_OP_WRITE_SAME:
                 bio->bi_io_vec[bio->bi_vcnt++] = bio_src->bi_io_vec[0];
-                goto integrity_clone;
+                break;
+        default:
+                bio_for_each_segment(bv, bio_src, iter)
+                        bio->bi_io_vec[bio->bi_vcnt++] = bv;
+                break;
         }
 
-        bio_for_each_segment(bv, bio_src, iter)
-                bio->bi_io_vec[bio->bi_vcnt++] = bv;
-
-integrity_clone:
         if (bio_integrity(bio_src)) {
                 int ret;
 
@@ -1788,7 +1789,7 @@ struct bio *bio_split(struct bio *bio, int sectors,
          * Discards need a mutable bio_vec to accommodate the payload
          * required by the DSM TRIM and UNMAP commands.
          */
-        if (bio_op(bio) == REQ_OP_DISCARD)
+        if (bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_SECURE_ERASE)
                 split = bio_clone_bioset(bio, gfp, bs);
         else
                 split = bio_clone_fast(bio, gfp, bs);
diff --git a/block/blk-core.c b/block/blk-core.c
index 999442ec4601..36c7ac328d8c 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -515,7 +515,9 @@ EXPORT_SYMBOL_GPL(blk_queue_bypass_end);
 
 void blk_set_queue_dying(struct request_queue *q)
 {
-        queue_flag_set_unlocked(QUEUE_FLAG_DYING, q);
+        spin_lock_irq(q->queue_lock);
+        queue_flag_set(QUEUE_FLAG_DYING, q);
+        spin_unlock_irq(q->queue_lock);
 
         if (q->mq_ops)
                 blk_mq_wake_waiters(q);
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 3eec75a9e91d..2642e5fc8b69 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -94,9 +94,31 @@ static struct bio *blk_bio_segment_split(struct request_queue *q,
         bool do_split = true;
         struct bio *new = NULL;
         const unsigned max_sectors = get_max_io_size(q, bio);
+        unsigned bvecs = 0;
 
         bio_for_each_segment(bv, bio, iter) {
                 /*
+                 * With arbitrary bio size, the incoming bio may be very
+                 * big. We have to split the bio into small bios so that
+                 * each holds at most BIO_MAX_PAGES bvecs because
+                 * bio_clone() can fail to allocate big bvecs.
+                 *
+                 * It should have been better to apply the limit per
+                 * request queue in which bio_clone() is involved,
+                 * instead of globally. The biggest blocker is the
+                 * bio_clone() in bio bounce.
+                 *
+                 * If bio is splitted by this reason, we should have
+                 * allowed to continue bios merging, but don't do
+                 * that now for making the change simple.
+                 *
+                 * TODO: deal with bio bounce's bio_clone() gracefully
+                 * and convert the global limit into per-queue limit.
+                 */
+                if (bvecs++ >= BIO_MAX_PAGES)
+                        goto split;
+
+                /*
                  * If the queue doesn't support SG gaps and adding this
                  * offset would create a gap, disallow it.
                  */
@@ -172,12 +194,18 @@ void blk_queue_split(struct request_queue *q, struct bio **bio,
         struct bio *split, *res;
         unsigned nsegs;
 
-        if (bio_op(*bio) == REQ_OP_DISCARD)
+        switch (bio_op(*bio)) {
+        case REQ_OP_DISCARD:
+        case REQ_OP_SECURE_ERASE:
                 split = blk_bio_discard_split(q, *bio, bs, &nsegs);
-        else if (bio_op(*bio) == REQ_OP_WRITE_SAME)
+                break;
+        case REQ_OP_WRITE_SAME:
                 split = blk_bio_write_same_split(q, *bio, bs, &nsegs);
-        else
+                break;
+        default:
                 split = blk_bio_segment_split(q, *bio, q->bio_split, &nsegs);
+                break;
+        }
 
         /* physical segments can be figured out during splitting */
         res = split ? split : *bio;
@@ -213,7 +241,7 @@ static unsigned int __blk_recalc_rq_segments(struct request_queue *q,
          * This should probably be returning 0, but blk_add_request_payload()
          * (Christoph!!!!)
          */
-        if (bio_op(bio) == REQ_OP_DISCARD)
+        if (bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_SECURE_ERASE)
                 return 1;
 
         if (bio_op(bio) == REQ_OP_WRITE_SAME)
@@ -385,7 +413,9 @@ static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio,
         nsegs = 0;
         cluster = blk_queue_cluster(q);
 
-        if (bio_op(bio) == REQ_OP_DISCARD) {
+        switch (bio_op(bio)) {
+        case REQ_OP_DISCARD:
+        case REQ_OP_SECURE_ERASE:
                 /*
                  * This is a hack - drivers should be neither modifying the
                  * biovec, nor relying on bi_vcnt - but because of
@@ -393,19 +423,16 @@ static int __blk_bios_map_sg(struct request_queue *q, struct bio *bio,
                  * a payload we need to set up here (thank you Christoph) and
                  * bi_vcnt is really the only way of telling if we need to.
                  */
-
-                if (bio->bi_vcnt)
-                        goto single_segment;
-
-                return 0;
-        }
-
-        if (bio_op(bio) == REQ_OP_WRITE_SAME) {
-single_segment:
+                if (!bio->bi_vcnt)
+                        return 0;
+                /* Fall through */
+        case REQ_OP_WRITE_SAME:
                 *sg = sglist;
                 bvec = bio_iovec(bio);
                 sg_set_page(*sg, bvec.bv_page, bvec.bv_len, bvec.bv_offset);
                 return 1;
+        default:
+                break;
         }
 
         for_each_bio(bio)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index e931a0e8e73d..c207fa9870eb 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -296,17 +296,29 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q, int rw,
         if (ret)
                 return ERR_PTR(ret);
 
+        /*
+         * Check if the hardware context is actually mapped to anything.
+         * If not tell the caller that it should skip this queue.
+         */
         hctx = q->queue_hw_ctx[hctx_idx];
+        if (!blk_mq_hw_queue_mapped(hctx)) {
+                ret = -EXDEV;
+                goto out_queue_exit;
+        }
         ctx = __blk_mq_get_ctx(q, cpumask_first(hctx->cpumask));
 
         blk_mq_set_alloc_data(&alloc_data, q, flags, ctx, hctx);
         rq = __blk_mq_alloc_request(&alloc_data, rw, 0);
         if (!rq) {
-                blk_queue_exit(q);
-                return ERR_PTR(-EWOULDBLOCK);
+                ret = -EWOULDBLOCK;
+                goto out_queue_exit;
         }
 
         return rq;
+
+out_queue_exit:
+        blk_queue_exit(q);
+        return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(blk_mq_alloc_request_hctx);
 
@@ -793,11 +805,12 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx)
         struct list_head *dptr;
         int queued;
 
-        WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask));
-
         if (unlikely(test_bit(BLK_MQ_S_STOPPED, &hctx->state)))
                 return;
 
+        WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) &&
+                cpu_online(hctx->next_cpu));
+
         hctx->run++;
 
         /*
@@ -1036,10 +1049,11 @@ void blk_mq_delay_queue(struct blk_mq_hw_ctx *hctx, unsigned long msecs)
 EXPORT_SYMBOL(blk_mq_delay_queue);
 
 static inline void __blk_mq_insert_req_list(struct blk_mq_hw_ctx *hctx,
-                                            struct blk_mq_ctx *ctx,
                                             struct request *rq,
                                             bool at_head)
 {
+        struct blk_mq_ctx *ctx = rq->mq_ctx;
+
         trace_block_rq_insert(hctx->queue, rq);
 
         if (at_head)
@@ -1053,20 +1067,16 @@ static void __blk_mq_insert_request(struct blk_mq_hw_ctx *hctx,
 {
         struct blk_mq_ctx *ctx = rq->mq_ctx;
 
-        __blk_mq_insert_req_list(hctx, ctx, rq, at_head);
+        __blk_mq_insert_req_list(hctx, rq, at_head);
         blk_mq_hctx_mark_pending(hctx, ctx);
 }
 
 void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,
-                bool async)
+                           bool async)
 {
+        struct blk_mq_ctx *ctx = rq->mq_ctx;
         struct request_queue *q = rq->q;
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *ctx = rq->mq_ctx, *current_ctx;
-
-        current_ctx = blk_mq_get_ctx(q);
-        if (!cpu_online(ctx->cpu))
-                rq->mq_ctx = ctx = current_ctx;
 
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
@@ -1076,8 +1086,6 @@ void blk_mq_insert_request(struct request *rq, bool at_head, bool run_queue,
 
         if (run_queue)
                 blk_mq_run_hw_queue(hctx, async);
-
-        blk_mq_put_ctx(current_ctx);
 }
 
 static void blk_mq_insert_requests(struct request_queue *q,
@@ -1088,14 +1096,9 @@ static void blk_mq_insert_requests(struct request_queue *q,
 
 {
         struct blk_mq_hw_ctx *hctx;
-        struct blk_mq_ctx *current_ctx;
 
         trace_block_unplug(q, depth, !from_schedule);
 
-        current_ctx = blk_mq_get_ctx(q);
-
-        if (!cpu_online(ctx->cpu))
-                ctx = current_ctx;
         hctx = q->mq_ops->map_queue(q, ctx->cpu);
 
         /*
@@ -1107,15 +1110,14 @@ static void blk_mq_insert_requests(struct request_queue *q,
                 struct request *rq;
 
                 rq = list_first_entry(list, struct request, queuelist);
+                BUG_ON(rq->mq_ctx != ctx);
                 list_del_init(&rq->queuelist);
-                rq->mq_ctx = ctx;
-                __blk_mq_insert_req_list(hctx, ctx, rq, false);
+                __blk_mq_insert_req_list(hctx, rq, false);
         }
         blk_mq_hctx_mark_pending(hctx, ctx);
         spin_unlock(&ctx->lock);
 
         blk_mq_run_hw_queue(hctx, from_schedule);
-        blk_mq_put_ctx(current_ctx);
 }
 
 static int plug_ctx_cmp(void *priv, struct list_head *a, struct list_head *b)
@@ -1630,16 +1632,17 @@ static int blk_mq_alloc_bitmap(struct blk_mq_ctxmap *bitmap, int node)
         return 0;
 }
 
+/*
+ * 'cpu' is going away. splice any existing rq_list entries from this
+ * software queue to the hw queue dispatch list, and ensure that it
+ * gets run.
+ */
 static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu)
 {
-        struct request_queue *q = hctx->queue;
         struct blk_mq_ctx *ctx;
         LIST_HEAD(tmp);
 
-        /*
-         * Move ctx entries to new CPU, if this one is going away.
-         */
-        ctx = __blk_mq_get_ctx(q, cpu);
+        ctx = __blk_mq_get_ctx(hctx->queue, cpu);
 
         spin_lock(&ctx->lock);
         if (!list_empty(&ctx->rq_list)) {
@@ -1651,24 +1654,11 @@ static int blk_mq_hctx_cpu_offline(struct blk_mq_hw_ctx *hctx, int cpu)
         if (list_empty(&tmp))
                 return NOTIFY_OK;
 
-        ctx = blk_mq_get_ctx(q);
-        spin_lock(&ctx->lock);
-
-        while (!list_empty(&tmp)) {
-                struct request *rq;
-
-                rq = list_first_entry(&tmp, struct request, queuelist);
-                rq->mq_ctx = ctx;
-                list_move_tail(&rq->queuelist, &ctx->rq_list);
-        }
-
-        hctx = q->mq_ops->map_queue(q, ctx->cpu);
-        blk_mq_hctx_mark_pending(hctx, ctx);
-
-        spin_unlock(&ctx->lock);
+        spin_lock(&hctx->lock);
+        list_splice_tail_init(&tmp, &hctx->dispatch);
+        spin_unlock(&hctx->lock);
 
         blk_mq_run_hw_queue(hctx, true);
-        blk_mq_put_ctx(ctx);
         return NOTIFY_OK;
 }
 
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index f1aba26f4719..a3ea8260c94c 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -780,9 +780,11 @@ static bool tg_may_dispatch(struct throtl_grp *tg, struct bio *bio,
         /*
          * If previous slice expired, start a new one otherwise renew/extend
          * existing slice to make sure it is at least throtl_slice interval
-         * long since now.
+         * long since now. New slice is started only for empty throttle group.
+         * If there is queued bio, that means there should be an active
+         * slice and it should be extended instead.
          */
-        if (throtl_slice_used(tg, rw))
+        if (throtl_slice_used(tg, rw) && !(tg->service_queue.nr_queued[rw]))
                 throtl_start_new_slice(tg, rw);
         else {
                 if (time_before(tg->slice_end[rw], jiffies + throtl_slice))
diff --git a/block/elevator.c b/block/elevator.c
index 7096c22041e7..f7d973a56fd7 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -366,7 +366,7 @@ void elv_dispatch_sort(struct request_queue *q, struct request *rq)
         list_for_each_prev(entry, &q->queue_head) {
                 struct request *pos = list_entry_rq(entry);
 
-                if ((req_op(rq) == REQ_OP_DISCARD) != (req_op(pos) == REQ_OP_DISCARD))
+                if (req_op(rq) != req_op(pos))
                         break;
                 if (rq_data_dir(rq) != rq_data_dir(pos))
                         break;
diff --git a/crypto/Kconfig b/crypto/Kconfig
index a9377bef25e3..84d71482bf08 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -439,7 +439,7 @@ config CRYPTO_CRC32C_INTEL
 
 config CRYPT_CRC32C_VPMSUM
         tristate "CRC32c CRC algorithm (powerpc64)"
-        depends on PPC64
+        depends on PPC64 && ALTIVEC
         select CRYPTO_HASH
         select CRC32
         help
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
index 369999530108..a832426820e8 100644
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -233,6 +233,8 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
                 return blkcipher_walk_done(desc, walk, -EINVAL);
         }
 
+        bsize = min(walk->walk_blocksize, n);
+
         walk->flags &= ~(BLKCIPHER_WALK_SLOW | BLKCIPHER_WALK_COPY |
                          BLKCIPHER_WALK_DIFF);
         if (!scatterwalk_aligned(&walk->in, walk->alignmask) ||
@@ -245,7 +247,6 @@ static int blkcipher_walk_next(struct blkcipher_desc *desc,
                 }
         }
 
-        bsize = min(walk->walk_blocksize, n);
         n = scatterwalk_clamp(&walk->in, n);
         n = scatterwalk_clamp(&walk->out, n);
 
diff --git a/crypto/cryptd.c b/crypto/cryptd.c
index cf8037a87b2d..0c654e59f215 100644
--- a/crypto/cryptd.c
+++ b/crypto/cryptd.c
@@ -631,9 +631,14 @@ static int cryptd_hash_export(struct ahash_request *req, void *out)
 
 static int cryptd_hash_import(struct ahash_request *req, const void *in)
 {
-        struct cryptd_hash_request_ctx *rctx = ahash_request_ctx(req);
+        struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
+        struct cryptd_hash_ctx *ctx = crypto_ahash_ctx(tfm);
+        struct shash_desc *desc = cryptd_shash_desc(req);
+
+        desc->tfm = ctx->child;
+        desc->flags = req->base.flags;
 
-        return crypto_shash_import(&rctx->desc, in);
+        return crypto_shash_import(desc, in);
 }
 
 static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
@@ -733,13 +738,14 @@ static void cryptd_aead_crypt(struct aead_request *req,
         rctx = aead_request_ctx(req);
         compl = rctx->complete;
 
+        tfm = crypto_aead_reqtfm(req);
+
         if (unlikely(err == -EINPROGRESS))
                 goto out;
         aead_request_set_tfm(req, child);
         err = crypt( req );
 
 out:
-        tfm = crypto_aead_reqtfm(req);
         ctx = crypto_aead_ctx(tfm);
         refcnt = atomic_read(&ctx->refcnt);
 
diff --git a/crypto/echainiv.c b/crypto/echainiv.c
index 1b01fe98e91f..e3d889b122e0 100644
--- a/crypto/echainiv.c
+++ b/crypto/echainiv.c
@@ -1,8 +1,8 @@
 /*
  * echainiv: Encrypted Chain IV Generator
  *
- * This generator generates an IV based on a sequence number by xoring it
- * with a salt and then encrypting it with the same key as used to encrypt
+ * This generator generates an IV based on a sequence number by multiplying
+ * it with a salt and then encrypting it with the same key as used to encrypt
  * the plain text.  This algorithm requires that the block size be equal
  * to the IV size.  It is mainly useful for CBC.
  *
@@ -24,81 +24,17 @@
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/mm.h>
 #include <linux/module.h>
-#include <linux/percpu.h>
-#include <linux/spinlock.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 
-#define MAX_IV_SIZE 16
-
-static DEFINE_PER_CPU(u32 [MAX_IV_SIZE / sizeof(u32)], echainiv_iv);
-
-/* We don't care if we get preempted and read/write IVs from the next CPU. */
-static void echainiv_read_iv(u8 *dst, unsigned size)
-{
-        u32 *a = (u32 *)dst;
-        u32 __percpu *b = echainiv_iv;
-
-        for (; size >= 4; size -= 4) {
-                *a++ = this_cpu_read(*b);
-                b++;
-        }
-}
-
-static void echainiv_write_iv(const u8 *src, unsigned size)
-{
-        const u32 *a = (const u32 *)src;
-        u32 __percpu *b = echainiv_iv;
-
-        for (; size >= 4; size -= 4) {
-                this_cpu_write(*b, *a);
-                a++;
-                b++;
-        }
-}
-
-static void echainiv_encrypt_complete2(struct aead_request *req, int err)
-{
-        struct aead_request *subreq = aead_request_ctx(req);
-        struct crypto_aead *geniv;
-        unsigned int ivsize;
-
-        if (err == -EINPROGRESS)
-                return;
-
-        if (err)
-                goto out;
-
-        geniv = crypto_aead_reqtfm(req);
-        ivsize = crypto_aead_ivsize(geniv);
-
-        echainiv_write_iv(subreq->iv, ivsize);
-
-        if (req->iv != subreq->iv)
-                memcpy(req->iv, subreq->iv, ivsize);
-
-out:
-        if (req->iv != subreq->iv)
-                kzfree(subreq->iv);
-}
-
-static void echainiv_encrypt_complete(struct crypto_async_request *base,
-                                         int err)
-{
-        struct aead_request *req = base->data;
-
-        echainiv_encrypt_complete2(req, err);
-        aead_request_complete(req, err);
-}
-
 static int echainiv_encrypt(struct aead_request *req)
 {
         struct crypto_aead *geniv = crypto_aead_reqtfm(req);
         struct aead_geniv_ctx *ctx = crypto_aead_ctx(geniv);
         struct aead_request *subreq = aead_request_ctx(req);
-        crypto_completion_t compl;
-        void *data;
+        __be64 nseqno;
+        u64 seqno;
         u8 *info;
         unsigned int ivsize = crypto_aead_ivsize(geniv);
         int err;
@@ -108,8 +44,6 @@ static int echainiv_encrypt(struct aead_request *req)
 
         aead_request_set_tfm(subreq, ctx->child);
 
-        compl = echainiv_encrypt_complete;
-        data = req;
         info = req->iv;
 
         if (req->src != req->dst) {
@@ -127,29 +61,30 @@ static int echainiv_encrypt(struct aead_request *req)
                         return err;
         }
 
-        if (unlikely(!IS_ALIGNED((unsigned long)info,
-                                 crypto_aead_alignmask(geniv) + 1))) {
-                info = kmalloc(ivsize, req->base.flags &
-                                       CRYPTO_TFM_REQ_MAY_SLEEP ? GFP_KERNEL:
-                                                                  GFP_ATOMIC);
-                if (!info)
-                        return -ENOMEM;
-
-                memcpy(info, req->iv, ivsize);
-        }
-
-        aead_request_set_callback(subreq, req->base.flags, compl, data);
+        aead_request_set_callback(subreq, req->base.flags,
+                                  req->base.complete, req->base.data);
         aead_request_set_crypt(subreq, req->dst, req->dst,
                                req->cryptlen, info);
         aead_request_set_ad(subreq, req->assoclen);
 
-        crypto_xor(info, ctx->salt, ivsize);
+        memcpy(&nseqno, info + ivsize - 8, 8);
+        seqno = be64_to_cpu(nseqno);
+        memset(info, 0, ivsize);
+
         scatterwalk_map_and_copy(info, req->dst, req->assoclen, ivsize, 1);
-        echainiv_read_iv(info, ivsize);
 
-        err = crypto_aead_encrypt(subreq);
-        echainiv_encrypt_complete2(req, err);
-        return err;
+        do {
+                u64 a;
+
+                memcpy(&a, ctx->salt + ivsize - 8, 8);
+
+                a |= 1;
+                a *= seqno;
+
+                memcpy(info + ivsize - 8, &a, 8);
+        } while ((ivsize -= 8));
+
+        return crypto_aead_encrypt(subreq);
 }
 
 static int echainiv_decrypt(struct aead_request *req)
@@ -196,8 +131,7 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
         alg = crypto_spawn_aead_alg(spawn);
 
         err = -EINVAL;
-        if (inst->alg.ivsize & (sizeof(u32) - 1) ||
-            inst->alg.ivsize > MAX_IV_SIZE)
+        if (inst->alg.ivsize & (sizeof(u64) - 1) || !inst->alg.ivsize)
                 goto free_inst;
 
         inst->alg.encrypt = echainiv_encrypt;
@@ -206,7 +140,6 @@ static int echainiv_aead_create(struct crypto_template *tmpl,
         inst->alg.init = aead_init_geniv;
         inst->alg.exit = aead_exit_geniv;
 
-        inst->alg.base.cra_alignmask |= __alignof__(u32) - 1;
         inst->alg.base.cra_ctxsize = sizeof(struct aead_geniv_ctx);
         inst->alg.base.cra_ctxsize += inst->alg.ivsize;
 
diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
index 877019a6d3ea..8baab4307f7b 100644
--- a/crypto/rsa-pkcs1pad.c
+++ b/crypto/rsa-pkcs1pad.c
@@ -298,41 +298,48 @@ static int pkcs1pad_decrypt_complete(struct akcipher_request *req, int err)
         struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req);
         struct pkcs1pad_ctx *ctx = akcipher_tfm_ctx(tfm);
         struct pkcs1pad_request *req_ctx = akcipher_request_ctx(req);
+        unsigned int dst_len;
         unsigned int pos;
-
-        if (err == -EOVERFLOW)
-                /* Decrypted value had no leading 0 byte */
-                err = -EINVAL;
+        u8 *out_buf;
 
         if (err)
                 goto done;
 
-        if (req_ctx->child_req.dst_len != ctx->key_size - 1) {
-                err = -EINVAL;
+        err = -EINVAL;
+        dst_len = req_ctx->child_req.dst_len;
+        if (dst_len < ctx->key_size - 1)
                 goto done;
+
+        out_buf = req_ctx->out_buf;
+        if (dst_len == ctx->key_size) {
+                if (out_buf[0] != 0x00)
+                        /* Decrypted value had no leading 0 byte */
+                        goto done;
+
+                dst_len--;
+                out_buf++;
         }
 
-        if (req_ctx->out_buf[0] != 0x02) {
-                err = -EINVAL;
+        if (out_buf[0] != 0x02)
                 goto done;
-        }
-        for (pos = 1; pos < req_ctx->child_req.dst_len; pos++)
-                if (req_ctx->out_buf[pos] == 0x00)
+
+        for (pos = 1; pos < dst_len; pos++)
+                if (out_buf[pos] == 0x00)
                         break;
-        if (pos < 9 || pos == req_ctx->child_req.dst_len) {
-                err = -EINVAL;
+        if (pos < 9 || pos == dst_len)
                 goto done;
-        }
         pos++;
 
-        if (req->dst_len < req_ctx->child_req.dst_len - pos)
+        err = 0;
+
+        if (req->dst_len < dst_len - pos)
                 err = -EOVERFLOW;
-        req->dst_len = req_ctx->child_req.dst_len - pos;
+        req->dst_len = dst_len - pos;
 
         if (!err)
                 sg_copy_from_buffer(req->dst,
                                 sg_nents_for_len(req->dst, req->dst_len),
-                                req_ctx->out_buf + pos, req->dst_len);
+                                out_buf + pos, req->dst_len);
 
 done:
         kzfree(req_ctx->out_buf);
diff --git a/crypto/sha3_generic.c b/crypto/sha3_generic.c
index 62264397a2d2..7e8ed96236ce 100644
--- a/crypto/sha3_generic.c
+++ b/crypto/sha3_generic.c
@@ -24,14 +24,14 @@
 #define ROTL64(x, y) (((x) << (y)) | ((x) >> (64 - (y))))
 
 static const u64 keccakf_rndc[24] = {
-        0x0000000000000001, 0x0000000000008082, 0x800000000000808a,
-        0x8000000080008000, 0x000000000000808b, 0x0000000080000001,
-        0x8000000080008081, 0x8000000000008009, 0x000000000000008a,
-        0x0000000000000088, 0x0000000080008009, 0x000000008000000a,
-        0x000000008000808b, 0x800000000000008b, 0x8000000000008089,
-        0x8000000000008003, 0x8000000000008002, 0x8000000000000080,
-        0x000000000000800a, 0x800000008000000a, 0x8000000080008081,
-        0x8000000000008080, 0x0000000080000001, 0x8000000080008008
+        0x0000000000000001ULL, 0x0000000000008082ULL, 0x800000000000808aULL,
+        0x8000000080008000ULL, 0x000000000000808bULL, 0x0000000080000001ULL,
+        0x8000000080008081ULL, 0x8000000000008009ULL, 0x000000000000008aULL,
+        0x0000000000000088ULL, 0x0000000080008009ULL, 0x000000008000000aULL,
+        0x000000008000808bULL, 0x800000000000008bULL, 0x8000000000008089ULL,
+        0x8000000000008003ULL, 0x8000000000008002ULL, 0x8000000000000080ULL,
+        0x000000000000800aULL, 0x800000008000000aULL, 0x8000000080008081ULL,
+        0x8000000000008080ULL, 0x0000000080000001ULL, 0x8000000080008008ULL
 };
 
 static const int keccakf_rotc[24] = {
diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
index 8c234dd9b8bc..80cc7c089a15 100644
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -1527,11 +1527,12 @@ static u32 read_blk_stat(struct nfit_blk *nfit_blk, unsigned int bw)
 {
         struct nfit_blk_mmio *mmio = &nfit_blk->mmio[DCR];
         u64 offset = nfit_blk->stat_offset + mmio->size * bw;
+        const u32 STATUS_MASK = 0x80000037;
 
         if (mmio->num_lines)
                 offset = to_interleave_offset(offset, mmio);
 
-        return readl(mmio->addr.base + offset);
+        return readl(mmio->addr.base + offset) & STATUS_MASK;
 }
 
 static void write_blk_ctl(struct nfit_blk *nfit_blk, unsigned int bw,
diff --git a/drivers/acpi/nfit/mce.c b/drivers/acpi/nfit/mce.c
index 4c745bf389fe..161f91539ae6 100644
--- a/drivers/acpi/nfit/mce.c
+++ b/drivers/acpi/nfit/mce.c
@@ -42,7 +42,7 @@ static int nfit_handle_mce(struct notifier_block *nb, unsigned long val,
                 list_for_each_entry(nfit_spa, &acpi_desc->spas, list) {
                         struct acpi_nfit_system_address *spa = nfit_spa->spa;
 
-                        if (nfit_spa_type(spa) == NFIT_SPA_PM)
+                        if (nfit_spa_type(spa) != NFIT_SPA_PM)
                                 continue;
                         /* find the spa that covers the mce addr */
                         if (spa->address > mce->addr)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ad9fc84a8601..e878fc799af7 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -2054,7 +2054,7 @@ int __init acpi_scan_init(void)
 
 static struct acpi_probe_entry *ape;
 static int acpi_probe_count;
-static DEFINE_SPINLOCK(acpi_probe_lock);
+static DEFINE_MUTEX(acpi_probe_mutex);
 
 static int __init acpi_match_madt(struct acpi_subtable_header *header,
                                   const unsigned long end)
@@ -2073,7 +2073,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
         if (acpi_disabled)
                 return 0;
 
-        spin_lock(&acpi_probe_lock);
+        mutex_lock(&acpi_probe_mutex);
         for (ape = ap_head; nr; ape++, nr--) {
                 if (ACPI_COMPARE_NAME(ACPI_SIG_MADT, ape->id)) {
                         acpi_probe_count = 0;
@@ -2086,7 +2086,7 @@ int __init __acpi_probe_device_table(struct acpi_probe_entry *ap_head, int nr)
                                 count++;
                 }
         }
-        spin_unlock(&acpi_probe_lock);
+        mutex_unlock(&acpi_probe_mutex);
 
         return count;
 }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 7461a587b39b..dcf2c724fd06 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -2524,7 +2524,7 @@ static int ahci_host_activate_multi_irqs(struct ata_host *host,
 
                 /* Do not receive interrupts sent by dummy ports */
                 if (!pp) {
-                        disable_irq(irq + i);
+                        disable_irq(irq);
                         continue;
                 }
 
diff --git a/drivers/ata/pata_ninja32.c b/drivers/ata/pata_ninja32.c
index 633aa2934a18..44f97ad3c88d 100644
--- a/drivers/ata/pata_ninja32.c
+++ b/drivers/ata/pata_ninja32.c
@@ -144,7 +144,7 @@ static int ninja32_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         ap->ioaddr.altstatus_addr = base + 0x1E;
         ap->ioaddr.bmdma_addr = base;
         ata_sff_std_ports(&ap->ioaddr);
-        ap->pflags = ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
+        ap->pflags |= ATA_PFLAG_PIO32 | ATA_PFLAG_PIO32CHANGE;
 
         ninja32_program(base);
         /* FIXME: Should we disable them at remove ? */
diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
index e097d355cc04..82a081ea4317 100644
--- a/drivers/base/power/runtime.c
+++ b/drivers/base/power/runtime.c
@@ -301,7 +301,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
         int (*callback)(struct device *);
         int retval;
 
-        trace_rpm_idle(dev, rpmflags);
+        trace_rpm_idle_rcuidle(dev, rpmflags);
         retval = rpm_check_suspend_allowed(dev);
         if (retval < 0)
                 ;       /* Conditions are wrong. */
@@ -337,7 +337,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
                         dev->power.request_pending = true;
                         queue_work(pm_wq, &dev->power.work);
                 }
-                trace_rpm_return_int(dev, _THIS_IP_, 0);
+                trace_rpm_return_int_rcuidle(dev, _THIS_IP_, 0);
                 return 0;
         }
 
@@ -352,7 +352,7 @@ static int rpm_idle(struct device *dev, int rpmflags)
         wake_up_all(&dev->power.wait_queue);
 
  out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
         return retval ? retval : rpm_suspend(dev, rpmflags | RPM_AUTO);
 }
 
@@ -419,7 +419,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
         struct device *parent = NULL;
         int retval;
 
-        trace_rpm_suspend(dev, rpmflags);
+        trace_rpm_suspend_rcuidle(dev, rpmflags);
 
  repeat:
         retval = rpm_check_suspend_allowed(dev);
@@ -549,7 +549,7 @@ static int rpm_suspend(struct device *dev, int rpmflags)
         }
 
  out:
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
 
         return retval;
 
@@ -601,7 +601,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
         struct device *parent = NULL;
         int retval = 0;
 
-        trace_rpm_resume(dev, rpmflags);
+        trace_rpm_resume_rcuidle(dev, rpmflags);
 
  repeat:
         if (dev->power.runtime_error)
@@ -764,7 +764,7 @@ static int rpm_resume(struct device *dev, int rpmflags)
                 spin_lock_irq(&dev->power.lock);
         }
 
-        trace_rpm_return_int(dev, _THIS_IP_, retval);
+        trace_rpm_return_int_rcuidle(dev, _THIS_IP_, retval);
 
         return retval;
 }
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index aa56af87d941..b11af3f2c1db 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -404,6 +404,7 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                 unsigned int new_base_reg, new_top_reg;
                 unsigned int min, max;
                 unsigned int max_dist;
+                unsigned int dist, best_dist = UINT_MAX;
 
                 max_dist = map->reg_stride * sizeof(*rbnode_tmp) /
                         map->cache_word_size;
@@ -423,24 +424,41 @@ static int regcache_rbtree_write(struct regmap *map, unsigned int reg,
                                 &base_reg, &top_reg);
 
                         if (base_reg <= max && top_reg >= min) {
-                                new_base_reg = min(reg, base_reg);
-                                new_top_reg = max(reg, top_reg);
-                        } else {
-                                if (max < base_reg)
-                                        node = node->rb_left;
+                                if (reg < base_reg)
+                                        dist = base_reg - reg;
+                                else if (reg > top_reg)
+                                        dist = reg - top_reg;
                                 else
-                                        node = node->rb_right;
-
-                                continue;
+                                        dist = 0;
+                                if (dist < best_dist) {
+                                        rbnode = rbnode_tmp;
+                                        best_dist = dist;
+                                        new_base_reg = min(reg, base_reg);
+                                        new_top_reg = max(reg, top_reg);
+                                }
                         }
 
-                        ret = regcache_rbtree_insert_to_block(map, rbnode_tmp,
+                        /*
+                         * Keep looking, we want to choose the closest block,
+                         * otherwise we might end up creating overlapping
+                         * blocks, which breaks the rbtree.
+                         */
+                        if (reg < base_reg)
+                                node = node->rb_left;
+                        else if (reg > top_reg)
+                                node = node->rb_right;
+                        else
+                                break;
+                }
+
+                if (rbnode) {
+                        ret = regcache_rbtree_insert_to_block(map, rbnode,
                                                               new_base_reg,
                                                               new_top_reg, reg,
                                                               value);
                         if (ret)
                                 return ret;
-                        rbtree_ctx->cached_rbnode = rbnode_tmp;
+                        rbtree_ctx->cached_rbnode = rbnode;
                         return 0;
                 }
 
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index df7ff7290821..4e582561e1e7 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -38,10 +38,11 @@ static int regcache_hw_init(struct regmap *map)
 
         /* calculate the size of reg_defaults */
         for (count = 0, i = 0; i < map->num_reg_defaults_raw; i++)
-                if (!regmap_volatile(map, i * map->reg_stride))
+                if (regmap_readable(map, i * map->reg_stride) &&
+                    !regmap_volatile(map, i * map->reg_stride))
                         count++;
 
-        /* all registers are volatile, so just bypass */
+        /* all registers are unreadable or volatile, so just bypass */
         if (!count) {
                 map->cache_bypass = true;
                 return 0;
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 51fa7d66a393..e964d068874d 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1474,6 +1474,12 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
                 ret = map->bus->write(map->bus_context, buf, len);
 
                 kfree(buf);
+        } else if (ret != 0 && !map->cache_bypass && map->format.parse_val) {
+                /* regcache_drop_region() takes lock that we already have,
+                 * thus call map->cache_ops->drop() directly
+                 */
+                if (map->cache_ops && map->cache_ops->drop)
+                        map->cache_ops->drop(map, reg, reg + 1);
         }
 
         trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index b71a9c767009..e3d8e4ced4a2 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3706,22 +3706,21 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
         if (UFDCS->rawcmd == 1)
                 UFDCS->rawcmd = 2;
 
-        if (mode & (FMODE_READ|FMODE_WRITE)) {
-                UDRS->last_checked = 0;
-                clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
-                check_disk_change(bdev);
-                if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
-                        goto out;
-                if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+        if (!(mode & FMODE_NDELAY)) {
+                if (mode & (FMODE_READ|FMODE_WRITE)) {
+                        UDRS->last_checked = 0;
+                        clear_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags);
+                        check_disk_change(bdev);
+                        if (test_bit(FD_DISK_CHANGED_BIT, &UDRS->flags))
+                                goto out;
+                        if (test_bit(FD_OPEN_SHOULD_FAIL_BIT, &UDRS->flags))
+                                goto out;
+                }
+                res = -EROFS;
+                if ((mode & FMODE_WRITE) &&
+                    !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
                         goto out;
         }
-
-        res = -EROFS;
-
-        if ((mode & FMODE_WRITE) &&
-                        !test_bit(FD_DISK_WRITABLE_BIT, &UDRS->flags))
-                goto out;
-
         mutex_unlock(&open_lock);
         mutex_unlock(&floppy_mutex);
         return 0;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 1a04af6d2421..6c6519f6492a 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3950,6 +3950,7 @@ static void rbd_dev_release(struct device *dev)
         bool need_put = !!rbd_dev->opts;
 
         ceph_oid_destroy(&rbd_dev->header_oid);
+        ceph_oloc_destroy(&rbd_dev->header_oloc);
 
         rbd_put_client(rbd_dev->rbd_client);
         rbd_spec_put(rbd_dev->spec);
@@ -5336,15 +5337,6 @@ static ssize_t do_rbd_add(struct bus_type *bus,
         }
         spec->pool_id = (u64)rc;
 
-        /* The ceph file layout needs to fit pool id in 32 bits */
-
-        if (spec->pool_id > (u64)U32_MAX) {
-                rbd_warn(NULL, "pool id too large (%llu > %u)",
-                                (unsigned long long)spec->pool_id, U32_MAX);
-                rc = -EIO;
-                goto err_out_client;
-        }
-
         rbd_dev = rbd_dev_create(rbdc, spec, rbd_opts);
         if (!rbd_dev) {
                 rc = -ENOMEM;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 1523e05c46fc..93b1aaa5ba3b 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -391,22 +391,16 @@ static int init_vq(struct virtio_blk *vblk)
                 num_vqs = 1;
 
         vblk->vqs = kmalloc(sizeof(*vblk->vqs) * num_vqs, GFP_KERNEL);
-        if (!vblk->vqs) {
-                err = -ENOMEM;
-                goto out;
-        }
+        if (!vblk->vqs)
+                return -ENOMEM;
 
         names = kmalloc(sizeof(*names) * num_vqs, GFP_KERNEL);
-        if (!names)
-                goto err_names;
-
         callbacks = kmalloc(sizeof(*callbacks) * num_vqs, GFP_KERNEL);
-        if (!callbacks)
-                goto err_callbacks;
-
         vqs = kmalloc(sizeof(*vqs) * num_vqs, GFP_KERNEL);
-        if (!vqs)
-                goto err_vqs;
+        if (!names || !callbacks || !vqs) {
+                err = -ENOMEM;
+                goto out;
+        }
 
         for (i = 0; i < num_vqs; i++) {
                 callbacks[i] = virtblk_done;
@@ -417,7 +411,7 @@ static int init_vq(struct virtio_blk *vblk)
         /* Discover virtqueues and write information to configuration.  */
         err = vdev->config->find_vqs(vdev, num_vqs, vqs, callbacks, names);
         if (err)
-                goto err_find_vqs;
+                goto out;
 
         for (i = 0; i < num_vqs; i++) {
                 spin_lock_init(&vblk->vqs[i].lock);
@@ -425,16 +419,12 @@ static int init_vq(struct virtio_blk *vblk)
         }
         vblk->num_vqs = num_vqs;
 
- err_find_vqs:
+out:
         kfree(vqs);
- err_vqs:
         kfree(callbacks);
- err_callbacks:
         kfree(names);
- err_names:
         if (err)
                 kfree(vblk->vqs);
- out:
         return err;
 }
 
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index be4fea6a5dd3..88ef6d4729b4 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -189,6 +189,8 @@ struct blkfront_info
         struct mutex mutex;
         struct xenbus_device *xbdev;
         struct gendisk *gd;
+        u16 sector_size;
+        unsigned int physical_sector_size;
         int vdevice;
         blkif_vdev_t handle;
         enum blkif_state connected;
@@ -910,9 +912,45 @@ static struct blk_mq_ops blkfront_mq_ops = {
         .map_queue = blk_mq_map_queue,
 };
 
+static void blkif_set_queue_limits(struct blkfront_info *info)
+{
+        struct request_queue *rq = info->rq;
+        struct gendisk *gd = info->gd;
+        unsigned int segments = info->max_indirect_segments ? :
+                                BLKIF_MAX_SEGMENTS_PER_REQUEST;
+
+        queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
+
+        if (info->feature_discard) {
+                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, rq);
+                blk_queue_max_discard_sectors(rq, get_capacity(gd));
+                rq->limits.discard_granularity = info->discard_granularity;
+                rq->limits.discard_alignment = info->discard_alignment;
+                if (info->feature_secdiscard)
+                        queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, rq);
+        }
+
+        /* Hard sector size and max sectors impersonate the equiv. hardware. */
+        blk_queue_logical_block_size(rq, info->sector_size);
+        blk_queue_physical_block_size(rq, info->physical_sector_size);
+        blk_queue_max_hw_sectors(rq, (segments * XEN_PAGE_SIZE) / 512);
+
+        /* Each segment in a request is up to an aligned page in size. */
+        blk_queue_segment_boundary(rq, PAGE_SIZE - 1);
+        blk_queue_max_segment_size(rq, PAGE_SIZE);
+
+        /* Ensure a merged request will fit in a single I/O ring slot. */
+        blk_queue_max_segments(rq, segments / GRANTS_PER_PSEG);
+
+        /* Make sure buffer addresses are sector-aligned. */
+        blk_queue_dma_alignment(rq, 511);
+
+        /* Make sure we don't use bounce buffers. */
+        blk_queue_bounce_limit(rq, BLK_BOUNCE_ANY);
+}
+
 static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
-                                unsigned int physical_sector_size,
-                                unsigned int segments)
+                                unsigned int physical_sector_size)
 {
         struct request_queue *rq;
         struct blkfront_info *info = gd->private_data;
@@ -944,36 +982,11 @@ static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
         }
 
         rq->queuedata = info;
-        queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
-
-        if (info->feature_discard) {
-                queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, rq);
-                blk_queue_max_discard_sectors(rq, get_capacity(gd));
-                rq->limits.discard_granularity = info->discard_granularity;
-                rq->limits.discard_alignment = info->discard_alignment;
-                if (info->feature_secdiscard)
-                        queue_flag_set_unlocked(QUEUE_FLAG_SECERASE, rq);
-        }
-
-        /* Hard sector size and max sectors impersonate the equiv. hardware. */
-        blk_queue_logical_block_size(rq, sector_size);
-        blk_queue_physical_block_size(rq, physical_sector_size);
-        blk_queue_max_hw_sectors(rq, (segments * XEN_PAGE_SIZE) / 512);
-
-        /* Each segment in a request is up to an aligned page in size. */
-        blk_queue_segment_boundary(rq, PAGE_SIZE - 1);
-        blk_queue_max_segment_size(rq, PAGE_SIZE);
-
-        /* Ensure a merged request will fit in a single I/O ring slot. */
-        blk_queue_max_segments(rq, segments / GRANTS_PER_PSEG);
-
-        /* Make sure buffer addresses are sector-aligned. */
-        blk_queue_dma_alignment(rq, 511);
-
-        /* Make sure we don't use bounce buffers. */
-        blk_queue_bounce_limit(rq, BLK_BOUNCE_ANY);
-
-        gd->queue = rq;
+        info->rq = gd->queue = rq;
+        info->gd = gd;
+        info->sector_size = sector_size;
+        info->physical_sector_size = physical_sector_size;
+        blkif_set_queue_limits(info);
 
         return 0;
 }
@@ -1136,16 +1149,11 @@ static int xlvbd_alloc_gendisk(blkif_sector_t capacity,
         gd->private_data = info;
         set_capacity(gd, capacity);
 
-        if (xlvbd_init_blk_queue(gd, sector_size, physical_sector_size,
-                                 info->max_indirect_segments ? :
-                                 BLKIF_MAX_SEGMENTS_PER_REQUEST)) {
+        if (xlvbd_init_blk_queue(gd, sector_size, physical_sector_size)) {
                 del_gendisk(gd);
                 goto release;
         }
 
-        info->rq = gd->queue;
-        info->gd = gd;
-
         xlvbd_flush(info);
 
         if (vdisk_info & VDISK_READONLY)
@@ -1315,7 +1323,7 @@ free_shadow:
                         rinfo->ring_ref[i] = GRANT_INVALID_REF;
                 }
         }
-        free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * PAGE_SIZE));
+        free_pages((unsigned long)rinfo->ring.sring, get_order(info->nr_ring_pages * XEN_PAGE_SIZE));
         rinfo->ring.sring = NULL;
 
         if (rinfo->irq)
@@ -2007,8 +2015,10 @@ static int blkif_recover(struct blkfront_info *info)
         struct split_bio *split_bio;
 
         blkfront_gather_backend_features(info);
+        /* Reset limits changed by blk_mq_update_nr_hw_queues(). */
+        blkif_set_queue_limits(info);
         segs = info->max_indirect_segments ? : BLKIF_MAX_SEGMENTS_PER_REQUEST;
-        blk_queue_max_segments(info->rq, segs);
+        blk_queue_max_segments(info->rq, segs / GRANTS_PER_PSEG);
 
         for (r_index = 0; r_index < info->nr_rings; r_index++) {
                 struct blkfront_ring_info *rinfo = &info->rinfo[r_index];
@@ -2432,7 +2442,7 @@ static void blkfront_connect(struct blkfront_info *info)
         if (err) {
                 xenbus_dev_fatal(info->xbdev, err, "xlvbd_add at %s",
                                  info->xbdev->otherend);
-                return;
+                goto fail;
         }
 
         xenbus_switch_state(info->xbdev, XenbusStateConnected);
@@ -2445,6 +2455,11 @@ static void blkfront_connect(struct blkfront_info *info)
         device_add_disk(&info->xbdev->dev, info->gd);
 
         info->is_ready = 1;
+        return;
+
+fail:
+        blkif_free(info, 0);
+        return;
 }
 
 /**
diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c
index 5755907f836f..ffa7c9dcbd7a 100644
--- a/drivers/bus/arm-cci.c
+++ b/drivers/bus/arm-cci.c
@@ -551,7 +551,7 @@ static struct attribute *cci5xx_pmu_event_attrs[] = {
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_wrq, 0xB),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_cd_hs, 0xC),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_rq_stall_addr_hazard, 0xD),
-        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snopp_rq_stall_tt_full, 0xE),
+        CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_stall_tt_full, 0xE),
         CCI5xx_GLOBAL_EVENT_EXT_ATTR_ENTRY(cci_snoop_rq_tzmp1_prot, 0xF),
         NULL
 };
diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
index 97a9185af433..884c0305e290 100644
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -187,6 +187,7 @@ struct arm_ccn {
         struct arm_ccn_component *xp;
 
         struct arm_ccn_dt dt;
+        int mn_id;
 };
 
 static DEFINE_MUTEX(arm_ccn_mutex);
@@ -212,6 +213,7 @@ static int arm_ccn_node_to_xp_port(int node)
 #define CCN_CONFIG_TYPE(_config)        (((_config) >> 8) & 0xff)
 #define CCN_CONFIG_EVENT(_config)       (((_config) >> 16) & 0xff)
 #define CCN_CONFIG_PORT(_config)        (((_config) >> 24) & 0x3)
+#define CCN_CONFIG_BUS(_config)         (((_config) >> 24) & 0x3)
 #define CCN_CONFIG_VC(_config)          (((_config) >> 26) & 0x7)
 #define CCN_CONFIG_DIR(_config)         (((_config) >> 29) & 0x1)
 #define CCN_CONFIG_MASK(_config)        (((_config) >> 30) & 0xf)
@@ -241,6 +243,7 @@ static CCN_FORMAT_ATTR(xp, "config:0-7");
 static CCN_FORMAT_ATTR(type, "config:8-15");
 static CCN_FORMAT_ATTR(event, "config:16-23");
 static CCN_FORMAT_ATTR(port, "config:24-25");
+static CCN_FORMAT_ATTR(bus, "config:24-25");
 static CCN_FORMAT_ATTR(vc, "config:26-28");
 static CCN_FORMAT_ATTR(dir, "config:29-29");
 static CCN_FORMAT_ATTR(mask, "config:30-33");
@@ -253,6 +256,7 @@ static struct attribute *arm_ccn_pmu_format_attrs[] = {
         &arm_ccn_pmu_format_attr_type.attr.attr,
         &arm_ccn_pmu_format_attr_event.attr.attr,
         &arm_ccn_pmu_format_attr_port.attr.attr,
+        &arm_ccn_pmu_format_attr_bus.attr.attr,
         &arm_ccn_pmu_format_attr_vc.attr.attr,
         &arm_ccn_pmu_format_attr_dir.attr.attr,
         &arm_ccn_pmu_format_attr_mask.attr.attr,
@@ -328,6 +332,7 @@ struct arm_ccn_pmu_event {
 static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(dev_get_drvdata(dev));
         struct arm_ccn_pmu_event *event = container_of(attr,
                         struct arm_ccn_pmu_event, attr);
         ssize_t res;
@@ -349,10 +354,17 @@ static ssize_t arm_ccn_pmu_event_show(struct device *dev,
                 break;
         case CCN_TYPE_XP:
                 res += snprintf(buf + res, PAGE_SIZE - res,
-                                ",xp=?,port=?,vc=?,dir=?");
+                                ",xp=?,vc=?");
                 if (event->event == CCN_EVENT_WATCHPOINT)
                         res += snprintf(buf + res, PAGE_SIZE - res,
-                                        ",cmp_l=?,cmp_h=?,mask=?");
+                                        ",port=?,dir=?,cmp_l=?,cmp_h=?,mask=?");
+                else
+                        res += snprintf(buf + res, PAGE_SIZE - res,
+                                        ",bus=?");
+
+                break;
+        case CCN_TYPE_MN:
+                res += snprintf(buf + res, PAGE_SIZE - res, ",node=%d", ccn->mn_id);
                 break;
         default:
                 res += snprintf(buf + res, PAGE_SIZE - res, ",node=?");
@@ -383,9 +395,9 @@ static umode_t arm_ccn_pmu_events_is_visible(struct kobject *kobj,
 }
 
 static struct arm_ccn_pmu_event arm_ccn_pmu_events[] = {
-        CCN_EVENT_MN(eobarrier, "dir=0,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(ecbarrier, "dir=0,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
-        CCN_EVENT_MN(dvmop, "dir=0,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(eobarrier, "dir=1,vc=0,cmp_h=0x1c00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(ecbarrier, "dir=1,vc=0,cmp_h=0x1e00", CCN_IDX_MASK_OPCODE),
+        CCN_EVENT_MN(dvmop, "dir=1,vc=0,cmp_h=0x2800", CCN_IDX_MASK_OPCODE),
         CCN_EVENT_HNI(txdatflits, "dir=1,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(rxdatflits, "dir=0,vc=3", CCN_IDX_MASK_ANY),
         CCN_EVENT_HNI(txreqflits, "dir=1,vc=0", CCN_IDX_MASK_ANY),
@@ -733,9 +745,10 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         if (has_branch_stack(event) || event->attr.exclude_user ||
                         event->attr.exclude_kernel || event->attr.exclude_hv ||
-                        event->attr.exclude_idle) {
+                        event->attr.exclude_idle || event->attr.exclude_host ||
+                        event->attr.exclude_guest) {
                 dev_warn(ccn->dev, "Can't exclude execution levels!\n");
-                return -EOPNOTSUPP;
+                return -EINVAL;
         }
 
         if (event->cpu < 0) {
@@ -759,6 +772,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event)
 
         /* Validate node/xp vs topology */
         switch (type) {
+        case CCN_TYPE_MN:
+                if (node_xp != ccn->mn_id) {
+                        dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp);
+                        return -EINVAL;
+                }
+                break;
         case CCN_TYPE_XP:
                 if (node_xp >= ccn->num_xps) {
                         dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp);
@@ -886,6 +905,10 @@ static void arm_ccn_pmu_xp_dt_config(struct perf_event *event, int enable)
         struct arm_ccn_component *xp;
         u32 val, dt_cfg;
 
+        /* Nothing to do for cycle counter */
+        if (hw->idx == CCN_IDX_PMU_CYCLE_COUNTER)
+                return;
+
         if (CCN_CONFIG_TYPE(event->attr.config) == CCN_TYPE_XP)
                 xp = &ccn->xp[CCN_CONFIG_XP(event->attr.config)];
         else
@@ -917,38 +940,17 @@ static void arm_ccn_pmu_event_start(struct perf_event *event, int flags)
                         arm_ccn_pmu_read_counter(ccn, hw->idx));
         hw->state = 0;
 
-        /*
-         * Pin the timer, so that the overflows are handled by the chosen
-         * event->cpu (this is the same one as presented in "cpumask"
-         * attribute).
-         */
-        if (!ccn->irq)
-                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
-                                HRTIMER_MODE_REL_PINNED);
-
         /* Set the DT bus input, engaging the counter */
         arm_ccn_pmu_xp_dt_config(event, 1);
 }
 
 static void arm_ccn_pmu_event_stop(struct perf_event *event, int flags)
 {
-        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
         struct hw_perf_event *hw = &event->hw;
-        u64 timeout;
 
         /* Disable counting, setting the DT bus to pass-through mode */
         arm_ccn_pmu_xp_dt_config(event, 0);
 
-        if (!ccn->irq)
-                hrtimer_cancel(&ccn->dt.hrtimer);
-
-        /* Let the DT bus drain */
-        timeout = arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) +
-                        ccn->num_xps;
-        while (arm_ccn_pmu_read_counter(ccn, CCN_IDX_PMU_CYCLE_COUNTER) <
-                        timeout)
-                cpu_relax();
-
         if (flags & PERF_EF_UPDATE)
                 arm_ccn_pmu_event_update(event);
 
@@ -988,7 +990,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Comparison values */
         writel(cmp_l & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_L(wp));
-        writel((cmp_l >> 32) & 0xefffffff,
+        writel((cmp_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_VAL_L(wp) + 4);
         writel(cmp_h & 0xffffffff, source->base + CCN_XP_DT_CMP_VAL_H(wp));
         writel((cmp_h >> 32) & 0x0fffffff,
@@ -996,7 +998,7 @@ static void arm_ccn_pmu_xp_watchpoint_config(struct perf_event *event)
 
         /* Mask */
         writel(mask_l & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_L(wp));
-        writel((mask_l >> 32) & 0xefffffff,
+        writel((mask_l >> 32) & 0x7fffffff,
                         source->base + CCN_XP_DT_CMP_MASK_L(wp) + 4);
         writel(mask_h & 0xffffffff, source->base + CCN_XP_DT_CMP_MASK_H(wp));
         writel((mask_h >> 32) & 0x0fffffff,
@@ -1014,7 +1016,7 @@ static void arm_ccn_pmu_xp_event_config(struct perf_event *event)
         hw->event_base = CCN_XP_DT_CONFIG__DT_CFG__XP_PMU_EVENT(hw->config_base);
 
         id = (CCN_CONFIG_VC(event->attr.config) << 4) |
-                        (CCN_CONFIG_PORT(event->attr.config) << 3) |
+                        (CCN_CONFIG_BUS(event->attr.config) << 3) |
                         (CCN_CONFIG_EVENT(event->attr.config) << 0);
 
         val = readl(source->base + CCN_XP_PMU_EVENT_SEL);
@@ -1099,15 +1101,31 @@ static void arm_ccn_pmu_event_config(struct perf_event *event)
         spin_unlock(&ccn->dt.config_lock);
 }
 
+static int arm_ccn_pmu_active_counters(struct arm_ccn *ccn)
+{
+        return bitmap_weight(ccn->dt.pmu_counters_mask,
+                             CCN_NUM_PMU_EVENT_COUNTERS + 1);
+}
+
 static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 {
         int err;
         struct hw_perf_event *hw = &event->hw;
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
 
         err = arm_ccn_pmu_event_alloc(event);
         if (err)
                 return err;
 
+        /*
+         * Pin the timer, so that the overflows are handled by the chosen
+         * event->cpu (this is the same one as presented in "cpumask"
+         * attribute).
+         */
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 1)
+                hrtimer_start(&ccn->dt.hrtimer, arm_ccn_pmu_timer_period(),
+                              HRTIMER_MODE_REL_PINNED);
+
         arm_ccn_pmu_event_config(event);
 
         hw->state = PERF_HES_STOPPED;
@@ -1120,9 +1138,14 @@ static int arm_ccn_pmu_event_add(struct perf_event *event, int flags)
 
 static void arm_ccn_pmu_event_del(struct perf_event *event, int flags)
 {
+        struct arm_ccn *ccn = pmu_to_arm_ccn(event->pmu);
+
         arm_ccn_pmu_event_stop(event, PERF_EF_UPDATE);
 
         arm_ccn_pmu_event_release(event);
+
+        if (!ccn->irq && arm_ccn_pmu_active_counters(ccn) == 0)
+                hrtimer_cancel(&ccn->dt.hrtimer);
 }
 
 static void arm_ccn_pmu_event_read(struct perf_event *event)
@@ -1130,6 +1153,24 @@ static void arm_ccn_pmu_event_read(struct perf_event *event)
         arm_ccn_pmu_event_update(event);
 }
 
+static void arm_ccn_pmu_enable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val |= CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
+static void arm_ccn_pmu_disable(struct pmu *pmu)
+{
+        struct arm_ccn *ccn = pmu_to_arm_ccn(pmu);
+
+        u32 val = readl(ccn->dt.base + CCN_DT_PMCR);
+        val &= ~CCN_DT_PMCR__PMU_EN;
+        writel(val, ccn->dt.base + CCN_DT_PMCR);
+}
+
 static irqreturn_t arm_ccn_pmu_overflow_handler(struct arm_ccn_dt *dt)
 {
         u32 pmovsr = readl(dt->base + CCN_DT_PMOVSR);
@@ -1252,6 +1293,8 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn)
                 .start = arm_ccn_pmu_event_start,
                 .stop = arm_ccn_pmu_event_stop,
                 .read = arm_ccn_pmu_event_read,
+                .pmu_enable = arm_ccn_pmu_enable,
+                .pmu_disable = arm_ccn_pmu_disable,
         };
 
         /* No overflow interrupt? Have to use a timer instead. */
@@ -1361,6 +1404,8 @@ static int arm_ccn_init_nodes(struct arm_ccn *ccn, int region,
 
         switch (type) {
         case CCN_TYPE_MN:
+                ccn->mn_id = id;
+                return 0;
         case CCN_TYPE_DT:
                 return 0;
         case CCN_TYPE_XP:
@@ -1471,8 +1516,9 @@ static int arm_ccn_probe(struct platform_device *pdev)
                 /* Can set 'disable' bits, so can acknowledge interrupts */
                 writel(CCN_MN_ERRINT_STATUS__PMU_EVENTS__ENABLE,
                                 ccn->base + CCN_MN_ERRINT_STATUS);
-                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler, 0,
-                                dev_name(ccn->dev), ccn);
+                err = devm_request_irq(ccn->dev, irq, arm_ccn_irq_handler,
+                                       IRQF_NOBALANCING | IRQF_NO_THREAD,
+                                       dev_name(ccn->dev), ccn);
                 if (err)
                         return err;
 
diff --git a/drivers/bus/vexpress-config.c b/drivers/bus/vexpress-config.c
index c3cb76b363c6..9efdf1de4035 100644
--- a/drivers/bus/vexpress-config.c
+++ b/drivers/bus/vexpress-config.c
@@ -178,6 +178,7 @@ static int vexpress_config_populate(struct device_node *node)
 
         parent = class_find_device(vexpress_config_class, NULL, bridge,
                         vexpress_config_node_match);
+        of_node_put(bridge);
         if (WARN_ON(!parent))
                 return -ENODEV;
 
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 56ad5a5936a9..8c0770bf8881 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -244,7 +244,7 @@ config HW_RANDOM_TX4939
 
 config HW_RANDOM_MXC_RNGA
         tristate "Freescale i.MX RNGA Random Number Generator"
-        depends on ARCH_HAS_RNGA
+        depends on SOC_IMX31
         default HW_RANDOM
         ---help---
           This driver provides kernel-side support for the Random Number
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 08c7e23ed535..0c75c3f1689f 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -957,7 +957,7 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                 goto out;
 
         rc = tpm2_do_selftest(chip);
-        if (rc != TPM2_RC_INITIALIZE) {
+        if (rc != 0 && rc != TPM2_RC_INITIALIZE) {
                 dev_err(&chip->dev, "TPM self test failed\n");
                 goto out;
         }
@@ -974,7 +974,6 @@ int tpm2_auto_startup(struct tpm_chip *chip)
                 }
         }
 
-        return rc;
 out:
         if (rc > 0)
                 rc = -ENODEV;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index d2406fe25533..5da47e26a012 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -165,6 +165,12 @@ struct ports_device {
          */
         struct virtqueue *c_ivq, *c_ovq;
 
+        /*
+         * A control packet buffer for guest->host requests, protected
+         * by c_ovq_lock.
+         */
+        struct virtio_console_control cpkt;
+
         /* Array of per-port IO virtqueues */
         struct virtqueue **in_vqs, **out_vqs;
 
@@ -560,28 +566,29 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
                                   unsigned int event, unsigned int value)
 {
         struct scatterlist sg[1];
-        struct virtio_console_control cpkt;
         struct virtqueue *vq;
         unsigned int len;
 
         if (!use_multiport(portdev))
                 return 0;
 
-        cpkt.id = cpu_to_virtio32(portdev->vdev, port_id);
-        cpkt.event = cpu_to_virtio16(portdev->vdev, event);
-        cpkt.value = cpu_to_virtio16(portdev->vdev, value);
-
         vq = portdev->c_ovq;
 
-        sg_init_one(sg, &cpkt, sizeof(cpkt));
-
         spin_lock(&portdev->c_ovq_lock);
-        if (virtqueue_add_outbuf(vq, sg, 1, &cpkt, GFP_ATOMIC) == 0) {
+
+        portdev->cpkt.id = cpu_to_virtio32(portdev->vdev, port_id);
+        portdev->cpkt.event = cpu_to_virtio16(portdev->vdev, event);
+        portdev->cpkt.value = cpu_to_virtio16(portdev->vdev, value);
+
+        sg_init_one(sg, &portdev->cpkt, sizeof(struct virtio_console_control));
+
+        if (virtqueue_add_outbuf(vq, sg, 1, &portdev->cpkt, GFP_ATOMIC) == 0) {
                 virtqueue_kick(vq);
                 while (!virtqueue_get_buf(vq, &len)
                         && !virtqueue_is_broken(vq))
                         cpu_relax();
         }
+
         spin_unlock(&portdev->c_ovq_lock);
         return 0;
 }
diff --git a/drivers/clk/renesas/r8a7795-cpg-mssr.c b/drivers/clk/renesas/r8a7795-cpg-mssr.c
index d359c92e13a6..e38bf60c0ff4 100644
--- a/drivers/clk/renesas/r8a7795-cpg-mssr.c
+++ b/drivers/clk/renesas/r8a7795-cpg-mssr.c
@@ -69,6 +69,7 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
         DEF_FIXED(".s1",        CLK_S1,            CLK_PLL1_DIV2,  3, 1),
         DEF_FIXED(".s2",        CLK_S2,            CLK_PLL1_DIV2,  4, 1),
         DEF_FIXED(".s3",        CLK_S3,            CLK_PLL1_DIV2,  6, 1),
+        DEF_FIXED(".sdsrc",     CLK_SDSRC,         CLK_PLL1_DIV2,  2, 1),
 
         /* Core Clock Outputs */
         DEF_FIXED("ztr",        R8A7795_CLK_ZTR,   CLK_PLL1_DIV2,  6, 1),
@@ -87,10 +88,10 @@ static const struct cpg_core_clk r8a7795_core_clks[] __initconst = {
         DEF_FIXED("s3d2",       R8A7795_CLK_S3D2,  CLK_S3,         2, 1),
         DEF_FIXED("s3d4",       R8A7795_CLK_S3D4,  CLK_S3,         4, 1),
 
-        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_PLL1_DIV2, 0x0074),
-        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_PLL1_DIV2, 0x0078),
-        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_PLL1_DIV2, 0x0268),
-        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_PLL1_DIV2, 0x026c),
+        DEF_GEN3_SD("sd0",      R8A7795_CLK_SD0,   CLK_SDSRC,     0x0074),
+        DEF_GEN3_SD("sd1",      R8A7795_CLK_SD1,   CLK_SDSRC,     0x0078),
+        DEF_GEN3_SD("sd2",      R8A7795_CLK_SD2,   CLK_SDSRC,     0x0268),
+        DEF_GEN3_SD("sd3",      R8A7795_CLK_SD3,   CLK_SDSRC,     0x026c),
 
         DEF_FIXED("cl",         R8A7795_CLK_CL,    CLK_PLL1_DIV2, 48, 1),
         DEF_FIXED("cp",         R8A7795_CLK_CP,    CLK_EXTAL,      2, 1),
diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c
index c109d80e7a8a..cdfabeb9a034 100644
--- a/drivers/clk/rockchip/clk-rk3399.c
+++ b/drivers/clk/rockchip/clk-rk3399.c
@@ -833,9 +833,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
 
         /* perihp */
         GATE(0, "cpll_aclk_perihp_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
-        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(5), 1, GFLAGS),
+        GATE(0, "gpll_aclk_perihp_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(5), 0, GFLAGS),
         COMPOSITE(ACLK_PERIHP, "aclk_perihp", mux_aclk_perihp_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(14), 7, 1, MFLAGS, 0, 5, DFLAGS,
                         RK3399_CLKGATE_CON(5), 2, GFLAGS),
@@ -923,9 +923,9 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
                         RK3399_CLKGATE_CON(6), 14, GFLAGS),
 
         GATE(0, "cpll_aclk_emmc_src", "cpll", CLK_IGNORE_UNUSED,
-                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
-        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
                         RK3399_CLKGATE_CON(6), 13, GFLAGS),
+        GATE(0, "gpll_aclk_emmc_src", "gpll", CLK_IGNORE_UNUSED,
+                        RK3399_CLKGATE_CON(6), 12, GFLAGS),
         COMPOSITE_NOGATE(ACLK_EMMC, "aclk_emmc", mux_aclk_emmc_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(21), 7, 1, MFLAGS, 0, 5, DFLAGS),
         GATE(ACLK_EMMC_CORE, "aclk_emmccore", "aclk_emmc", CLK_IGNORE_UNUSED,
@@ -1071,7 +1071,7 @@ static struct rockchip_clk_branch rk3399_clk_branches[] __initdata = {
         /* vio */
         COMPOSITE(ACLK_VIO, "aclk_vio", mux_pll_src_cpll_gpll_ppll_p, CLK_IGNORE_UNUSED,
                         RK3399_CLKSEL_CON(42), 6, 2, MFLAGS, 0, 5, DFLAGS,
-                        RK3399_CLKGATE_CON(11), 10, GFLAGS),
+                        RK3399_CLKGATE_CON(11), 0, GFLAGS),
         COMPOSITE_NOMUX(PCLK_VIO, "pclk_vio", "aclk_vio", 0,
                         RK3399_CLKSEL_CON(43), 0, 5, DFLAGS,
                         RK3399_CLKGATE_CON(11), 1, GFLAGS),
@@ -1484,6 +1484,7 @@ static const char *const rk3399_cru_critical_clocks[] __initconst = {
         "hclk_perilp1",
         "hclk_perilp1_noc",
         "aclk_dmac0_perilp",
+        "aclk_emmc_noc",
         "gpll_hclk_perilp1_src",
         "gpll_aclk_perilp0_src",
         "gpll_aclk_perihp_src",
diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
index 9af359544110..267f99523fbe 100644
--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
@@ -783,14 +783,14 @@ static struct ccu_reset_map sun8i_h3_ccu_resets[] = {
         [RST_BUS_I2S1]          =  { 0x2d0, BIT(13) },
         [RST_BUS_I2S2]          =  { 0x2d0, BIT(14) },
 
-        [RST_BUS_I2C0]          =  { 0x2d4, BIT(0) },
-        [RST_BUS_I2C1]          =  { 0x2d4, BIT(1) },
-        [RST_BUS_I2C2]          =  { 0x2d4, BIT(2) },
-        [RST_BUS_UART0]         =  { 0x2d4, BIT(16) },
-        [RST_BUS_UART1]         =  { 0x2d4, BIT(17) },
-        [RST_BUS_UART2]         =  { 0x2d4, BIT(18) },
-        [RST_BUS_UART3]         =  { 0x2d4, BIT(19) },
-        [RST_BUS_SCR]           =  { 0x2d4, BIT(20) },
+        [RST_BUS_I2C0]          =  { 0x2d8, BIT(0) },
+        [RST_BUS_I2C1]          =  { 0x2d8, BIT(1) },
+        [RST_BUS_I2C2]          =  { 0x2d8, BIT(2) },
+        [RST_BUS_UART0]         =  { 0x2d8, BIT(16) },
+        [RST_BUS_UART1]         =  { 0x2d8, BIT(17) },
+        [RST_BUS_UART2]         =  { 0x2d8, BIT(18) },
+        [RST_BUS_UART3]         =  { 0x2d8, BIT(19) },
+        [RST_BUS_SCR]           =  { 0x2d8, BIT(20) },
 };
 
 static const struct sunxi_ccu_desc sun8i_h3_ccu_desc = {
diff --git a/drivers/clk/sunxi-ng/ccu_common.c b/drivers/clk/sunxi-ng/ccu_common.c
index fc17b5295e16..51d4bac97ab3 100644
--- a/drivers/clk/sunxi-ng/ccu_common.c
+++ b/drivers/clk/sunxi-ng/ccu_common.c
@@ -31,7 +31,7 @@ void ccu_helper_wait_for_lock(struct ccu_common *common, u32 lock)
                 return;
 
         WARN_ON(readl_relaxed_poll_timeout(common->base + common->reg, reg,
-                                           !(reg & lock), 100, 70000));
+                                           reg & lock, 100, 70000));
 }
 
 int sunxi_ccu_probe(struct device_node *node, void __iomem *reg,
diff --git a/drivers/clk/sunxi-ng/ccu_nk.c b/drivers/clk/sunxi-ng/ccu_nk.c
index 4470ffc8cf0d..d6fafb397489 100644
--- a/drivers/clk/sunxi-ng/ccu_nk.c
+++ b/drivers/clk/sunxi-ng/ccu_nk.c
@@ -14,9 +14,9 @@
 #include "ccu_gate.h"
 #include "ccu_nk.h"
 
-void ccu_nk_find_best(unsigned long parent, unsigned long rate,
-                      unsigned int max_n, unsigned int max_k,
-                      unsigned int *n, unsigned int *k)
+static void ccu_nk_find_best(unsigned long parent, unsigned long rate,
+                             unsigned int max_n, unsigned int max_k,
+                             unsigned int *n, unsigned int *k)
 {
         unsigned long best_rate = 0;
         unsigned int best_k = 0, best_n = 0;
diff --git a/drivers/clk/sunxi/clk-a10-pll2.c b/drivers/clk/sunxi/clk-a10-pll2.c
index 0ee1f363e4be..d8eab90ae661 100644
--- a/drivers/clk/sunxi/clk-a10-pll2.c
+++ b/drivers/clk/sunxi/clk-a10-pll2.c
@@ -73,7 +73,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           SUN4I_PLL2_PRE_DIV_WIDTH,
                                           CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO,
                                           &sun4i_a10_pll2_lock);
-        if (!prediv_clk) {
+        if (IS_ERR(prediv_clk)) {
                 pr_err("Couldn't register the prediv clock\n");
                 goto err_free_array;
         }
@@ -106,7 +106,7 @@ static void __init sun4i_pll2_setup(struct device_node *node,
                                           &mult->hw, &clk_multiplier_ops,
                                           &gate->hw, &clk_gate_ops,
                                           CLK_SET_RATE_PARENT);
-        if (!base_clk) {
+        if (IS_ERR(base_clk)) {
                 pr_err("Couldn't register the base multiplier clock\n");
                 goto err_free_multiplier;
         }
diff --git a/drivers/clk/sunxi/clk-sun8i-mbus.c b/drivers/clk/sunxi/clk-sun8i-mbus.c
index 411d3033a96e..b200ebf159ee 100644
--- a/drivers/clk/sunxi/clk-sun8i-mbus.c
+++ b/drivers/clk/sunxi/clk-sun8i-mbus.c
@@ -48,7 +48,7 @@ static void __init sun8i_a23_mbus_setup(struct device_node *node)
                 return;
 
         reg = of_io_request_and_map(node, 0, of_node_full_name(node));
-        if (!reg) {
+        if (IS_ERR(reg)) {
                 pr_err("Could not get registers for sun8i-mbus-clk\n");
                 goto err_free_parents;
         }
diff --git a/drivers/clk/tegra/clk-tegra114.c b/drivers/clk/tegra/clk-tegra114.c
index 64da7b79a6e4..933b5dd698b8 100644
--- a/drivers/clk/tegra/clk-tegra114.c
+++ b/drivers/clk/tegra/clk-tegra114.c
@@ -428,7 +428,7 @@ static struct tegra_clk_pll_params pll_d_params = {
         .div_nmp = &pllp_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 
 static struct tegra_clk_pll_params pll_d2_params = {
@@ -446,7 +446,7 @@ static struct tegra_clk_pll_params pll_d2_params = {
         .div_nmp = &pllp_nmp,
         .freq_table = pll_d_freq_table,
         .flags = TEGRA_PLL_HAS_CPCON | TEGRA_PLL_SET_LFCON |
-                 TEGRA_PLL_USE_LOCK | TEGRA_PLL_HAS_LOCK_ENABLE,
+                 TEGRA_PLL_HAS_LOCK_ENABLE,
 };
 
 static const struct pdiv_map pllu_p[] = {
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 28bce3f4f81d..57700541f951 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -8,6 +8,9 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+
+#define pr_fmt(fmt)     "arm_arch_timer: " fmt
+
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/device.h>
@@ -370,16 +373,33 @@ static bool arch_timer_has_nonsecure_ppi(void)
                 arch_timer_ppi[PHYS_NONSECURE_PPI]);
 }
 
+static u32 check_ppi_trigger(int irq)
+{
+        u32 flags = irq_get_trigger_type(irq);
+
+        if (flags != IRQF_TRIGGER_HIGH && flags != IRQF_TRIGGER_LOW) {
+                pr_warn("WARNING: Invalid trigger for IRQ%d, assuming level low\n", irq);
+                pr_warn("WARNING: Please fix your firmware\n");
+                flags = IRQF_TRIGGER_LOW;
+        }
+
+        return flags;
+}
+
 static int arch_timer_starting_cpu(unsigned int cpu)
 {
         struct clock_event_device *clk = this_cpu_ptr(arch_timer_evt);
+        u32 flags;
 
         __arch_timer_setup(ARCH_CP15_TIMER, clk);
 
-        enable_percpu_irq(arch_timer_ppi[arch_timer_uses_ppi], 0);
+        flags = check_ppi_trigger(arch_timer_ppi[arch_timer_uses_ppi]);
+        enable_percpu_irq(arch_timer_ppi[arch_timer_uses_ppi], flags);
 
-        if (arch_timer_has_nonsecure_ppi())
-                enable_percpu_irq(arch_timer_ppi[PHYS_NONSECURE_PPI], 0);
+        if (arch_timer_has_nonsecure_ppi()) {
+                flags = check_ppi_trigger(arch_timer_ppi[PHYS_NONSECURE_PPI]);
+                enable_percpu_irq(arch_timer_ppi[PHYS_NONSECURE_PPI], flags);
+        }
 
         arch_counter_set_user_access();
         if (evtstrm_enable)
diff --git a/drivers/clocksource/bcm_kona_timer.c b/drivers/clocksource/bcm_kona_timer.c
index 7e3fd375a627..92f6e4deee74 100644
--- a/drivers/clocksource/bcm_kona_timer.c
+++ b/drivers/clocksource/bcm_kona_timer.c
@@ -66,10 +66,10 @@ static void kona_timer_disable_and_clear(void __iomem *base)
 
 }
 
-static void
+static int
 kona_timer_get_counter(void __iomem *timer_base, uint32_t *msw, uint32_t *lsw)
 {
-        int loop_limit = 4;
+        int loop_limit = 3;
 
         /*
          * Read 64-bit free running counter
@@ -83,18 +83,19 @@ kona_timer_get_counter(void __iomem *timer_base, uint32_t *msw, uint32_t *lsw)
          *      if new hi-word is equal to previously read hi-word then stop.
          */
 
-        while (--loop_limit) {
+        do {
                 *msw = readl(timer_base + KONA_GPTIMER_STCHI_OFFSET);
                 *lsw = readl(timer_base + KONA_GPTIMER_STCLO_OFFSET);
                 if (*msw == readl(timer_base + KONA_GPTIMER_STCHI_OFFSET))
                         break;
-        }
+        } while (--loop_limit);
         if (!loop_limit) {
                 pr_err("bcm_kona_timer: getting counter failed.\n");
                 pr_err(" Timer will be impacted\n");
+                return -ETIMEDOUT;
         }
 
-        return;
+        return 0;
 }
 
 static int kona_timer_set_next_event(unsigned long clc,
@@ -112,8 +113,11 @@ static int kona_timer_set_next_event(unsigned long clc,
 
         uint32_t lsw, msw;
         uint32_t reg;
+        int ret;
 
-        kona_timer_get_counter(timers.tmr_regs, &msw, &lsw);
+        ret = kona_timer_get_counter(timers.tmr_regs, &msw, &lsw);
+        if (ret)
+                return ret;
 
         /* Load the "next" event tick value */
         writel(lsw + clc, timers.tmr_regs + KONA_GPTIMER_STCM0_OFFSET);
diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c
index d91e8725917c..b4b3ab5a11ad 100644
--- a/drivers/clocksource/mips-gic-timer.c
+++ b/drivers/clocksource/mips-gic-timer.c
@@ -164,7 +164,7 @@ void __init gic_clocksource_init(unsigned int frequency)
         gic_start_count();
 }
 
-static void __init gic_clocksource_of_init(struct device_node *node)
+static int __init gic_clocksource_of_init(struct device_node *node)
 {
         struct clk *clk;
         int ret;
diff --git a/drivers/clocksource/pxa_timer.c b/drivers/clocksource/pxa_timer.c
index 937e10b84d58..3e1cb512f3ce 100644
--- a/drivers/clocksource/pxa_timer.c
+++ b/drivers/clocksource/pxa_timer.c
@@ -21,6 +21,8 @@
 #include <linux/of_irq.h>
 #include <linux/sched_clock.h>
 
+#include <clocksource/pxa.h>
+
 #include <asm/div64.h>
 
 #define OSMR0           0x00    /* OS Timer 0 Match Register */
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index 97669ee4df2a..c83452cacb41 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -123,12 +123,16 @@ static struct clock_event_device sun4i_clockevent = {
         .set_next_event = sun4i_clkevt_next_event,
 };
 
+static void sun4i_timer_clear_interrupt(void)
+{
+        writel(TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_ST_REG);
+}
 
 static irqreturn_t sun4i_timer_interrupt(int irq, void *dev_id)
 {
         struct clock_event_device *evt = (struct clock_event_device *)dev_id;
 
-        writel(0x1, timer_base + TIMER_IRQ_ST_REG);
+        sun4i_timer_clear_interrupt();
         evt->event_handler(evt);
 
         return IRQ_HANDLED;
@@ -208,6 +212,9 @@ static int __init sun4i_timer_init(struct device_node *node)
         /* Make sure timer is stopped before playing with interrupts */
         sun4i_clkevt_time_stop(0);
 
+        /* clear timer0 interrupt */
+        sun4i_timer_clear_interrupt();
+
         sun4i_clockevent.cpumask = cpu_possible_mask;
         sun4i_clockevent.irq = irq;
 
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index 719b478d136e..3c39e6f45971 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -338,7 +338,6 @@ static int __init armada_xp_timer_init(struct device_node *np)
         struct clk *clk = of_clk_get_by_name(np, "fixed");
         int ret;
 
-        clk = of_clk_get(np, 0);
         if (IS_ERR(clk)) {
                 pr_err("Failed to get clock");
                 return PTR_ERR(clk);
diff --git a/drivers/clocksource/time-pistachio.c b/drivers/clocksource/time-pistachio.c
index a7d9a08e4b0e..a8e6c7df853d 100644
--- a/drivers/clocksource/time-pistachio.c
+++ b/drivers/clocksource/time-pistachio.c
@@ -202,10 +202,10 @@ static int __init pistachio_clksrc_of_init(struct device_node *node)
         rate = clk_get_rate(fast_clk);
 
         /* Disable irq's for clocksource usage */
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
-        gpt_writel(&pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 0);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 1);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 2);
+        gpt_writel(pcs_gpt.base, 0, TIMER_IRQ_MASK, 3);
 
         /* Enable timer block */
         writel(TIMER_ME_GLOBAL, pcs_gpt.base);
diff --git a/drivers/clocksource/timer-atmel-pit.c b/drivers/clocksource/timer-atmel-pit.c
index 1ffac0cb0cb7..7f0f5b26d8c5 100644
--- a/drivers/clocksource/timer-atmel-pit.c
+++ b/drivers/clocksource/timer-atmel-pit.c
@@ -240,6 +240,7 @@ static int __init at91sam926x_pit_common_init(struct pit_data *data)
 static int __init at91sam926x_pit_dt_init(struct device_node *node)
 {
         struct pit_data *data;
+        int ret;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (!data)
@@ -261,6 +262,12 @@ static int __init at91sam926x_pit_dt_init(struct device_node *node)
                 return PTR_ERR(data->mck);
         }
 
+        ret = clk_prepare_enable(data->mck);
+        if (ret) {
+                pr_err("Unable to enable mck\n");
+                return ret;
+        }
+
         /* Get the interrupts property */
         data->irq = irq_of_parse_and_map(node, 0);
         if (!data->irq) {
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index 0bb44d5b5df4..2ee40fd360ca 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -74,6 +74,8 @@ static const struct of_device_id machines[] __initconst = {
         { .compatible = "ti,omap5", },
 
         { .compatible = "xlnx,zynq-7000", },
+
+        { }
 };
 
 static int __init cpufreq_dt_platdev_init(void)
diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
index 87796e0864e9..d3ffde806629 100644
--- a/drivers/cpufreq/powernv-cpufreq.c
+++ b/drivers/cpufreq/powernv-cpufreq.c
@@ -145,11 +145,30 @@ static struct powernv_pstate_info {
 /* Use following macros for conversions between pstate_id and index */
 static inline int idx_to_pstate(unsigned int i)
 {
+        if (unlikely(i >= powernv_pstate_info.nr_pstates)) {
+                pr_warn_once("index %u is out of bound\n", i);
+                return powernv_freqs[powernv_pstate_info.nominal].driver_data;
+        }
+
         return powernv_freqs[i].driver_data;
 }
 
 static inline unsigned int pstate_to_idx(int pstate)
 {
+        int min = powernv_freqs[powernv_pstate_info.min].driver_data;
+        int max = powernv_freqs[powernv_pstate_info.max].driver_data;
+
+        if (min > 0) {
+                if (unlikely((pstate < max) || (pstate > min))) {
+                        pr_warn_once("pstate %d is out of bound\n", pstate);
+                        return powernv_pstate_info.nominal;
+                }
+        } else {
+                if (unlikely((pstate > max) || (pstate < min))) {
+                        pr_warn_once("pstate %d is out of bound\n", pstate);
+                        return powernv_pstate_info.nominal;
+                }
+        }
         /*
          * abs() is deliberately used so that is works with
          * both monotonically increasing and decreasing
@@ -593,7 +612,7 @@ void gpstate_timer_handler(unsigned long data)
         } else {
                 gpstate_idx = calc_global_pstate(gpstates->elapsed_time,
                                                  gpstates->highest_lpstate_idx,
-                                                 freq_data.pstate_id);
+                                                 gpstates->last_lpstate_idx);
         }
 
         /*
diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
index ea8189f4b021..b3044219772c 100644
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -441,6 +441,9 @@ static int aead_set_sh_desc(struct crypto_aead *aead)
                                OP_ALG_AAI_CTR_MOD128);
         const bool is_rfc3686 = alg->caam.rfc3686;
 
+        if (!ctx->authsize)
+                return 0;
+
         /* NULL encryption / decryption */
         if (!ctx->enckeylen)
                 return aead_null_set_sh_desc(aead);
@@ -553,7 +556,10 @@ skip_enc:
 
         /* Read and write assoclen bytes */
         append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
-        append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
+        if (alg->caam.geniv)
+                append_math_add_imm_u32(desc, VARSEQOUTLEN, REG3, IMM, ivsize);
+        else
+                append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
 
         /* Skip assoc data */
         append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
@@ -562,6 +568,14 @@ skip_enc:
         append_seq_fifo_load(desc, 0, FIFOLD_CLASS_CLASS2 | FIFOLD_TYPE_MSG |
                              KEY_VLF);
 
+        if (alg->caam.geniv) {
+                append_seq_load(desc, ivsize, LDST_CLASS_1_CCB |
+                                LDST_SRCDST_BYTE_CONTEXT |
+                                (ctx1_iv_off << LDST_OFFSET_SHIFT));
+                append_move(desc, MOVE_SRC_CLASS1CTX | MOVE_DEST_CLASS2INFIFO |
+                            (ctx1_iv_off << MOVE_OFFSET_SHIFT) | ivsize);
+        }
+
         /* Load Counter into CONTEXT1 reg */
         if (is_rfc3686)
                 append_load_imm_u32(desc, be32_to_cpu(1), LDST_IMM |
@@ -614,7 +628,7 @@ skip_enc:
                 keys_fit_inline = true;
 
         /* aead_givencrypt shared descriptor */
-        desc = ctx->sh_desc_givenc;
+        desc = ctx->sh_desc_enc;
 
         /* Note: Context registers are saved. */
         init_sh_desc_key_aead(desc, ctx, keys_fit_inline, is_rfc3686);
@@ -645,13 +659,13 @@ copy_iv:
         append_operation(desc, ctx->class2_alg_type |
                          OP_ALG_AS_INITFINAL | OP_ALG_ENCRYPT);
 
-        /* ivsize + cryptlen = seqoutlen - authsize */
-        append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
-
         /* Read and write assoclen bytes */
         append_math_add(desc, VARSEQINLEN, ZERO, REG3, CAAM_CMD_SZ);
         append_math_add(desc, VARSEQOUTLEN, ZERO, REG3, CAAM_CMD_SZ);
 
+        /* ivsize + cryptlen = seqoutlen - authsize */
+        append_math_sub_imm_u32(desc, REG3, SEQOUTLEN, IMM, ctx->authsize);
+
         /* Skip assoc data */
         append_seq_fifo_store(desc, 0, FIFOST_TYPE_SKIP | FIFOLDST_VLF);
 
@@ -697,7 +711,7 @@ copy_iv:
         ctx->sh_desc_enc_dma = dma_map_single(jrdev, desc,
                                               desc_bytes(desc),
                                               DMA_TO_DEVICE);
-        if (dma_mapping_error(jrdev, ctx->sh_desc_givenc_dma)) {
+        if (dma_mapping_error(jrdev, ctx->sh_desc_enc_dma)) {
                 dev_err(jrdev, "unable to map shared descriptor\n");
                 return -ENOMEM;
         }
@@ -2147,7 +2161,7 @@ static void init_authenc_job(struct aead_request *req,
 
         init_aead_job(req, edesc, all_contig, encrypt);
 
-        if (ivsize && (is_rfc3686 || !(alg->caam.geniv && encrypt)))
+        if (ivsize && ((is_rfc3686 && encrypt) || !alg->caam.geniv))
                 append_load_as_imm(desc, req->iv, ivsize,
                                    LDST_CLASS_1_CCB |
                                    LDST_SRCDST_BYTE_CONTEXT |
@@ -2534,20 +2548,6 @@ static int aead_decrypt(struct aead_request *req)
         return ret;
 }
 
-static int aead_givdecrypt(struct aead_request *req)
-{
-        struct crypto_aead *aead = crypto_aead_reqtfm(req);
-        unsigned int ivsize = crypto_aead_ivsize(aead);
-
-        if (req->cryptlen < ivsize)
-                return -EINVAL;
-
-        req->cryptlen -= ivsize;
-        req->assoclen += ivsize;
-
-        return aead_decrypt(req);
-}
-
 /*
  * allocate and map the ablkcipher extended descriptor for ablkcipher
  */
@@ -3207,7 +3207,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3253,7 +3253,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3299,7 +3299,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3345,7 +3345,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3391,7 +3391,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3437,7 +3437,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = AES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3483,7 +3483,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3531,7 +3531,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3579,7 +3579,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3627,7 +3627,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3675,7 +3675,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3723,7 +3723,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES3_EDE_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -3769,7 +3769,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -3815,7 +3815,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -3861,7 +3861,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -3907,7 +3907,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -3953,7 +3953,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -3999,7 +3999,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = DES_BLOCK_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
@@ -4048,7 +4048,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = MD5_DIGEST_SIZE,
                 },
@@ -4099,7 +4099,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA1_DIGEST_SIZE,
                 },
@@ -4150,7 +4150,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA224_DIGEST_SIZE,
                 },
@@ -4201,7 +4201,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA256_DIGEST_SIZE,
                 },
@@ -4252,7 +4252,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA384_DIGEST_SIZE,
                 },
@@ -4303,7 +4303,7 @@ static struct caam_aead_alg driver_aeads[] = {
                         .setkey = aead_setkey,
                         .setauthsize = aead_setauthsize,
                         .encrypt = aead_encrypt,
-                        .decrypt = aead_givdecrypt,
+                        .decrypt = aead_decrypt,
                         .ivsize = CTR_RFC3686_IV_SIZE,
                         .maxauthsize = SHA512_DIGEST_SIZE,
                 },
diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index f1ecc8df8d41..36365b3efdfd 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -1898,6 +1898,7 @@ caam_hash_alloc(struct caam_hash_template *template,
                          template->name);
                 snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s",
                          template->driver_name);
+                t_alg->ahash_alg.setkey = NULL;
         }
         alg->cra_module = THIS_MODULE;
         alg->cra_init = caam_hash_cra_init;
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index 769148dbaeb3..20f35df8a01f 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -1260,8 +1260,8 @@ static struct crypto_alg qat_algs[] = { {
                         .setkey = qat_alg_ablkcipher_xts_setkey,
                         .decrypt = qat_alg_ablkcipher_decrypt,
                         .encrypt = qat_alg_ablkcipher_encrypt,
-                        .min_keysize = AES_MIN_KEY_SIZE,
-                        .max_keysize = AES_MAX_KEY_SIZE,
+                        .min_keysize = 2 * AES_MIN_KEY_SIZE,
+                        .max_keysize = 2 * AES_MAX_KEY_SIZE,
                         .ivsize = AES_BLOCK_SIZE,
                 },
         },
diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c
index cfb25413917c..24353ec336c5 100644
--- a/drivers/crypto/vmx/aes_xts.c
+++ b/drivers/crypto/vmx/aes_xts.c
@@ -129,8 +129,8 @@ static int p8_aes_xts_crypt(struct blkcipher_desc *desc,
 
                 blkcipher_walk_init(&walk, dst, src, nbytes);
 
-                iv = (u8 *)walk.iv;
                 ret = blkcipher_walk_virt(desc, &walk);
+                iv = walk.iv;
                 memset(tweak, 0, AES_BLOCK_SIZE);
                 aes_p8_encrypt(iv, tweak, &ctx->tweak_key);
 
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 803f3953b341..29f600f2c447 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -459,7 +459,7 @@ static int __dax_dev_pmd_fault(struct dax_dev *dax_dev,
         }
 
         pgoff = linear_page_index(vma, pmd_addr);
-        phys = pgoff_to_phys(dax_dev, pgoff, PAGE_SIZE);
+        phys = pgoff_to_phys(dax_dev, pgoff, PMD_SIZE);
         if (phys == -1) {
                 dev_dbg(dev, "%s: phys_to_pgoff(%#lx) failed\n", __func__,
                                 pgoff);
diff --git a/drivers/dax/pmem.c b/drivers/dax/pmem.c
index dfb168568af1..1f01e98c83c7 100644
--- a/drivers/dax/pmem.c
+++ b/drivers/dax/pmem.c
@@ -116,6 +116,9 @@ static int dax_pmem_probe(struct device *dev)
         if (rc)
                 return rc;
 
+        /* adjust the dax_region resource to the start of data */
+        res.start += le64_to_cpu(pfn_sb->dataoff);
+
         nd_region = to_nd_region(dev->parent);
         dax_region = alloc_dax_region(dev, nd_region->id, &res,
                         le32_to_cpu(pfn_sb->align), addr, PFN_DEV|PFN_MAP);
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index e434ffe7bc5c..832cbd647145 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -2067,7 +2067,7 @@ err_dma_unregister:
 err_clk_disable:
         clk_disable_unprepare(atxdmac->clk);
 err_free_irq:
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
         return ret;
 }
 
@@ -2081,7 +2081,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
         dma_async_device_unregister(&atxdmac->dma);
         clk_disable_unprepare(atxdmac->clk);
 
-        free_irq(atxdmac->irq, atxdmac->dma.dev);
+        free_irq(atxdmac->irq, atxdmac);
 
         for (i = 0; i < atxdmac->dma.chancnt; i++) {
                 struct at_xdmac_chan *atchan = &atxdmac->chan[i];
diff --git a/drivers/dma/fsl_raid.c b/drivers/dma/fsl_raid.c
index aad167eaaee8..de2a2a2b1d75 100644
--- a/drivers/dma/fsl_raid.c
+++ b/drivers/dma/fsl_raid.c
@@ -836,6 +836,7 @@ static int fsl_re_probe(struct platform_device *ofdev)
                 rc = of_property_read_u32(np, "reg", &off);
                 if (rc) {
                         dev_err(dev, "Reg property not found in JQ node\n");
+                        of_node_put(np);
                         return -ENODEV;
                 }
                 /* Find out the Job Rings present under each JQ */
diff --git a/drivers/dma/img-mdc-dma.c b/drivers/dma/img-mdc-dma.c
index a4c53be482cf..624f1e1e9c55 100644
--- a/drivers/dma/img-mdc-dma.c
+++ b/drivers/dma/img-mdc-dma.c
@@ -861,7 +861,6 @@ static int mdc_dma_probe(struct platform_device *pdev)
 {
         struct mdc_dma *mdma;
         struct resource *res;
-        const struct of_device_id *match;
         unsigned int i;
         u32 val;
         int ret;
@@ -871,8 +870,7 @@ static int mdc_dma_probe(struct platform_device *pdev)
                 return -ENOMEM;
         platform_set_drvdata(pdev, mdma);
 
-        match = of_match_device(mdc_dma_of_match, &pdev->dev);
-        mdma->soc = match->data;
+        mdma->soc = of_device_get_match_data(&pdev->dev);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         mdma->regs = devm_ioremap_resource(&pdev->dev, res);
diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c
index dc7850a422b8..3f56f9ca4482 100644
--- a/drivers/dma/pxa_dma.c
+++ b/drivers/dma/pxa_dma.c
@@ -638,7 +638,7 @@ static bool pxad_try_hotchain(struct virt_dma_chan *vc,
                 vd_last_issued = list_entry(vc->desc_issued.prev,
                                             struct virt_dma_desc, node);
                 pxad_desc_chain(vd_last_issued, vd);
-                if (is_chan_running(chan) || is_desc_completed(vd_last_issued))
+                if (is_chan_running(chan) || is_desc_completed(vd))
                         return true;
         }
 
@@ -671,6 +671,7 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
         struct virt_dma_desc *vd, *tmp;
         unsigned int dcsr;
         unsigned long flags;
+        bool vd_completed;
         dma_cookie_t last_started = 0;
 
         BUG_ON(!chan);
@@ -681,15 +682,17 @@ static irqreturn_t pxad_chan_handler(int irq, void *dev_id)
 
         spin_lock_irqsave(&chan->vc.lock, flags);
         list_for_each_entry_safe(vd, tmp, &chan->vc.desc_issued, node) {
+                vd_completed = is_desc_completed(vd);
                 dev_dbg(&chan->vc.chan.dev->device,
-                        "%s(): checking txd %p[%x]: completed=%d\n",
-                        __func__, vd, vd->tx.cookie, is_desc_completed(vd));
+                        "%s(): checking txd %p[%x]: completed=%d dcsr=0x%x\n",
+                        __func__, vd, vd->tx.cookie, vd_completed,
+                        dcsr);
                 last_started = vd->tx.cookie;
                 if (to_pxad_sw_desc(vd)->cyclic) {
                         vchan_cyclic_callback(vd);
                         break;
                 }
-                if (is_desc_completed(vd)) {
+                if (vd_completed) {
                         list_del(&vd->node);
                         vchan_cookie_complete(vd);
                 } else {
diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c
index 749f1bd5d65d..06ecdc38cee0 100644
--- a/drivers/dma/sh/usb-dmac.c
+++ b/drivers/dma/sh/usb-dmac.c
@@ -600,27 +600,30 @@ static irqreturn_t usb_dmac_isr_channel(int irq, void *dev)
 {
         struct usb_dmac_chan *chan = dev;
         irqreturn_t ret = IRQ_NONE;
-        u32 mask = USB_DMACHCR_TE;
-        u32 check_bits = USB_DMACHCR_TE | USB_DMACHCR_SP;
+        u32 mask = 0;
         u32 chcr;
+        bool xfer_end = false;
 
         spin_lock(&chan->vc.lock);
 
         chcr = usb_dmac_chan_read(chan, USB_DMACHCR);
-        if (chcr & check_bits)
-                mask |= USB_DMACHCR_DE | check_bits;
+        if (chcr & (USB_DMACHCR_TE | USB_DMACHCR_SP)) {
+                mask |= USB_DMACHCR_DE | USB_DMACHCR_TE | USB_DMACHCR_SP;
+                if (chcr & USB_DMACHCR_DE)
+                        xfer_end = true;
+                ret |= IRQ_HANDLED;
+        }
         if (chcr & USB_DMACHCR_NULL) {
                 /* An interruption of TE will happen after we set FTE */
                 mask |= USB_DMACHCR_NULL;
                 chcr |= USB_DMACHCR_FTE;
                 ret |= IRQ_HANDLED;
         }
-        usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
+        if (mask)
+                usb_dmac_chan_write(chan, USB_DMACHCR, chcr & ~mask);
 
-        if (chcr & check_bits) {
+        if (xfer_end)
                 usb_dmac_isr_transfer_end(chan);
-                ret |= IRQ_HANDLED;
-        }
 
         spin_unlock(&chan->vc.lock);
 
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index d0c1dab9b435..dff1a4a6dc1b 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -251,6 +251,14 @@ config EDAC_SBRIDGE
           Support for error detection and correction the Intel
           Sandy Bridge, Ivy Bridge and Haswell Integrated Memory Controllers.
 
+config EDAC_SKX
+        tristate "Intel Skylake server Integrated MC"
+        depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
+        depends on PCI_MMCONFIG
+        help
+          Support for error detection and correction the Intel
+          Skylake server Integrated Memory Controllers.
+
 config EDAC_MPC85XX
         tristate "Freescale MPC83xx / MPC85xx"
         depends on EDAC_MM_EDAC && FSL_SOC
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index f9e4a3e0e6e9..986049925b08 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -31,6 +31,7 @@ obj-$(CONFIG_EDAC_I5400)		+= i5400_edac.o
 obj-$(CONFIG_EDAC_I7300)                += i7300_edac.o
 obj-$(CONFIG_EDAC_I7CORE)               += i7core_edac.o
 obj-$(CONFIG_EDAC_SBRIDGE)              += sb_edac.o
+obj-$(CONFIG_EDAC_SKX)                  += skx_edac.o
 obj-$(CONFIG_EDAC_E7XXX)                += e7xxx_edac.o
 obj-$(CONFIG_EDAC_E752X)                += e752x_edac.o
 obj-$(CONFIG_EDAC_I82443BXGX)           += i82443bxgx_edac.o
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index 4fb2eb7c800d..ce0067b7a2f6 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -552,9 +552,9 @@ static const struct pci_id_table pci_dev_descr_haswell_table[] = {
 /* Knight's Landing Support */
 /*
  * KNL's memory channels are swizzled between memory controllers.
- * MC0 is mapped to CH3,5,6 and MC1 is mapped to CH0,1,2
+ * MC0 is mapped to CH3,4,5 and MC1 is mapped to CH0,1,2
  */
-#define knl_channel_remap(channel) ((channel + 3) % 6)
+#define knl_channel_remap(mc, chan) ((mc) ? (chan) : (chan) + 3)
 
 /* Memory controller, TAD tables, error injection - 2-8-0, 2-9-0 (2 of these) */
 #define PCI_DEVICE_ID_INTEL_KNL_IMC_MC       0x7840
@@ -1286,7 +1286,7 @@ static u32 knl_get_mc_route(int entry, u32 reg)
         mc = GET_BITFIELD(reg, entry*3, (entry*3)+2);
         chan = GET_BITFIELD(reg, (entry*2) + 18, (entry*2) + 18 + 1);
 
-        return knl_channel_remap(mc*3 + chan);
+        return knl_channel_remap(mc, chan);
 }
 
 /*
@@ -2997,8 +2997,15 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
                 } else {
                         char A = *("A");
 
-                        channel = knl_channel_remap(channel);
+                        /*
+                         * Reported channel is in range 0-2, so we can't map it
+                         * back to mc. To figure out mc we check machine check
+                         * bank register that reported this error.
+                         * bank15 means mc0 and bank16 means mc1.
+                         */
+                        channel = knl_channel_remap(m->bank == 16, channel);
                         channel_mask = 1 << channel;
+
                         snprintf(msg, sizeof(msg),
                                 "%s%s err_code:%04x:%04x channel:%d (DIMM_%c)",
                                 overflow ? " OVERFLOW" : "",
diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
new file mode 100644
index 000000000000..0ff4878c2aa1
--- /dev/null
+++ b/drivers/edac/skx_edac.c
@@ -0,0 +1,1121 @@
+/*
+ * EDAC driver for Intel(R) Xeon(R) Skylake processors
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/pci.h>
+#include <linux/pci_ids.h>
+#include <linux/slab.h>
+#include <linux/delay.h>
+#include <linux/edac.h>
+#include <linux/mmzone.h>
+#include <linux/smp.h>
+#include <linux/bitmap.h>
+#include <linux/math64.h>
+#include <linux/mod_devicetable.h>
+#include <asm/cpu_device_id.h>
+#include <asm/processor.h>
+#include <asm/mce.h>
+
+#include "edac_core.h"
+
+#define SKX_REVISION    " Ver: 1.0 "
+
+/*
+ * Debug macros
+ */
+#define skx_printk(level, fmt, arg...)                  \
+        edac_printk(level, "skx", fmt, ##arg)
+
+#define skx_mc_printk(mci, level, fmt, arg...)          \
+        edac_mc_chipset_printk(mci, level, "skx", fmt, ##arg)
+
+/*
+ * Get a bit field at register value <v>, from bit <lo> to bit <hi>
+ */
+#define GET_BITFIELD(v, lo, hi) \
+        (((v) & GENMASK_ULL((hi), (lo))) >> (lo))
+
+static LIST_HEAD(skx_edac_list);
+
+static u64 skx_tolm, skx_tohm;
+
+#define NUM_IMC                 2       /* memory controllers per socket */
+#define NUM_CHANNELS            3       /* channels per memory controller */
+#define NUM_DIMMS               2       /* Max DIMMS per channel */
+
+#define MASK26  0x3FFFFFF               /* Mask for 2^26 */
+#define MASK29  0x1FFFFFFF              /* Mask for 2^29 */
+
+/*
+ * Each cpu socket contains some pci devices that provide global
+ * information, and also some that are local to each of the two
+ * memory controllers on the die.
+ */
+struct skx_dev {
+        struct list_head        list;
+        u8                      bus[4];
+        struct pci_dev  *sad_all;
+        struct pci_dev  *util_all;
+        u32     mcroute;
+        struct skx_imc {
+                struct mem_ctl_info *mci;
+                u8      mc;     /* system wide mc# */
+                u8      lmc;    /* socket relative mc# */
+                u8      src_id, node_id;
+                struct skx_channel {
+                        struct pci_dev *cdev;
+                        struct skx_dimm {
+                                u8      close_pg;
+                                u8      bank_xor_enable;
+                                u8      fine_grain_bank;
+                                u8      rowbits;
+                                u8      colbits;
+                        } dimms[NUM_DIMMS];
+                } chan[NUM_CHANNELS];
+        } imc[NUM_IMC];
+};
+static int skx_num_sockets;
+
+struct skx_pvt {
+        struct skx_imc  *imc;
+};
+
+struct decoded_addr {
+        struct skx_dev *dev;
+        u64     addr;
+        int     socket;
+        int     imc;
+        int     channel;
+        u64     chan_addr;
+        int     sktways;
+        int     chanways;
+        int     dimm;
+        int     rank;
+        int     channel_rank;
+        u64     rank_address;
+        int     row;
+        int     column;
+        int     bank_address;
+        int     bank_group;
+};
+
+static struct skx_dev *get_skx_dev(u8 bus, u8 idx)
+{
+        struct skx_dev *d;
+
+        list_for_each_entry(d, &skx_edac_list, list) {
+                if (d->bus[idx] == bus)
+                        return d;
+        }
+
+        return NULL;
+}
+
+enum munittype {
+        CHAN0, CHAN1, CHAN2, SAD_ALL, UTIL_ALL, SAD
+};
+
+struct munit {
+        u16     did;
+        u16     devfn[NUM_IMC];
+        u8      busidx;
+        u8      per_socket;
+        enum munittype mtype;
+};
+
+/*
+ * List of PCI device ids that we need together with some device
+ * number and function numbers to tell which memory controller the
+ * device belongs to.
+ */
+static const struct munit skx_all_munits[] = {
+        { 0x2054, { }, 1, 1, SAD_ALL },
+        { 0x2055, { }, 1, 1, UTIL_ALL },
+        { 0x2040, { PCI_DEVFN(10, 0), PCI_DEVFN(12, 0) }, 2, 2, CHAN0 },
+        { 0x2044, { PCI_DEVFN(10, 4), PCI_DEVFN(12, 4) }, 2, 2, CHAN1 },
+        { 0x2048, { PCI_DEVFN(11, 0), PCI_DEVFN(13, 0) }, 2, 2, CHAN2 },
+        { 0x208e, { }, 1, 0, SAD },
+        { }
+};
+
+/*
+ * We use the per-socket device 0x2016 to count how many sockets are present,
+ * and to detemine which PCI buses are associated with each socket. Allocate
+ * and build the full list of all the skx_dev structures that we need here.
+ */
+static int get_all_bus_mappings(void)
+{
+        struct pci_dev *pdev, *prev;
+        struct skx_dev *d;
+        u32 reg;
+        int ndev = 0;
+
+        prev = NULL;
+        for (;;) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2016, prev);
+                if (!pdev)
+                        break;
+                ndev++;
+                d = kzalloc(sizeof(*d), GFP_KERNEL);
+                if (!d) {
+                        pci_dev_put(pdev);
+                        return -ENOMEM;
+                }
+                pci_read_config_dword(pdev, 0xCC, &reg);
+                d->bus[0] =  GET_BITFIELD(reg, 0, 7);
+                d->bus[1] =  GET_BITFIELD(reg, 8, 15);
+                d->bus[2] =  GET_BITFIELD(reg, 16, 23);
+                d->bus[3] =  GET_BITFIELD(reg, 24, 31);
+                edac_dbg(2, "busses: %x, %x, %x, %x\n",
+                         d->bus[0], d->bus[1], d->bus[2], d->bus[3]);
+                list_add_tail(&d->list, &skx_edac_list);
+                skx_num_sockets++;
+                prev = pdev;
+        }
+
+        return ndev;
+}
+
+static int get_all_munits(const struct munit *m)
+{
+        struct pci_dev *pdev, *prev;
+        struct skx_dev *d;
+        u32 reg;
+        int i = 0, ndev = 0;
+
+        prev = NULL;
+        for (;;) {
+                pdev = pci_get_device(PCI_VENDOR_ID_INTEL, m->did, prev);
+                if (!pdev)
+                        break;
+                ndev++;
+                if (m->per_socket == NUM_IMC) {
+                        for (i = 0; i < NUM_IMC; i++)
+                                if (m->devfn[i] == pdev->devfn)
+                                        break;
+                        if (i == NUM_IMC)
+                                goto fail;
+                }
+                d = get_skx_dev(pdev->bus->number, m->busidx);
+                if (!d)
+                        goto fail;
+
+                /* Be sure that the device is enabled */
+                if (unlikely(pci_enable_device(pdev) < 0)) {
+                        skx_printk(KERN_ERR,
+                                "Couldn't enable %04x:%04x\n", PCI_VENDOR_ID_INTEL, m->did);
+                        goto fail;
+                }
+
+                switch (m->mtype) {
+                case CHAN0: case CHAN1: case CHAN2:
+                        pci_dev_get(pdev);
+                        d->imc[i].chan[m->mtype].cdev = pdev;
+                        break;
+                case SAD_ALL:
+                        pci_dev_get(pdev);
+                        d->sad_all = pdev;
+                        break;
+                case UTIL_ALL:
+                        pci_dev_get(pdev);
+                        d->util_all = pdev;
+                        break;
+                case SAD:
+                        /*
+                         * one of these devices per core, including cores
+                         * that don't exist on this SKU. Ignore any that
+                         * read a route table of zero, make sure all the
+                         * non-zero values match.
+                         */
+                        pci_read_config_dword(pdev, 0xB4, &reg);
+                        if (reg != 0) {
+                                if (d->mcroute == 0)
+                                        d->mcroute = reg;
+                                else if (d->mcroute != reg) {
+                                        skx_printk(KERN_ERR,
+                                                "mcroute mismatch\n");
+                                        goto fail;
+                                }
+                        }
+                        ndev--;
+                        break;
+                }
+
+                prev = pdev;
+        }
+
+        return ndev;
+fail:
+        pci_dev_put(pdev);
+        return -ENODEV;
+}
+
+const struct x86_cpu_id skx_cpuids[] = {
+        { X86_VENDOR_INTEL, 6, 0x55, 0, 0 },    /* Skylake */
+        { }
+};
+MODULE_DEVICE_TABLE(x86cpu, skx_cpuids);
+
+static u8 get_src_id(struct skx_dev *d)
+{
+        u32 reg;
+
+        pci_read_config_dword(d->util_all, 0xF0, &reg);
+
+        return GET_BITFIELD(reg, 12, 14);
+}
+
+static u8 skx_get_node_id(struct skx_dev *d)
+{
+        u32 reg;
+
+        pci_read_config_dword(d->util_all, 0xF4, &reg);
+
+        return GET_BITFIELD(reg, 0, 2);
+}
+
+static int get_dimm_attr(u32 reg, int lobit, int hibit, int add, int minval,
+                         int maxval, char *name)
+{
+        u32 val = GET_BITFIELD(reg, lobit, hibit);
+
+        if (val < minval || val > maxval) {
+                edac_dbg(2, "bad %s = %d (raw=%x)\n", name, val, reg);
+                return -EINVAL;
+        }
+        return val + add;
+}
+
+#define IS_DIMM_PRESENT(mtr)            GET_BITFIELD((mtr), 15, 15)
+
+#define numrank(reg) get_dimm_attr((reg), 12, 13, 0, 1, 2, "ranks")
+#define numrow(reg) get_dimm_attr((reg), 2, 4, 12, 1, 6, "rows")
+#define numcol(reg) get_dimm_attr((reg), 0, 1, 10, 0, 2, "cols")
+
+static int get_width(u32 mtr)
+{
+        switch (GET_BITFIELD(mtr, 8, 9)) {
+        case 0:
+                return DEV_X4;
+        case 1:
+                return DEV_X8;
+        case 2:
+                return DEV_X16;
+        }
+        return DEV_UNKNOWN;
+}
+
+static int skx_get_hi_lo(void)
+{
+        struct pci_dev *pdev;
+        u32 reg;
+
+        pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2034, NULL);
+        if (!pdev) {
+                edac_dbg(0, "Can't get tolm/tohm\n");
+                return -ENODEV;
+        }
+
+        pci_read_config_dword(pdev, 0xD0, &reg);
+        skx_tolm = reg;
+        pci_read_config_dword(pdev, 0xD4, &reg);
+        skx_tohm = reg;
+        pci_read_config_dword(pdev, 0xD8, &reg);
+        skx_tohm |= (u64)reg << 32;
+
+        pci_dev_put(pdev);
+        edac_dbg(2, "tolm=%llx tohm=%llx\n", skx_tolm, skx_tohm);
+
+        return 0;
+}
+
+static int get_dimm_info(u32 mtr, u32 amap, struct dimm_info *dimm,
+                         struct skx_imc *imc, int chan, int dimmno)
+{
+        int  banks = 16, ranks, rows, cols, npages;
+        u64 size;
+
+        if (!IS_DIMM_PRESENT(mtr))
+                return 0;
+        ranks = numrank(mtr);
+        rows = numrow(mtr);
+        cols = numcol(mtr);
+
+        /*
+         * Compute size in 8-byte (2^3) words, then shift to MiB (2^20)
+         */
+        size = ((1ull << (rows + cols + ranks)) * banks) >> (20 - 3);
+        npages = MiB_TO_PAGES(size);
+
+        edac_dbg(0, "mc#%d: channel %d, dimm %d, %lld Mb (%d pages) bank: %d, rank: %d, row: %#x, col: %#x\n",
+                 imc->mc, chan, dimmno, size, npages,
+                 banks, ranks, rows, cols);
+
+        imc->chan[chan].dimms[dimmno].close_pg = GET_BITFIELD(mtr, 0, 0);
+        imc->chan[chan].dimms[dimmno].bank_xor_enable = GET_BITFIELD(mtr, 9, 9);
+        imc->chan[chan].dimms[dimmno].fine_grain_bank = GET_BITFIELD(amap, 0, 0);
+        imc->chan[chan].dimms[dimmno].rowbits = rows;
+        imc->chan[chan].dimms[dimmno].colbits = cols;
+
+        dimm->nr_pages = npages;
+        dimm->grain = 32;
+        dimm->dtype = get_width(mtr);
+        dimm->mtype = MEM_DDR4;
+        dimm->edac_mode = EDAC_SECDED; /* likely better than this */
+        snprintf(dimm->label, sizeof(dimm->label), "CPU_SrcID#%u_MC#%u_Chan#%u_DIMM#%u",
+                 imc->src_id, imc->lmc, chan, dimmno);
+
+        return 1;
+}
+
+#define SKX_GET_MTMTR(dev, reg) \
+        pci_read_config_dword((dev), 0x87c, &reg)
+
+static bool skx_check_ecc(struct pci_dev *pdev)
+{
+        u32 mtmtr;
+
+        SKX_GET_MTMTR(pdev, mtmtr);
+
+        return !!GET_BITFIELD(mtmtr, 2, 2);
+}
+
+static int skx_get_dimm_config(struct mem_ctl_info *mci)
+{
+        struct skx_pvt *pvt = mci->pvt_info;
+        struct skx_imc *imc = pvt->imc;
+        struct dimm_info *dimm;
+        int i, j;
+        u32 mtr, amap;
+        int ndimms;
+
+        for (i = 0; i < NUM_CHANNELS; i++) {
+                ndimms = 0;
+                pci_read_config_dword(imc->chan[i].cdev, 0x8C, &amap);
+                for (j = 0; j < NUM_DIMMS; j++) {
+                        dimm = EDAC_DIMM_PTR(mci->layers, mci->dimms,
+                                             mci->n_layers, i, j, 0);
+                        pci_read_config_dword(imc->chan[i].cdev,
+                                        0x80 + 4*j, &mtr);
+                        ndimms += get_dimm_info(mtr, amap, dimm, imc, i, j);
+                }
+                if (ndimms && !skx_check_ecc(imc->chan[0].cdev)) {
+                        skx_printk(KERN_ERR, "ECC is disabled on imc %d\n", imc->mc);
+                        return -ENODEV;
+                }
+        }
+
+        return 0;
+}
+
+static void skx_unregister_mci(struct skx_imc *imc)
+{
+        struct mem_ctl_info *mci = imc->mci;
+
+        if (!mci)
+                return;
+
+        edac_dbg(0, "MC%d: mci = %p\n", imc->mc, mci);
+
+        /* Remove MC sysfs nodes */
+        edac_mc_del_mc(mci->pdev);
+
+        edac_dbg(1, "%s: free mci struct\n", mci->ctl_name);
+        kfree(mci->ctl_name);
+        edac_mc_free(mci);
+}
+
+static int skx_register_mci(struct skx_imc *imc)
+{
+        struct mem_ctl_info *mci;
+        struct edac_mc_layer layers[2];
+        struct pci_dev *pdev = imc->chan[0].cdev;
+        struct skx_pvt *pvt;
+        int rc;
+
+        /* allocate a new MC control structure */
+        layers[0].type = EDAC_MC_LAYER_CHANNEL;
+        layers[0].size = NUM_CHANNELS;
+        layers[0].is_virt_csrow = false;
+        layers[1].type = EDAC_MC_LAYER_SLOT;
+        layers[1].size = NUM_DIMMS;
+        layers[1].is_virt_csrow = true;
+        mci = edac_mc_alloc(imc->mc, ARRAY_SIZE(layers), layers,
+                            sizeof(struct skx_pvt));
+
+        if (unlikely(!mci))
+                return -ENOMEM;
+
+        edac_dbg(0, "MC#%d: mci = %p\n", imc->mc, mci);
+
+        /* Associate skx_dev and mci for future usage */
+        imc->mci = mci;
+        pvt = mci->pvt_info;
+        pvt->imc = imc;
+
+        mci->ctl_name = kasprintf(GFP_KERNEL, "Skylake Socket#%d IMC#%d",
+                                  imc->node_id, imc->lmc);
+        mci->mtype_cap = MEM_FLAG_DDR4;
+        mci->edac_ctl_cap = EDAC_FLAG_NONE;
+        mci->edac_cap = EDAC_FLAG_NONE;
+        mci->mod_name = "skx_edac.c";
+        mci->dev_name = pci_name(imc->chan[0].cdev);
+        mci->mod_ver = SKX_REVISION;
+        mci->ctl_page_to_phys = NULL;
+
+        rc = skx_get_dimm_config(mci);
+        if (rc < 0)
+                goto fail;
+
+        /* record ptr to the generic device */
+        mci->pdev = &pdev->dev;
+
+        /* add this new MC control structure to EDAC's list of MCs */
+        if (unlikely(edac_mc_add_mc(mci))) {
+                edac_dbg(0, "MC: failed edac_mc_add_mc()\n");
+                rc = -EINVAL;
+                goto fail;
+        }
+
+        return 0;
+
+fail:
+        kfree(mci->ctl_name);
+        edac_mc_free(mci);
+        imc->mci = NULL;
+        return rc;
+}
+
+#define SKX_MAX_SAD 24
+
+#define SKX_GET_SAD(d, i, reg)  \
+        pci_read_config_dword((d)->sad_all, 0x60 + 8 * (i), &reg)
+#define SKX_GET_ILV(d, i, reg)  \
+        pci_read_config_dword((d)->sad_all, 0x64 + 8 * (i), &reg)
+
+#define SKX_SAD_MOD3MODE(sad)   GET_BITFIELD((sad), 30, 31)
+#define SKX_SAD_MOD3(sad)       GET_BITFIELD((sad), 27, 27)
+#define SKX_SAD_LIMIT(sad)      (((u64)GET_BITFIELD((sad), 7, 26) << 26) | MASK26)
+#define SKX_SAD_MOD3ASMOD2(sad) GET_BITFIELD((sad), 5, 6)
+#define SKX_SAD_ATTR(sad)       GET_BITFIELD((sad), 3, 4)
+#define SKX_SAD_INTERLEAVE(sad) GET_BITFIELD((sad), 1, 2)
+#define SKX_SAD_ENABLE(sad)     GET_BITFIELD((sad), 0, 0)
+
+#define SKX_ILV_REMOTE(tgt)     (((tgt) & 8) == 0)
+#define SKX_ILV_TARGET(tgt)     ((tgt) & 7)
+
+static bool skx_sad_decode(struct decoded_addr *res)
+{
+        struct skx_dev *d = list_first_entry(&skx_edac_list, typeof(*d), list);
+        u64 addr = res->addr;
+        int i, idx, tgt, lchan, shift;
+        u32 sad, ilv;
+        u64 limit, prev_limit;
+        int remote = 0;
+
+        /* Simple sanity check for I/O space or out of range */
+        if (addr >= skx_tohm || (addr >= skx_tolm && addr < BIT_ULL(32))) {
+                edac_dbg(0, "Address %llx out of range\n", addr);
+                return false;
+        }
+
+restart:
+        prev_limit = 0;
+        for (i = 0; i < SKX_MAX_SAD; i++) {
+                SKX_GET_SAD(d, i, sad);
+                limit = SKX_SAD_LIMIT(sad);
+                if (SKX_SAD_ENABLE(sad)) {
+                        if (addr >= prev_limit && addr <= limit)
+                                goto sad_found;
+                }
+                prev_limit = limit + 1;
+        }
+        edac_dbg(0, "No SAD entry for %llx\n", addr);
+        return false;
+
+sad_found:
+        SKX_GET_ILV(d, i, ilv);
+
+        switch (SKX_SAD_INTERLEAVE(sad)) {
+        case 0:
+                idx = GET_BITFIELD(addr, 6, 8);
+                break;
+        case 1:
+                idx = GET_BITFIELD(addr, 8, 10);
+                break;
+        case 2:
+                idx = GET_BITFIELD(addr, 12, 14);
+                break;
+        case 3:
+                idx = GET_BITFIELD(addr, 30, 32);
+                break;
+        }
+
+        tgt = GET_BITFIELD(ilv, 4 * idx, 4 * idx + 3);
+
+        /* If point to another node, find it and start over */
+        if (SKX_ILV_REMOTE(tgt)) {
+                if (remote) {
+                        edac_dbg(0, "Double remote!\n");
+                        return false;
+                }
+                remote = 1;
+                list_for_each_entry(d, &skx_edac_list, list) {
+                        if (d->imc[0].src_id == SKX_ILV_TARGET(tgt))
+                                goto restart;
+                }
+                edac_dbg(0, "Can't find node %d\n", SKX_ILV_TARGET(tgt));
+                return false;
+        }
+
+        if (SKX_SAD_MOD3(sad) == 0)
+                lchan = SKX_ILV_TARGET(tgt);
+        else {
+                switch (SKX_SAD_MOD3MODE(sad)) {
+                case 0:
+                        shift = 6;
+                        break;
+                case 1:
+                        shift = 8;
+                        break;
+                case 2:
+                        shift = 12;
+                        break;
+                default:
+                        edac_dbg(0, "illegal mod3mode\n");
+                        return false;
+                }
+                switch (SKX_SAD_MOD3ASMOD2(sad)) {
+                case 0:
+                        lchan = (addr >> shift) % 3;
+                        break;
+                case 1:
+                        lchan = (addr >> shift) % 2;
+                        break;
+                case 2:
+                        lchan = (addr >> shift) % 2;
+                        lchan = (lchan << 1) | ~lchan;
+                        break;
+                case 3:
+                        lchan = ((addr >> shift) % 2) << 1;
+                        break;
+                }
+                lchan = (lchan << 1) | (SKX_ILV_TARGET(tgt) & 1);
+        }
+
+        res->dev = d;
+        res->socket = d->imc[0].src_id;
+        res->imc = GET_BITFIELD(d->mcroute, lchan * 3, lchan * 3 + 2);
+        res->channel = GET_BITFIELD(d->mcroute, lchan * 2 + 18, lchan * 2 + 19);
+
+        edac_dbg(2, "%llx: socket=%d imc=%d channel=%d\n",
+                 res->addr, res->socket, res->imc, res->channel);
+        return true;
+}
+
+#define SKX_MAX_TAD 8
+
+#define SKX_GET_TADBASE(d, mc, i, reg)                  \
+        pci_read_config_dword((d)->imc[mc].chan[0].cdev, 0x850 + 4 * (i), &reg)
+#define SKX_GET_TADWAYNESS(d, mc, i, reg)               \
+        pci_read_config_dword((d)->imc[mc].chan[0].cdev, 0x880 + 4 * (i), &reg)
+#define SKX_GET_TADCHNILVOFFSET(d, mc, ch, i, reg)      \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev, 0x90 + 4 * (i), &reg)
+
+#define SKX_TAD_BASE(b)         ((u64)GET_BITFIELD((b), 12, 31) << 26)
+#define SKX_TAD_SKT_GRAN(b)     GET_BITFIELD((b), 4, 5)
+#define SKX_TAD_CHN_GRAN(b)     GET_BITFIELD((b), 6, 7)
+#define SKX_TAD_LIMIT(b)        (((u64)GET_BITFIELD((b), 12, 31) << 26) | MASK26)
+#define SKX_TAD_OFFSET(b)       ((u64)GET_BITFIELD((b), 4, 23) << 26)
+#define SKX_TAD_SKTWAYS(b)      (1 << GET_BITFIELD((b), 10, 11))
+#define SKX_TAD_CHNWAYS(b)      (GET_BITFIELD((b), 8, 9) + 1)
+
+/* which bit used for both socket and channel interleave */
+static int skx_granularity[] = { 6, 8, 12, 30 };
+
+static u64 skx_do_interleave(u64 addr, int shift, int ways, u64 lowbits)
+{
+        addr >>= shift;
+        addr /= ways;
+        addr <<= shift;
+
+        return addr | (lowbits & ((1ull << shift) - 1));
+}
+
+static bool skx_tad_decode(struct decoded_addr *res)
+{
+        int i;
+        u32 base, wayness, chnilvoffset;
+        int skt_interleave_bit, chn_interleave_bit;
+        u64 channel_addr;
+
+        for (i = 0; i < SKX_MAX_TAD; i++) {
+                SKX_GET_TADBASE(res->dev, res->imc, i, base);
+                SKX_GET_TADWAYNESS(res->dev, res->imc, i, wayness);
+                if (SKX_TAD_BASE(base) <= res->addr && res->addr <= SKX_TAD_LIMIT(wayness))
+                        goto tad_found;
+        }
+        edac_dbg(0, "No TAD entry for %llx\n", res->addr);
+        return false;
+
+tad_found:
+        res->sktways = SKX_TAD_SKTWAYS(wayness);
+        res->chanways = SKX_TAD_CHNWAYS(wayness);
+        skt_interleave_bit = skx_granularity[SKX_TAD_SKT_GRAN(base)];
+        chn_interleave_bit = skx_granularity[SKX_TAD_CHN_GRAN(base)];
+
+        SKX_GET_TADCHNILVOFFSET(res->dev, res->imc, res->channel, i, chnilvoffset);
+        channel_addr = res->addr - SKX_TAD_OFFSET(chnilvoffset);
+
+        if (res->chanways == 3 && skt_interleave_bit > chn_interleave_bit) {
+                /* Must handle channel first, then socket */
+                channel_addr = skx_do_interleave(channel_addr, chn_interleave_bit,
+                                                 res->chanways, channel_addr);
+                channel_addr = skx_do_interleave(channel_addr, skt_interleave_bit,
+                                                 res->sktways, channel_addr);
+        } else {
+                /* Handle socket then channel. Preserve low bits from original address */
+                channel_addr = skx_do_interleave(channel_addr, skt_interleave_bit,
+                                                 res->sktways, res->addr);
+                channel_addr = skx_do_interleave(channel_addr, chn_interleave_bit,
+                                                 res->chanways, res->addr);
+        }
+
+        res->chan_addr = channel_addr;
+
+        edac_dbg(2, "%llx: chan_addr=%llx sktways=%d chanways=%d\n",
+                 res->addr, res->chan_addr, res->sktways, res->chanways);
+        return true;
+}
+
+#define SKX_MAX_RIR 4
+
+#define SKX_GET_RIRWAYNESS(d, mc, ch, i, reg)           \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev,       \
+                              0x108 + 4 * (i), &reg)
+#define SKX_GET_RIRILV(d, mc, ch, idx, i, reg)          \
+        pci_read_config_dword((d)->imc[mc].chan[ch].cdev,       \
+                              0x120 + 16 * idx + 4 * (i), &reg)
+
+#define SKX_RIR_VALID(b) GET_BITFIELD((b), 31, 31)
+#define SKX_RIR_LIMIT(b) (((u64)GET_BITFIELD((b), 1, 11) << 29) | MASK29)
+#define SKX_RIR_WAYS(b) (1 << GET_BITFIELD((b), 28, 29))
+#define SKX_RIR_CHAN_RANK(b) GET_BITFIELD((b), 16, 19)
+#define SKX_RIR_OFFSET(b) ((u64)(GET_BITFIELD((b), 2, 15) << 26))
+
+static bool skx_rir_decode(struct decoded_addr *res)
+{
+        int i, idx, chan_rank;
+        int shift;
+        u32 rirway, rirlv;
+        u64 rank_addr, prev_limit = 0, limit;
+
+        if (res->dev->imc[res->imc].chan[res->channel].dimms[0].close_pg)
+                shift = 6;
+        else
+                shift = 13;
+
+        for (i = 0; i < SKX_MAX_RIR; i++) {
+                SKX_GET_RIRWAYNESS(res->dev, res->imc, res->channel, i, rirway);
+                limit = SKX_RIR_LIMIT(rirway);
+                if (SKX_RIR_VALID(rirway)) {
+                        if (prev_limit <= res->chan_addr &&
+                            res->chan_addr <= limit)
+                                goto rir_found;
+                }
+                prev_limit = limit;
+        }
+        edac_dbg(0, "No RIR entry for %llx\n", res->addr);
+        return false;
+
+rir_found:
+        rank_addr = res->chan_addr >> shift;
+        rank_addr /= SKX_RIR_WAYS(rirway);
+        rank_addr <<= shift;
+        rank_addr |= res->chan_addr & GENMASK_ULL(shift - 1, 0);
+
+        res->rank_address = rank_addr;
+        idx = (res->chan_addr >> shift) % SKX_RIR_WAYS(rirway);
+
+        SKX_GET_RIRILV(res->dev, res->imc, res->channel, idx, i, rirlv);
+        res->rank_address = rank_addr - SKX_RIR_OFFSET(rirlv);
+        chan_rank = SKX_RIR_CHAN_RANK(rirlv);
+        res->channel_rank = chan_rank;
+        res->dimm = chan_rank / 4;
+        res->rank = chan_rank % 4;
+
+        edac_dbg(2, "%llx: dimm=%d rank=%d chan_rank=%d rank_addr=%llx\n",
+                 res->addr, res->dimm, res->rank,
+                 res->channel_rank, res->rank_address);
+        return true;
+}
+
+static u8 skx_close_row[] = {
+        15, 16, 17, 18, 20, 21, 22, 28, 10, 11, 12, 13, 29, 30, 31, 32, 33
+};
+static u8 skx_close_column[] = {
+        3, 4, 5, 14, 19, 23, 24, 25, 26, 27
+};
+static u8 skx_open_row[] = {
+        14, 15, 16, 20, 28, 21, 22, 23, 24, 25, 26, 27, 29, 30, 31, 32, 33
+};
+static u8 skx_open_column[] = {
+        3, 4, 5, 6, 7, 8, 9, 10, 11, 12
+};
+static u8 skx_open_fine_column[] = {
+        3, 4, 5, 7, 8, 9, 10, 11, 12, 13
+};
+
+static int skx_bits(u64 addr, int nbits, u8 *bits)
+{
+        int i, res = 0;
+
+        for (i = 0; i < nbits; i++)
+                res |= ((addr >> bits[i]) & 1) << i;
+        return res;
+}
+
+static int skx_bank_bits(u64 addr, int b0, int b1, int do_xor, int x0, int x1)
+{
+        int ret = GET_BITFIELD(addr, b0, b0) | (GET_BITFIELD(addr, b1, b1) << 1);
+
+        if (do_xor)
+                ret ^= GET_BITFIELD(addr, x0, x0) | (GET_BITFIELD(addr, x1, x1) << 1);
+
+        return ret;
+}
+
+static bool skx_mad_decode(struct decoded_addr *r)
+{
+        struct skx_dimm *dimm = &r->dev->imc[r->imc].chan[r->channel].dimms[r->dimm];
+        int bg0 = dimm->fine_grain_bank ? 6 : 13;
+
+        if (dimm->close_pg) {
+                r->row = skx_bits(r->rank_address, dimm->rowbits, skx_close_row);
+                r->column = skx_bits(r->rank_address, dimm->colbits, skx_close_column);
+                r->column |= 0x400; /* C10 is autoprecharge, always set */
+                r->bank_address = skx_bank_bits(r->rank_address, 8, 9, dimm->bank_xor_enable, 22, 28);
+                r->bank_group = skx_bank_bits(r->rank_address, 6, 7, dimm->bank_xor_enable, 20, 21);
+        } else {
+                r->row = skx_bits(r->rank_address, dimm->rowbits, skx_open_row);
+                if (dimm->fine_grain_bank)
+                        r->column = skx_bits(r->rank_address, dimm->colbits, skx_open_fine_column);
+                else
+                        r->column = skx_bits(r->rank_address, dimm->colbits, skx_open_column);
+                r->bank_address = skx_bank_bits(r->rank_address, 18, 19, dimm->bank_xor_enable, 22, 23);
+                r->bank_group = skx_bank_bits(r->rank_address, bg0, 17, dimm->bank_xor_enable, 20, 21);
+        }
+        r->row &= (1u << dimm->rowbits) - 1;
+
+        edac_dbg(2, "%llx: row=%x col=%x bank_addr=%d bank_group=%d\n",
+                 r->addr, r->row, r->column, r->bank_address,
+                 r->bank_group);
+        return true;
+}
+
+static bool skx_decode(struct decoded_addr *res)
+{
+
+        return skx_sad_decode(res) && skx_tad_decode(res) &&
+                skx_rir_decode(res) && skx_mad_decode(res);
+}
+
+#ifdef CONFIG_EDAC_DEBUG
+/*
+ * Debug feature. Make /sys/kernel/debug/skx_edac_test/addr.
+ * Write an address to this file to exercise the address decode
+ * logic in this driver.
+ */
+static struct dentry *skx_test;
+static u64 skx_fake_addr;
+
+static int debugfs_u64_set(void *data, u64 val)
+{
+        struct decoded_addr res;
+
+        res.addr = val;
+        skx_decode(&res);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_u64_wo, NULL, debugfs_u64_set, "%llu\n");
+
+static struct dentry *mydebugfs_create(const char *name, umode_t mode,
+                                       struct dentry *parent, u64 *value)
+{
+        return debugfs_create_file(name, mode, parent, value, &fops_u64_wo);
+}
+
+static void setup_skx_debug(void)
+{
+        skx_test = debugfs_create_dir("skx_edac_test", NULL);
+        mydebugfs_create("addr", S_IWUSR, skx_test, &skx_fake_addr);
+}
+
+static void teardown_skx_debug(void)
+{
+        debugfs_remove_recursive(skx_test);
+}
+#else
+static void setup_skx_debug(void)
+{
+}
+
+static void teardown_skx_debug(void)
+{
+}
+#endif /*CONFIG_EDAC_DEBUG*/
+
+static void skx_mce_output_error(struct mem_ctl_info *mci,
+                                 const struct mce *m,
+                                 struct decoded_addr *res)
+{
+        enum hw_event_mc_err_type tp_event;
+        char *type, *optype, msg[256];
+        bool ripv = GET_BITFIELD(m->mcgstatus, 0, 0);
+        bool overflow = GET_BITFIELD(m->status, 62, 62);
+        bool uncorrected_error = GET_BITFIELD(m->status, 61, 61);
+        bool recoverable;
+        u32 core_err_cnt = GET_BITFIELD(m->status, 38, 52);
+        u32 mscod = GET_BITFIELD(m->status, 16, 31);
+        u32 errcode = GET_BITFIELD(m->status, 0, 15);
+        u32 optypenum = GET_BITFIELD(m->status, 4, 6);
+
+        recoverable = GET_BITFIELD(m->status, 56, 56);
+
+        if (uncorrected_error) {
+                if (ripv) {
+                        type = "FATAL";
+                        tp_event = HW_EVENT_ERR_FATAL;
+                } else {
+                        type = "NON_FATAL";
+                        tp_event = HW_EVENT_ERR_UNCORRECTED;
+                }
+        } else {
+                type = "CORRECTED";
+                tp_event = HW_EVENT_ERR_CORRECTED;
+        }
+
+        /*
+         * According with Table 15-9 of the Intel Architecture spec vol 3A,
+         * memory errors should fit in this mask:
+         *      000f 0000 1mmm cccc (binary)
+         * where:
+         *      f = Correction Report Filtering Bit. If 1, subsequent errors
+         *          won't be shown
+         *      mmm = error type
+         *      cccc = channel
+         * If the mask doesn't match, report an error to the parsing logic
+         */
+        if (!((errcode & 0xef80) == 0x80)) {
+                optype = "Can't parse: it is not a mem";
+        } else {
+                switch (optypenum) {
+                case 0:
+                        optype = "generic undef request error";
+                        break;
+                case 1:
+                        optype = "memory read error";
+                        break;
+                case 2:
+                        optype = "memory write error";
+                        break;
+                case 3:
+                        optype = "addr/cmd error";
+                        break;
+                case 4:
+                        optype = "memory scrubbing error";
+                        break;
+                default:
+                        optype = "reserved";
+                        break;
+                }
+        }
+
+        snprintf(msg, sizeof(msg),
+                 "%s%s err_code:%04x:%04x socket:%d imc:%d rank:%d bg:%d ba:%d row:%x col:%x",
+                 overflow ? " OVERFLOW" : "",
+                 (uncorrected_error && recoverable) ? " recoverable" : "",
+                 mscod, errcode,
+                 res->socket, res->imc, res->rank,
+                 res->bank_group, res->bank_address, res->row, res->column);
+
+        edac_dbg(0, "%s\n", msg);
+
+        /* Call the helper to output message */
+        edac_mc_handle_error(tp_event, mci, core_err_cnt,
+                             m->addr >> PAGE_SHIFT, m->addr & ~PAGE_MASK, 0,
+                             res->channel, res->dimm, -1,
+                             optype, msg);
+}
+
+static int skx_mce_check_error(struct notifier_block *nb, unsigned long val,
+                               void *data)
+{
+        struct mce *mce = (struct mce *)data;
+        struct decoded_addr res;
+        struct mem_ctl_info *mci;
+        char *type;
+
+        if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                return NOTIFY_DONE;
+
+        /* ignore unless this is memory related with an address */
+        if ((mce->status & 0xefff) >> 7 != 1 || !(mce->status & MCI_STATUS_ADDRV))
+                return NOTIFY_DONE;
+
+        res.addr = mce->addr;
+        if (!skx_decode(&res))
+                return NOTIFY_DONE;
+        mci = res.dev->imc[res.imc].mci;
+
+        if (mce->mcgstatus & MCG_STATUS_MCIP)
+                type = "Exception";
+        else
+                type = "Event";
+
+        skx_mc_printk(mci, KERN_DEBUG, "HANDLING MCE MEMORY ERROR\n");
+
+        skx_mc_printk(mci, KERN_DEBUG, "CPU %d: Machine Check %s: %Lx "
+                          "Bank %d: %016Lx\n", mce->extcpu, type,
+                          mce->mcgstatus, mce->bank, mce->status);
+        skx_mc_printk(mci, KERN_DEBUG, "TSC %llx ", mce->tsc);
+        skx_mc_printk(mci, KERN_DEBUG, "ADDR %llx ", mce->addr);
+        skx_mc_printk(mci, KERN_DEBUG, "MISC %llx ", mce->misc);
+
+        skx_mc_printk(mci, KERN_DEBUG, "PROCESSOR %u:%x TIME %llu SOCKET "
+                          "%u APIC %x\n", mce->cpuvendor, mce->cpuid,
+                          mce->time, mce->socketid, mce->apicid);
+
+        skx_mce_output_error(mci, mce, &res);
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block skx_mce_dec = {
+        .notifier_call = skx_mce_check_error,
+};
+
+static void skx_remove(void)
+{
+        int i, j;
+        struct skx_dev *d, *tmp;
+
+        edac_dbg(0, "\n");
+
+        list_for_each_entry_safe(d, tmp, &skx_edac_list, list) {
+                list_del(&d->list);
+                for (i = 0; i < NUM_IMC; i++) {
+                        skx_unregister_mci(&d->imc[i]);
+                        for (j = 0; j < NUM_CHANNELS; j++)
+                                pci_dev_put(d->imc[i].chan[j].cdev);
+                }
+                pci_dev_put(d->util_all);
+                pci_dev_put(d->sad_all);
+
+                kfree(d);
+        }
+}
+
+/*
+ * skx_init:
+ *      make sure we are running on the correct cpu model
+ *      search for all the devices we need
+ *      check which DIMMs are present.
+ */
+int __init skx_init(void)
+{
+        const struct x86_cpu_id *id;
+        const struct munit *m;
+        int rc = 0, i;
+        u8 mc = 0, src_id, node_id;
+        struct skx_dev *d;
+
+        edac_dbg(2, "\n");
+
+        id = x86_match_cpu(skx_cpuids);
+        if (!id)
+                return -ENODEV;
+
+        rc = skx_get_hi_lo();
+        if (rc)
+                return rc;
+
+        rc = get_all_bus_mappings();
+        if (rc < 0)
+                goto fail;
+        if (rc == 0) {
+                edac_dbg(2, "No memory controllers found\n");
+                return -ENODEV;
+        }
+
+        for (m = skx_all_munits; m->did; m++) {
+                rc = get_all_munits(m);
+                if (rc < 0)
+                        goto fail;
+                if (rc != m->per_socket * skx_num_sockets) {
+                        edac_dbg(2, "Expected %d, got %d of %x\n",
+                                 m->per_socket * skx_num_sockets, rc, m->did);
+                        rc = -ENODEV;
+                        goto fail;
+                }
+        }
+
+        list_for_each_entry(d, &skx_edac_list, list) {
+                src_id = get_src_id(d);
+                node_id = skx_get_node_id(d);
+                edac_dbg(2, "src_id=%d node_id=%d\n", src_id, node_id);
+                for (i = 0; i < NUM_IMC; i++) {
+                        d->imc[i].mc = mc++;
+                        d->imc[i].lmc = i;
+                        d->imc[i].src_id = src_id;
+                        d->imc[i].node_id = node_id;
+                        rc = skx_register_mci(&d->imc[i]);
+                        if (rc < 0)
+                                goto fail;
+                }
+        }
+
+        /* Ensure that the OPSTATE is set correctly for POLL or NMI */
+        opstate_init();
+
+        setup_skx_debug();
+
+        mce_register_decode_chain(&skx_mce_dec);
+
+        return 0;
+fail:
+        skx_remove();
+        return rc;
+}
+
+static void __exit skx_exit(void)
+{
+        edac_dbg(2, "\n");
+        mce_unregister_decode_chain(&skx_mce_dec);
+        skx_remove();
+        teardown_skx_debug();
+}
+
+module_init(skx_init);
+module_exit(skx_exit);
+
+module_param(edac_op_state, int, 0444);
+MODULE_PARM_DESC(edac_op_state, "EDAC Error Reporting state: 0=Poll,1=NMI");
+
+MODULE_LICENSE("GPL v2");
+MODULE_AUTHOR("Tony Luck");
+MODULE_DESCRIPTION("MC Driver for Intel Skylake server processors");
diff --git a/drivers/firmware/arm_scpi.c b/drivers/firmware/arm_scpi.c
index 438893762076..ce2bc2a38101 100644
--- a/drivers/firmware/arm_scpi.c
+++ b/drivers/firmware/arm_scpi.c
@@ -709,9 +709,10 @@ static int scpi_probe(struct platform_device *pdev)
                 struct mbox_client *cl = &pchan->cl;
                 struct device_node *shmem = of_parse_phandle(np, "shmem", idx);
 
-                if (of_address_to_resource(shmem, 0, &res)) {
+                ret = of_address_to_resource(shmem, 0, &res);
+                of_node_put(shmem);
+                if (ret) {
                         dev_err(dev, "failed to get SCPI payload mem resource\n");
-                        ret = -EINVAL;
                         goto err;
                 }
 
diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 94a58a082b99..44c01390d035 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c
@@ -229,14 +229,14 @@ static int __init dmi_id_init(void)
 
         ret = device_register(dmi_dev);
         if (ret)
-                goto fail_free_dmi_dev;
+                goto fail_put_dmi_dev;
 
         return 0;
 
-fail_free_dmi_dev:
-        kfree(dmi_dev);
-fail_class_unregister:
+fail_put_dmi_dev:
+        put_device(dmi_dev);
 
+fail_class_unregister:
         class_unregister(&dmi_class);
 
         return ret;
diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c
index c99c24bc79b0..9ae6c116c474 100644
--- a/drivers/firmware/efi/capsule-loader.c
+++ b/drivers/firmware/efi/capsule-loader.c
@@ -16,6 +16,7 @@
 #include <linux/slab.h>
 #include <linux/mutex.h>
 #include <linux/efi.h>
+#include <linux/vmalloc.h>
 
 #define NO_FURTHER_WRITE_ACTION -1
 
@@ -108,14 +109,15 @@ static ssize_t efi_capsule_submit_update(struct capsule_info *cap_info)
         int ret;
         void *cap_hdr_temp;
 
-        cap_hdr_temp = kmap(cap_info->pages[0]);
+        cap_hdr_temp = vmap(cap_info->pages, cap_info->index,
+                        VM_MAP, PAGE_KERNEL);
         if (!cap_hdr_temp) {
-                pr_debug("%s: kmap() failed\n", __func__);
+                pr_debug("%s: vmap() failed\n", __func__);
                 return -EFAULT;
         }
 
         ret = efi_capsule_update(cap_hdr_temp, cap_info->pages);
-        kunmap(cap_info->pages[0]);
+        vunmap(cap_hdr_temp);
         if (ret) {
                 pr_err("%s: efi_capsule_update() failed\n", __func__);
                 return ret;
diff --git a/drivers/firmware/efi/capsule.c b/drivers/firmware/efi/capsule.c
index 53b9fd2293ee..6eedff45e6d7 100644
--- a/drivers/firmware/efi/capsule.c
+++ b/drivers/firmware/efi/capsule.c
@@ -190,9 +190,9 @@ efi_capsule_update_locked(efi_capsule_header_t *capsule,
  * map the capsule described by @capsule with its data in @pages and
  * send it to the firmware via the UpdateCapsule() runtime service.
  *
- * @capsule must be a virtual mapping of the first page in @pages
- * (@pages[0]) in the kernel address space. That is, a
- * capsule_header_t that describes the entire contents of the capsule
+ * @capsule must be a virtual mapping of the complete capsule update in the
+ * kernel address space, as the capsule can be consumed immediately.
+ * A capsule_header_t that describes the entire contents of the capsule
  * must be at the start of the first data page.
  *
  * Even though this function will validate that the firmware supports
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 5a2631af7410..7dd2e2d37231 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -657,9 +657,12 @@ static int __init fdt_find_uefi_params(unsigned long node, const char *uname,
                 }
 
                 if (subnode) {
-                        node = of_get_flat_dt_subnode_by_name(node, subnode);
-                        if (node < 0)
+                        int err = of_get_flat_dt_subnode_by_name(node, subnode);
+
+                        if (err < 0)
                                 return 0;
+
+                        node = err;
                 }
 
                 return __find_uefi_params(node, info, dt_params[i].params);
diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c
index 3bd127f95315..aded10662020 100644
--- a/drivers/firmware/efi/libstub/efi-stub-helper.c
+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c
@@ -41,6 +41,8 @@ static unsigned long __chunk_size = EFI_READ_CHUNK_SIZE;
 #define EFI_ALLOC_ALIGN         EFI_PAGE_SIZE
 #endif
 
+#define EFI_MMAP_NR_SLACK_SLOTS 8
+
 struct file_info {
         efi_file_handle_t *handle;
         u64 size;
@@ -63,49 +65,62 @@ void efi_printk(efi_system_table_t *sys_table_arg, char *str)
         }
 }
 
+static inline bool mmap_has_headroom(unsigned long buff_size,
+                                     unsigned long map_size,
+                                     unsigned long desc_size)
+{
+        unsigned long slack = buff_size - map_size;
+
+        return slack / desc_size >= EFI_MMAP_NR_SLACK_SLOTS;
+}
+
 efi_status_t efi_get_memory_map(efi_system_table_t *sys_table_arg,
-                                efi_memory_desc_t **map,
-                                unsigned long *map_size,
-                                unsigned long *desc_size,
-                                u32 *desc_ver,
-                                unsigned long *key_ptr)
+                                struct efi_boot_memmap *map)
 {
         efi_memory_desc_t *m = NULL;
         efi_status_t status;
         unsigned long key;
         u32 desc_version;
 
-        *map_size = sizeof(*m) * 32;
+        *map->desc_size =       sizeof(*m);
+        *map->map_size =        *map->desc_size * 32;
+        *map->buff_size =       *map->map_size;
 again:
-        /*
-         * Add an additional efi_memory_desc_t because we're doing an
-         * allocation which may be in a new descriptor region.
-         */
-        *map_size += sizeof(*m);
         status = efi_call_early(allocate_pool, EFI_LOADER_DATA,
-                                *map_size, (void **)&m);
+                                *map->map_size, (void **)&m);
         if (status != EFI_SUCCESS)
                 goto fail;
 
-        *desc_size = 0;
+        *map->desc_size = 0;
         key = 0;
-        status = efi_call_early(get_memory_map, map_size, m,
-                                &key, desc_size, &desc_version);
-        if (status == EFI_BUFFER_TOO_SMALL) {
+        status = efi_call_early(get_memory_map, map->map_size, m,
+                                &key, map->desc_size, &desc_version);
+        if (status == EFI_BUFFER_TOO_SMALL ||
+            !mmap_has_headroom(*map->buff_size, *map->map_size,
+                               *map->desc_size)) {
                 efi_call_early(free_pool, m);
+                /*
+                 * Make sure there is some entries of headroom so that the
+                 * buffer can be reused for a new map after allocations are
+                 * no longer permitted.  Its unlikely that the map will grow to
+                 * exceed this headroom once we are ready to trigger
+                 * ExitBootServices()
+                 */
+                *map->map_size += *map->desc_size * EFI_MMAP_NR_SLACK_SLOTS;
+                *map->buff_size = *map->map_size;
                 goto again;
         }
 
         if (status != EFI_SUCCESS)
                 efi_call_early(free_pool, m);
 
-        if (key_ptr && status == EFI_SUCCESS)
-                *key_ptr = key;
-        if (desc_ver && status == EFI_SUCCESS)
-                *desc_ver = desc_version;
+        if (map->key_ptr && status == EFI_SUCCESS)
+                *map->key_ptr = key;
+        if (map->desc_ver && status == EFI_SUCCESS)
+                *map->desc_ver = desc_version;
 
 fail:
-        *map = m;
+        *map->map = m;
         return status;
 }
 
@@ -113,13 +128,20 @@ fail:
 unsigned long get_dram_base(efi_system_table_t *sys_table_arg)
 {
         efi_status_t status;
-        unsigned long map_size;
+        unsigned long map_size, buff_size;
         unsigned long membase  = EFI_ERROR;
         struct efi_memory_map map;
         efi_memory_desc_t *md;
+        struct efi_boot_memmap boot_map;
 
-        status = efi_get_memory_map(sys_table_arg, (efi_memory_desc_t **)&map.map,
-                                    &map_size, &map.desc_size, NULL, NULL);
+        boot_map.map =          (efi_memory_desc_t **)&map.map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &map.desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 return membase;
 
@@ -144,15 +166,22 @@ efi_status_t efi_high_alloc(efi_system_table_t *sys_table_arg,
                             unsigned long size, unsigned long align,
                             unsigned long *addr, unsigned long max)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         efi_memory_desc_t *map;
         efi_status_t status;
         unsigned long nr_pages;
         u64 max_addr = 0;
         int i;
+        struct efi_boot_memmap boot_map;
+
+        boot_map.map =          &map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
 
-        status = efi_get_memory_map(sys_table_arg, &map, &map_size, &desc_size,
-                                    NULL, NULL);
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 goto fail;
 
@@ -230,14 +259,21 @@ efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
                            unsigned long size, unsigned long align,
                            unsigned long *addr)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         efi_memory_desc_t *map;
         efi_status_t status;
         unsigned long nr_pages;
         int i;
+        struct efi_boot_memmap boot_map;
 
-        status = efi_get_memory_map(sys_table_arg, &map, &map_size, &desc_size,
-                                    NULL, NULL);
+        boot_map.map =          &map;
+        boot_map.map_size =     &map_size;
+        boot_map.desc_size =    &desc_size;
+        boot_map.desc_ver =     NULL;
+        boot_map.key_ptr =      NULL;
+        boot_map.buff_size =    &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &boot_map);
         if (status != EFI_SUCCESS)
                 goto fail;
 
@@ -704,3 +740,76 @@ char *efi_convert_cmdline(efi_system_table_t *sys_table_arg,
         *cmd_line_len = options_bytes;
         return (char *)cmdline_addr;
 }
+
+/*
+ * Handle calling ExitBootServices according to the requirements set out by the
+ * spec.  Obtains the current memory map, and returns that info after calling
+ * ExitBootServices.  The client must specify a function to perform any
+ * processing of the memory map data prior to ExitBootServices.  A client
+ * specific structure may be passed to the function via priv.  The client
+ * function may be called multiple times.
+ */
+efi_status_t efi_exit_boot_services(efi_system_table_t *sys_table_arg,
+                                    void *handle,
+                                    struct efi_boot_memmap *map,
+                                    void *priv,
+                                    efi_exit_boot_map_processing priv_func)
+{
+        efi_status_t status;
+
+        status = efi_get_memory_map(sys_table_arg, map);
+
+        if (status != EFI_SUCCESS)
+                goto fail;
+
+        status = priv_func(sys_table_arg, map, priv);
+        if (status != EFI_SUCCESS)
+                goto free_map;
+
+        status = efi_call_early(exit_boot_services, handle, *map->key_ptr);
+
+        if (status == EFI_INVALID_PARAMETER) {
+                /*
+                 * The memory map changed between efi_get_memory_map() and
+                 * exit_boot_services().  Per the UEFI Spec v2.6, Section 6.4:
+                 * EFI_BOOT_SERVICES.ExitBootServices we need to get the
+                 * updated map, and try again.  The spec implies one retry
+                 * should be sufficent, which is confirmed against the EDK2
+                 * implementation.  Per the spec, we can only invoke
+                 * get_memory_map() and exit_boot_services() - we cannot alloc
+                 * so efi_get_memory_map() cannot be used, and we must reuse
+                 * the buffer.  For all practical purposes, the headroom in the
+                 * buffer should account for any changes in the map so the call
+                 * to get_memory_map() is expected to succeed here.
+                 */
+                *map->map_size = *map->buff_size;
+                status = efi_call_early(get_memory_map,
+                                        map->map_size,
+                                        *map->map,
+                                        map->key_ptr,
+                                        map->desc_size,
+                                        map->desc_ver);
+
+                /* exit_boot_services() was called, thus cannot free */
+                if (status != EFI_SUCCESS)
+                        goto fail;
+
+                status = priv_func(sys_table_arg, map, priv);
+                /* exit_boot_services() was called, thus cannot free */
+                if (status != EFI_SUCCESS)
+                        goto fail;
+
+                status = efi_call_early(exit_boot_services, handle, *map->key_ptr);
+        }
+
+        /* exit_boot_services() was called, thus cannot free */
+        if (status != EFI_SUCCESS)
+                goto fail;
+
+        return EFI_SUCCESS;
+
+free_map:
+        efi_call_early(free_pool, *map->map);
+fail:
+        return status;
+}
diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c
index e58abfa953cc..a6a93116a8f0 100644
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -152,6 +152,27 @@ fdt_set_fail:
 #define EFI_FDT_ALIGN EFI_PAGE_SIZE
 #endif
 
+struct exit_boot_struct {
+        efi_memory_desc_t *runtime_map;
+        int *runtime_entry_count;
+};
+
+static efi_status_t exit_boot_func(efi_system_table_t *sys_table_arg,
+                                   struct efi_boot_memmap *map,
+                                   void *priv)
+{
+        struct exit_boot_struct *p = priv;
+        /*
+         * Update the memory map with virtual addresses. The function will also
+         * populate @runtime_map with copies of just the EFI_MEMORY_RUNTIME
+         * entries so that we can pass it straight to SetVirtualAddressMap()
+         */
+        efi_get_virtmap(*map->map, *map->map_size, *map->desc_size,
+                        p->runtime_map, p->runtime_entry_count);
+
+        return EFI_SUCCESS;
+}
+
 /*
  * Allocate memory for a new FDT, then add EFI, commandline, and
  * initrd related fields to the FDT.  This routine increases the
@@ -175,13 +196,22 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                                             unsigned long fdt_addr,
                                             unsigned long fdt_size)
 {
-        unsigned long map_size, desc_size;
+        unsigned long map_size, desc_size, buff_size;
         u32 desc_ver;
         unsigned long mmap_key;
         efi_memory_desc_t *memory_map, *runtime_map;
         unsigned long new_fdt_size;
         efi_status_t status;
         int runtime_entry_count = 0;
+        struct efi_boot_memmap map;
+        struct exit_boot_struct priv;
+
+        map.map =       &runtime_map;
+        map.map_size =  &map_size;
+        map.desc_size = &desc_size;
+        map.desc_ver =  &desc_ver;
+        map.key_ptr =   &mmap_key;
+        map.buff_size = &buff_size;
 
         /*
          * Get a copy of the current memory map that we will use to prepare
@@ -189,8 +219,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
          * subsequent allocations adding entries, since they could not affect
          * the number of EFI_MEMORY_RUNTIME regions.
          */
-        status = efi_get_memory_map(sys_table, &runtime_map, &map_size,
-                                    &desc_size, &desc_ver, &mmap_key);
+        status = efi_get_memory_map(sys_table, &map);
         if (status != EFI_SUCCESS) {
                 pr_efi_err(sys_table, "Unable to retrieve UEFI memory map.\n");
                 return status;
@@ -199,6 +228,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
         pr_efi(sys_table,
                "Exiting boot services and installing virtual address map...\n");
 
+        map.map = &memory_map;
         /*
          * Estimate size of new FDT, and allocate memory for it. We
          * will allocate a bigger buffer if this ends up being too
@@ -218,8 +248,7 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                  * we can get the memory map key  needed for
                  * exit_boot_services().
                  */
-                status = efi_get_memory_map(sys_table, &memory_map, &map_size,
-                                            &desc_size, &desc_ver, &mmap_key);
+                status = efi_get_memory_map(sys_table, &map);
                 if (status != EFI_SUCCESS)
                         goto fail_free_new_fdt;
 
@@ -250,16 +279,11 @@ efi_status_t allocate_new_fdt_and_exit_boot(efi_system_table_t *sys_table,
                 }
         }
 
-        /*
-         * Update the memory map with virtual addresses. The function will also
-         * populate @runtime_map with copies of just the EFI_MEMORY_RUNTIME
-         * entries so that we can pass it straight into SetVirtualAddressMap()
-         */
-        efi_get_virtmap(memory_map, map_size, desc_size, runtime_map,
-                        &runtime_entry_count);
-
-        /* Now we are ready to exit_boot_services.*/
-        status = sys_table->boottime->exit_boot_services(handle, mmap_key);
+        sys_table->boottime->free_pool(memory_map);
+        priv.runtime_map = runtime_map;
+        priv.runtime_entry_count = &runtime_entry_count;
+        status = efi_exit_boot_services(sys_table, handle, &map, &priv,
+                                        exit_boot_func);
 
         if (status == EFI_SUCCESS) {
                 efi_set_virtual_address_map_t *svam;
diff --git a/drivers/firmware/efi/libstub/random.c b/drivers/firmware/efi/libstub/random.c
index 53f6d3fe6d86..0c9f58c5ba50 100644
--- a/drivers/firmware/efi/libstub/random.c
+++ b/drivers/firmware/efi/libstub/random.c
@@ -73,12 +73,20 @@ efi_status_t efi_random_alloc(efi_system_table_t *sys_table_arg,
                               unsigned long random_seed)
 {
         unsigned long map_size, desc_size, total_slots = 0, target_slot;
+        unsigned long buff_size;
         efi_status_t status;
         efi_memory_desc_t *memory_map;
         int map_offset;
+        struct efi_boot_memmap map;
 
-        status = efi_get_memory_map(sys_table_arg, &memory_map, &map_size,
-                                    &desc_size, NULL, NULL);
+        map.map =       &memory_map;
+        map.map_size =  &map_size;
+        map.desc_size = &desc_size;
+        map.desc_ver =  NULL;
+        map.key_ptr =   NULL;
+        map.buff_size = &buff_size;
+
+        status = efi_get_memory_map(sys_table_arg, &map);
         if (status != EFI_SUCCESS)
                 return status;
 
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 98dd47a30fc7..24caedb00a7a 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -50,6 +50,7 @@ config GPIO_DEVRES
 config OF_GPIO
         def_bool y
         depends on OF
+        depends on HAS_IOMEM
 
 config GPIO_ACPI
         def_bool y
@@ -188,7 +189,7 @@ config GPIO_EP93XX
 config GPIO_ETRAXFS
         bool "Axis ETRAX FS General I/O"
         depends on CRIS || COMPILE_TEST
-        depends on OF
+        depends on OF_GPIO
         select GPIO_GENERIC
         select GPIOLIB_IRQCHIP
         help
@@ -214,7 +215,7 @@ config GPIO_GENERIC_PLATFORM
 
 config GPIO_GRGPIO
         tristate "Aeroflex Gaisler GRGPIO support"
-        depends on OF
+        depends on OF_GPIO
         select GPIO_GENERIC
         select IRQ_DOMAIN
         help
@@ -312,7 +313,7 @@ config GPIO_MPC8XXX
 config GPIO_MVEBU
         def_bool y
         depends on PLAT_ORION
-        depends on OF
+        depends on OF_GPIO
         select GENERIC_IRQ_CHIP
 
 config GPIO_MXC
@@ -405,7 +406,7 @@ config GPIO_TEGRA
         bool "NVIDIA Tegra GPIO support"
         default ARCH_TEGRA
         depends on ARCH_TEGRA || COMPILE_TEST
-        depends on OF
+        depends on OF_GPIO
         help
           Say yes here to support GPIO pins on NVIDIA Tegra SoCs.
 
@@ -1099,7 +1100,7 @@ menu "SPI GPIO expanders"
 
 config GPIO_74X164
         tristate "74x164 serial-in/parallel-out 8-bits shift register"
-        depends on OF
+        depends on OF_GPIO
         help
           Driver for 74x164 compatible serial-in/parallel-out 8-outputs
           shift registers. This driver can be used to provide access
@@ -1130,6 +1131,7 @@ menu "SPI or I2C GPIO expanders"
 
 config GPIO_MCP23S08
         tristate "Microchip MCP23xxx I/O expander"
+        depends on OF_GPIO
         select GPIOLIB_IRQCHIP
         help
           SPI/I2C driver for Microchip MCP23S08/MCP23S17/MCP23008/MCP23017
diff --git a/drivers/gpio/gpio-max730x.c b/drivers/gpio/gpio-max730x.c
index 08807368f007..946d09195598 100644
--- a/drivers/gpio/gpio-max730x.c
+++ b/drivers/gpio/gpio-max730x.c
@@ -192,6 +192,10 @@ int __max730x_probe(struct max7301 *ts)
         ts->chip.parent = dev;
         ts->chip.owner = THIS_MODULE;
 
+        ret = gpiochip_add_data(&ts->chip, ts);
+        if (ret)
+                goto exit_destroy;
+
         /*
          * initialize pullups according to platform data and cache the
          * register values for later use.
@@ -213,10 +217,6 @@ int __max730x_probe(struct max7301 *ts)
                 }
         }
 
-        ret = gpiochip_add_data(&ts->chip, ts);
-        if (ret)
-                goto exit_destroy;
-
         return ret;
 
 exit_destroy:
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index ac22efc1840e..99d37b56c258 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -564,7 +564,7 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
         mcp->chip.direction_output = mcp23s08_direction_output;
         mcp->chip.set = mcp23s08_set;
         mcp->chip.dbg_show = mcp23s08_dbg_show;
-#ifdef CONFIG_OF
+#ifdef CONFIG_OF_GPIO
         mcp->chip.of_gpio_n_cells = 2;
         mcp->chip.of_node = dev->of_node;
 #endif
diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
index 0c99e8fb9af3..8d8ee0ebf14c 100644
--- a/drivers/gpio/gpio-sa1100.c
+++ b/drivers/gpio/gpio-sa1100.c
@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d,
 {
         irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
                                  handle_edge_irq);
-        irq_set_noprobe(irq);
+        irq_set_probe(irq);
 
         return 0;
 }
diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
index 75e7b3919ea7..a28feb3edf33 100644
--- a/drivers/gpio/gpiolib-of.c
+++ b/drivers/gpio/gpiolib-of.c
@@ -16,7 +16,6 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/io.h>
-#include <linux/io-mapping.h>
 #include <linux/gpio/consumer.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 8ebc5f1eb4c0..700c56baf2de 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -426,6 +426,8 @@ struct amdgpu_mman {
 
         /* custom LRU management */
         struct amdgpu_mman_lru                  log2_size[AMDGPU_TTM_LRU_SIZE];
+        /* guard for log2_size array, don't add anything in between */
+        struct amdgpu_mman_lru                  guard;
 };
 
 int amdgpu_copy_buffer(struct amdgpu_ring *ring,
@@ -646,9 +648,9 @@ int amdgpu_gart_table_vram_pin(struct amdgpu_device *adev);
 void amdgpu_gart_table_vram_unpin(struct amdgpu_device *adev);
 int amdgpu_gart_init(struct amdgpu_device *adev);
 void amdgpu_gart_fini(struct amdgpu_device *adev);
-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
                         int pages);
-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
                      int pages, struct page **pagelist,
                      dma_addr_t *dma_addr, uint32_t flags);
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
index 983175363b06..fe872b82e619 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
@@ -321,6 +321,19 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
                             (le16_to_cpu(path->usConnObjectId) &
                              OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
 
+                        /* Skip TV/CV support */
+                        if ((le16_to_cpu(path->usDeviceTag) ==
+                             ATOM_DEVICE_TV1_SUPPORT) ||
+                            (le16_to_cpu(path->usDeviceTag) ==
+                             ATOM_DEVICE_CV_SUPPORT))
+                                continue;
+
+                        if (con_obj_id >= ARRAY_SIZE(object_connector_convert)) {
+                                DRM_ERROR("invalid con_obj_id %d for device tag 0x%04x\n",
+                                          con_obj_id, le16_to_cpu(path->usDeviceTag));
+                                continue;
+                        }
+
                         connector_type =
                                 object_connector_convert[con_obj_id];
                         connector_object_id = con_obj_id;
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
index 49de92600074..10b5ddf2c588 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c
@@ -200,16 +200,7 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-#if 1
-                /* This is a temporary hack until the D3 cold support
-                 * makes it upstream.  The ATPX power_control method seems
-                 * to still work on even if the system should be using
-                 * the new standardized hybrid D3 cold ACPI interface.
-                 */
-                atpx->functions.power_cntl = true;
-#else
                 atpx->functions.power_cntl = false;
-#endif
                 atpx->is_hybrid = true;
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
index 921bce2df0b0..0feea347f680 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -221,7 +221,7 @@ void amdgpu_gart_table_vram_free(struct amdgpu_device *adev)
  * Unbinds the requested pages from the gart page table and
  * replaces them with the dummy page (all asics).
  */
-void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
+void amdgpu_gart_unbind(struct amdgpu_device *adev, uint64_t offset,
                         int pages)
 {
         unsigned t;
@@ -268,7 +268,7 @@ void amdgpu_gart_unbind(struct amdgpu_device *adev, unsigned offset,
  * (all asics).
  * Returns 0 for success, -EINVAL for failure.
  */
-int amdgpu_gart_bind(struct amdgpu_device *adev, unsigned offset,
+int amdgpu_gart_bind(struct amdgpu_device *adev, uint64_t offset,
                      int pages, struct page **pagelist, dma_addr_t *dma_addr,
                      uint32_t flags)
 {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
index a31d7ef3032c..ec1282af2479 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c
@@ -280,7 +280,7 @@ void amdgpu_ib_pool_fini(struct amdgpu_device *adev)
 int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
 {
         unsigned i;
-        int r;
+        int r, ret = 0;
 
         for (i = 0; i < AMDGPU_MAX_RINGS; ++i) {
                 struct amdgpu_ring *ring = adev->rings[i];
@@ -301,10 +301,11 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev)
                         } else {
                                 /* still not good, but we can live with it */
                                 DRM_ERROR("amdgpu: failed testing IB on ring %d (%d).\n", i, r);
+                                ret = r;
                         }
                 }
         }
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
index ff63b88b0ffa..5cc7052e391d 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -305,7 +305,7 @@ static ssize_t amdgpu_get_pp_table(struct device *dev,
         struct drm_device *ddev = dev_get_drvdata(dev);
         struct amdgpu_device *adev = ddev->dev_private;
         char *table = NULL;
-        int size, i;
+        int size;
 
         if (adev->pp_enabled)
                 size = amdgpu_dpm_get_pp_table(adev, &table);
@@ -315,10 +315,7 @@ static ssize_t amdgpu_get_pp_table(struct device *dev,
         if (size >= PAGE_SIZE)
                 size = PAGE_SIZE - 1;
 
-        for (i = 0; i < size; i++) {
-                sprintf(buf + i, "%02x", table[i]);
-        }
-        sprintf(buf + i, "\n");
+        memcpy(buf, table, size);
 
         return size;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index b7742e62972a..716f2afeb6a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -251,8 +251,8 @@ static int amdgpu_move_blit(struct ttm_buffer_object *bo,
 
         adev = amdgpu_get_adev(bo->bdev);
         ring = adev->mman.buffer_funcs_ring;
-        old_start = old_mem->start << PAGE_SHIFT;
-        new_start = new_mem->start << PAGE_SHIFT;
+        old_start = (u64)old_mem->start << PAGE_SHIFT;
+        new_start = (u64)new_mem->start << PAGE_SHIFT;
 
         switch (old_mem->mem_type) {
         case TTM_PL_VRAM:
@@ -335,7 +335,7 @@ static int amdgpu_move_vram_ram(struct ttm_buffer_object *bo,
         if (unlikely(r)) {
                 goto out_cleanup;
         }
-        r = ttm_bo_move_ttm(bo, true, no_wait_gpu, new_mem);
+        r = ttm_bo_move_ttm(bo, true, interruptible, no_wait_gpu, new_mem);
 out_cleanup:
         ttm_bo_mem_put(bo, &tmp_mem);
         return r;
@@ -368,7 +368,7 @@ static int amdgpu_move_ram_vram(struct ttm_buffer_object *bo,
         if (unlikely(r)) {
                 return r;
         }
-        r = ttm_bo_move_ttm(bo, true, no_wait_gpu, &tmp_mem);
+        r = ttm_bo_move_ttm(bo, true, interruptible, no_wait_gpu, &tmp_mem);
         if (unlikely(r)) {
                 goto out_cleanup;
         }
@@ -950,6 +950,8 @@ static struct list_head *amdgpu_ttm_lru_tail(struct ttm_buffer_object *tbo)
         struct list_head *res = lru->lru[tbo->mem.mem_type];
 
         lru->lru[tbo->mem.mem_type] = &tbo->lru;
+        while ((++lru)->lru[tbo->mem.mem_type] == res)
+                lru->lru[tbo->mem.mem_type] = &tbo->lru;
 
         return res;
 }
@@ -960,6 +962,8 @@ static struct list_head *amdgpu_ttm_swap_lru_tail(struct ttm_buffer_object *tbo)
         struct list_head *res = lru->swap_lru;
 
         lru->swap_lru = &tbo->swap;
+        while ((++lru)->swap_lru == res)
+                lru->swap_lru = &tbo->swap;
 
         return res;
 }
@@ -1011,6 +1015,10 @@ int amdgpu_ttm_init(struct amdgpu_device *adev)
                 lru->swap_lru = &adev->mman.bdev.glob->swap_lru;
         }
 
+        for (j = 0; j < TTM_NUM_MEM_TYPES; ++j)
+                adev->mman.guard.lru[j] = NULL;
+        adev->mman.guard.swap_lru = NULL;
+
         adev->mman.initialized = true;
         r = ttm_bo_init_mm(&adev->mman.bdev, TTM_PL_VRAM,
                                 adev->mc.real_vram_size >> PAGE_SHIFT);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
index b11f4e8868d7..4aa993d19018 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c
@@ -1187,7 +1187,8 @@ int amdgpu_uvd_ring_test_ib(struct amdgpu_ring *ring, long timeout)
                 r = 0;
         }
 
-error:
         fence_put(fence);
+
+error:
         return r;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 8e642fc48df4..80120fa4092c 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1535,7 +1535,7 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm)
         r = amd_sched_entity_init(&ring->sched, &vm->entity,
                                   rq, amdgpu_sched_jobs);
         if (r)
-                return r;
+                goto err;
 
         vm->page_directory_fence = NULL;
 
@@ -1565,6 +1565,9 @@ error_free_page_directory:
 error_free_sched_entity:
         amd_sched_entity_fini(&ring->sched, &vm->entity);
 
+err:
+        drm_free_large(vm->page_tables);
+
         return r;
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index e2f0e5d58d5c..a5c94b482459 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -5779,6 +5779,7 @@ static int ci_dpm_init_microcode(struct amdgpu_device *adev)
                 break;
         case CHIP_KAVERI:
         case CHIP_KABINI:
+        case CHIP_MULLINS:
         default: BUG();
         }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index ee6466912497..77fdd9911c3c 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -52,6 +52,7 @@ static void cik_sdma_set_ring_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_irq_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_buffer_funcs(struct amdgpu_device *adev);
 static void cik_sdma_set_vm_pte_funcs(struct amdgpu_device *adev);
+static int cik_sdma_soft_reset(void *handle);
 
 MODULE_FIRMWARE("radeon/bonaire_sdma.bin");
 MODULE_FIRMWARE("radeon/bonaire_sdma1.bin");
@@ -1037,6 +1038,8 @@ static int cik_sdma_resume(void *handle)
 {
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        cik_sdma_soft_reset(handle);
+
         return cik_sdma_hw_init(adev);
 }
 
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index d869d058ef24..425413fcaf02 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -2755,8 +2755,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
         u64 wb_gpu_addr;
         u32 *buf;
         struct bonaire_mqd *mqd;
-
-        gfx_v7_0_cp_compute_enable(adev, true);
+        struct amdgpu_ring *ring;
 
         /* fix up chicken bits */
         tmp = RREG32(mmCP_CPF_DEBUG);
@@ -2791,7 +2790,7 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
 
         /* init the queues.  Just two for now. */
         for (i = 0; i < adev->gfx.num_compute_rings; i++) {
-                struct amdgpu_ring *ring = &adev->gfx.compute_ring[i];
+                ring = &adev->gfx.compute_ring[i];
 
                 if (ring->mqd_obj == NULL) {
                         r = amdgpu_bo_create(adev,
@@ -2970,6 +2969,13 @@ static int gfx_v7_0_cp_compute_resume(struct amdgpu_device *adev)
                 amdgpu_bo_unreserve(ring->mqd_obj);
 
                 ring->ready = true;
+        }
+
+        gfx_v7_0_cp_compute_enable(adev, true);
+
+        for (i = 0; i < adev->gfx.num_compute_rings; i++) {
+                ring = &adev->gfx.compute_ring[i];
+
                 r = amdgpu_ring_test_ring(ring);
                 if (r)
                         ring->ready = false;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
index bff8668e9e6d..b8184617ca25 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
@@ -270,7 +270,8 @@ static const u32 tonga_mgcg_cgcg_init[] =
 
 static const u32 golden_settings_polaris11_a11[] =
 {
-        mmCB_HW_CONTROL, 0xfffdf3cf, 0x00006208,
+        mmCB_HW_CONTROL, 0x0000f3cf, 0x00007208,
+        mmCB_HW_CONTROL_2, 0x0f000000, 0x0f000000,
         mmCB_HW_CONTROL_3, 0x000001ff, 0x00000040,
         mmDB_DEBUG2, 0xf00fffff, 0x00000400,
         mmPA_SC_ENHANCE, 0xffffffff, 0x20000001,
@@ -279,7 +280,7 @@ static const u32 golden_settings_polaris11_a11[] =
         mmPA_SC_RASTER_CONFIG_1, 0x0000003f, 0x00000000,
         mmRLC_CGCG_CGLS_CTRL, 0x00000003, 0x0001003c,
         mmRLC_CGCG_CGLS_CTRL_3D, 0xffffffff, 0x0001003c,
-        mmSQ_CONFIG, 0x07f80000, 0x07180000,
+        mmSQ_CONFIG, 0x07f80000, 0x01180000,
         mmTA_CNTL_AUX, 0x000f000f, 0x000b0000,
         mmTCC_CTRL, 0x00100000, 0xf31fff7f,
         mmTCP_ADDR_CONFIG, 0x000003ff, 0x000000f3,
@@ -301,8 +302,8 @@ static const u32 polaris11_golden_common_all[] =
 static const u32 golden_settings_polaris10_a11[] =
 {
         mmATC_MISC_CG, 0x000c0fc0, 0x000c0200,
-        mmCB_HW_CONTROL, 0xfffdf3cf, 0x00007208,
-        mmCB_HW_CONTROL_2, 0, 0x0f000000,
+        mmCB_HW_CONTROL, 0x0001f3cf, 0x00007208,
+        mmCB_HW_CONTROL_2, 0x0f000000, 0x0f000000,
         mmCB_HW_CONTROL_3, 0x000001ff, 0x00000040,
         mmDB_DEBUG2, 0xf00fffff, 0x00000400,
         mmPA_SC_ENHANCE, 0xffffffff, 0x20000001,
@@ -409,6 +410,7 @@ static const u32 golden_settings_iceland_a11[] =
         mmPA_SC_LINE_STIPPLE_STATE, 0x0000ff0f, 0x00000000,
         mmPA_SC_RASTER_CONFIG, 0x3f3fffff, 0x00000002,
         mmPA_SC_RASTER_CONFIG_1, 0x0000003f, 0x00000000,
+        mmRLC_CGCG_CGLS_CTRL, 0x00000003, 0x0000003c,
         mmSQ_RANDOM_WAVE_PRI, 0x001fffff, 0x000006fd,
         mmTA_CNTL_AUX, 0x000f000f, 0x000b0000,
         mmTCC_CTRL, 0x00100000, 0xf31fff7f,
@@ -505,8 +507,10 @@ static const u32 cz_golden_settings_a11[] =
         mmGB_GPU_ID, 0x0000000f, 0x00000000,
         mmPA_SC_ENHANCE, 0xffffffff, 0x00000001,
         mmPA_SC_LINE_STIPPLE_STATE, 0x0000ff0f, 0x00000000,
+        mmRLC_CGCG_CGLS_CTRL, 0x00000003, 0x0000003c,
         mmSQ_RANDOM_WAVE_PRI, 0x001fffff, 0x000006fd,
         mmTA_CNTL_AUX, 0x000f000f, 0x00010000,
+        mmTCC_CTRL, 0x00100000, 0xf31fff7f,
         mmTCC_EXE_DISABLE, 0x00000002, 0x00000002,
         mmTCP_ADDR_CONFIG, 0x0000000f, 0x000000f3,
         mmTCP_CHAN_STEER_LO, 0xffffffff, 0x00001302
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index d24a82bd0c7a..0b0f08641eed 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -144,6 +144,7 @@ static int gmc_v7_0_init_microcode(struct amdgpu_device *adev)
                 break;
         case CHIP_KAVERI:
         case CHIP_KABINI:
+        case CHIP_MULLINS:
                 return 0;
         default: BUG();
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
index 717359d3ba8c..2aee2c6f3cd5 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
@@ -103,6 +103,11 @@ static const u32 stoney_mgcg_cgcg_init[] =
         mmMC_MEM_POWER_LS, 0xffffffff, 0x00000104
 };
 
+static const u32 golden_settings_stoney_common[] =
+{
+        mmMC_HUB_RDREQ_UVD, MC_HUB_RDREQ_UVD__PRESCALE_MASK, 0x00000004,
+        mmMC_RD_GRP_OTH, MC_RD_GRP_OTH__UVD_MASK, 0x00600000
+};
 
 static void gmc_v8_0_init_golden_registers(struct amdgpu_device *adev)
 {
@@ -142,6 +147,9 @@ static void gmc_v8_0_init_golden_registers(struct amdgpu_device *adev)
                 amdgpu_program_register_sequence(adev,
                                                  stoney_mgcg_cgcg_init,
                                                  (const u32)ARRAY_SIZE(stoney_mgcg_cgcg_init));
+                amdgpu_program_register_sequence(adev,
+                                                 golden_settings_stoney_common,
+                                                 (const u32)ARRAY_SIZE(golden_settings_stoney_common));
                 break;
         default:
                 break;
diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
index 1351c7e834a2..a64715d90503 100644
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c
@@ -714,7 +714,7 @@ static int sdma_v2_4_ring_test_ib(struct amdgpu_ring *ring, long timeout)
                 DRM_ERROR("amdgpu: IB test timed out\n");
                 r = -ETIMEDOUT;
                 goto err1;
-        } else if (r) {
+        } else if (r < 0) {
                 DRM_ERROR("amdgpu: fence wait failed (%ld).\n", r);
                 goto err1;
         }
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
index e621eba63126..a7d3cb3fead0 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_doorbell.c
@@ -184,7 +184,7 @@ u32 __iomem *kfd_get_kernel_doorbell(struct kfd_dev *kfd,
                                                         sizeof(u32)) + inx;
 
         pr_debug("kfd: get kernel queue doorbell\n"
-                         "     doorbell offset   == 0x%08d\n"
+                         "     doorbell offset   == 0x%08X\n"
                          "     kernel address    == 0x%08lX\n",
                 *doorbell_off, (uintptr_t)(kfd->doorbell_kernel_ptr + inx));
 
diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
index ef312bb75fda..963a24d46a93 100644
--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
+++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c
@@ -405,7 +405,7 @@ void amd_sched_job_recovery(struct amd_gpu_scheduler *sched)
         spin_lock(&sched->job_list_lock);
         s_job = list_first_entry_or_null(&sched->ring_mirror_list,
                                          struct amd_sched_job, node);
-        if (s_job)
+        if (s_job && sched->timeout != MAX_SCHEDULE_TIMEOUT)
                 schedule_delayed_work(&s_job->work_tdr, sched->timeout);
 
         list_for_each_entry_safe(s_job, tmp, &sched->ring_mirror_list, node) {
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
index a978381ef95b..9b17a66cf0e1 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_crtc.c
@@ -387,7 +387,7 @@ void atmel_hlcdc_crtc_irq(struct drm_crtc *c)
         atmel_hlcdc_crtc_finish_page_flip(drm_crtc_to_atmel_hlcdc_crtc(c));
 }
 
-void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
+static void atmel_hlcdc_crtc_reset(struct drm_crtc *crtc)
 {
         struct atmel_hlcdc_crtc_state *state;
 
diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
index 016c191221f3..52c527f6642a 100644
--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
+++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c
@@ -320,19 +320,19 @@ atmel_hlcdc_plane_update_pos_and_size(struct atmel_hlcdc_plane *plane,
                         u32 *coeff_tab = heo_upscaling_ycoef;
                         u32 max_memsize;
 
-                        if (state->crtc_w < state->src_w)
+                        if (state->crtc_h < state->src_h)
                                 coeff_tab = heo_downscaling_ycoef;
                         for (i = 0; i < ARRAY_SIZE(heo_upscaling_ycoef); i++)
                                 atmel_hlcdc_layer_update_cfg(&plane->layer,
                                                              33 + i,
                                                              0xffffffff,
                                                              coeff_tab[i]);
-                        factor = ((8 * 256 * state->src_w) - (256 * 4)) /
-                                 state->crtc_w;
+                        factor = ((8 * 256 * state->src_h) - (256 * 4)) /
+                                 state->crtc_h;
                         factor++;
-                        max_memsize = ((factor * state->crtc_w) + (256 * 4)) /
+                        max_memsize = ((factor * state->crtc_h) + (256 * 4)) /
                                       2048;
-                        if (max_memsize > state->src_w)
+                        if (max_memsize > state->src_h)
                                 factor--;
                         factor_reg |= (factor << 16) | 0x80000000;
                 }
diff --git a/drivers/gpu/drm/cirrus/cirrus_main.c b/drivers/gpu/drm/cirrus/cirrus_main.c
index 80446e2d3ab6..76bcb43e7c06 100644
--- a/drivers/gpu/drm/cirrus/cirrus_main.c
+++ b/drivers/gpu/drm/cirrus/cirrus_main.c
@@ -185,14 +185,23 @@ int cirrus_driver_load(struct drm_device *dev, unsigned long flags)
                 goto out;
         }
 
+        /*
+         * cirrus_modeset_init() is initializing/registering the emulated fbdev
+         * and DRM internals can access/test some of the fields in
+         * mode_config->funcs as part of the fbdev registration process.
+         * Make sure dev->mode_config.funcs is properly set to avoid
+         * dereferencing a NULL pointer.
+         * FIXME: mode_config.funcs assignment should probably be done in
+         * cirrus_modeset_init() (that's a common pattern seen in other DRM
+         * drivers).
+         */
+        dev->mode_config.funcs = &cirrus_mode_funcs;
         r = cirrus_modeset_init(cdev);
         if (r) {
                 dev_err(&dev->pdev->dev, "Fatal error during modeset init: %d\n", r);
                 goto out;
         }
 
-        dev->mode_config.funcs = (void *)&cirrus_mode_funcs;
-
         return 0;
 out:
         cirrus_driver_unload(dev);
diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
index fa3930757972..2a3ded44cf2a 100644
--- a/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -475,7 +475,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         -1,
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (property == config->ctm_property) {
                 ret = drm_atomic_replace_property_blob_from_id(crtc,
@@ -483,7 +483,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         sizeof(struct drm_color_ctm),
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (property == config->gamma_lut_property) {
                 ret = drm_atomic_replace_property_blob_from_id(crtc,
@@ -491,7 +491,7 @@ int drm_atomic_crtc_set_property(struct drm_crtc *crtc,
                                         val,
                                         -1,
                                         &replaced);
-                state->color_mgmt_changed = replaced;
+                state->color_mgmt_changed |= replaced;
                 return ret;
         } else if (crtc->funcs->atomic_set_property)
                 return crtc->funcs->atomic_set_property(crtc, state, property, val);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index f1d9f0569d7f..ddebe54cd5ca 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -1121,16 +1121,14 @@ static int drm_connector_register_all(struct drm_device *dev)
         struct drm_connector *connector;
         int ret;
 
-        mutex_lock(&dev->mode_config.mutex);
-
-        drm_for_each_connector(connector, dev) {
+        /* FIXME: taking the mode config mutex ends up in a clash with
+         * fbcon/backlight registration */
+        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 ret = drm_connector_register(connector);
                 if (ret)
                         goto err;
         }
 
-        mutex_unlock(&dev->mode_config.mutex);
-
         return 0;
 
 err:
@@ -5406,6 +5404,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
         struct drm_pending_vblank_event *e = NULL;
         int ret = -EINVAL;
 
+        if (!drm_core_check_feature(dev, DRIVER_MODESET))
+                return -EINVAL;
+
         if (page_flip->flags & ~DRM_MODE_PAGE_FLIP_FLAGS ||
             page_flip->reserved != 0)
                 return -EINVAL;
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 7df26d4b7ad8..637a0aa4d3a0 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -74,6 +74,8 @@
 #define EDID_QUIRK_FORCE_8BPC                   (1 << 8)
 /* Force 12bpc */
 #define EDID_QUIRK_FORCE_12BPC                  (1 << 9)
+/* Force 6bpc */
+#define EDID_QUIRK_FORCE_6BPC                   (1 << 10)
 
 struct detailed_mode_closure {
         struct drm_connector *connector;
@@ -100,6 +102,9 @@ static struct edid_quirk {
         /* Unknown Acer */
         { "ACR", 2423, EDID_QUIRK_FIRST_DETAILED_PREFERRED },
 
+        /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */
+        { "AEO", 0, EDID_QUIRK_FORCE_6BPC },
+
         /* Belinea 10 15 55 */
         { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 },
         { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 },
@@ -3862,6 +3867,20 @@ static void drm_add_display_info(struct edid *edid,
         /* HDMI deep color modes supported? Assign to info, if so */
         drm_assign_hdmi_deep_color_info(edid, info, connector);
 
+        /*
+         * Digital sink with "DFP 1.x compliant TMDS" according to EDID 1.3?
+         *
+         * For such displays, the DFP spec 1.0, section 3.10 "EDID support"
+         * tells us to assume 8 bpc color depth if the EDID doesn't have
+         * extensions which tell otherwise.
+         */
+        if ((info->bpc == 0) && (edid->revision < 4) &&
+            (edid->input & DRM_EDID_DIGITAL_TYPE_DVI)) {
+                info->bpc = 8;
+                DRM_DEBUG("%s: Assigning DFP sink color depth as %d bpc.\n",
+                          connector->name, info->bpc);
+        }
+
         /* Only defined for 1.4 with digital displays */
         if (edid->revision < 4)
                 return;
@@ -4082,6 +4101,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid)
 
         drm_add_display_info(edid, &connector->display_info, connector);
 
+        if (quirks & EDID_QUIRK_FORCE_6BPC)
+                connector->display_info.bpc = 6;
+
         if (quirks & EDID_QUIRK_FORCE_8BPC)
                 connector->display_info.bpc = 8;
 
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index ce54e985d91b..0a06f9120b5a 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -464,7 +464,7 @@ static bool drm_fb_helper_is_bound(struct drm_fb_helper *fb_helper)
 
         /* Sometimes user space wants everything disabled, so don't steal the
          * display if there's a master. */
-        if (lockless_dereference(dev->master))
+        if (READ_ONCE(dev->master))
                 return false;
 
         drm_for_each_crtc(crtc, dev) {
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 57676f8d7ecf..a6289752be16 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -1015,6 +1015,7 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
         return 0;
 }
 
+#if defined(CONFIG_X86) || defined(CONFIG_IA64)
 typedef struct drm_mode_fb_cmd232 {
         u32 fb_id;
         u32 width;
@@ -1071,6 +1072,7 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
 
         return 0;
 }
+#endif
 
 static drm_ioctl_compat_t *drm_compat_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
@@ -1104,7 +1106,9 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
         [DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
 #endif
         [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
+#if defined(CONFIG_X86) || defined(CONFIG_IA64)
         [DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
+#endif
 };
 
 /**
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 87ef34150d46..b382cf505262 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1333,8 +1333,6 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         if (ret < 0)
                 return ret;
 
-        mutex_lock(&gpu->lock);
-
         /*
          * TODO
          *
@@ -1348,16 +1346,18 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         if (unlikely(event == ~0U)) {
                 DRM_ERROR("no free event\n");
                 ret = -EBUSY;
-                goto out_unlock;
+                goto out_pm_put;
         }
 
         fence = etnaviv_gpu_fence_alloc(gpu);
         if (!fence) {
                 event_free(gpu, event);
                 ret = -ENOMEM;
-                goto out_unlock;
+                goto out_pm_put;
         }
 
+        mutex_lock(&gpu->lock);
+
         gpu->event[event].fence = fence;
         submit->fence = fence->seqno;
         gpu->active_fence = submit->fence;
@@ -1395,9 +1395,9 @@ int etnaviv_gpu_submit(struct etnaviv_gpu *gpu,
         hangcheck_timer_reset(gpu);
         ret = 0;
 
-out_unlock:
         mutex_unlock(&gpu->lock);
 
+out_pm_put:
         etnaviv_gpu_pm_put(gpu);
 
         return ret;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index e0166403b4bd..40ce841eb952 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -55,11 +55,11 @@ static int check_fb_gem_memory_type(struct drm_device *drm_dev,
         flags = exynos_gem->flags;
 
         /*
-         * without iommu support, not support physically non-continuous memory
-         * for framebuffer.
+         * Physically non-contiguous memory type for framebuffer is not
+         * supported without IOMMU.
          */
         if (IS_NONCONTIG_BUFFER(flags)) {
-                DRM_ERROR("cannot use this gem memory type for fb.\n");
+                DRM_ERROR("Non-contiguous GEM memory is not supported.\n");
                 return -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimc.c b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
index 0525c56145db..147ef0d298cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimc.c
@@ -1753,32 +1753,6 @@ static int fimc_clk_ctrl(struct fimc_context *ctx, bool enable)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int fimc_suspend(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return fimc_clk_ctrl(ctx, false);
-}
-
-static int fimc_resume(struct device *dev)
-{
-        struct fimc_context *ctx = get_fimc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (!pm_runtime_suspended(dev))
-                return fimc_clk_ctrl(ctx, true);
-
-        return 0;
-}
-#endif
-
 static int fimc_runtime_suspend(struct device *dev)
 {
         struct fimc_context *ctx = get_fimc_context(dev);
@@ -1799,7 +1773,8 @@ static int fimc_runtime_resume(struct device *dev)
 #endif
 
 static const struct dev_pm_ops fimc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(fimc_suspend, fimc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(fimc_runtime_suspend, fimc_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 4bf00f57ffe8..6eca8bb88648 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1475,8 +1475,8 @@ static int g2d_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int g2d_suspend(struct device *dev)
+#ifdef CONFIG_PM
+static int g2d_runtime_suspend(struct device *dev)
 {
         struct g2d_data *g2d = dev_get_drvdata(dev);
 
@@ -1490,25 +1490,6 @@ static int g2d_suspend(struct device *dev)
 
         flush_work(&g2d->runqueue_work);
 
-        return 0;
-}
-
-static int g2d_resume(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
-
-        g2d->suspended = false;
-        g2d_exec_runqueue(g2d);
-
-        return 0;
-}
-#endif
-
-#ifdef CONFIG_PM
-static int g2d_runtime_suspend(struct device *dev)
-{
-        struct g2d_data *g2d = dev_get_drvdata(dev);
-
         clk_disable_unprepare(g2d->gate_clk);
 
         return 0;
@@ -1523,12 +1504,16 @@ static int g2d_runtime_resume(struct device *dev)
         if (ret < 0)
                 dev_warn(dev, "failed to enable clock.\n");
 
+        g2d->suspended = false;
+        g2d_exec_runqueue(g2d);
+
         return ret;
 }
 #endif
 
 static const struct dev_pm_ops g2d_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(g2d_suspend, g2d_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(g2d_runtime_suspend, g2d_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gsc.c b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
index 5d20da8f957e..52a9d269484e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -1760,34 +1760,7 @@ static int gsc_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-static int gsc_suspend(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return gsc_clk_ctrl(ctx, false);
-}
-
-static int gsc_resume(struct device *dev)
-{
-        struct gsc_context *ctx = get_gsc_context(dev);
-
-        DRM_DEBUG_KMS("id[%d]\n", ctx->id);
-
-        if (!pm_runtime_suspended(dev))
-                return gsc_clk_ctrl(ctx, true);
-
-        return 0;
-}
-#endif
-
-#ifdef CONFIG_PM
-static int gsc_runtime_suspend(struct device *dev)
+static int __maybe_unused gsc_runtime_suspend(struct device *dev)
 {
         struct gsc_context *ctx = get_gsc_context(dev);
 
@@ -1796,7 +1769,7 @@ static int gsc_runtime_suspend(struct device *dev)
         return  gsc_clk_ctrl(ctx, false);
 }
 
-static int gsc_runtime_resume(struct device *dev)
+static int __maybe_unused gsc_runtime_resume(struct device *dev)
 {
         struct gsc_context *ctx = get_gsc_context(dev);
 
@@ -1804,10 +1777,10 @@ static int gsc_runtime_resume(struct device *dev)
 
         return  gsc_clk_ctrl(ctx, true);
 }
-#endif
 
 static const struct dev_pm_ops gsc_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(gsc_suspend, gsc_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(gsc_runtime_suspend, gsc_runtime_resume, NULL)
 };
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index 404367a430b5..6591e406084c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -794,29 +794,6 @@ static int rotator_clk_crtl(struct rot_context *rot, bool enable)
         return 0;
 }
 
-
-#ifdef CONFIG_PM_SLEEP
-static int rotator_suspend(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        return rotator_clk_crtl(rot, false);
-}
-
-static int rotator_resume(struct device *dev)
-{
-        struct rot_context *rot = dev_get_drvdata(dev);
-
-        if (!pm_runtime_suspended(dev))
-                return rotator_clk_crtl(rot, true);
-
-        return 0;
-}
-#endif
-
 static int rotator_runtime_suspend(struct device *dev)
 {
         struct rot_context *rot = dev_get_drvdata(dev);
@@ -833,7 +810,8 @@ static int rotator_runtime_resume(struct device *dev)
 #endif
 
 static const struct dev_pm_ops rotator_pm_ops = {
-        SET_SYSTEM_SLEEP_PM_OPS(rotator_suspend, rotator_resume)
+        SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
+                                pm_runtime_force_resume)
         SET_RUNTIME_PM_OPS(rotator_runtime_suspend, rotator_runtime_resume,
                                                                         NULL)
 };
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 95ddd56b89f0..5de36d8dcc68 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -1281,6 +1281,11 @@ int i915_driver_load(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         intel_runtime_pm_enable(dev_priv);
 
+        /* Everything is in place, we can now relax! */
+        DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
+                 driver.name, driver.major, driver.minor, driver.patchlevel,
+                 driver.date, pci_name(pdev), dev_priv->drm.primary->index);
+
         intel_runtime_pm_put(dev_priv);
 
         return 0;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 21f939074abc..f68c78918d63 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -882,11 +882,12 @@ struct i915_gem_context {
 
         struct i915_ctx_hang_stats hang_stats;
 
-        /* Unique identifier for this context, used by the hw for tracking */
         unsigned long flags;
 #define CONTEXT_NO_ZEROMAP              BIT(0)
 #define CONTEXT_NO_ERROR_CAPTURE        BIT(1)
-        unsigned hw_id;
+
+        /* Unique identifier for this context, used by the hw for tracking */
+        unsigned int hw_id;
         u32 user_handle;
 
         u32 ggtt_alignment;
@@ -1854,6 +1855,7 @@ struct drm_i915_private {
         enum modeset_restore modeset_restore;
         struct mutex modeset_restore_lock;
         struct drm_atomic_state *modeset_restore_state;
+        struct drm_modeset_acquire_ctx reset_ctx;
 
         struct list_head vm_list; /* Global list of all address spaces */
         struct i915_ggtt ggtt; /* VM representing the global address space */
@@ -1962,6 +1964,13 @@ struct drm_i915_private {
         struct i915_suspend_saved_registers regfile;
         struct vlv_s0ix_state vlv_s0ix_state;
 
+        enum {
+                I915_SKL_SAGV_UNKNOWN = 0,
+                I915_SKL_SAGV_DISABLED,
+                I915_SKL_SAGV_ENABLED,
+                I915_SKL_SAGV_NOT_CONTROLLED
+        } skl_sagv_status;
+
         struct {
                 /*
                  * Raw watermark latency values:
@@ -3590,6 +3599,7 @@ int i915_gem_evict_vm(struct i915_address_space *vm, bool do_idle);
 /* belongs in i915_gem_gtt.h */
 static inline void i915_gem_chipset_flush(struct drm_i915_private *dev_priv)
 {
+        wmb();
         if (INTEL_GEN(dev_priv) < 6)
                 intel_gtt_chipset_flush();
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 11681501d7b1..a77ce9983f69 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -879,9 +879,12 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
         ret = i915_gem_shmem_pread(dev, obj, args, file);
 
         /* pread for non shmem backed objects */
-        if (ret == -EFAULT || ret == -ENODEV)
+        if (ret == -EFAULT || ret == -ENODEV) {
+                intel_runtime_pm_get(to_i915(dev));
                 ret = i915_gem_gtt_pread(dev, obj, args->size,
                                         args->offset, args->data_ptr);
+                intel_runtime_pm_put(to_i915(dev));
+        }
 
 out:
         drm_gem_object_unreference(&obj->base);
@@ -1306,7 +1309,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                  * textures). Fallback to the shmem path in that case. */
         }
 
-        if (ret == -EFAULT) {
+        if (ret == -EFAULT || ret == -ENOSPC) {
                 if (obj->phys_handle)
                         ret = i915_gem_phys_pwrite(obj, args, file);
                 else if (i915_gem_object_has_struct_page(obj))
@@ -3169,6 +3172,8 @@ static void i915_gem_reset_engine_cleanup(struct intel_engine_cs *engine)
         }
 
         intel_ring_init_seqno(engine, engine->last_submitted_seqno);
+
+        engine->i915->gt.active_engines &= ~intel_engine_flag(engine);
 }
 
 void i915_gem_reset(struct drm_device *dev)
@@ -3186,6 +3191,7 @@ void i915_gem_reset(struct drm_device *dev)
 
         for_each_engine(engine, dev_priv)
                 i915_gem_reset_engine_cleanup(engine);
+        mod_delayed_work(dev_priv->wq, &dev_priv->gt.idle_work, 0);
 
         i915_gem_context_reset(dev);
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index 1978633e7549..b35e5b6475b2 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -943,8 +943,6 @@ i915_gem_execbuffer_move_to_gpu(struct drm_i915_gem_request *req,
 {
         const unsigned other_rings = ~intel_engine_flag(req->engine);
         struct i915_vma *vma;
-        uint32_t flush_domains = 0;
-        bool flush_chipset = false;
         int ret;
 
         list_for_each_entry(vma, vmas, exec_list) {
@@ -957,16 +955,11 @@ i915_gem_execbuffer_move_to_gpu(struct drm_i915_gem_request *req,
                 }
 
                 if (obj->base.write_domain & I915_GEM_DOMAIN_CPU)
-                        flush_chipset |= i915_gem_clflush_object(obj, false);
-
-                flush_domains |= obj->base.write_domain;
+                        i915_gem_clflush_object(obj, false);
         }
 
-        if (flush_chipset)
-                i915_gem_chipset_flush(req->engine->i915);
-
-        if (flush_domains & I915_GEM_DOMAIN_GTT)
-                wmb();
+        /* Unconditionally flush any chipset caches (for streaming writes). */
+        i915_gem_chipset_flush(req->engine->i915);
 
         /* Unconditionally invalidate gpu caches and ensure that we do flush
          * any residual writes from the previous batch.
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 10f1e32767e6..f38ceffd82c3 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -122,8 +122,11 @@ int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
         has_full_48bit_ppgtt =
                 IS_BROADWELL(dev_priv) || INTEL_GEN(dev_priv) >= 9;
 
-        if (intel_vgpu_active(dev_priv))
-                has_full_ppgtt = false; /* emulation is too hard */
+        if (intel_vgpu_active(dev_priv)) {
+                /* emulation is too hard */
+                has_full_ppgtt = false;
+                has_full_48bit_ppgtt = false;
+        }
 
         if (!has_aliasing_ppgtt)
                 return 0;
@@ -158,7 +161,7 @@ int intel_sanitize_enable_ppgtt(struct drm_i915_private *dev_priv,
                 return 0;
         }
 
-        if (INTEL_GEN(dev_priv) >= 8 && i915.enable_execlists)
+        if (INTEL_GEN(dev_priv) >= 8 && i915.enable_execlists && has_full_ppgtt)
                 return has_full_48bit_ppgtt ? 3 : 2;
         else
                 return has_aliasing_ppgtt ? 1 : 0;
@@ -2873,6 +2876,7 @@ void i915_ggtt_cleanup_hw(struct drm_device *dev)
                 struct i915_hw_ppgtt *ppgtt = dev_priv->mm.aliasing_ppgtt;
 
                 ppgtt->base.cleanup(&ppgtt->base);
+                kfree(ppgtt);
         }
 
         i915_gem_cleanup_stolen(dev);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index ce14fe09d962..bf2cad3f9e1f 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1536,6 +1536,7 @@ enum skl_disp_power_wells {
 #define BALANCE_LEG_MASK(port)          (7<<(8+3*(port)))
 /* Balance leg disable bits */
 #define BALANCE_LEG_DISABLE_SHIFT       23
+#define BALANCE_LEG_DISABLE(port)       (1 << (23 + (port)))
 
 /*
  * Fence registers
@@ -7144,6 +7145,15 @@ enum {
 
 #define GEN6_PCODE_MAILBOX                      _MMIO(0x138124)
 #define   GEN6_PCODE_READY                      (1<<31)
+#define   GEN6_PCODE_ERROR_MASK                 0xFF
+#define     GEN6_PCODE_SUCCESS                  0x0
+#define     GEN6_PCODE_ILLEGAL_CMD              0x1
+#define     GEN6_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE 0x2
+#define     GEN6_PCODE_TIMEOUT                  0x3
+#define     GEN6_PCODE_UNIMPLEMENTED_CMD        0xFF
+#define     GEN7_PCODE_TIMEOUT                  0x2
+#define     GEN7_PCODE_ILLEGAL_DATA             0x3
+#define     GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE 0x10
 #define   GEN6_PCODE_WRITE_RC6VIDS              0x4
 #define   GEN6_PCODE_READ_RC6VIDS               0x5
 #define     GEN6_ENCODE_RC6_VID(mv)             (((mv) - 245) / 5)
@@ -7165,6 +7175,10 @@ enum {
 #define   HSW_PCODE_DE_WRITE_FREQ_REQ           0x17
 #define   DISPLAY_IPS_CONTROL                   0x19
 #define   HSW_PCODE_DYNAMIC_DUTY_CYCLE_CONTROL  0x1A
+#define   GEN9_PCODE_SAGV_CONTROL               0x21
+#define     GEN9_SAGV_DISABLE                   0x0
+#define     GEN9_SAGV_IS_DISABLED               0x1
+#define     GEN9_SAGV_ENABLE                    0x3
 #define GEN6_PCODE_DATA                         _MMIO(0x138128)
 #define   GEN6_PCODE_FREQ_IA_RATIO_SHIFT        8
 #define   GEN6_PCODE_FREQ_RING_RATIO_SHIFT      16
diff --git a/drivers/gpu/drm/i915/i915_vgpu.c b/drivers/gpu/drm/i915/i915_vgpu.c
index f6acb5a0e701..b81cfb3b22ec 100644
--- a/drivers/gpu/drm/i915/i915_vgpu.c
+++ b/drivers/gpu/drm/i915/i915_vgpu.c
@@ -65,9 +65,6 @@ void i915_check_vgpu(struct drm_i915_private *dev_priv)
 
         BUILD_BUG_ON(sizeof(struct vgt_if) != VGT_PVINFO_SIZE);
 
-        if (!IS_HASWELL(dev_priv))
-                return;
-
         magic = __raw_i915_read64(dev_priv, vgtif_reg(magic));
         if (magic != VGT_MAGIC)
                 return;
diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
index 6700a7be7f78..d32f586f9c05 100644
--- a/drivers/gpu/drm/i915/intel_audio.c
+++ b/drivers/gpu/drm/i915/intel_audio.c
@@ -600,6 +600,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
         if (!IS_SKYLAKE(dev_priv) && !IS_KABYLAKE(dev_priv))
                 return;
 
+        i915_audio_component_get_power(dev);
+
         /*
          * Enable/disable generating the codec wake signal, overriding the
          * internal logic to generate the codec wake to controller.
@@ -615,6 +617,8 @@ static void i915_audio_component_codec_wake_override(struct device *dev,
                 I915_WRITE(HSW_AUD_CHICKENBIT, tmp);
                 usleep_range(1000, 1500);
         }
+
+        i915_audio_component_put_power(dev);
 }
 
 /* Get CDCLK in kHz  */
@@ -648,6 +652,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
             !IS_HASWELL(dev_priv))
                 return 0;
 
+        i915_audio_component_get_power(dev);
         mutex_lock(&dev_priv->av_mutex);
         /* 1. get the pipe */
         intel_encoder = dev_priv->dig_port_map[port];
@@ -698,6 +703,7 @@ static int i915_audio_component_sync_audio_rate(struct device *dev,
 
  unlock:
         mutex_unlock(&dev_priv->av_mutex);
+        i915_audio_component_put_power(dev);
         return err;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_csr.c b/drivers/gpu/drm/i915/intel_csr.c
index 3edb9580928e..c3b33a10c15c 100644
--- a/drivers/gpu/drm/i915/intel_csr.c
+++ b/drivers/gpu/drm/i915/intel_csr.c
@@ -41,15 +41,15 @@
  * be moved to FW_FAILED.
  */
 
-#define I915_CSR_KBL "i915/kbl_dmc_ver1.bin"
+#define I915_CSR_KBL "i915/kbl_dmc_ver1_01.bin"
 MODULE_FIRMWARE(I915_CSR_KBL);
 #define KBL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 1)
 
-#define I915_CSR_SKL "i915/skl_dmc_ver1.bin"
+#define I915_CSR_SKL "i915/skl_dmc_ver1_26.bin"
 MODULE_FIRMWARE(I915_CSR_SKL);
-#define SKL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 23)
+#define SKL_CSR_VERSION_REQUIRED        CSR_VERSION(1, 26)
 
-#define I915_CSR_BXT "i915/bxt_dmc_ver1.bin"
+#define I915_CSR_BXT "i915/bxt_dmc_ver1_07.bin"
 MODULE_FIRMWARE(I915_CSR_BXT);
 #define BXT_CSR_VERSION_REQUIRED        CSR_VERSION(1, 7)
 
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index dd1d6fe12297..1a7efac65fd5 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -145,7 +145,7 @@ static const struct ddi_buf_trans skl_ddi_translations_dp[] = {
 static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
         { 0x0000201B, 0x000000A2, 0x0 },
         { 0x00005012, 0x00000088, 0x0 },
-        { 0x80007011, 0x000000CD, 0x0 },
+        { 0x80007011, 0x000000CD, 0x1 },
         { 0x80009010, 0x000000C0, 0x1 },
         { 0x0000201B, 0x0000009D, 0x0 },
         { 0x80005012, 0x000000C0, 0x1 },
@@ -158,7 +158,7 @@ static const struct ddi_buf_trans skl_u_ddi_translations_dp[] = {
 static const struct ddi_buf_trans skl_y_ddi_translations_dp[] = {
         { 0x00000018, 0x000000A2, 0x0 },
         { 0x00005012, 0x00000088, 0x0 },
-        { 0x80007011, 0x000000CD, 0x0 },
+        { 0x80007011, 0x000000CD, 0x3 },
         { 0x80009010, 0x000000C0, 0x3 },
         { 0x00000018, 0x0000009D, 0x0 },
         { 0x80005012, 0x000000C0, 0x3 },
@@ -388,6 +388,40 @@ skl_get_buf_trans_hdmi(struct drm_i915_private *dev_priv, int *n_entries)
         }
 }
 
+static int intel_ddi_hdmi_level(struct drm_i915_private *dev_priv, enum port port)
+{
+        int n_hdmi_entries;
+        int hdmi_level;
+        int hdmi_default_entry;
+
+        hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
+
+        if (IS_BROXTON(dev_priv))
+                return hdmi_level;
+
+        if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv)) {
+                skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
+                hdmi_default_entry = 8;
+        } else if (IS_BROADWELL(dev_priv)) {
+                n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
+                hdmi_default_entry = 7;
+        } else if (IS_HASWELL(dev_priv)) {
+                n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
+                hdmi_default_entry = 6;
+        } else {
+                WARN(1, "ddi translation table missing\n");
+                n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
+                hdmi_default_entry = 7;
+        }
+
+        /* Choose a good default if VBT is badly populated */
+        if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
+            hdmi_level >= n_hdmi_entries)
+                hdmi_level = hdmi_default_entry;
+
+        return hdmi_level;
+}
+
 /*
  * Starting with Haswell, DDI port buffers must be programmed with correct
  * values in advance. The buffer values are different for FDI and DP modes,
@@ -399,7 +433,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
 {
         struct drm_i915_private *dev_priv = to_i915(encoder->base.dev);
         u32 iboost_bit = 0;
-        int i, n_hdmi_entries, n_dp_entries, n_edp_entries, hdmi_default_entry,
+        int i, n_hdmi_entries, n_dp_entries, n_edp_entries,
             size;
         int hdmi_level;
         enum port port;
@@ -410,7 +444,7 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
         const struct ddi_buf_trans *ddi_translations;
 
         port = intel_ddi_get_encoder_port(encoder);
-        hdmi_level = dev_priv->vbt.ddi_port_info[port].hdmi_level_shift;
+        hdmi_level = intel_ddi_hdmi_level(dev_priv, port);
 
         if (IS_BROXTON(dev_priv)) {
                 if (encoder->type != INTEL_OUTPUT_HDMI)
@@ -430,7 +464,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
                                 skl_get_buf_trans_edp(dev_priv, &n_edp_entries);
                 ddi_translations_hdmi =
                                 skl_get_buf_trans_hdmi(dev_priv, &n_hdmi_entries);
-                hdmi_default_entry = 8;
                 /* If we're boosting the current, set bit 31 of trans1 */
                 if (dev_priv->vbt.ddi_port_info[port].hdmi_boost_level ||
                     dev_priv->vbt.ddi_port_info[port].dp_boost_level)
@@ -456,7 +489,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
 
                 n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
                 n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-                hdmi_default_entry = 7;
         } else if (IS_HASWELL(dev_priv)) {
                 ddi_translations_fdi = hsw_ddi_translations_fdi;
                 ddi_translations_dp = hsw_ddi_translations_dp;
@@ -464,7 +496,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
                 ddi_translations_hdmi = hsw_ddi_translations_hdmi;
                 n_dp_entries = n_edp_entries = ARRAY_SIZE(hsw_ddi_translations_dp);
                 n_hdmi_entries = ARRAY_SIZE(hsw_ddi_translations_hdmi);
-                hdmi_default_entry = 6;
         } else {
                 WARN(1, "ddi translation table missing\n");
                 ddi_translations_edp = bdw_ddi_translations_dp;
@@ -474,7 +505,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
                 n_edp_entries = ARRAY_SIZE(bdw_ddi_translations_edp);
                 n_dp_entries = ARRAY_SIZE(bdw_ddi_translations_dp);
                 n_hdmi_entries = ARRAY_SIZE(bdw_ddi_translations_hdmi);
-                hdmi_default_entry = 7;
         }
 
         switch (encoder->type) {
@@ -505,11 +535,6 @@ void intel_prepare_ddi_buffer(struct intel_encoder *encoder)
         if (encoder->type != INTEL_OUTPUT_HDMI)
                 return;
 
-        /* Choose a good default if VBT is badly populated */
-        if (hdmi_level == HDMI_LEVEL_SHIFT_UNKNOWN ||
-            hdmi_level >= n_hdmi_entries)
-                hdmi_level = hdmi_default_entry;
-
         /* Entry 9 is for HDMI: */
         I915_WRITE(DDI_BUF_TRANS_LO(port, i),
                    ddi_translations_hdmi[hdmi_level].trans1 | iboost_bit);
@@ -1379,14 +1404,30 @@ void intel_ddi_disable_pipe_clock(struct intel_crtc *intel_crtc)
                            TRANS_CLK_SEL_DISABLED);
 }
 
-static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
-                               u32 level, enum port port, int type)
+static void _skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
+                                enum port port, uint8_t iboost)
 {
+        u32 tmp;
+
+        tmp = I915_READ(DISPIO_CR_TX_BMU_CR0);
+        tmp &= ~(BALANCE_LEG_MASK(port) | BALANCE_LEG_DISABLE(port));
+        if (iboost)
+                tmp |= iboost << BALANCE_LEG_SHIFT(port);
+        else
+                tmp |= BALANCE_LEG_DISABLE(port);
+        I915_WRITE(DISPIO_CR_TX_BMU_CR0, tmp);
+}
+
+static void skl_ddi_set_iboost(struct intel_encoder *encoder, u32 level)
+{
+        struct intel_digital_port *intel_dig_port = enc_to_dig_port(&encoder->base);
+        struct drm_i915_private *dev_priv = to_i915(intel_dig_port->base.base.dev);
+        enum port port = intel_dig_port->port;
+        int type = encoder->type;
         const struct ddi_buf_trans *ddi_translations;
         uint8_t iboost;
         uint8_t dp_iboost, hdmi_iboost;
         int n_entries;
-        u32 reg;
 
         /* VBT may override standard boost values */
         dp_iboost = dev_priv->vbt.ddi_port_info[port].dp_boost_level;
@@ -1428,16 +1469,10 @@ static void skl_ddi_set_iboost(struct drm_i915_private *dev_priv,
                 return;
         }
 
-        reg = I915_READ(DISPIO_CR_TX_BMU_CR0);
-        reg &= ~BALANCE_LEG_MASK(port);
-        reg &= ~(1 << (BALANCE_LEG_DISABLE_SHIFT + port));
-
-        if (iboost)
-                reg |= iboost << BALANCE_LEG_SHIFT(port);
-        else
-                reg |= 1 << (BALANCE_LEG_DISABLE_SHIFT + port);
+        _skl_ddi_set_iboost(dev_priv, port, iboost);
 
-        I915_WRITE(DISPIO_CR_TX_BMU_CR0, reg);
+        if (port == PORT_A && intel_dig_port->max_lanes == 4)
+                _skl_ddi_set_iboost(dev_priv, PORT_E, iboost);
 }
 
 static void bxt_ddi_vswing_sequence(struct drm_i915_private *dev_priv,
@@ -1568,7 +1603,7 @@ uint32_t ddi_signal_levels(struct intel_dp *intel_dp)
         level = translate_signal_level(signal_levels);
 
         if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
-                skl_ddi_set_iboost(dev_priv, level, port, encoder->type);
+                skl_ddi_set_iboost(encoder, level);
         else if (IS_BROXTON(dev_priv))
                 bxt_ddi_vswing_sequence(dev_priv, level, port, encoder->type);
 
@@ -1637,6 +1672,10 @@ static void intel_ddi_pre_enable(struct intel_encoder *intel_encoder)
                         intel_dp_stop_link_train(intel_dp);
         } else if (type == INTEL_OUTPUT_HDMI) {
                 struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
+                int level = intel_ddi_hdmi_level(dev_priv, port);
+
+                if (IS_SKYLAKE(dev_priv) || IS_KABYLAKE(dev_priv))
+                        skl_ddi_set_iboost(intel_encoder, level);
 
                 intel_hdmi->set_infoframes(encoder,
                                            crtc->config->has_hdmi_sink,
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index c457eed76f1f..175595fc3e45 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3093,40 +3093,110 @@ static void intel_update_primary_planes(struct drm_device *dev)
 
         for_each_crtc(dev, crtc) {
                 struct intel_plane *plane = to_intel_plane(crtc->primary);
-                struct intel_plane_state *plane_state;
-
-                drm_modeset_lock_crtc(crtc, &plane->base);
-                plane_state = to_intel_plane_state(plane->base.state);
+                struct intel_plane_state *plane_state =
+                        to_intel_plane_state(plane->base.state);
 
                 if (plane_state->visible)
                         plane->update_plane(&plane->base,
                                             to_intel_crtc_state(crtc->state),
                                             plane_state);
+        }
+}
+
+static int
+__intel_display_resume(struct drm_device *dev,
+                       struct drm_atomic_state *state)
+{
+        struct drm_crtc_state *crtc_state;
+        struct drm_crtc *crtc;
+        int i, ret;
+
+        intel_modeset_setup_hw_state(dev);
+        i915_redisable_vga(dev);
+
+        if (!state)
+                return 0;
 
-                drm_modeset_unlock_crtc(crtc);
+        for_each_crtc_in_state(state, crtc, crtc_state, i) {
+                /*
+                 * Force recalculation even if we restore
+                 * current state. With fast modeset this may not result
+                 * in a modeset when the state is compatible.
+                 */
+                crtc_state->mode_changed = true;
         }
+
+        /* ignore any reset values/BIOS leftovers in the WM registers */
+        to_intel_atomic_state(state)->skip_intermediate_wm = true;
+
+        ret = drm_atomic_commit(state);
+
+        WARN_ON(ret == -EDEADLK);
+        return ret;
 }
 
 void intel_prepare_reset(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = &dev_priv->drm;
+        struct drm_modeset_acquire_ctx *ctx = &dev_priv->reset_ctx;
+        struct drm_atomic_state *state;
+        int ret;
+
         /* no reset support for gen2 */
         if (IS_GEN2(dev_priv))
                 return;
 
-        /* reset doesn't touch the display */
+        /*
+         * Need mode_config.mutex so that we don't
+         * trample ongoing ->detect() and whatnot.
+         */
+        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_acquire_init(ctx, 0);
+        while (1) {
+                ret = drm_modeset_lock_all_ctx(dev, ctx);
+                if (ret != -EDEADLK)
+                        break;
+
+                drm_modeset_backoff(ctx);
+        }
+
+        /* reset doesn't touch the display, but flips might get nuked anyway, */
         if (INTEL_GEN(dev_priv) >= 5 || IS_G4X(dev_priv))
                 return;
 
-        drm_modeset_lock_all(&dev_priv->drm);
         /*
          * Disabling the crtcs gracefully seems nicer. Also the
          * g33 docs say we should at least disable all the planes.
          */
-        intel_display_suspend(&dev_priv->drm);
+        state = drm_atomic_helper_duplicate_state(dev, ctx);
+        if (IS_ERR(state)) {
+                ret = PTR_ERR(state);
+                state = NULL;
+                DRM_ERROR("Duplicating state failed with %i\n", ret);
+                goto err;
+        }
+
+        ret = drm_atomic_helper_disable_all(dev, ctx);
+        if (ret) {
+                DRM_ERROR("Suspending crtc's failed with %i\n", ret);
+                goto err;
+        }
+
+        dev_priv->modeset_restore_state = state;
+        state->acquire_ctx = ctx;
+        return;
+
+err:
+        drm_atomic_state_free(state);
 }
 
 void intel_finish_reset(struct drm_i915_private *dev_priv)
 {
+        struct drm_device *dev = &dev_priv->drm;
+        struct drm_modeset_acquire_ctx *ctx = &dev_priv->reset_ctx;
+        struct drm_atomic_state *state = dev_priv->modeset_restore_state;
+        int ret;
+
         /*
          * Flips in the rings will be nuked by the reset,
          * so complete all pending flips so that user space
@@ -3138,6 +3208,8 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
         if (IS_GEN2(dev_priv))
                 return;
 
+        dev_priv->modeset_restore_state = NULL;
+
         /* reset doesn't touch the display */
         if (INTEL_GEN(dev_priv) >= 5 || IS_G4X(dev_priv)) {
                 /*
@@ -3149,29 +3221,32 @@ void intel_finish_reset(struct drm_i915_private *dev_priv)
                  * FIXME: Atomic will make this obsolete since we won't schedule
                  * CS-based flips (which might get lost in gpu resets) any more.
                  */
-                intel_update_primary_planes(&dev_priv->drm);
-                return;
-        }
-
-        /*
-         * The display has been reset as well,
-         * so need a full re-initialization.
-         */
-        intel_runtime_pm_disable_interrupts(dev_priv);
-        intel_runtime_pm_enable_interrupts(dev_priv);
+                intel_update_primary_planes(dev);
+        } else {
+                /*
+                 * The display has been reset as well,
+                 * so need a full re-initialization.
+                 */
+                intel_runtime_pm_disable_interrupts(dev_priv);
+                intel_runtime_pm_enable_interrupts(dev_priv);
 
-        intel_modeset_init_hw(&dev_priv->drm);
+                intel_modeset_init_hw(dev);
 
-        spin_lock_irq(&dev_priv->irq_lock);
-        if (dev_priv->display.hpd_irq_setup)
-                dev_priv->display.hpd_irq_setup(dev_priv);
-        spin_unlock_irq(&dev_priv->irq_lock);
+                spin_lock_irq(&dev_priv->irq_lock);
+                if (dev_priv->display.hpd_irq_setup)
+                        dev_priv->display.hpd_irq_setup(dev_priv);
+                spin_unlock_irq(&dev_priv->irq_lock);
 
-        intel_display_resume(&dev_priv->drm);
+                ret = __intel_display_resume(dev, state);
+                if (ret)
+                        DRM_ERROR("Restoring old state failed with %i\n", ret);
 
-        intel_hpd_init(dev_priv);
+                intel_hpd_init(dev_priv);
+        }
 
-        drm_modeset_unlock_all(&dev_priv->drm);
+        drm_modeset_drop_locks(ctx);
+        drm_modeset_acquire_fini(ctx);
+        mutex_unlock(&dev->mode_config.mutex);
 }
 
 static bool intel_crtc_has_pending_flip(struct drm_crtc *crtc)
@@ -5691,15 +5766,7 @@ static bool skl_cdclk_pcu_ready(struct drm_i915_private *dev_priv)
 
 static bool skl_cdclk_wait_for_pcu_ready(struct drm_i915_private *dev_priv)
 {
-        unsigned int i;
-
-        for (i = 0; i < 15; i++) {
-                if (skl_cdclk_pcu_ready(dev_priv))
-                        return true;
-                udelay(10);
-        }
-
-        return false;
+        return _wait_for(skl_cdclk_pcu_ready(dev_priv), 3000, 10) == 0;
 }
 
 static void skl_set_cdclk(struct drm_i915_private *dev_priv, int cdclk, int vco)
@@ -12114,21 +12181,11 @@ connected_sink_compute_bpp(struct intel_connector *connector,
                 pipe_config->pipe_bpp = connector->base.display_info.bpc*3;
         }
 
-        /* Clamp bpp to default limit on screens without EDID 1.4 */
-        if (connector->base.display_info.bpc == 0) {
-                int type = connector->base.connector_type;
-                int clamp_bpp = 24;
-
-                /* Fall back to 18 bpp when DP sink capability is unknown. */
-                if (type == DRM_MODE_CONNECTOR_DisplayPort ||
-                    type == DRM_MODE_CONNECTOR_eDP)
-                        clamp_bpp = 18;
-
-                if (bpp > clamp_bpp) {
-                        DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of %d\n",
-                                      bpp, clamp_bpp);
-                        pipe_config->pipe_bpp = clamp_bpp;
-                }
+        /* Clamp bpp to 8 on screens without EDID 1.4 */
+        if (connector->base.display_info.bpc == 0 && bpp > 24) {
+                DRM_DEBUG_KMS("clamping display bpp (was %d) to default limit of 24\n",
+                              bpp);
+                pipe_config->pipe_bpp = 24;
         }
 }
 
@@ -13702,6 +13759,13 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
                      intel_state->cdclk_pll_vco != dev_priv->cdclk_pll.vco))
                         dev_priv->display.modeset_commit_cdclk(state);
 
+                /*
+                 * SKL workaround: bspec recommends we disable the SAGV when we
+                 * have more then one pipe enabled
+                 */
+                if (IS_SKYLAKE(dev_priv) && !skl_can_enable_sagv(state))
+                        skl_disable_sagv(dev_priv);
+
                 intel_modeset_verify_disabled(dev);
         }
 
@@ -13775,6 +13839,10 @@ static void intel_atomic_commit_tail(struct drm_atomic_state *state)
                 intel_modeset_verify_crtc(crtc, old_crtc_state, crtc->state);
         }
 
+        if (IS_SKYLAKE(dev_priv) && intel_state->modeset &&
+            skl_can_enable_sagv(state))
+                skl_enable_sagv(dev_priv);
+
         drm_atomic_helper_commit_hw_done(state);
 
         if (intel_state->modeset)
@@ -16174,9 +16242,10 @@ void intel_display_resume(struct drm_device *dev)
         struct drm_atomic_state *state = dev_priv->modeset_restore_state;
         struct drm_modeset_acquire_ctx ctx;
         int ret;
-        bool setup = false;
 
         dev_priv->modeset_restore_state = NULL;
+        if (state)
+                state->acquire_ctx = &ctx;
 
         /*
          * This is a cludge because with real atomic modeset mode_config.mutex
@@ -16187,43 +16256,17 @@ void intel_display_resume(struct drm_device *dev)
         mutex_lock(&dev->mode_config.mutex);
         drm_modeset_acquire_init(&ctx, 0);
 
-retry:
-        ret = drm_modeset_lock_all_ctx(dev, &ctx);
-
-        if (ret == 0 && !setup) {
-                setup = true;
-
-                intel_modeset_setup_hw_state(dev);
-                i915_redisable_vga(dev);
-        }
-
-        if (ret == 0 && state) {
-                struct drm_crtc_state *crtc_state;
-                struct drm_crtc *crtc;
-                int i;
-
-                state->acquire_ctx = &ctx;
-
-                /* ignore any reset values/BIOS leftovers in the WM registers */
-                to_intel_atomic_state(state)->skip_intermediate_wm = true;
-
-                for_each_crtc_in_state(state, crtc, crtc_state, i) {
-                        /*
-                         * Force recalculation even if we restore
-                         * current state. With fast modeset this may not result
-                         * in a modeset when the state is compatible.
-                         */
-                        crtc_state->mode_changed = true;
-                }
-
-                ret = drm_atomic_commit(state);
-        }
+        while (1) {
+                ret = drm_modeset_lock_all_ctx(dev, &ctx);
+                if (ret != -EDEADLK)
+                        break;
 
-        if (ret == -EDEADLK) {
                 drm_modeset_backoff(&ctx);
-                goto retry;
         }
 
+        if (!ret)
+                ret = __intel_display_resume(dev, state);
+
         drm_modeset_drop_locks(&ctx);
         drm_modeset_acquire_fini(&ctx);
         mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index cc937a19b1ba..ff399b9a5c1f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -1716,6 +1716,9 @@ void ilk_wm_get_hw_state(struct drm_device *dev);
 void skl_wm_get_hw_state(struct drm_device *dev);
 void skl_ddb_get_hw_state(struct drm_i915_private *dev_priv,
                           struct skl_ddb_allocation *ddb /* out */);
+bool skl_can_enable_sagv(struct drm_atomic_state *state);
+int skl_enable_sagv(struct drm_i915_private *dev_priv);
+int skl_disable_sagv(struct drm_i915_private *dev_priv);
 uint32_t ilk_pipe_pixel_rate(const struct intel_crtc_state *pipe_config);
 bool ilk_disable_lp_wm(struct drm_device *dev);
 int sanitize_rc6_option(struct drm_i915_private *dev_priv, int enable_rc6);
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 47bdf9dad0d3..b9e5a63a7c9e 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -554,7 +554,6 @@ void intel_dvo_init(struct drm_device *dev)
                 return;
         }
 
-        drm_encoder_cleanup(&intel_encoder->base);
         kfree(intel_dvo);
         kfree(intel_connector);
 }
diff --git a/drivers/gpu/drm/i915/intel_fbc.c b/drivers/gpu/drm/i915/intel_fbc.c
index 6a7ad3ed1463..3836a1c79714 100644
--- a/drivers/gpu/drm/i915/intel_fbc.c
+++ b/drivers/gpu/drm/i915/intel_fbc.c
@@ -1230,12 +1230,29 @@ static int intel_sanitize_fbc_option(struct drm_i915_private *dev_priv)
         if (i915.enable_fbc >= 0)
                 return !!i915.enable_fbc;
 
+        if (!HAS_FBC(dev_priv))
+                return 0;
+
         if (IS_BROADWELL(dev_priv))
                 return 1;
 
         return 0;
 }
 
+static bool need_fbc_vtd_wa(struct drm_i915_private *dev_priv)
+{
+#ifdef CONFIG_INTEL_IOMMU
+        /* WaFbcTurnOffFbcWhenHyperVisorIsUsed:skl,bxt */
+        if (intel_iommu_gfx_mapped &&
+            (IS_SKYLAKE(dev_priv) || IS_BROXTON(dev_priv))) {
+                DRM_INFO("Disabling framebuffer compression (FBC) to prevent screen flicker with VT-d enabled\n");
+                return true;
+        }
+#endif
+
+        return false;
+}
+
 /**
  * intel_fbc_init - Initialize FBC
  * @dev_priv: the i915 device
@@ -1253,6 +1270,9 @@ void intel_fbc_init(struct drm_i915_private *dev_priv)
         fbc->active = false;
         fbc->work.scheduled = false;
 
+        if (need_fbc_vtd_wa(dev_priv))
+                mkwrite_device_info(dev_priv)->has_fbc = false;
+
         i915.enable_fbc = intel_sanitize_fbc_option(dev_priv);
         DRM_DEBUG_KMS("Sanitized enable_fbc value: %d\n", i915.enable_fbc);
 
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 86b00c6db1a6..3e3632c18733 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -782,7 +782,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
         struct intel_fbdev *ifbdev = dev_priv->fbdev;
         struct fb_info *info;
 
-        if (!ifbdev)
+        if (!ifbdev || !ifbdev->fb)
                 return;
 
         info = ifbdev->helper.fbdev;
@@ -827,31 +827,28 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
 
 void intel_fbdev_output_poll_changed(struct drm_device *dev)
 {
-        struct drm_i915_private *dev_priv = to_i915(dev);
-        if (dev_priv->fbdev)
-                drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
+        struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
+
+        if (ifbdev && ifbdev->fb)
+                drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 
 void intel_fbdev_restore_mode(struct drm_device *dev)
 {
-        int ret;
-        struct drm_i915_private *dev_priv = to_i915(dev);
-        struct intel_fbdev *ifbdev = dev_priv->fbdev;
-        struct drm_fb_helper *fb_helper;
+        struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
 
         if (!ifbdev)
                 return;
 
         intel_fbdev_sync(ifbdev);
+        if (!ifbdev->fb)
+                return;
 
-        fb_helper = &ifbdev->helper;
-
-        ret = drm_fb_helper_restore_fbdev_mode_unlocked(fb_helper);
-        if (ret) {
+        if (drm_fb_helper_restore_fbdev_mode_unlocked(&ifbdev->helper)) {
                 DRM_DEBUG("failed to restore crtc mode\n");
         } else {
-                mutex_lock(&fb_helper->dev->struct_mutex);
+                mutex_lock(&dev->struct_mutex);
                 intel_fb_obj_invalidate(ifbdev->fb->obj, ORIGIN_GTT);
-                mutex_unlock(&fb_helper->dev->struct_mutex);
+                mutex_unlock(&dev->struct_mutex);
         }
 }
diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
index adca262d591a..7acbbbf97833 100644
--- a/drivers/gpu/drm/i915/intel_opregion.c
+++ b/drivers/gpu/drm/i915/intel_opregion.c
@@ -1047,6 +1047,23 @@ err_out:
         return err;
 }
 
+static int intel_use_opregion_panel_type_callback(const struct dmi_system_id *id)
+{
+        DRM_INFO("Using panel type from OpRegion on %s\n", id->ident);
+        return 1;
+}
+
+static const struct dmi_system_id intel_use_opregion_panel_type[] = {
+        {
+                .callback = intel_use_opregion_panel_type_callback,
+                .ident = "Conrac GmbH IX45GM2",
+                .matches = {DMI_MATCH(DMI_SYS_VENDOR, "Conrac GmbH"),
+                            DMI_MATCH(DMI_PRODUCT_NAME, "IX45GM2"),
+                },
+        },
+        { }
+};
+
 int
 intel_opregion_get_panel_type(struct drm_i915_private *dev_priv)
 {
@@ -1073,6 +1090,16 @@ intel_opregion_get_panel_type(struct drm_i915_private *dev_priv)
         }
 
         /*
+         * So far we know that some machined must use it, others must not use it.
+         * There doesn't seem to be any way to determine which way to go, except
+         * via a quirk list :(
+         */
+        if (!dmi_check_system(intel_use_opregion_panel_type)) {
+                DRM_DEBUG_KMS("Ignoring OpRegion panel type (%d)\n", ret - 1);
+                return -ENODEV;
+        }
+
+        /*
          * FIXME On Dell XPS 13 9350 the OpRegion panel type (0) gives us
          * low vswing for eDP, whereas the VBT panel type (2) gives us normal
          * vswing instead. Low vswing results in some display flickers, so
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index f4f3fcc8b3be..2d2481392824 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -2852,6 +2852,7 @@ bool ilk_disable_lp_wm(struct drm_device *dev)
 
 #define SKL_DDB_SIZE            896     /* in blocks */
 #define BXT_DDB_SIZE            512
+#define SKL_SAGV_BLOCK_TIME     30 /* µs */
 
 /*
  * Return the index of a plane in the SKL DDB and wm result arrays.  Primary
@@ -2875,6 +2876,153 @@ skl_wm_plane_id(const struct intel_plane *plane)
         }
 }
 
+/*
+ * SAGV dynamically adjusts the system agent voltage and clock frequencies
+ * depending on power and performance requirements. The display engine access
+ * to system memory is blocked during the adjustment time. Because of the
+ * blocking time, having this enabled can cause full system hangs and/or pipe
+ * underruns if we don't meet all of the following requirements:
+ *
+ *  - <= 1 pipe enabled
+ *  - All planes can enable watermarks for latencies >= SAGV engine block time
+ *  - We're not using an interlaced display configuration
+ */
+int
+skl_enable_sagv(struct drm_i915_private *dev_priv)
+{
+        int ret;
+
+        if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
+            dev_priv->skl_sagv_status == I915_SKL_SAGV_ENABLED)
+                return 0;
+
+        DRM_DEBUG_KMS("Enabling the SAGV\n");
+        mutex_lock(&dev_priv->rps.hw_lock);
+
+        ret = sandybridge_pcode_write(dev_priv, GEN9_PCODE_SAGV_CONTROL,
+                                      GEN9_SAGV_ENABLE);
+
+        /* We don't need to wait for the SAGV when enabling */
+        mutex_unlock(&dev_priv->rps.hw_lock);
+
+        /*
+         * Some skl systems, pre-release machines in particular,
+         * don't actually have an SAGV.
+         */
+        if (ret == -ENXIO) {
+                DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
+                dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
+                return 0;
+        } else if (ret < 0) {
+                DRM_ERROR("Failed to enable the SAGV\n");
+                return ret;
+        }
+
+        dev_priv->skl_sagv_status = I915_SKL_SAGV_ENABLED;
+        return 0;
+}
+
+static int
+skl_do_sagv_disable(struct drm_i915_private *dev_priv)
+{
+        int ret;
+        uint32_t temp = GEN9_SAGV_DISABLE;
+
+        ret = sandybridge_pcode_read(dev_priv, GEN9_PCODE_SAGV_CONTROL,
+                                     &temp);
+        if (ret)
+                return ret;
+        else
+                return temp & GEN9_SAGV_IS_DISABLED;
+}
+
+int
+skl_disable_sagv(struct drm_i915_private *dev_priv)
+{
+        int ret, result;
+
+        if (dev_priv->skl_sagv_status == I915_SKL_SAGV_NOT_CONTROLLED ||
+            dev_priv->skl_sagv_status == I915_SKL_SAGV_DISABLED)
+                return 0;
+
+        DRM_DEBUG_KMS("Disabling the SAGV\n");
+        mutex_lock(&dev_priv->rps.hw_lock);
+
+        /* bspec says to keep retrying for at least 1 ms */
+        ret = wait_for(result = skl_do_sagv_disable(dev_priv), 1);
+        mutex_unlock(&dev_priv->rps.hw_lock);
+
+        if (ret == -ETIMEDOUT) {
+                DRM_ERROR("Request to disable SAGV timed out\n");
+                return -ETIMEDOUT;
+        }
+
+        /*
+         * Some skl systems, pre-release machines in particular,
+         * don't actually have an SAGV.
+         */
+        if (result == -ENXIO) {
+                DRM_DEBUG_DRIVER("No SAGV found on system, ignoring\n");
+                dev_priv->skl_sagv_status = I915_SKL_SAGV_NOT_CONTROLLED;
+                return 0;
+        } else if (result < 0) {
+                DRM_ERROR("Failed to disable the SAGV\n");
+                return result;
+        }
+
+        dev_priv->skl_sagv_status = I915_SKL_SAGV_DISABLED;
+        return 0;
+}
+
+bool skl_can_enable_sagv(struct drm_atomic_state *state)
+{
+        struct drm_device *dev = state->dev;
+        struct drm_i915_private *dev_priv = to_i915(dev);
+        struct intel_atomic_state *intel_state = to_intel_atomic_state(state);
+        struct drm_crtc *crtc;
+        enum pipe pipe;
+        int level, plane;
+
+        /*
+         * SKL workaround: bspec recommends we disable the SAGV when we have
+         * more then one pipe enabled
+         *
+         * If there are no active CRTCs, no additional checks need be performed
+         */
+        if (hweight32(intel_state->active_crtcs) == 0)
+                return true;
+        else if (hweight32(intel_state->active_crtcs) > 1)
+                return false;
+
+        /* Since we're now guaranteed to only have one active CRTC... */
+        pipe = ffs(intel_state->active_crtcs) - 1;
+        crtc = dev_priv->pipe_to_crtc_mapping[pipe];
+
+        if (crtc->state->mode.flags & DRM_MODE_FLAG_INTERLACE)
+                return false;
+
+        for_each_plane(dev_priv, pipe, plane) {
+                /* Skip this plane if it's not enabled */
+                if (intel_state->wm_results.plane[pipe][plane][0] == 0)
+                        continue;
+
+                /* Find the highest enabled wm level for this plane */
+                for (level = ilk_wm_max_level(dev);
+                     intel_state->wm_results.plane[pipe][plane][level] == 0; --level)
+                     { }
+
+                /*
+                 * If any of the planes on this pipe don't enable wm levels
+                 * that incur memory latencies higher then 30µs we can't enable
+                 * the SAGV
+                 */
+                if (dev_priv->wm.skl_latency[level] < SKL_SAGV_BLOCK_TIME)
+                        return false;
+        }
+
+        return true;
+}
+
 static void
 skl_ddb_get_pipe_allocation_limits(struct drm_device *dev,
                                    const struct intel_crtc_state *cstate,
@@ -3107,8 +3255,6 @@ skl_get_total_relative_data_rate(struct intel_crtc_state *intel_cstate)
                 total_data_rate += intel_cstate->wm.skl.plane_y_data_rate[id];
         }
 
-        WARN_ON(cstate->plane_mask && total_data_rate == 0);
-
         return total_data_rate;
 }
 
@@ -3344,6 +3490,8 @@ static uint32_t skl_wm_method2(uint32_t pixel_rate, uint32_t pipe_htotal,
                 plane_bytes_per_line *= 4;
                 plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
                 plane_blocks_per_line /= 4;
+        } else if (tiling == DRM_FORMAT_MOD_NONE) {
+                plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512) + 1;
         } else {
                 plane_blocks_per_line = DIV_ROUND_UP(plane_bytes_per_line, 512);
         }
@@ -3910,9 +4058,24 @@ skl_compute_ddb(struct drm_atomic_state *state)
          * pretend that all pipes switched active status so that we'll
          * ensure a full DDB recompute.
          */
-        if (dev_priv->wm.distrust_bios_wm)
+        if (dev_priv->wm.distrust_bios_wm) {
+                ret = drm_modeset_lock(&dev->mode_config.connection_mutex,
+                                       state->acquire_ctx);
+                if (ret)
+                        return ret;
+
                 intel_state->active_pipe_changes = ~0;
 
+                /*
+                 * We usually only initialize intel_state->active_crtcs if we
+                 * we're doing a modeset; make sure this field is always
+                 * initialized during the sanitization process that happens
+                 * on the first commit too.
+                 */
+                if (!intel_state->modeset)
+                        intel_state->active_crtcs = dev_priv->active_crtcs;
+        }
+
         /*
          * If the modeset changes which CRTC's are active, we need to
          * recompute the DDB allocation for *all* active pipes, even
@@ -3941,11 +4104,33 @@ skl_compute_ddb(struct drm_atomic_state *state)
                 ret = skl_allocate_pipe_ddb(cstate, ddb);
                 if (ret)
                         return ret;
+
+                ret = drm_atomic_add_affected_planes(state, &intel_crtc->base);
+                if (ret)
+                        return ret;
         }
 
         return 0;
 }
 
+static void
+skl_copy_wm_for_pipe(struct skl_wm_values *dst,
+                     struct skl_wm_values *src,
+                     enum pipe pipe)
+{
+        dst->wm_linetime[pipe] = src->wm_linetime[pipe];
+        memcpy(dst->plane[pipe], src->plane[pipe],
+               sizeof(dst->plane[pipe]));
+        memcpy(dst->plane_trans[pipe], src->plane_trans[pipe],
+               sizeof(dst->plane_trans[pipe]));
+
+        dst->ddb.pipe[pipe] = src->ddb.pipe[pipe];
+        memcpy(dst->ddb.y_plane[pipe], src->ddb.y_plane[pipe],
+               sizeof(dst->ddb.y_plane[pipe]));
+        memcpy(dst->ddb.plane[pipe], src->ddb.plane[pipe],
+               sizeof(dst->ddb.plane[pipe]));
+}
+
 static int
 skl_compute_wm(struct drm_atomic_state *state)
 {
@@ -4018,8 +4203,10 @@ static void skl_update_wm(struct drm_crtc *crtc)
         struct drm_device *dev = crtc->dev;
         struct drm_i915_private *dev_priv = to_i915(dev);
         struct skl_wm_values *results = &dev_priv->wm.skl_results;
+        struct skl_wm_values *hw_vals = &dev_priv->wm.skl_hw;
         struct intel_crtc_state *cstate = to_intel_crtc_state(crtc->state);
         struct skl_pipe_wm *pipe_wm = &cstate->wm.skl.optimal;
+        int pipe;
 
         if ((results->dirty_pipes & drm_crtc_mask(crtc)) == 0)
                 return;
@@ -4031,8 +4218,12 @@ static void skl_update_wm(struct drm_crtc *crtc)
         skl_write_wm_values(dev_priv, results);
         skl_flush_wm_values(dev_priv, results);
 
-        /* store the new configuration */
-        dev_priv->wm.skl_hw = *results;
+        /*
+         * Store the new configuration (but only for the pipes that have
+         * changed; the other values weren't recomputed).
+         */
+        for_each_pipe_masked(dev_priv, pipe, results->dirty_pipes)
+                skl_copy_wm_for_pipe(hw_vals, results, pipe);
 
         mutex_unlock(&dev_priv->wm.wm_mutex);
 }
@@ -4892,7 +5083,8 @@ void gen6_rps_idle(struct drm_i915_private *dev_priv)
                 else
                         gen6_set_rps(dev_priv, dev_priv->rps.idle_freq);
                 dev_priv->rps.last_adj = 0;
-                I915_WRITE(GEN6_PMINTRMSK, 0xffffffff);
+                I915_WRITE(GEN6_PMINTRMSK,
+                           gen6_sanitize_rps_pm_mask(dev_priv, ~0));
         }
         mutex_unlock(&dev_priv->rps.hw_lock);
 
@@ -6573,9 +6765,7 @@ void intel_init_gt_powersave(struct drm_i915_private *dev_priv)
 
 void intel_cleanup_gt_powersave(struct drm_i915_private *dev_priv)
 {
-        if (IS_CHERRYVIEW(dev_priv))
-                return;
-        else if (IS_VALLEYVIEW(dev_priv))
+        if (IS_VALLEYVIEW(dev_priv))
                 valleyview_cleanup_gt_powersave(dev_priv);
 
         if (!i915.enable_rc6)
@@ -7657,8 +7847,54 @@ void intel_init_pm(struct drm_device *dev)
         }
 }
 
+static inline int gen6_check_mailbox_status(struct drm_i915_private *dev_priv)
+{
+        uint32_t flags =
+                I915_READ_FW(GEN6_PCODE_MAILBOX) & GEN6_PCODE_ERROR_MASK;
+
+        switch (flags) {
+        case GEN6_PCODE_SUCCESS:
+                return 0;
+        case GEN6_PCODE_UNIMPLEMENTED_CMD:
+        case GEN6_PCODE_ILLEGAL_CMD:
+                return -ENXIO;
+        case GEN6_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
+        case GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
+                return -EOVERFLOW;
+        case GEN6_PCODE_TIMEOUT:
+                return -ETIMEDOUT;
+        default:
+                MISSING_CASE(flags)
+                return 0;
+        }
+}
+
+static inline int gen7_check_mailbox_status(struct drm_i915_private *dev_priv)
+{
+        uint32_t flags =
+                I915_READ_FW(GEN6_PCODE_MAILBOX) & GEN6_PCODE_ERROR_MASK;
+
+        switch (flags) {
+        case GEN6_PCODE_SUCCESS:
+                return 0;
+        case GEN6_PCODE_ILLEGAL_CMD:
+                return -ENXIO;
+        case GEN7_PCODE_TIMEOUT:
+                return -ETIMEDOUT;
+        case GEN7_PCODE_ILLEGAL_DATA:
+                return -EINVAL;
+        case GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE:
+                return -EOVERFLOW;
+        default:
+                MISSING_CASE(flags);
+                return 0;
+        }
+}
+
 int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val)
 {
+        int status;
+
         WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
 
         /* GEN6_PCODE_* are outside of the forcewake domain, we can
@@ -7685,12 +7921,25 @@ int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val
         *val = I915_READ_FW(GEN6_PCODE_DATA);
         I915_WRITE_FW(GEN6_PCODE_DATA, 0);
 
+        if (INTEL_GEN(dev_priv) > 6)
+                status = gen7_check_mailbox_status(dev_priv);
+        else
+                status = gen6_check_mailbox_status(dev_priv);
+
+        if (status) {
+                DRM_DEBUG_DRIVER("warning: pcode (read) mailbox access failed: %d\n",
+                                 status);
+                return status;
+        }
+
         return 0;
 }
 
 int sandybridge_pcode_write(struct drm_i915_private *dev_priv,
-                               u32 mbox, u32 val)
+                            u32 mbox, u32 val)
 {
+        int status;
+
         WARN_ON(!mutex_is_locked(&dev_priv->rps.hw_lock));
 
         /* GEN6_PCODE_* are outside of the forcewake domain, we can
@@ -7715,6 +7964,17 @@ int sandybridge_pcode_write(struct drm_i915_private *dev_priv,
 
         I915_WRITE_FW(GEN6_PCODE_DATA, 0);
 
+        if (INTEL_GEN(dev_priv) > 6)
+                status = gen7_check_mailbox_status(dev_priv);
+        else
+                status = gen6_check_mailbox_status(dev_priv);
+
+        if (status) {
+                DRM_DEBUG_DRIVER("warning: pcode (write) mailbox access failed: %d\n",
+                                 status);
+                return status;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_psr.c b/drivers/gpu/drm/i915/intel_psr.c
index 2b0d1baf15b3..cf171b4b8c67 100644
--- a/drivers/gpu/drm/i915/intel_psr.c
+++ b/drivers/gpu/drm/i915/intel_psr.c
@@ -255,14 +255,14 @@ static void hsw_psr_enable_source(struct intel_dp *intel_dp)
         struct drm_i915_private *dev_priv = to_i915(dev);
 
         uint32_t max_sleep_time = 0x1f;
-        /* Lately it was identified that depending on panel idle frame count
-         * calculated at HW can be off by 1. So let's use what came
-         * from VBT + 1.
-         * There are also other cases where panel demands at least 4
-         * but VBT is not being set. To cover these 2 cases lets use
-         * at least 5 when VBT isn't set to be on the safest side.
+        /*
+         * Let's respect VBT in case VBT asks a higher idle_frame value.
+         * Let's use 6 as the minimum to cover all known cases including
+         * the off-by-one issue that HW has in some cases. Also there are
+         * cases where sink should be able to train
+         * with the 5 or 6 idle patterns.
          */
-        uint32_t idle_frames = dev_priv->vbt.psr.idle_frames + 1;
+        uint32_t idle_frames = max(6, dev_priv->vbt.psr.idle_frames);
         uint32_t val = EDP_PSR_ENABLE;
 
         val |= max_sleep_time << EDP_PSR_MAX_SLEEP_TIME_SHIFT;
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index cca7792f26d5..1d3161bbea24 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -1178,8 +1178,8 @@ static int bxt_init_workarounds(struct intel_engine_cs *engine)
                 I915_WRITE(GEN8_L3SQCREG1, L3_GENERAL_PRIO_CREDITS(62) |
                                            L3_HIGH_PRIO_CREDITS(2));
 
-        /* WaInsertDummyPushConstPs:bxt */
-        if (IS_BXT_REVID(dev_priv, 0, BXT_REVID_B0))
+        /* WaToEnableHwFixForPushConstHWBug:bxt */
+        if (IS_BXT_REVID(dev_priv, BXT_REVID_C0, REVID_FOREVER))
                 WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
                                   GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
 
@@ -1222,8 +1222,8 @@ static int kbl_init_workarounds(struct intel_engine_cs *engine)
                 I915_WRITE(GEN8_L3SQCREG4, I915_READ(GEN8_L3SQCREG4) |
                            GEN8_LQSC_RO_PERF_DIS);
 
-        /* WaInsertDummyPushConstPs:kbl */
-        if (IS_KBL_REVID(dev_priv, 0, KBL_REVID_B0))
+        /* WaToEnableHwFixForPushConstHWBug:kbl */
+        if (IS_KBL_REVID(dev_priv, KBL_REVID_C0, REVID_FOREVER))
                 WA_SET_BIT_MASKED(COMMON_SLICE_CHICKEN2,
                                   GEN8_SBE_DISABLE_REPLAY_BUF_OPTIMIZATION);
 
diff --git a/drivers/gpu/drm/imx/imx-drm-core.c b/drivers/gpu/drm/imx/imx-drm-core.c
index 9f7dafce3a4c..7bf90e9e6139 100644
--- a/drivers/gpu/drm/imx/imx-drm-core.c
+++ b/drivers/gpu/drm/imx/imx-drm-core.c
@@ -171,10 +171,34 @@ static void imx_drm_output_poll_changed(struct drm_device *drm)
         drm_fbdev_cma_hotplug_event(imxdrm->fbhelper);
 }
 
+static int imx_drm_atomic_check(struct drm_device *dev,
+                                struct drm_atomic_state *state)
+{
+        int ret;
+
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+
+        ret = drm_atomic_helper_check_planes(dev, state);
+        if (ret)
+                return ret;
+
+        /*
+         * Check modeset again in case crtc_state->mode_changed is
+         * updated in plane's ->atomic_check callback.
+         */
+        ret = drm_atomic_helper_check_modeset(dev, state);
+        if (ret)
+                return ret;
+
+        return ret;
+}
+
 static const struct drm_mode_config_funcs imx_drm_mode_config_funcs = {
         .fb_create = drm_fb_cma_create,
         .output_poll_changed = imx_drm_output_poll_changed,
-        .atomic_check = drm_atomic_helper_check,
+        .atomic_check = imx_drm_atomic_check,
         .atomic_commit = drm_atomic_helper_commit,
 };
 
diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c
index 08e188bc10fc..462056e4b9e4 100644
--- a/drivers/gpu/drm/imx/ipuv3-crtc.c
+++ b/drivers/gpu/drm/imx/ipuv3-crtc.c
@@ -76,6 +76,8 @@ static void ipu_crtc_disable(struct drm_crtc *crtc)
                 crtc->state->event = NULL;
         }
         spin_unlock_irq(&crtc->dev->event_lock);
+
+        drm_crtc_vblank_off(crtc);
 }
 
 static void imx_drm_crtc_reset(struct drm_crtc *crtc)
@@ -175,6 +177,8 @@ static int ipu_crtc_atomic_check(struct drm_crtc *crtc,
 static void ipu_crtc_atomic_begin(struct drm_crtc *crtc,
                                   struct drm_crtc_state *old_crtc_state)
 {
+        drm_crtc_vblank_on(crtc);
+
         spin_lock_irq(&crtc->dev->event_lock);
         if (crtc->state->event) {
                 WARN_ON(drm_crtc_vblank_get(crtc));
diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c
index 4ad67d015ec7..29423e757d36 100644
--- a/drivers/gpu/drm/imx/ipuv3-plane.c
+++ b/drivers/gpu/drm/imx/ipuv3-plane.c
@@ -319,13 +319,14 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                 return -EINVAL;
 
         /*
-         * since we cannot touch active IDMAC channels, we do not support
-         * resizing the enabled plane or changing its format
+         * We support resizing active plane or changing its format by
+         * forcing CRTC mode change and disabling-enabling plane in plane's
+         * ->atomic_update callback.
          */
         if (old_fb && (state->src_w != old_state->src_w ||
                               state->src_h != old_state->src_h ||
                               fb->pixel_format != old_fb->pixel_format))
-                return -EINVAL;
+                crtc_state->mode_changed = true;
 
         eba = drm_plane_state_to_eba(state);
 
@@ -336,7 +337,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                 return -EINVAL;
 
         if (old_fb && fb->pitches[0] != old_fb->pitches[0])
-                return -EINVAL;
+                crtc_state->mode_changed = true;
 
         switch (fb->pixel_format) {
         case DRM_FORMAT_YUV420:
@@ -372,7 +373,7 @@ static int ipu_plane_atomic_check(struct drm_plane *plane,
                         return -EINVAL;
 
                 if (old_fb && old_fb->pitches[1] != fb->pitches[1])
-                        return -EINVAL;
+                        crtc_state->mode_changed = true;
         }
 
         return 0;
@@ -392,8 +393,14 @@ static void ipu_plane_atomic_update(struct drm_plane *plane,
         enum ipu_color_space ics;
 
         if (old_state->fb) {
-                ipu_plane_atomic_set_base(ipu_plane, old_state);
-                return;
+                struct drm_crtc_state *crtc_state = state->crtc->state;
+
+                if (!crtc_state->mode_changed) {
+                        ipu_plane_atomic_set_base(ipu_plane, old_state);
+                        return;
+                }
+
+                ipu_disable_plane(plane);
         }
 
         switch (ipu_plane->dp_flow) {
diff --git a/drivers/gpu/drm/mediatek/Kconfig b/drivers/gpu/drm/mediatek/Kconfig
index 23ac8041c562..294de4549922 100644
--- a/drivers/gpu/drm/mediatek/Kconfig
+++ b/drivers/gpu/drm/mediatek/Kconfig
@@ -2,6 +2,9 @@ config DRM_MEDIATEK
         tristate "DRM Support for Mediatek SoCs"
         depends on DRM
         depends on ARCH_MEDIATEK || (ARM && COMPILE_TEST)
+        depends on COMMON_CLK
+        depends on HAVE_ARM_SMCCC
+        depends on OF
         select DRM_GEM_CMA_HELPER
         select DRM_KMS_HELPER
         select DRM_MIPI_DSI
diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h
index b4bc7f1ef717..d0da52f2a806 100644
--- a/drivers/gpu/drm/msm/msm_drv.h
+++ b/drivers/gpu/drm/msm/msm_drv.h
@@ -157,6 +157,12 @@ struct msm_drm_private {
         struct shrinker shrinker;
 
         struct msm_vblank_ctrl vblank_ctrl;
+
+        /* task holding struct_mutex.. currently only used in submit path
+         * to detect and reject faults from copy_from_user() for submit
+         * ioctl.
+         */
+        struct task_struct *struct_mutex_task;
 };
 
 struct msm_format {
diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c
index 6cd4af443139..85f3047e05ae 100644
--- a/drivers/gpu/drm/msm/msm_gem.c
+++ b/drivers/gpu/drm/msm/msm_gem.c
@@ -196,11 +196,20 @@ int msm_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 {
         struct drm_gem_object *obj = vma->vm_private_data;
         struct drm_device *dev = obj->dev;
+        struct msm_drm_private *priv = dev->dev_private;
         struct page **pages;
         unsigned long pfn;
         pgoff_t pgoff;
         int ret;
 
+        /* This should only happen if userspace tries to pass a mmap'd
+         * but unfaulted gem bo vaddr into submit ioctl, triggering
+         * a page fault while struct_mutex is already held.  This is
+         * not a valid use-case so just bail.
+         */
+        if (priv->struct_mutex_task == current)
+                return VM_FAULT_SIGBUS;
+
         /* Make sure we don't parallel update on a fault, nor move or remove
          * something from beneath our feet
          */
diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c
index 9766f9ae4b7d..880d6a9af7c8 100644
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -64,6 +64,14 @@ void msm_gem_submit_free(struct msm_gem_submit *submit)
         kfree(submit);
 }
 
+static inline unsigned long __must_check
+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+{
+        if (access_ok(VERIFY_READ, from, n))
+                return __copy_from_user_inatomic(to, from, n);
+        return -EFAULT;
+}
+
 static int submit_lookup_objects(struct msm_gem_submit *submit,
                 struct drm_msm_gem_submit *args, struct drm_file *file)
 {
@@ -71,6 +79,7 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
         int ret = 0;
 
         spin_lock(&file->table_lock);
+        pagefault_disable();
 
         for (i = 0; i < args->nr_bos; i++) {
                 struct drm_msm_gem_submit_bo submit_bo;
@@ -84,10 +93,15 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
                  */
                 submit->bos[i].flags = 0;
 
-                ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
-                if (ret) {
-                        ret = -EFAULT;
-                        goto out_unlock;
+                ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
+                if (unlikely(ret)) {
+                        pagefault_enable();
+                        spin_unlock(&file->table_lock);
+                        ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+                        if (ret)
+                                goto out;
+                        spin_lock(&file->table_lock);
+                        pagefault_disable();
                 }
 
                 if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@@ -127,9 +141,12 @@ static int submit_lookup_objects(struct msm_gem_submit *submit,
         }
 
 out_unlock:
-        submit->nr_bos = i;
+        pagefault_enable();
         spin_unlock(&file->table_lock);
 
+out:
+        submit->nr_bos = i;
+
         return ret;
 }
 
@@ -377,6 +394,8 @@ int msm_ioctl_gem_submit(struct drm_device *dev, void *data,
         if (ret)
                 return ret;
 
+        priv->struct_mutex_task = current;
+
         submit = submit_create(dev, gpu, args->nr_bos, args->nr_cmds);
         if (!submit) {
                 ret = -ENOMEM;
@@ -468,6 +487,7 @@ out:
         if (ret)
                 msm_gem_submit_free(submit);
 out_unlock:
+        priv->struct_mutex_task = NULL;
         mutex_unlock(&dev->struct_mutex);
         return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index f2ad17aa33f0..dc57b628e074 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -225,6 +225,17 @@ static bool nouveau_pr3_present(struct pci_dev *pdev)
         if (!parent_pdev)
                 return false;
 
+        if (!parent_pdev->bridge_d3) {
+                /*
+                 * Parent PCI bridge is currently not power managed.
+                 * Since userspace can change these afterwards to be on
+                 * the safe side we stick with _DSM and prevent usage of
+                 * _PR3 from the bridge.
+                 */
+                pci_d3cold_disable(pdev);
+                return false;
+        }
+
         parent_adev = ACPI_COMPANION(&parent_pdev->dev);
         if (!parent_adev)
                 return false;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 528bdeffb339..6190035edfea 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -1151,7 +1151,7 @@ nouveau_bo_move_flipd(struct ttm_buffer_object *bo, bool evict, bool intr,
         if (ret)
                 goto out;
 
-        ret = ttm_bo_move_ttm(bo, true, no_wait_gpu, new_mem);
+        ret = ttm_bo_move_ttm(bo, true, intr, no_wait_gpu, new_mem);
 out:
         ttm_bo_mem_put(bo, &tmp_mem);
         return ret;
@@ -1179,7 +1179,7 @@ nouveau_bo_move_flips(struct ttm_buffer_object *bo, bool evict, bool intr,
         if (ret)
                 return ret;
 
-        ret = ttm_bo_move_ttm(bo, true, no_wait_gpu, &tmp_mem);
+        ret = ttm_bo_move_ttm(bo, true, intr, no_wait_gpu, &tmp_mem);
         if (ret)
                 goto out;
 
diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
index df2657051afd..28c1423049c5 100644
--- a/drivers/gpu/drm/qxl/qxl_fb.c
+++ b/drivers/gpu/drm/qxl/qxl_fb.c
@@ -73,10 +73,12 @@ static void qxl_fb_image_init(struct qxl_fb_image *qxl_fb_image,
         }
 }
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
 static struct fb_deferred_io qxl_defio = {
         .delay          = QXL_DIRTY_DELAY,
         .deferred_io    = drm_fb_helper_deferred_io,
 };
+#endif
 
 static struct fb_ops qxlfb_ops = {
         .owner = THIS_MODULE,
@@ -313,8 +315,10 @@ static int qxlfb_create(struct qxl_fbdev *qfbdev,
                 goto out_destroy_fbi;
         }
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
         info->fbdefio = &qxl_defio;
         fb_deferred_io_init(info);
+#endif
 
         qdev->fbdev_info = info;
         qdev->fbdev_qfb = &qfbdev->qfb;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index a97abc8af657..1dcf39084555 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -627,7 +627,9 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                         if (radeon_crtc->ss.refdiv) {
                                 radeon_crtc->pll_flags |= RADEON_PLL_USE_REF_DIV;
                                 radeon_crtc->pll_reference_div = radeon_crtc->ss.refdiv;
-                                if (rdev->family >= CHIP_RV770)
+                                if (ASIC_IS_AVIVO(rdev) &&
+                                    rdev->family != CHIP_RS780 &&
+                                    rdev->family != CHIP_RS880)
                                         radeon_crtc->pll_flags |= RADEON_PLL_USE_FRAC_FB_DIV;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 6de342861202..ddef0d494084 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -198,16 +198,7 @@ static int radeon_atpx_validate(struct radeon_atpx *atpx)
         atpx->is_hybrid = false;
         if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) {
                 printk("ATPX Hybrid Graphics\n");
-#if 1
-                /* This is a temporary hack until the D3 cold support
-                 * makes it upstream.  The ATPX power_control method seems
-                 * to still work on even if the system should be using
-                 * the new standardized hybrid D3 cold ACPI interface.
-                 */
-                atpx->functions.power_cntl = true;
-#else
                 atpx->functions.power_cntl = false;
-#endif
                 atpx->is_hybrid = true;
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index ffdad81ef964..c2e0a1ccdfbc 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -263,8 +263,8 @@ static int radeon_move_blit(struct ttm_buffer_object *bo,
 
         rdev = radeon_get_rdev(bo->bdev);
         ridx = radeon_copy_ring_index(rdev);
-        old_start = old_mem->start << PAGE_SHIFT;
-        new_start = new_mem->start << PAGE_SHIFT;
+        old_start = (u64)old_mem->start << PAGE_SHIFT;
+        new_start = (u64)new_mem->start << PAGE_SHIFT;
 
         switch (old_mem->mem_type) {
         case TTM_PL_VRAM:
@@ -346,7 +346,7 @@ static int radeon_move_vram_ram(struct ttm_buffer_object *bo,
         if (unlikely(r)) {
                 goto out_cleanup;
         }
-        r = ttm_bo_move_ttm(bo, true, no_wait_gpu, new_mem);
+        r = ttm_bo_move_ttm(bo, true, interruptible, no_wait_gpu, new_mem);
 out_cleanup:
         ttm_bo_mem_put(bo, &tmp_mem);
         return r;
@@ -379,7 +379,7 @@ static int radeon_move_ram_vram(struct ttm_buffer_object *bo,
         if (unlikely(r)) {
                 return r;
         }
-        r = ttm_bo_move_ttm(bo, true, no_wait_gpu, &tmp_mem);
+        r = ttm_bo_move_ttm(bo, true, interruptible, no_wait_gpu, &tmp_mem);
         if (unlikely(r)) {
                 goto out_cleanup;
         }
diff --git a/drivers/gpu/drm/rcar-du/rcar_du_hdmienc.c b/drivers/gpu/drm/rcar-du/rcar_du_hdmienc.c
index 4de3ff0dbebd..e03004f4588d 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_hdmienc.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_hdmienc.c
@@ -125,6 +125,7 @@ int rcar_du_hdmienc_init(struct rcar_du_device *rcdu,
 
         /* Link drm_bridge to encoder */
         bridge->encoder = encoder;
+        encoder->bridge = bridge;
 
         ret = drm_bridge_attach(rcdu->ddev, bridge);
         if (ret) {
diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c
index 3d228ad90e0f..3dea1216bafd 100644
--- a/drivers/gpu/drm/tegra/dsi.c
+++ b/drivers/gpu/drm/tegra/dsi.c
@@ -840,6 +840,21 @@ static const struct drm_encoder_funcs tegra_dsi_encoder_funcs = {
         .destroy = tegra_output_encoder_destroy,
 };
 
+static void tegra_dsi_unprepare(struct tegra_dsi *dsi)
+{
+        int err;
+
+        if (dsi->slave)
+                tegra_dsi_unprepare(dsi->slave);
+
+        err = tegra_mipi_disable(dsi->mipi);
+        if (err < 0)
+                dev_err(dsi->dev, "failed to disable MIPI calibration: %d\n",
+                        err);
+
+        pm_runtime_put(dsi->dev);
+}
+
 static void tegra_dsi_encoder_disable(struct drm_encoder *encoder)
 {
         struct tegra_output *output = encoder_to_output(encoder);
@@ -876,7 +891,26 @@ static void tegra_dsi_encoder_disable(struct drm_encoder *encoder)
 
         tegra_dsi_disable(dsi);
 
-        pm_runtime_put(dsi->dev);
+        tegra_dsi_unprepare(dsi);
+}
+
+static void tegra_dsi_prepare(struct tegra_dsi *dsi)
+{
+        int err;
+
+        pm_runtime_get_sync(dsi->dev);
+
+        err = tegra_mipi_enable(dsi->mipi);
+        if (err < 0)
+                dev_err(dsi->dev, "failed to enable MIPI calibration: %d\n",
+                        err);
+
+        err = tegra_dsi_pad_calibrate(dsi);
+        if (err < 0)
+                dev_err(dsi->dev, "MIPI calibration failed: %d\n", err);
+
+        if (dsi->slave)
+                tegra_dsi_prepare(dsi->slave);
 }
 
 static void tegra_dsi_encoder_enable(struct drm_encoder *encoder)
@@ -887,13 +921,8 @@ static void tegra_dsi_encoder_enable(struct drm_encoder *encoder)
         struct tegra_dsi *dsi = to_dsi(output);
         struct tegra_dsi_state *state;
         u32 value;
-        int err;
-
-        pm_runtime_get_sync(dsi->dev);
 
-        err = tegra_dsi_pad_calibrate(dsi);
-        if (err < 0)
-                dev_err(dsi->dev, "MIPI calibration failed: %d\n", err);
+        tegra_dsi_prepare(dsi);
 
         state = tegra_dsi_get_state(dsi);
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 4054d804fe06..42c074a9c955 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -354,7 +354,8 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
 
         if (!(old_man->flags & TTM_MEMTYPE_FLAG_FIXED) &&
             !(new_man->flags & TTM_MEMTYPE_FLAG_FIXED))
-                ret = ttm_bo_move_ttm(bo, evict, no_wait_gpu, mem);
+                ret = ttm_bo_move_ttm(bo, evict, interruptible, no_wait_gpu,
+                                      mem);
         else if (bdev->driver->move)
                 ret = bdev->driver->move(bo, evict, interruptible,
                                          no_wait_gpu, mem);
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 2df602a35f92..f157a9efd220 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -45,7 +45,7 @@ void ttm_bo_free_old_node(struct ttm_buffer_object *bo)
 }
 
 int ttm_bo_move_ttm(struct ttm_buffer_object *bo,
-                    bool evict,
+                    bool evict, bool interruptible,
                     bool no_wait_gpu, struct ttm_mem_reg *new_mem)
 {
         struct ttm_tt *ttm = bo->ttm;
@@ -53,6 +53,14 @@ int ttm_bo_move_ttm(struct ttm_buffer_object *bo,
         int ret;
 
         if (old_mem->mem_type != TTM_PL_SYSTEM) {
+                ret = ttm_bo_wait(bo, interruptible, no_wait_gpu);
+
+                if (unlikely(ret != 0)) {
+                        if (ret != -ERESTARTSYS)
+                                pr_err("Failed to expire sync object before unbinding TTM\n");
+                        return ret;
+                }
+
                 ttm_tt_unbind(ttm);
                 ttm_bo_free_old_node(bo);
                 ttm_flag_masked(&old_mem->placement, TTM_PL_FLAG_SYSTEM,
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index d5df555aeba0..9688bfa92ccd 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -203,6 +203,7 @@ static int udl_fb_open(struct fb_info *info, int user)
 
         ufbdev->fb_count++;
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
         if (fb_defio && (info->fbdefio == NULL)) {
                 /* enable defio at last moment if not disabled by client */
 
@@ -218,6 +219,7 @@ static int udl_fb_open(struct fb_info *info, int user)
                 info->fbdefio = fbdefio;
                 fb_deferred_io_init(info);
         }
+#endif
 
         pr_notice("open /dev/fb%d user=%d fb_info=%p count=%d\n",
                   info->node, user, info, ufbdev->fb_count);
@@ -235,12 +237,14 @@ static int udl_fb_release(struct fb_info *info, int user)
 
         ufbdev->fb_count--;
 
+#ifdef CONFIG_DRM_FBDEV_EMULATION
         if ((ufbdev->fb_count == 0) && (info->fbdefio)) {
                 fb_deferred_io_cleanup(info);
                 kfree(info->fbdefio);
                 info->fbdefio = NULL;
                 info->fbops->fb_mmap = udl_fb_mmap;
         }
+#endif
 
         pr_warn("released /dev/fb%d user=%d count=%d\n",
                 info->node, user, ufbdev->fb_count);
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
index 59adcf8532dd..3f6704cf6608 100644
--- a/drivers/gpu/drm/vc4/vc4_bo.c
+++ b/drivers/gpu/drm/vc4/vc4_bo.c
@@ -144,7 +144,7 @@ static struct list_head *vc4_get_cache_list_for_size(struct drm_device *dev,
         return &vc4->bo_cache.size_list[page_index];
 }
 
-void vc4_bo_cache_purge(struct drm_device *dev)
+static void vc4_bo_cache_purge(struct drm_device *dev)
 {
         struct vc4_dev *vc4 = to_vc4_dev(dev);
 
diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
index 8b42d31a7f0e..9ecef9385491 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.c
+++ b/drivers/gpu/drm/vc4/vc4_drv.c
@@ -57,21 +57,21 @@ static int vc4_get_param_ioctl(struct drm_device *dev, void *data,
         switch (args->param) {
         case DRM_VC4_PARAM_V3D_IDENT0:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT0);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
                 break;
         case DRM_VC4_PARAM_V3D_IDENT1:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT1);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
                 break;
         case DRM_VC4_PARAM_V3D_IDENT2:
                 ret = pm_runtime_get_sync(&vc4->v3d->pdev->dev);
-                if (ret)
+                if (ret < 0)
                         return ret;
                 args->value = V3D_READ(V3D_IDENT2);
                 pm_runtime_put(&vc4->v3d->pdev->dev);
diff --git a/drivers/gpu/drm/vc4/vc4_drv.h b/drivers/gpu/drm/vc4/vc4_drv.h
index 489e3de0c050..428e24919ef1 100644
--- a/drivers/gpu/drm/vc4/vc4_drv.h
+++ b/drivers/gpu/drm/vc4/vc4_drv.h
@@ -321,6 +321,15 @@ vc4_first_render_job(struct vc4_dev *vc4)
                                 struct vc4_exec_info, head);
 }
 
+static inline struct vc4_exec_info *
+vc4_last_render_job(struct vc4_dev *vc4)
+{
+        if (list_empty(&vc4->render_job_list))
+                return NULL;
+        return list_last_entry(&vc4->render_job_list,
+                               struct vc4_exec_info, head);
+}
+
 /**
  * struct vc4_texture_sample_info - saves the offsets into the UBO for texture
  * setup parameters.
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 6155e8aca1c6..b262c5c26f10 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -534,8 +534,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
                 return -EINVAL;
         }
 
-        exec->bo = kcalloc(exec->bo_count, sizeof(struct drm_gem_cma_object *),
-                           GFP_KERNEL);
+        exec->bo = drm_calloc_large(exec->bo_count,
+                                    sizeof(struct drm_gem_cma_object *));
         if (!exec->bo) {
                 DRM_ERROR("Failed to allocate validated BO pointers\n");
                 return -ENOMEM;
@@ -572,8 +572,8 @@ vc4_cl_lookup_bos(struct drm_device *dev,
         spin_unlock(&file_priv->table_lock);
 
 fail:
-        kfree(handles);
-        return 0;
+        drm_free_large(handles);
+        return ret;
 }
 
 static int
@@ -608,7 +608,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
          * read the contents back for validation, and I think the
          * bo->vaddr is uncached access.
          */
-        temp = kmalloc(temp_size, GFP_KERNEL);
+        temp = drm_malloc_ab(temp_size, 1);
         if (!temp) {
                 DRM_ERROR("Failed to allocate storage for copying "
                           "in bin/render CLs.\n");
@@ -675,7 +675,7 @@ vc4_get_bcl(struct drm_device *dev, struct vc4_exec_info *exec)
         ret = vc4_validate_shader_recs(dev, exec);
 
 fail:
-        kfree(temp);
+        drm_free_large(temp);
         return ret;
 }
 
@@ -688,7 +688,7 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
         if (exec->bo) {
                 for (i = 0; i < exec->bo_count; i++)
                         drm_gem_object_unreference_unlocked(&exec->bo[i]->base);
-                kfree(exec->bo);
+                drm_free_large(exec->bo);
         }
 
         while (!list_empty(&exec->unref_list)) {
@@ -942,8 +942,8 @@ vc4_gem_destroy(struct drm_device *dev)
                 vc4->overflow_mem = NULL;
         }
 
-        vc4_bo_cache_destroy(dev);
-
         if (vc4->hang_state)
                 vc4_free_hang_state(dev, vc4->hang_state);
+
+        vc4_bo_cache_destroy(dev);
 }
diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
index b0104a346a74..094bc6a475c1 100644
--- a/drivers/gpu/drm/vc4/vc4_irq.c
+++ b/drivers/gpu/drm/vc4/vc4_irq.c
@@ -83,8 +83,10 @@ vc4_overflow_mem_work(struct work_struct *work)
 
                 spin_lock_irqsave(&vc4->job_lock, irqflags);
                 current_exec = vc4_first_bin_job(vc4);
+                if (!current_exec)
+                        current_exec = vc4_last_render_job(vc4);
                 if (current_exec) {
-                        vc4->overflow_mem->seqno = vc4->finished_seqno + 1;
+                        vc4->overflow_mem->seqno = current_exec->seqno;
                         list_add_tail(&vc4->overflow_mem->unref_head,
                                       &current_exec->unref_list);
                         vc4->overflow_mem = NULL;
diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
index 46527e989ce3..2543cf5b8b51 100644
--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c
+++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c
@@ -309,8 +309,14 @@ validate_uniform_address_write(struct vc4_validated_shader_info *validated_shade
          * of uniforms on each side.  However, this scheme is easy to
          * validate so it's all we allow for now.
          */
-
-        if (QPU_GET_FIELD(inst, QPU_SIG) != QPU_SIG_NONE) {
+        switch (QPU_GET_FIELD(inst, QPU_SIG)) {
+        case QPU_SIG_NONE:
+        case QPU_SIG_SCOREBOARD_UNLOCK:
+        case QPU_SIG_COLOR_LOAD:
+        case QPU_SIG_LOAD_TMU0:
+        case QPU_SIG_LOAD_TMU1:
+                break;
+        default:
                 DRM_ERROR("uniforms address change must be "
                           "normal math\n");
                 return false;
diff --git a/drivers/gpu/host1x/mipi.c b/drivers/gpu/host1x/mipi.c
index 52a6fd224127..e00809d996a2 100644
--- a/drivers/gpu/host1x/mipi.c
+++ b/drivers/gpu/host1x/mipi.c
@@ -242,20 +242,6 @@ struct tegra_mipi_device *tegra_mipi_request(struct device *device)
         dev->pads = args.args[0];
         dev->device = device;
 
-        mutex_lock(&dev->mipi->lock);
-
-        if (dev->mipi->usage_count++ == 0) {
-                err = tegra_mipi_power_up(dev->mipi);
-                if (err < 0) {
-                        dev_err(dev->mipi->dev,
-                                "failed to power up MIPI bricks: %d\n",
-                                err);
-                        return ERR_PTR(err);
-                }
-        }
-
-        mutex_unlock(&dev->mipi->lock);
-
         return dev;
 
 put:
@@ -270,29 +256,42 @@ EXPORT_SYMBOL(tegra_mipi_request);
 
 void tegra_mipi_free(struct tegra_mipi_device *device)
 {
-        int err;
+        platform_device_put(device->pdev);
+        kfree(device);
+}
+EXPORT_SYMBOL(tegra_mipi_free);
 
-        mutex_lock(&device->mipi->lock);
+int tegra_mipi_enable(struct tegra_mipi_device *dev)
+{
+        int err = 0;
 
-        if (--device->mipi->usage_count == 0) {
-                err = tegra_mipi_power_down(device->mipi);
-                if (err < 0) {
-                        /*
-                         * Not much that can be done here, so an error message
-                         * will have to do.
-                         */
-                        dev_err(device->mipi->dev,
-                                "failed to power down MIPI bricks: %d\n",
-                                err);
-                }
-        }
+        mutex_lock(&dev->mipi->lock);
 
-        mutex_unlock(&device->mipi->lock);
+        if (dev->mipi->usage_count++ == 0)
+                err = tegra_mipi_power_up(dev->mipi);
+
+        mutex_unlock(&dev->mipi->lock);
+
+        return err;
 
-        platform_device_put(device->pdev);
-        kfree(device);
 }
-EXPORT_SYMBOL(tegra_mipi_free);
+EXPORT_SYMBOL(tegra_mipi_enable);
+
+int tegra_mipi_disable(struct tegra_mipi_device *dev)
+{
+        int err = 0;
+
+        mutex_lock(&dev->mipi->lock);
+
+        if (--dev->mipi->usage_count == 0)
+                err = tegra_mipi_power_down(dev->mipi);
+
+        mutex_unlock(&dev->mipi->lock);
+
+        return err;
+
+}
+EXPORT_SYMBOL(tegra_mipi_disable);
 
 static int tegra_mipi_wait(struct tegra_mipi *mipi)
 {
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 730d84028260..4667012b46b7 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -491,7 +491,7 @@ struct it87_sio_data {
 struct it87_data {
         const struct attribute_group *groups[7];
         enum chips type;
-        u16 features;
+        u32 features;
         u8 peci_mask;
         u8 old_peci_mask;
 
@@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = {
         &sensor_dev_attr_in10_input.dev_attr.attr,      /* 41 */
         &sensor_dev_attr_in11_input.dev_attr.attr,      /* 41 */
         &sensor_dev_attr_in12_input.dev_attr.attr,      /* 41 */
+        NULL
 };
 
 static const struct attribute_group it87_group_in = {
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index f23372669f77..1bb97f658b47 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -38,6 +38,7 @@
 #define AT91_I2C_TIMEOUT        msecs_to_jiffies(100)   /* transfer timeout */
 #define AT91_I2C_DMA_THRESHOLD  8                       /* enable DMA if transfer size is bigger than this threshold */
 #define AUTOSUSPEND_TIMEOUT             2000
+#define AT91_I2C_MAX_ALT_CMD_DATA_SIZE  256
 
 /* AT91 TWI register definitions */
 #define AT91_TWI_CR             0x0000  /* Control Register */
@@ -141,6 +142,7 @@ struct at91_twi_dev {
         unsigned twi_cwgr_reg;
         struct at91_twi_pdata *pdata;
         bool use_dma;
+        bool use_alt_cmd;
         bool recv_len_abort;
         u32 fifo_size;
         struct at91_twi_dma dma;
@@ -269,7 +271,7 @@ static void at91_twi_write_next_byte(struct at91_twi_dev *dev)
 
         /* send stop when last byte has been written */
         if (--dev->buf_len == 0)
-                if (!dev->pdata->has_alt_cmd)
+                if (!dev->use_alt_cmd)
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 
         dev_dbg(dev->dev, "wrote 0x%x, to go %d\n", *dev->buf, dev->buf_len);
@@ -292,7 +294,7 @@ static void at91_twi_write_data_dma_callback(void *data)
          * we just have to enable TXCOMP one.
          */
         at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
-        if (!dev->pdata->has_alt_cmd)
+        if (!dev->use_alt_cmd)
                 at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 }
 
@@ -410,7 +412,7 @@ static void at91_twi_read_next_byte(struct at91_twi_dev *dev)
         }
 
         /* send stop if second but last byte has been read */
-        if (!dev->pdata->has_alt_cmd && dev->buf_len == 1)
+        if (!dev->use_alt_cmd && dev->buf_len == 1)
                 at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
 
         dev_dbg(dev->dev, "read 0x%x, to go %d\n", *dev->buf, dev->buf_len);
@@ -426,7 +428,7 @@ static void at91_twi_read_data_dma_callback(void *data)
         dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg[0]),
                          dev->buf_len, DMA_FROM_DEVICE);
 
-        if (!dev->pdata->has_alt_cmd) {
+        if (!dev->use_alt_cmd) {
                 /* The last two bytes have to be read without using dma */
                 dev->buf += dev->buf_len - 2;
                 dev->buf_len = 2;
@@ -443,7 +445,7 @@ static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
         struct dma_chan *chan_rx = dma->chan_rx;
         size_t buf_len;
 
-        buf_len = (dev->pdata->has_alt_cmd) ? dev->buf_len : dev->buf_len - 2;
+        buf_len = (dev->use_alt_cmd) ? dev->buf_len : dev->buf_len - 2;
         dma->direction = DMA_FROM_DEVICE;
 
         /* Keep in mind that we won't use dma to read the last two bytes */
@@ -651,7 +653,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 unsigned start_flags = AT91_TWI_START;
 
                 /* if only one byte is to be read, immediately stop transfer */
-                if (!has_alt_cmd && dev->buf_len <= 1 &&
+                if (!dev->use_alt_cmd && dev->buf_len <= 1 &&
                     !(dev->msg->flags & I2C_M_RECV_LEN))
                         start_flags |= AT91_TWI_STOP;
                 at91_twi_write(dev, AT91_TWI_CR, start_flags);
@@ -745,7 +747,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
         int ret;
         unsigned int_addr_flag = 0;
         struct i2c_msg *m_start = msg;
-        bool is_read, use_alt_cmd = false;
+        bool is_read;
 
         dev_dbg(&adap->dev, "at91_xfer: processing %d messages:\n", num);
 
@@ -768,14 +770,16 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
                 at91_twi_write(dev, AT91_TWI_IADR, internal_address);
         }
 
+        dev->use_alt_cmd = false;
         is_read = (m_start->flags & I2C_M_RD);
         if (dev->pdata->has_alt_cmd) {
-                if (m_start->len > 0) {
+                if (m_start->len > 0 &&
+                    m_start->len < AT91_I2C_MAX_ALT_CMD_DATA_SIZE) {
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_ACMEN);
                         at91_twi_write(dev, AT91_TWI_ACR,
                                        AT91_TWI_ACR_DATAL(m_start->len) |
                                        ((is_read) ? AT91_TWI_ACR_DIR : 0));
-                        use_alt_cmd = true;
+                        dev->use_alt_cmd = true;
                 } else {
                         at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_ACMDIS);
                 }
@@ -784,7 +788,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num)
         at91_twi_write(dev, AT91_TWI_MMR,
                        (m_start->addr << 16) |
                        int_addr_flag |
-                       ((!use_alt_cmd && is_read) ? AT91_TWI_MREAD : 0));
+                       ((!dev->use_alt_cmd && is_read) ? AT91_TWI_MREAD : 0));
 
         dev->buf_len = m_start->len;
         dev->buf = m_start->buf;
diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c
index 19c843828fe2..95f7cac76f89 100644
--- a/drivers/i2c/busses/i2c-bcm-iproc.c
+++ b/drivers/i2c/busses/i2c-bcm-iproc.c
@@ -158,7 +158,7 @@ static irqreturn_t bcm_iproc_i2c_isr(int irq, void *data)
 
         if (status & BIT(IS_M_START_BUSY_SHIFT)) {
                 iproc_i2c->xfer_is_done = 1;
-                complete_all(&iproc_i2c->done);
+                complete(&iproc_i2c->done);
         }
 
         writel(status, iproc_i2c->base + IS_OFFSET);
diff --git a/drivers/i2c/busses/i2c-bcm-kona.c b/drivers/i2c/busses/i2c-bcm-kona.c
index ac9f47679c3a..258cb9a40ab3 100644
--- a/drivers/i2c/busses/i2c-bcm-kona.c
+++ b/drivers/i2c/busses/i2c-bcm-kona.c
@@ -229,7 +229,7 @@ static irqreturn_t bcm_kona_i2c_isr(int irq, void *devid)
                        dev->base + TXFCR_OFFSET);
 
         writel(status & ~ISR_RESERVED_MASK, dev->base + ISR_OFFSET);
-        complete_all(&dev->done);
+        complete(&dev->done);
 
         return IRQ_HANDLED;
 }
@@ -643,7 +643,7 @@ static int bcm_kona_i2c_xfer(struct i2c_adapter *adapter,
                         if (rc < 0) {
                                 dev_err(dev->device,
                                         "restart cmd failed rc = %d\n", rc);
-                                        goto xfer_send_stop;
+                                goto xfer_send_stop;
                         }
                 }
 
diff --git a/drivers/i2c/busses/i2c-brcmstb.c b/drivers/i2c/busses/i2c-brcmstb.c
index 3f5a4d71d3bf..385b57bfcb38 100644
--- a/drivers/i2c/busses/i2c-brcmstb.c
+++ b/drivers/i2c/busses/i2c-brcmstb.c
@@ -228,7 +228,7 @@ static irqreturn_t brcmstb_i2c_isr(int irq, void *devid)
                 return IRQ_NONE;
 
         brcmstb_i2c_enable_disable_irq(dev, INT_DISABLE);
-        complete_all(&dev->done);
+        complete(&dev->done);
 
         dev_dbg(dev->device, "isr handled");
         return IRQ_HANDLED;
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 90bbd9f9dd8f..3c16a2f7c673 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -767,7 +767,7 @@ static int cdns_i2c_setclk(unsigned long clk_in, struct cdns_i2c *id)
  * depending on the scaling direction.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int cdns_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
index a0d95ff682ae..2d5ff86398d0 100644
--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
@@ -215,7 +215,7 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
         msg->outsize = request_len;
         msg->insize = response_len;
 
-        result = cros_ec_cmd_xfer(bus->ec, msg);
+        result = cros_ec_cmd_xfer_status(bus->ec, msg);
         if (result < 0) {
                 dev_err(dev, "Error transferring EC i2c message %d\n", result);
                 goto exit;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index c6922b806fb7..fcd973d5131e 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -367,13 +367,17 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         dev_dbg(dev->dev, "Fast-mode HCNT:LCNT = %d:%d\n", hcnt, lcnt);
 
         /* Configure SDA Hold Time if required */
-        if (dev->sda_hold_time) {
-                reg = dw_readl(dev, DW_IC_COMP_VERSION);
-                if (reg >= DW_IC_SDA_HOLD_MIN_VERS)
+        reg = dw_readl(dev, DW_IC_COMP_VERSION);
+        if (reg >= DW_IC_SDA_HOLD_MIN_VERS) {
+                if (dev->sda_hold_time) {
                         dw_writel(dev, dev->sda_hold_time, DW_IC_SDA_HOLD);
-                else
-                        dev_warn(dev->dev,
-                                "Hardware too old to adjust SDA hold time.");
+                } else {
+                        /* Keep previous hold time setting if no one set it */
+                        dev->sda_hold_time = dw_readl(dev, DW_IC_SDA_HOLD);
+                }
+        } else {
+                dev_warn(dev->dev,
+                        "Hardware too old to adjust SDA hold time.\n");
         }
 
         /* Configure Tx/Rx FIFO threshold levels */
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 137125b5eae7..5ce71ce7b6c4 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -773,13 +773,6 @@ static int pch_i2c_probe(struct pci_dev *pdev,
         /* Set the number of I2C channel instance */
         adap_info->ch_num = id->driver_data;
 
-        ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
-                  KBUILD_MODNAME, adap_info);
-        if (ret) {
-                pch_pci_err(pdev, "request_irq FAILED\n");
-                goto err_request_irq;
-        }
-
         for (i = 0; i < adap_info->ch_num; i++) {
                 pch_adap = &adap_info->pch_data[i].pch_adapter;
                 adap_info->pch_i2c_suspended = false;
@@ -797,6 +790,17 @@ static int pch_i2c_probe(struct pci_dev *pdev,
 
                 pch_adap->dev.of_node = pdev->dev.of_node;
                 pch_adap->dev.parent = &pdev->dev;
+        }
+
+        ret = request_irq(pdev->irq, pch_i2c_handler, IRQF_SHARED,
+                  KBUILD_MODNAME, adap_info);
+        if (ret) {
+                pch_pci_err(pdev, "request_irq FAILED\n");
+                goto err_request_irq;
+        }
+
+        for (i = 0; i < adap_info->ch_num; i++) {
+                pch_adap = &adap_info->pch_data[i].pch_adapter;
 
                 pch_i2c_init(&adap_info->pch_data[i]);
 
diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
index 71d3929adf54..76e28980904f 100644
--- a/drivers/i2c/busses/i2c-meson.c
+++ b/drivers/i2c/busses/i2c-meson.c
@@ -211,7 +211,7 @@ static void meson_i2c_stop(struct meson_i2c *i2c)
                 meson_i2c_add_token(i2c, TOKEN_STOP);
         } else {
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
         }
 }
 
@@ -238,7 +238,7 @@ static irqreturn_t meson_i2c_irq(int irqno, void *dev_id)
                 dev_dbg(i2c->dev, "error bit set\n");
                 i2c->error = -ENXIO;
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
                 goto out;
         }
 
@@ -269,7 +269,7 @@ static irqreturn_t meson_i2c_irq(int irqno, void *dev_id)
                 break;
         case STATE_STOP:
                 i2c->state = STATE_IDLE;
-                complete_all(&i2c->done);
+                complete(&i2c->done);
                 break;
         case STATE_IDLE:
                 break;
diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
index dfa7a4b4a91d..ac88a524143e 100644
--- a/drivers/i2c/busses/i2c-ocores.c
+++ b/drivers/i2c/busses/i2c-ocores.c
@@ -379,6 +379,7 @@ static int ocores_i2c_of_probe(struct platform_device *pdev,
                         if (!clock_frequency_present) {
                                 dev_err(&pdev->dev,
                                         "Missing required parameter 'opencores,ip-clock-frequency'\n");
+                                clk_disable_unprepare(i2c->clk);
                                 return -ENODEV;
                         }
                         i2c->ip_clock_khz = clock_frequency / 1000;
@@ -467,20 +468,21 @@ static int ocores_i2c_probe(struct platform_device *pdev)
                 default:
                         dev_err(&pdev->dev, "Unsupported I/O width (%d)\n",
                                 i2c->reg_io_width);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto err_clk;
                 }
         }
 
         ret = ocores_init(&pdev->dev, i2c);
         if (ret)
-                return ret;
+                goto err_clk;
 
         init_waitqueue_head(&i2c->wait);
         ret = devm_request_irq(&pdev->dev, irq, ocores_isr, 0,
                                pdev->name, i2c);
         if (ret) {
                 dev_err(&pdev->dev, "Cannot claim IRQ\n");
-                return ret;
+                goto err_clk;
         }
 
         /* hook up driver to tree */
@@ -494,7 +496,7 @@ static int ocores_i2c_probe(struct platform_device *pdev)
         ret = i2c_add_adapter(&i2c->adap);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to add adapter\n");
-                return ret;
+                goto err_clk;
         }
 
         /* add in known devices to the bus */
@@ -504,6 +506,10 @@ static int ocores_i2c_probe(struct platform_device *pdev)
         }
 
         return 0;
+
+err_clk:
+        clk_disable_unprepare(i2c->clk);
+        return ret;
 }
 
 static int ocores_i2c_remove(struct platform_device *pdev)
diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
index 501bd15cb78e..a8497cfdae6f 100644
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -1599,7 +1599,8 @@ static int qup_i2c_pm_resume_runtime(struct device *device)
 #ifdef CONFIG_PM_SLEEP
 static int qup_i2c_suspend(struct device *device)
 {
-        qup_i2c_pm_suspend_runtime(device);
+        if (!pm_runtime_suspended(device))
+                return qup_i2c_pm_suspend_runtime(device);
         return 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 52407f3c9e1c..9bd849dacee8 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -378,7 +378,7 @@ static void rcar_i2c_dma(struct rcar_i2c_priv *priv)
         }
 
         dma_addr = dma_map_single(chan->device->dev, buf, len, dir);
-        if (dma_mapping_error(dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 2bc8b01153d6..5c5b7cada8be 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -918,7 +918,7 @@ static void rk3x_i2c_adapt_div(struct rk3x_i2c *i2c, unsigned long clk_rate)
  * Code adapted from i2c-cadence.c.
  *
  * Return:      NOTIFY_STOP if the rate change should be aborted, NOTIFY_OK
- *              to acknowedge the change, NOTIFY_DONE if the notification is
+ *              to acknowledge the change, NOTIFY_DONE if the notification is
  *              considered irrelevant.
  */
 static int rk3x_i2c_clk_notifier_cb(struct notifier_block *nb, unsigned long
@@ -1111,6 +1111,15 @@ static int rk3x_i2c_xfer(struct i2c_adapter *adap,
         return ret < 0 ? ret : num;
 }
 
+static __maybe_unused int rk3x_i2c_resume(struct device *dev)
+{
+        struct rk3x_i2c *i2c = dev_get_drvdata(dev);
+
+        rk3x_i2c_adapt_div(i2c, clk_get_rate(i2c->clk));
+
+        return 0;
+}
+
 static u32 rk3x_i2c_func(struct i2c_adapter *adap)
 {
         return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING;
@@ -1334,12 +1343,15 @@ static int rk3x_i2c_remove(struct platform_device *pdev)
         return 0;
 }
 
+static SIMPLE_DEV_PM_OPS(rk3x_i2c_pm_ops, NULL, rk3x_i2c_resume);
+
 static struct platform_driver rk3x_i2c_driver = {
         .probe   = rk3x_i2c_probe,
         .remove  = rk3x_i2c_remove,
         .driver  = {
                 .name  = "rk3x-i2c",
                 .of_match_table = rk3x_i2c_match,
+                .pm = &rk3x_i2c_pm_ops,
         },
 };
 
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 6fb3e2645992..05b1eeab9cf5 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -610,7 +610,7 @@ static void sh_mobile_i2c_xfer_dma(struct sh_mobile_i2c_data *pd)
                 return;
 
         dma_addr = dma_map_single(chan->device->dev, pd->msg->buf, pd->msg->len, dir);
-        if (dma_mapping_error(pd->dev, dma_addr)) {
+        if (dma_mapping_error(chan->device->dev, dma_addr)) {
                 dev_dbg(pd->dev, "dma map failed, using PIO\n");
                 return;
         }
diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c
index 8de073aed001..b3893f6282ba 100644
--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c
@@ -37,8 +37,6 @@ struct i2c_demux_pinctrl_priv {
         struct i2c_demux_pinctrl_chan chan[];
 };
 
-static struct property status_okay = { .name = "status", .length = 3, .value = "ok" };
-
 static int i2c_demux_master_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 {
         struct i2c_demux_pinctrl_priv *priv = adap->algo_data;
@@ -68,7 +66,7 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
         adap = of_find_i2c_adapter_by_node(priv->chan[new_chan].parent_np);
         if (!adap) {
                 ret = -ENODEV;
-                goto err;
+                goto err_with_revert;
         }
 
         p = devm_pinctrl_get_select(adap->dev.parent, priv->bus_name);
@@ -103,8 +101,11 @@ static int i2c_demux_activate_master(struct i2c_demux_pinctrl_priv *priv, u32 ne
 
  err_with_put:
         i2c_put_adapter(adap);
+ err_with_revert:
+        of_changeset_revert(&priv->chan[new_chan].chgset);
  err:
         dev_err(priv->dev, "failed to setup demux-adapter %d (%d)\n", new_chan, ret);
+        priv->cur_chan = -EINVAL;
         return ret;
 }
 
@@ -190,6 +191,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
         struct i2c_demux_pinctrl_priv *priv;
+        struct property *props;
         int num_chan, i, j, err;
 
         num_chan = of_count_phandle_with_args(np, "i2c-parent", NULL);
@@ -200,7 +202,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
 
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv)
                            + num_chan * sizeof(struct i2c_demux_pinctrl_chan), GFP_KERNEL);
-        if (!priv)
+
+        props = devm_kcalloc(&pdev->dev, num_chan, sizeof(*props), GFP_KERNEL);
+
+        if (!priv || !props)
                 return -ENOMEM;
 
         err = of_property_read_string(np, "i2c-bus-name", &priv->bus_name);
@@ -218,8 +223,12 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev)
                 }
                 priv->chan[i].parent_np = adap_np;
 
+                props[i].name = devm_kstrdup(&pdev->dev, "status", GFP_KERNEL);
+                props[i].value = devm_kstrdup(&pdev->dev, "ok", GFP_KERNEL);
+                props[i].length = 3;
+
                 of_changeset_init(&priv->chan[i].chgset);
-                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &status_okay);
+                of_changeset_update_property(&priv->chan[i].chgset, adap_np, &props[i]);
         }
 
         priv->num_chan = num_chan;
diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
index 528e755c468f..3278ebf1cc5c 100644
--- a/drivers/i2c/muxes/i2c-mux-pca954x.c
+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
@@ -164,7 +164,7 @@ static int pca954x_select_chan(struct i2c_mux_core *muxc, u32 chan)
         /* Only select the channel if its different from the last channel */
         if (data->last_chan != regval) {
                 ret = pca954x_reg_write(muxc->parent, client, regval);
-                data->last_chan = regval;
+                data->last_chan = ret ? 0 : regval;
         }
 
         return ret;
diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig
index 89d78208de3f..78f148ea9d9f 100644
--- a/drivers/iio/accel/Kconfig
+++ b/drivers/iio/accel/Kconfig
@@ -20,6 +20,8 @@ config BMA180
 config BMA220
     tristate "Bosch BMA220 3-Axis Accelerometer Driver"
         depends on SPI
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
     help
       Say yes here to add support for the Bosch BMA220 triaxial
       acceleration sensor.
@@ -234,7 +236,8 @@ config STK8312
 config STK8BA50
         tristate "Sensortek STK8BA50 3-Axis Accelerometer Driver"
         depends on I2C
-        depends on IIO_TRIGGER
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
           Say yes here to get support for the Sensortek STK8BA50 3-axis
           accelerometer.
diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c
index 1098d10df8e8..5099f295dd37 100644
--- a/drivers/iio/accel/bma220_spi.c
+++ b/drivers/iio/accel/bma220_spi.c
@@ -253,7 +253,7 @@ static int bma220_probe(struct spi_device *spi)
         if (ret < 0)
                 return ret;
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                          bma220_trigger_handler, NULL);
         if (ret < 0) {
                 dev_err(&spi->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
index bf17aae66145..59b380dbf27f 100644
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -67,6 +67,9 @@
 #define BMC150_ACCEL_REG_PMU_BW         0x10
 #define BMC150_ACCEL_DEF_BW                     125
 
+#define BMC150_ACCEL_REG_RESET                  0x14
+#define BMC150_ACCEL_RESET_VAL                  0xB6
+
 #define BMC150_ACCEL_REG_INT_MAP_0              0x19
 #define BMC150_ACCEL_INT_MAP_0_BIT_SLOPE        BIT(2)
 
@@ -1497,6 +1500,14 @@ static int bmc150_accel_chip_init(struct bmc150_accel_data *data)
         int ret, i;
         unsigned int val;
 
+        /*
+         * Reset chip to get it in a known good state. A delay of 1.8ms after
+         * reset is required according to the data sheets of supported chips.
+         */
+        regmap_write(data->regmap, BMC150_ACCEL_REG_RESET,
+                     BMC150_ACCEL_RESET_VAL);
+        usleep_range(1800, 2500);
+
         ret = regmap_read(data->regmap, BMC150_ACCEL_REG_CHIP_ID, &val);
         if (ret < 0) {
                 dev_err(dev, "Error: Reading chip id\n");
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 3a9f106787d2..9d72d4bcf5e9 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -160,11 +160,13 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
                 if (ret < 0)
                         goto error_ret;
                 *val = ret;
+                ret = IIO_VAL_INT;
                 break;
         case IIO_CHAN_INFO_SCALE:
                 ret = spi_w8r8(st->us, KXSD9_READ(KXSD9_REG_CTRL_C));
                 if (ret < 0)
                         goto error_ret;
+                *val = 0;
                 *val2 = kxsd9_micro_scales[ret & KXSD9_FS_MASK];
                 ret = IIO_VAL_INT_PLUS_MICRO;
                 break;
diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
index 1de31bdd4ce4..767577298ee3 100644
--- a/drivers/iio/adc/Kconfig
+++ b/drivers/iio/adc/Kconfig
@@ -389,6 +389,7 @@ config QCOM_SPMI_VADC
 config ROCKCHIP_SARADC
         tristate "Rockchip SARADC driver"
         depends on ARCH_ROCKCHIP || (ARM && COMPILE_TEST)
+        depends on RESET_CONTROLLER
         help
           Say yes here to build support for the SARADC found in SoCs from
           Rockchip.
diff --git a/drivers/iio/adc/ad799x.c b/drivers/iio/adc/ad799x.c
index b6163764489c..9704090b7908 100644
--- a/drivers/iio/adc/ad799x.c
+++ b/drivers/iio/adc/ad799x.c
@@ -527,6 +527,7 @@ static struct attribute_group ad799x_event_attrs_group = {
 static const struct iio_info ad7991_info = {
         .read_raw = &ad799x_read_raw,
         .driver_module = THIS_MODULE,
+        .update_scan_mode = ad799x_update_scan_mode,
 };
 
 static const struct iio_info ad7993_4_7_8_noirq_info = {
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 52430ba171f3..0438c68015e8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -381,8 +381,8 @@ static irqreturn_t at91_adc_rl_interrupt(int irq, void *private)
                 st->ts_bufferedmeasure = false;
                 input_report_key(st->ts_input, BTN_TOUCH, 0);
                 input_sync(st->ts_input);
-        } else if (status & AT91_ADC_EOC(3)) {
-                /* Conversion finished */
+        } else if (status & AT91_ADC_EOC(3) && st->ts_input) {
+                /* Conversion finished and we've a touchscreen */
                 if (st->ts_bufferedmeasure) {
                         /*
                          * Last measurement is always discarded, since it can
diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
index f9ad6c2d6821..85d701291654 100644
--- a/drivers/iio/adc/rockchip_saradc.c
+++ b/drivers/iio/adc/rockchip_saradc.c
@@ -21,6 +21,8 @@
 #include <linux/of_device.h>
 #include <linux/clk.h>
 #include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/reset.h>
 #include <linux/regulator/consumer.h>
 #include <linux/iio/iio.h>
 
@@ -53,6 +55,7 @@ struct rockchip_saradc {
         struct clk              *clk;
         struct completion       completion;
         struct regulator        *vref;
+        struct reset_control    *reset;
         const struct rockchip_saradc_data *data;
         u16                     last_val;
 };
@@ -190,6 +193,16 @@ static const struct of_device_id rockchip_saradc_match[] = {
 };
 MODULE_DEVICE_TABLE(of, rockchip_saradc_match);
 
+/**
+ * Reset SARADC Controller.
+ */
+static void rockchip_saradc_reset_controller(struct reset_control *reset)
+{
+        reset_control_assert(reset);
+        usleep_range(10, 20);
+        reset_control_deassert(reset);
+}
+
 static int rockchip_saradc_probe(struct platform_device *pdev)
 {
         struct rockchip_saradc *info = NULL;
@@ -218,6 +231,20 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
         if (IS_ERR(info->regs))
                 return PTR_ERR(info->regs);
 
+        /*
+         * The reset should be an optional property, as it should work
+         * with old devicetrees as well
+         */
+        info->reset = devm_reset_control_get(&pdev->dev, "saradc-apb");
+        if (IS_ERR(info->reset)) {
+                ret = PTR_ERR(info->reset);
+                if (ret != -ENOENT)
+                        return ret;
+
+                dev_dbg(&pdev->dev, "no reset control found\n");
+                info->reset = NULL;
+        }
+
         init_completion(&info->completion);
 
         irq = platform_get_irq(pdev, 0);
@@ -252,6 +279,9 @@ static int rockchip_saradc_probe(struct platform_device *pdev)
                 return PTR_ERR(info->vref);
         }
 
+        if (info->reset)
+                rockchip_saradc_reset_controller(info->reset);
+
         /*
          * Use a default value for the converter clock.
          * This may become user-configurable in the future.
diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c
index 1ef398770a1f..066abaf80201 100644
--- a/drivers/iio/adc/ti-ads1015.c
+++ b/drivers/iio/adc/ti-ads1015.c
@@ -489,7 +489,8 @@ static struct iio_info ads1115_info = {
 #ifdef CONFIG_OF
 static int ads1015_get_channels_config_of(struct i2c_client *client)
 {
-        struct ads1015_data *data = i2c_get_clientdata(client);
+        struct iio_dev *indio_dev = i2c_get_clientdata(client);
+        struct ads1015_data *data = iio_priv(indio_dev);
         struct device_node *node;
 
         if (!client->dev.of_node ||
diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c
index 8a368756881b..c3cfacca2541 100644
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -32,6 +32,7 @@
 
 struct tiadc_device {
         struct ti_tscadc_dev *mfd_tscadc;
+        struct mutex fifo1_lock; /* to protect fifo access */
         int channels;
         u8 channel_line[8];
         u8 channel_step[8];
@@ -359,6 +360,7 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
                 int *val, int *val2, long mask)
 {
         struct tiadc_device *adc_dev = iio_priv(indio_dev);
+        int ret = IIO_VAL_INT;
         int i, map_val;
         unsigned int fifo1count, read, stepid;
         bool found = false;
@@ -372,13 +374,14 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
         if (!step_en)
                 return -EINVAL;
 
+        mutex_lock(&adc_dev->fifo1_lock);
         fifo1count = tiadc_readl(adc_dev, REG_FIFO1CNT);
         while (fifo1count--)
                 tiadc_readl(adc_dev, REG_FIFO1);
 
         am335x_tsc_se_set_once(adc_dev->mfd_tscadc, step_en);
 
-        timeout = jiffies + usecs_to_jiffies
+        timeout = jiffies + msecs_to_jiffies
                                 (IDLE_TIMEOUT * adc_dev->channels);
         /* Wait for Fifo threshold interrupt */
         while (1) {
@@ -388,7 +391,8 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
 
                 if (time_after(jiffies, timeout)) {
                         am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
-                        return -EAGAIN;
+                        ret = -EAGAIN;
+                        goto err_unlock;
                 }
         }
         map_val = adc_dev->channel_step[chan->scan_index];
@@ -414,8 +418,11 @@ static int tiadc_read_raw(struct iio_dev *indio_dev,
         am335x_tsc_se_adc_done(adc_dev->mfd_tscadc);
 
         if (found == false)
-                return -EBUSY;
-        return IIO_VAL_INT;
+                ret =  -EBUSY;
+
+err_unlock:
+        mutex_unlock(&adc_dev->fifo1_lock);
+        return ret;
 }
 
 static const struct iio_info tiadc_info = {
@@ -483,6 +490,7 @@ static int tiadc_probe(struct platform_device *pdev)
 
         tiadc_step_config(indio_dev);
         tiadc_writel(adc_dev, REG_FIFO1THR, FIFO1_THRESHOLD);
+        mutex_init(&adc_dev->fifo1_lock);
 
         err = tiadc_channel_init(indio_dev, adc_dev->channels);
         if (err < 0)
diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
index ae038a59d256..407f141a1eee 100644
--- a/drivers/iio/chemical/atlas-ph-sensor.c
+++ b/drivers/iio/chemical/atlas-ph-sensor.c
@@ -434,7 +434,7 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
                         break;
                 case IIO_ELECTRICALCONDUCTIVITY:
                         *val = 1; /* 0.00001 */
-                        *val = 100000;
+                        *val2 = 100000;
                         break;
                 case IIO_CONCENTRATION:
                         *val = 0; /* 0.000000001 */
diff --git a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
index e81f434760f4..dc33c1dd5191 100644
--- a/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-attributes.c
@@ -56,8 +56,8 @@ static struct {
         {HID_USAGE_SENSOR_ALS, 0, 1, 0},
         {HID_USAGE_SENSOR_ALS, HID_USAGE_SENSOR_UNITS_LUX, 1, 0},
 
-        {HID_USAGE_SENSOR_PRESSURE, 0, 100000, 0},
-        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 1, 0},
+        {HID_USAGE_SENSOR_PRESSURE, 0, 100, 0},
+        {HID_USAGE_SENSOR_PRESSURE, HID_USAGE_SENSOR_UNITS_PASCAL, 0, 1000},
 };
 
 static int pow_10(unsigned power)
diff --git a/drivers/iio/dac/stx104.c b/drivers/iio/dac/stx104.c
index 792a97164cb2..bebbd00304ce 100644
--- a/drivers/iio/dac/stx104.c
+++ b/drivers/iio/dac/stx104.c
@@ -65,6 +65,16 @@ struct stx104_gpio {
         unsigned int out_state;
 };
 
+/**
+ * struct stx104_dev - STX104 device private data structure
+ * @indio_dev:  IIO device
+ * @chip:       instance of the gpio_chip
+ */
+struct stx104_dev {
+        struct iio_dev *indio_dev;
+        struct gpio_chip *chip;
+};
+
 static int stx104_read_raw(struct iio_dev *indio_dev,
         struct iio_chan_spec const *chan, int *val, int *val2, long mask)
 {
@@ -107,6 +117,7 @@ static const struct iio_chan_spec stx104_channels[STX104_NUM_CHAN] = {
 static int stx104_gpio_get_direction(struct gpio_chip *chip,
         unsigned int offset)
 {
+        /* GPIO 0-3 are input only, while the rest are output only */
         if (offset < 4)
                 return 1;
 
@@ -169,6 +180,7 @@ static int stx104_probe(struct device *dev, unsigned int id)
         struct iio_dev *indio_dev;
         struct stx104_iio *priv;
         struct stx104_gpio *stx104gpio;
+        struct stx104_dev *stx104dev;
         int err;
 
         indio_dev = devm_iio_device_alloc(dev, sizeof(*priv));
@@ -179,6 +191,10 @@ static int stx104_probe(struct device *dev, unsigned int id)
         if (!stx104gpio)
                 return -ENOMEM;
 
+        stx104dev = devm_kzalloc(dev, sizeof(*stx104dev), GFP_KERNEL);
+        if (!stx104dev)
+                return -ENOMEM;
+
         if (!devm_request_region(dev, base[id], STX104_EXTENT,
                 dev_name(dev))) {
                 dev_err(dev, "Unable to lock port addresses (0x%X-0x%X)\n",
@@ -199,12 +215,6 @@ static int stx104_probe(struct device *dev, unsigned int id)
         outw(0, base[id] + 4);
         outw(0, base[id] + 6);
 
-        err = devm_iio_device_register(dev, indio_dev);
-        if (err) {
-                dev_err(dev, "IIO device registering failed (%d)\n", err);
-                return err;
-        }
-
         stx104gpio->chip.label = dev_name(dev);
         stx104gpio->chip.parent = dev;
         stx104gpio->chip.owner = THIS_MODULE;
@@ -220,7 +230,9 @@ static int stx104_probe(struct device *dev, unsigned int id)
 
         spin_lock_init(&stx104gpio->lock);
 
-        dev_set_drvdata(dev, stx104gpio);
+        stx104dev->indio_dev = indio_dev;
+        stx104dev->chip = &stx104gpio->chip;
+        dev_set_drvdata(dev, stx104dev);
 
         err = gpiochip_add_data(&stx104gpio->chip, stx104gpio);
         if (err) {
@@ -228,14 +240,22 @@ static int stx104_probe(struct device *dev, unsigned int id)
                 return err;
         }
 
+        err = iio_device_register(indio_dev);
+        if (err) {
+                dev_err(dev, "IIO device registering failed (%d)\n", err);
+                gpiochip_remove(&stx104gpio->chip);
+                return err;
+        }
+
         return 0;
 }
 
 static int stx104_remove(struct device *dev, unsigned int id)
 {
-        struct stx104_gpio *const stx104gpio = dev_get_drvdata(dev);
+        struct stx104_dev *const stx104dev = dev_get_drvdata(dev);
 
-        gpiochip_remove(&stx104gpio->chip);
+        iio_device_unregister(stx104dev->indio_dev);
+        gpiochip_remove(stx104dev->chip);
 
         return 0;
 }
diff --git a/drivers/iio/humidity/Kconfig b/drivers/iio/humidity/Kconfig
index 738a86d9e4a9..d04124345992 100644
--- a/drivers/iio/humidity/Kconfig
+++ b/drivers/iio/humidity/Kconfig
@@ -6,6 +6,8 @@ menu "Humidity sensors"
 config AM2315
     tristate "Aosong AM2315 relative humidity and temperature sensor"
     depends on I2C
+    select IIO_BUFFER
+    select IIO_TRIGGERED_BUFFER
     help
       If you say yes here you get support for the Aosong AM2315
       relative humidity and ambient temperature sensor.
diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c
index 3e200f69e886..ff96b6d0fdae 100644
--- a/drivers/iio/humidity/am2315.c
+++ b/drivers/iio/humidity/am2315.c
@@ -244,7 +244,7 @@ static int am2315_probe(struct i2c_client *client,
         indio_dev->channels = am2315_channels;
         indio_dev->num_channels = ARRAY_SIZE(am2315_channels);
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                                          am2315_trigger_handler, NULL);
         if (ret < 0) {
                 dev_err(&client->dev, "iio triggered buffer setup failed\n");
diff --git a/drivers/iio/humidity/hdc100x.c b/drivers/iio/humidity/hdc100x.c
index a03832a5fc95..e0c9c70c2a4a 100644
--- a/drivers/iio/humidity/hdc100x.c
+++ b/drivers/iio/humidity/hdc100x.c
@@ -142,7 +142,7 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
         struct i2c_client *client = data->client;
         int delay = data->adc_int_us[chan->address];
         int ret;
-        int val;
+        __be16 val;
 
         /* start measurement */
         ret = i2c_smbus_write_byte(client, chan->address);
@@ -154,26 +154,13 @@ static int hdc100x_get_measurement(struct hdc100x_data *data,
         /* wait for integration time to pass */
         usleep_range(delay, delay + 1000);
 
-        /*
-         * i2c_smbus_read_word_data cannot() be used here due to the command
-         * value not being understood and causes NAKs preventing any reading
-         * from being accessed.
-         */
-        ret = i2c_smbus_read_byte(client);
+        /* read measurement */
+        ret = i2c_master_recv(data->client, (char *)&val, sizeof(val));
         if (ret < 0) {
-                dev_err(&client->dev, "cannot read high byte measurement");
+                dev_err(&client->dev, "cannot read sensor data\n");
                 return ret;
         }
-        val = ret << 8;
-
-        ret = i2c_smbus_read_byte(client);
-        if (ret < 0) {
-                dev_err(&client->dev, "cannot read low byte measurement");
-                return ret;
-        }
-        val |= ret;
-
-        return val;
+        return be16_to_cpu(val);
 }
 
 static int hdc100x_get_heater_status(struct hdc100x_data *data)
@@ -272,8 +259,8 @@ static int hdc100x_probe(struct i2c_client *client,
         struct iio_dev *indio_dev;
         struct hdc100x_data *data;
 
-        if (!i2c_check_functionality(client->adapter,
-                                I2C_FUNC_SMBUS_WORD_DATA | I2C_FUNC_SMBUS_BYTE))
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_WORD_DATA |
+                                     I2C_FUNC_SMBUS_BYTE | I2C_FUNC_I2C))
                 return -EOPNOTSUPP;
 
         indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data));
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 90462fcf5436..158aaf44dd95 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -107,9 +107,10 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
 {
         struct iio_dev *indio_dev = filp->private_data;
         struct iio_buffer *rb = indio_dev->buffer;
+        DEFINE_WAIT_FUNC(wait, woken_wake_function);
         size_t datum_size;
         size_t to_wait;
-        int ret;
+        int ret = 0;
 
         if (!indio_dev->info)
                 return -ENODEV;
@@ -131,19 +132,29 @@ ssize_t iio_buffer_read_first_n_outer(struct file *filp, char __user *buf,
         else
                 to_wait = min_t(size_t, n / datum_size, rb->watermark);
 
+        add_wait_queue(&rb->pollq, &wait);
         do {
-                ret = wait_event_interruptible(rb->pollq,
-                      iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size));
-                if (ret)
-                        return ret;
+                if (!indio_dev->info) {
+                        ret = -ENODEV;
+                        break;
+                }
 
-                if (!indio_dev->info)
-                        return -ENODEV;
+                if (!iio_buffer_ready(indio_dev, rb, to_wait, n / datum_size)) {
+                        if (signal_pending(current)) {
+                                ret = -ERESTARTSYS;
+                                break;
+                        }
+
+                        wait_woken(&wait, TASK_INTERRUPTIBLE,
+                                   MAX_SCHEDULE_TIMEOUT);
+                        continue;
+                }
 
                 ret = rb->access->read_first_n(rb, n, buf);
                 if (ret == 0 && (filp->f_flags & O_NONBLOCK))
                         ret = -EAGAIN;
-         } while (ret == 0);
+        } while (ret == 0);
+        remove_wait_queue(&rb->pollq, &wait);
 
         return ret;
 }
diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
index f914d5d140e4..d2b889918c3e 100644
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -613,9 +613,8 @@ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
                         return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
         case IIO_VAL_FRACTIONAL:
                 tmp = div_s64((s64)vals[0] * 1000000000LL, vals[1]);
-                vals[1] = do_div(tmp, 1000000000LL);
-                vals[0] = tmp;
-                return sprintf(buf, "%d.%09u\n", vals[0], vals[1]);
+                vals[0] = (int)div_s64_rem(tmp, 1000000000, &vals[1]);
+                return sprintf(buf, "%d.%09u\n", vals[0], abs(vals[1]));
         case IIO_VAL_FRACTIONAL_LOG2:
                 tmp = (s64)vals[0] * 1000000000LL >> vals[1];
                 vals[1] = do_div(tmp, 1000000000LL);
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index 7c566f516572..3574945183fe 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -76,7 +76,6 @@ config BH1750
 config BH1780
         tristate "ROHM BH1780 ambient light sensor"
         depends on I2C
-        depends on !SENSORS_BH1780
         help
          Say Y here to build support for the ROHM BH1780GLI ambient
          light sensor.
@@ -238,6 +237,8 @@ config MAX44000
         tristate "MAX44000 Ambient and Infrared Proximity Sensor"
         depends on I2C
         select REGMAP_I2C
+        select IIO_BUFFER
+        select IIO_TRIGGERED_BUFFER
         help
          Say Y here if you want to build support for Maxim Integrated's
          MAX44000 ambient and infrared proximity sensor device.
diff --git a/drivers/iio/pressure/bmp280-core.c b/drivers/iio/pressure/bmp280-core.c
index 6943688e66df..e5a533cbd53f 100644
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -970,7 +970,7 @@ int bmp280_common_probe(struct device *dev,
         data->vdda = devm_regulator_get(dev, "vdda");
         if (IS_ERR(data->vdda)) {
                 dev_err(dev, "failed to get VDDA regulator\n");
-                ret = PTR_ERR(data->vddd);
+                ret = PTR_ERR(data->vdda);
                 goto out_disable_vddd;
         }
         ret = regulator_enable(data->vdda);
@@ -1079,7 +1079,8 @@ EXPORT_SYMBOL(bmp280_common_remove);
 #ifdef CONFIG_PM
 static int bmp280_runtime_suspend(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
         int ret;
 
         ret = regulator_disable(data->vdda);
@@ -1090,7 +1091,8 @@ static int bmp280_runtime_suspend(struct device *dev)
 
 static int bmp280_runtime_resume(struct device *dev)
 {
-        struct bmp280_data *data = dev_get_drvdata(dev);
+        struct iio_dev *indio_dev = dev_get_drvdata(dev);
+        struct bmp280_data *data = iio_priv(indio_dev);
         int ret;
 
         ret = regulator_enable(data->vddd);
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 2e3a70e1b245..5656deb17261 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -397,7 +397,7 @@ static int as3935_probe(struct spi_device *spi)
                 return ret;
         }
 
-        ret = iio_triggered_buffer_setup(indio_dev, NULL,
+        ret = iio_triggered_buffer_setup(indio_dev, iio_pollfunc_store_time,
                 &as3935_trigger_handler, NULL);
 
         if (ret) {
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index e6dfa1bd3def..5f65a78b27c9 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2462,18 +2462,24 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv)
 
         if (addr->dev_addr.bound_dev_if) {
                 ndev = dev_get_by_index(&init_net, addr->dev_addr.bound_dev_if);
-                if (!ndev)
-                        return -ENODEV;
+                if (!ndev) {
+                        ret = -ENODEV;
+                        goto err2;
+                }
 
                 if (ndev->flags & IFF_LOOPBACK) {
                         dev_put(ndev);
-                        if (!id_priv->id.device->get_netdev)
-                                return -EOPNOTSUPP;
+                        if (!id_priv->id.device->get_netdev) {
+                                ret = -EOPNOTSUPP;
+                                goto err2;
+                        }
 
                         ndev = id_priv->id.device->get_netdev(id_priv->id.device,
                                                               id_priv->id.port_num);
-                        if (!ndev)
-                                return -ENODEV;
+                        if (!ndev) {
+                                ret = -ENODEV;
+                                goto err2;
+                        }
                 }
 
                 route->path_rec->net = &init_net;
diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
index 3a3c5d73bbfc..51c79b2fb0b8 100644
--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -106,7 +106,6 @@ struct mcast_group {
         atomic_t                refcount;
         enum mcast_group_state  state;
         struct ib_sa_query      *query;
-        int                     query_id;
         u16                     pkey_index;
         u8                      leave_state;
         int                     retries;
@@ -340,11 +339,7 @@ static int send_join(struct mcast_group *group, struct mcast_member *member)
                                        member->multicast.comp_mask,
                                        3000, GFP_KERNEL, join_handler, group,
                                        &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static int send_leave(struct mcast_group *group, u8 leave_state)
@@ -364,11 +359,7 @@ static int send_leave(struct mcast_group *group, u8 leave_state)
                                        IB_SA_MCMEMBER_REC_JOIN_STATE,
                                        3000, GFP_KERNEL, leave_handler,
                                        group, &group->query);
-        if (ret >= 0) {
-                group->query_id = ret;
-                ret = 0;
-        }
-        return ret;
+        return (ret > 0) ? 0 : ret;
 }
 
 static void join_group(struct mcast_group *group, struct mcast_member *member,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 3aca7f6171b4..80f988984f44 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -333,6 +333,8 @@ static void remove_ep_tid(struct c4iw_ep *ep)
 
         spin_lock_irqsave(&ep->com.dev->lock, flags);
         _remove_handle(ep->com.dev, &ep->com.dev->hwtid_idr, ep->hwtid, 0);
+        if (idr_is_empty(&ep->com.dev->hwtid_idr))
+                wake_up(&ep->com.dev->wait);
         spin_unlock_irqrestore(&ep->com.dev->lock, flags);
 }
 
@@ -1827,8 +1829,12 @@ static int process_mpa_request(struct c4iw_ep *ep, struct sk_buff *skb)
                                 (ep->mpa_pkt + sizeof(*mpa));
                         ep->ird = ntohs(mpa_v2_params->ird) &
                                 MPA_V2_IRD_ORD_MASK;
+                        ep->ird = min_t(u32, ep->ird,
+                                        cur_max_read_depth(ep->com.dev));
                         ep->ord = ntohs(mpa_v2_params->ord) &
                                 MPA_V2_IRD_ORD_MASK;
+                        ep->ord = min_t(u32, ep->ord,
+                                        cur_max_read_depth(ep->com.dev));
                         PDBG("%s initiator ird %u ord %u\n", __func__, ep->ird,
                              ep->ord);
                         if (ntohs(mpa_v2_params->ird) & MPA_V2_PEER2PEER_MODEL)
@@ -2113,8 +2119,10 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
                 }
                 ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
                                         n, pdev, rt_tos2priority(tos));
-                if (!ep->l2t)
+                if (!ep->l2t) {
+                        dev_put(pdev);
                         goto out;
+                }
                 ep->mtu = pdev->mtu;
                 ep->tx_chan = cxgb4_port_chan(pdev);
                 ep->smac_idx = cxgb4_tp_smt_idx(adapter_type,
@@ -3136,7 +3144,7 @@ int c4iw_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         if (ep->mpa_attr.version == 2 && ep->mpa_attr.enhanced_rdma_conn) {
                 if (conn_param->ord > ep->ird) {
                         if (RELAXED_IRD_NEGOTIATION) {
-                                ep->ord = ep->ird;
+                                conn_param->ord = ep->ird;
                         } else {
                                 ep->ird = conn_param->ird;
                                 ep->ord = conn_param->ord;
diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c
index 812ab7278b8e..ac926c942fee 100644
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -1016,15 +1016,15 @@ int c4iw_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata)
 int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
 {
         struct c4iw_cq *chp;
-        int ret;
+        int ret = 0;
         unsigned long flag;
 
         chp = to_c4iw_cq(ibcq);
         spin_lock_irqsave(&chp->lock, flag);
-        ret = t4_arm_cq(&chp->cq,
-                        (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        t4_arm_cq(&chp->cq,
+                  (flags & IB_CQ_SOLICITED_MASK) == IB_CQ_SOLICITED);
+        if (flags & IB_CQ_REPORT_MISSED_EVENTS)
+                ret = t4_cq_notempty(&chp->cq);
         spin_unlock_irqrestore(&chp->lock, flag);
-        if (ret && !(flags & IB_CQ_REPORT_MISSED_EVENTS))
-                ret = 0;
         return ret;
 }
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c
index 071d7332ec06..3c4b2126e0d1 100644
--- a/drivers/infiniband/hw/cxgb4/device.c
+++ b/drivers/infiniband/hw/cxgb4/device.c
@@ -872,9 +872,13 @@ static void c4iw_rdev_close(struct c4iw_rdev *rdev)
 static void c4iw_dealloc(struct uld_ctx *ctx)
 {
         c4iw_rdev_close(&ctx->dev->rdev);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->cqidr));
         idr_destroy(&ctx->dev->cqidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->qpidr));
         idr_destroy(&ctx->dev->qpidr);
+        WARN_ON_ONCE(!idr_is_empty(&ctx->dev->mmidr));
         idr_destroy(&ctx->dev->mmidr);
+        wait_event(ctx->dev->wait, idr_is_empty(&ctx->dev->hwtid_idr));
         idr_destroy(&ctx->dev->hwtid_idr);
         idr_destroy(&ctx->dev->stid_idr);
         idr_destroy(&ctx->dev->atid_idr);
@@ -992,6 +996,7 @@ static struct c4iw_dev *c4iw_alloc(const struct cxgb4_lld_info *infop)
         mutex_init(&devp->rdev.stats.lock);
         mutex_init(&devp->db_mutex);
         INIT_LIST_HEAD(&devp->db_fc_list);
+        init_waitqueue_head(&devp->wait);
         devp->avail_ird = devp->rdev.lldi.max_ird_adapter;
 
         if (c4iw_debugfs_root) {
diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
index aa47e0ae80bc..4b83b84f7ddf 100644
--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
+++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h
@@ -263,6 +263,7 @@ struct c4iw_dev {
         struct idr stid_idr;
         struct list_head db_fc_list;
         u32 avail_ird;
+        wait_queue_head_t wait;
 };
 
 static inline struct c4iw_dev *to_c4iw_dev(struct ib_device *ibdev)
diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
index edb1172b6f54..690435229be7 100644
--- a/drivers/infiniband/hw/cxgb4/qp.c
+++ b/drivers/infiniband/hw/cxgb4/qp.c
@@ -683,7 +683,7 @@ static int build_inv_stag(union t4_wr *wqe, struct ib_send_wr *wr,
         return 0;
 }
 
-void _free_qp(struct kref *kref)
+static void _free_qp(struct kref *kref)
 {
         struct c4iw_qp *qhp;
 
diff --git a/drivers/infiniband/hw/cxgb4/t4.h b/drivers/infiniband/hw/cxgb4/t4.h
index 6126bbe36095..02173f4315fa 100644
--- a/drivers/infiniband/hw/cxgb4/t4.h
+++ b/drivers/infiniband/hw/cxgb4/t4.h
@@ -634,6 +634,11 @@ static inline int t4_valid_cqe(struct t4_cq *cq, struct t4_cqe *cqe)
         return (CQE_GENBIT(cqe) == cq->gen);
 }
 
+static inline int t4_cq_notempty(struct t4_cq *cq)
+{
+        return cq->sw_in_use || t4_valid_cqe(cq, &cq->queue[cq->cidx]);
+}
+
 static inline int t4_next_hw_cqe(struct t4_cq *cq, struct t4_cqe **cqe)
 {
         int ret;
diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c
index 79575ee873f2..0566393e5aba 100644
--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@@ -47,7 +47,6 @@
 #include <linux/topology.h>
 #include <linux/cpumask.h>
 #include <linux/module.h>
-#include <linux/cpumask.h>
 
 #include "hfi.h"
 #include "affinity.h"
@@ -682,7 +681,7 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
                            size_t count)
 {
         struct hfi1_affinity_node *entry;
-        struct cpumask mask;
+        cpumask_var_t mask;
         int ret, i;
 
         spin_lock(&node_affinity.lock);
@@ -692,19 +691,24 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
         if (!entry)
                 return -EINVAL;
 
-        ret = cpulist_parse(buf, &mask);
+        ret = zalloc_cpumask_var(&mask, GFP_KERNEL);
+        if (!ret)
+                return -ENOMEM;
+
+        ret = cpulist_parse(buf, mask);
         if (ret)
-                return ret;
+                goto out;
 
-        if (!cpumask_subset(&mask, cpu_online_mask) || cpumask_empty(&mask)) {
+        if (!cpumask_subset(mask, cpu_online_mask) || cpumask_empty(mask)) {
                 dd_dev_warn(dd, "Invalid CPU mask\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         mutex_lock(&sdma_affinity_mutex);
         /* reset the SDMA interrupt affinity details */
         init_cpu_mask_set(&entry->def_intr);
-        cpumask_copy(&entry->def_intr.mask, &mask);
+        cpumask_copy(&entry->def_intr.mask, mask);
         /*
          * Reassign the affinity for each SDMA interrupt.
          */
@@ -720,8 +724,9 @@ int hfi1_set_sdma_affinity(struct hfi1_devdata *dd, const char *buf,
                 if (ret)
                         break;
         }
-
         mutex_unlock(&sdma_affinity_mutex);
+out:
+        free_cpumask_var(mask);
         return ret ? ret : strnlen(buf, PAGE_SIZE);
 }
 
diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
index b32638d58ae8..cc38004cea42 100644
--- a/drivers/infiniband/hw/hfi1/chip.c
+++ b/drivers/infiniband/hw/hfi1/chip.c
@@ -9490,6 +9490,78 @@ static void init_lcb(struct hfi1_devdata *dd)
         write_csr(dd, DC_LCB_CFG_TX_FIFOS_RESET, 0x00);
 }
 
+/*
+ * Perform a test read on the QSFP.  Return 0 on success, -ERRNO
+ * on error.
+ */
+static int test_qsfp_read(struct hfi1_pportdata *ppd)
+{
+        int ret;
+        u8 status;
+
+        /* report success if not a QSFP */
+        if (ppd->port_type != PORT_TYPE_QSFP)
+                return 0;
+
+        /* read byte 2, the status byte */
+        ret = one_qsfp_read(ppd, ppd->dd->hfi1_id, 2, &status, 1);
+        if (ret < 0)
+                return ret;
+        if (ret != 1)
+                return -EIO;
+
+        return 0; /* success */
+}
+
+/*
+ * Values for QSFP retry.
+ *
+ * Give up after 10s (20 x 500ms).  The overall timeout was empirically
+ * arrived at from experience on a large cluster.
+ */
+#define MAX_QSFP_RETRIES 20
+#define QSFP_RETRY_WAIT 500 /* msec */
+
+/*
+ * Try a QSFP read.  If it fails, schedule a retry for later.
+ * Called on first link activation after driver load.
+ */
+static void try_start_link(struct hfi1_pportdata *ppd)
+{
+        if (test_qsfp_read(ppd)) {
+                /* read failed */
+                if (ppd->qsfp_retry_count >= MAX_QSFP_RETRIES) {
+                        dd_dev_err(ppd->dd, "QSFP not responding, giving up\n");
+                        return;
+                }
+                dd_dev_info(ppd->dd,
+                            "QSFP not responding, waiting and retrying %d\n",
+                            (int)ppd->qsfp_retry_count);
+                ppd->qsfp_retry_count++;
+                queue_delayed_work(ppd->hfi1_wq, &ppd->start_link_work,
+                                   msecs_to_jiffies(QSFP_RETRY_WAIT));
+                return;
+        }
+        ppd->qsfp_retry_count = 0;
+
+        /*
+         * Tune the SerDes to a ballpark setting for optimal signal and bit
+         * error rate.  Needs to be done before starting the link.
+         */
+        tune_serdes(ppd);
+        start_link(ppd);
+}
+
+/*
+ * Workqueue function to start the link after a delay.
+ */
+void handle_start_link(struct work_struct *work)
+{
+        struct hfi1_pportdata *ppd = container_of(work, struct hfi1_pportdata,
+                                                  start_link_work.work);
+        try_start_link(ppd);
+}
+
 int bringup_serdes(struct hfi1_pportdata *ppd)
 {
         struct hfi1_devdata *dd = ppd->dd;
@@ -9525,14 +9597,8 @@ int bringup_serdes(struct hfi1_pportdata *ppd)
                 set_qsfp_int_n(ppd, 1);
         }
 
-        /*
-         * Tune the SerDes to a ballpark setting for
-         * optimal signal and bit error rate
-         * Needs to be done before starting the link
-         */
-        tune_serdes(ppd);
-
-        return start_link(ppd);
+        try_start_link(ppd);
+        return 0;
 }
 
 void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
@@ -9549,6 +9615,10 @@ void hfi1_quiet_serdes(struct hfi1_pportdata *ppd)
         ppd->driver_link_ready = 0;
         ppd->link_enabled = 0;
 
+        ppd->qsfp_retry_count = MAX_QSFP_RETRIES; /* prevent more retries */
+        flush_delayed_work(&ppd->start_link_work);
+        cancel_delayed_work_sync(&ppd->start_link_work);
+
         ppd->offline_disabled_reason =
                         HFI1_ODR_MASK(OPA_LINKDOWN_REASON_SMA_DISABLED);
         set_link_down_reason(ppd, OPA_LINKDOWN_REASON_SMA_DISABLED, 0,
@@ -12865,7 +12935,7 @@ fail:
  */
 static int set_up_context_variables(struct hfi1_devdata *dd)
 {
-        int num_kernel_contexts;
+        unsigned long num_kernel_contexts;
         int total_contexts;
         int ret;
         unsigned ngroups;
@@ -12894,9 +12964,9 @@ static int set_up_context_variables(struct hfi1_devdata *dd)
          */
         if (num_kernel_contexts > (dd->chip_send_contexts - num_vls - 1)) {
                 dd_dev_err(dd,
-                           "Reducing # kernel rcv contexts to: %d, from %d\n",
+                           "Reducing # kernel rcv contexts to: %d, from %lu\n",
                            (int)(dd->chip_send_contexts - num_vls - 1),
-                           (int)num_kernel_contexts);
+                           num_kernel_contexts);
                 num_kernel_contexts = dd->chip_send_contexts - num_vls - 1;
         }
         /*
diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
index ed11107c50fe..e29573769efc 100644
--- a/drivers/infiniband/hw/hfi1/chip.h
+++ b/drivers/infiniband/hw/hfi1/chip.h
@@ -706,6 +706,7 @@ void handle_link_up(struct work_struct *work);
 void handle_link_down(struct work_struct *work);
 void handle_link_downgrade(struct work_struct *work);
 void handle_link_bounce(struct work_struct *work);
+void handle_start_link(struct work_struct *work);
 void handle_sma_message(struct work_struct *work);
 void reset_qsfp(struct hfi1_pportdata *ppd);
 void qsfp_event(struct work_struct *work);
diff --git a/drivers/infiniband/hw/hfi1/debugfs.c b/drivers/infiniband/hw/hfi1/debugfs.c
index dbab9d9cc288..5e9be16f6cd3 100644
--- a/drivers/infiniband/hw/hfi1/debugfs.c
+++ b/drivers/infiniband/hw/hfi1/debugfs.c
@@ -59,6 +59,40 @@
 
 static struct dentry *hfi1_dbg_root;
 
+/* wrappers to enforce srcu in seq file */
+static ssize_t hfi1_seq_read(
+        struct file *file,
+        char __user *buf,
+        size_t size,
+        loff_t *ppos)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        ssize_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_read(file, buf, size, ppos);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
+static loff_t hfi1_seq_lseek(
+        struct file *file,
+        loff_t offset,
+        int whence)
+{
+        struct dentry *d = file->f_path.dentry;
+        int srcu_idx;
+        loff_t r;
+
+        r = debugfs_use_file_start(d, &srcu_idx);
+        if (likely(!r))
+                r = seq_lseek(file, offset, whence);
+        debugfs_use_file_finish(srcu_idx);
+        return r;
+}
+
 #define private2dd(file) (file_inode(file)->i_private)
 #define private2ppd(file) (file_inode(file)->i_private)
 
@@ -87,8 +121,8 @@ static int _##name##_open(struct inode *inode, struct file *s) \
 static const struct file_operations _##name##_file_ops = { \
         .owner   = THIS_MODULE, \
         .open    = _##name##_open, \
-        .read    = seq_read, \
-        .llseek  = seq_lseek, \
+        .read    = hfi1_seq_read, \
+        .llseek  = hfi1_seq_lseek, \
         .release = seq_release \
 }
 
@@ -105,11 +139,9 @@ do { \
         DEBUGFS_FILE_CREATE(#name, parent, data, &_##name##_file_ops, S_IRUGO)
 
 static void *_opcode_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_opcode_stats_perctx *opstats;
 
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(opstats->stats))
                 return NULL;
         return pos;
@@ -126,9 +158,7 @@ static void *_opcode_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _opcode_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _opcode_stats_seq_show(struct seq_file *s, void *v)
@@ -223,28 +253,32 @@ DEBUGFS_SEQ_FILE_OPEN(ctx_stats)
 DEBUGFS_FILE_OPS(ctx_stats);
 
 static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
+        __acquires(RCU)
 {
         struct qp_iter *iter;
         loff_t n = *pos;
 
-        rcu_read_lock();
         iter = qp_iter_init(s->private);
+
+        /* stop calls rcu_read_unlock */
+        rcu_read_lock();
+
         if (!iter)
                 return NULL;
 
-        while (n--) {
+        do {
                 if (qp_iter_next(iter)) {
                         kfree(iter);
                         return NULL;
                 }
-        }
+        } while (n--);
 
         return iter;
 }
 
 static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
                                 loff_t *pos)
+        __must_hold(RCU)
 {
         struct qp_iter *iter = iter_ptr;
 
@@ -259,7 +293,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 }
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
-__releases(RCU)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
@@ -281,12 +315,10 @@ DEBUGFS_SEQ_FILE_OPEN(qp_stats)
 DEBUGFS_FILE_OPS(qp_stats);
 
 static void *_sdes_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
         struct hfi1_ibdev *ibd;
         struct hfi1_devdata *dd;
 
-        rcu_read_lock();
         ibd = (struct hfi1_ibdev *)s->private;
         dd = dd_from_dev(ibd);
         if (!dd->per_sdma || *pos >= dd->num_sdma)
@@ -306,9 +338,7 @@ static void *_sdes_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _sdes_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _sdes_seq_show(struct seq_file *s, void *v)
@@ -335,11 +365,9 @@ static ssize_t dev_counters_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, NULL, &counters);
         rval =  simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -352,11 +380,9 @@ static ssize_t dev_names_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_cntrs(dd, &names, NULL);
         rval =  simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -379,11 +405,9 @@ static ssize_t portnames_read(struct file *file, char __user *buf,
         struct hfi1_devdata *dd;
         ssize_t rval;
 
-        rcu_read_lock();
         dd = private2dd(file);
         avail = hfi1_read_portcntrs(dd->pport, &names, NULL);
         rval = simple_read_from_buffer(buf, count, ppos, names, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -396,11 +420,9 @@ static ssize_t portcntrs_debugfs_read(struct file *file, char __user *buf,
         struct hfi1_pportdata *ppd;
         ssize_t rval;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         avail = hfi1_read_portcntrs(ppd, NULL, &counters);
         rval = simple_read_from_buffer(buf, count, ppos, counters, avail);
-        rcu_read_unlock();
         return rval;
 }
 
@@ -430,16 +452,13 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         int used;
         int i;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
         size = PAGE_SIZE;
         used = 0;
         tmp = kmalloc(size, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         scratch0 = read_csr(dd, ASIC_CFG_SCRATCH);
         used += scnprintf(tmp + used, size - used,
@@ -466,7 +485,6 @@ static ssize_t asic_flags_read(struct file *file, char __user *buf,
         used += scnprintf(tmp + used, size - used, "Write bits to clear\n");
 
         ret = simple_read_from_buffer(buf, count, ppos, tmp, used);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -482,15 +500,12 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
         u64 scratch0;
         u64 clear;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         dd = ppd->dd;
 
         buff = kmalloc(count + 1, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto do_return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -523,8 +538,6 @@ static ssize_t asic_flags_write(struct file *file, const char __user *buf,
 
  do_free:
         kfree(buff);
- do_return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -538,18 +551,14 @@ static ssize_t qsfp_debugfs_dump(struct file *file, char __user *buf,
         char *tmp;
         int ret;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
         tmp = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!tmp) {
-                rcu_read_unlock();
+        if (!tmp)
                 return -ENOMEM;
-        }
 
         ret = qsfp_dump(ppd, tmp, PAGE_SIZE);
         if (ret > 0)
                 ret = simple_read_from_buffer(buf, count, ppos, tmp, ret);
-        rcu_read_unlock();
         kfree(tmp);
         return ret;
 }
@@ -565,7 +574,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         int offset;
         int total_written;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -573,16 +581,12 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
@@ -602,8 +606,6 @@ static ssize_t __i2c_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -632,7 +634,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         int offset;
         int total_read;
 
-        rcu_read_lock();
         ppd = private2ppd(file);
 
         /* byte offset format: [offsetSize][i2cAddr][offsetHigh][offsetLow] */
@@ -640,16 +641,12 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
         offset = *ppos & 0xffff;
 
         /* explicitly reject invalid address 0 to catch cp and cat */
-        if (i2c_addr == 0) {
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (i2c_addr == 0)
+                return -EINVAL;
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         total_read = i2c_read(ppd, target, i2c_addr, offset, buff, count);
         if (total_read < 0) {
@@ -669,8 +666,6 @@ static ssize_t __i2c_debugfs_read(struct file *file, char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -697,26 +692,20 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
         int ret;
         int total_written;
 
-        rcu_read_lock();
-        if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
-                ret = -EINVAL;
-                goto _return;
-        }
+        if (*ppos + count > QSFP_PAGESIZE * 4) /* base page + page00-page03 */
+                return -EINVAL;
 
         ppd = private2ppd(file);
 
         buff = kmalloc(count, GFP_KERNEL);
-        if (!buff) {
-                ret = -ENOMEM;
-                goto _return;
-        }
+        if (!buff)
+                return -ENOMEM;
 
         ret = copy_from_user(buff, buf, count);
         if (ret > 0) {
                 ret = -EFAULT;
                 goto _free;
         }
-
         total_written = qsfp_write(ppd, target, *ppos, buff, count);
         if (total_written < 0) {
                 ret = total_written;
@@ -729,8 +718,6 @@ static ssize_t __qsfp_debugfs_write(struct file *file, const char __user *buf,
 
  _free:
         kfree(buff);
- _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -757,7 +744,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
         int ret;
         int total_read;
 
-        rcu_read_lock();
         if (*ppos + count > QSFP_PAGESIZE * 4) { /* base page + page00-page03 */
                 ret = -EINVAL;
                 goto _return;
@@ -790,7 +776,6 @@ static ssize_t __qsfp_debugfs_read(struct file *file, char __user *buf,
  _free:
         kfree(buff);
  _return:
-        rcu_read_unlock();
         return ret;
 }
 
@@ -1006,7 +991,6 @@ void hfi1_dbg_ibdev_exit(struct hfi1_ibdev *ibd)
         debugfs_remove_recursive(ibd->hfi1_ibdev_dbg);
 out:
         ibd->hfi1_ibdev_dbg = NULL;
-        synchronize_rcu();
 }
 
 /*
@@ -1031,9 +1015,7 @@ static const char * const hfi1_statnames[] = {
 };
 
 static void *_driver_stats_names_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1051,9 +1033,7 @@ static void *_driver_stats_names_seq_next(
 }
 
 static void _driver_stats_names_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static int _driver_stats_names_seq_show(struct seq_file *s, void *v)
@@ -1069,9 +1049,7 @@ DEBUGFS_SEQ_FILE_OPEN(driver_stats_names)
 DEBUGFS_FILE_OPS(driver_stats_names);
 
 static void *_driver_stats_seq_start(struct seq_file *s, loff_t *pos)
-__acquires(RCU)
 {
-        rcu_read_lock();
         if (*pos >= ARRAY_SIZE(hfi1_statnames))
                 return NULL;
         return pos;
@@ -1086,9 +1064,7 @@ static void *_driver_stats_seq_next(struct seq_file *s, void *v, loff_t *pos)
 }
 
 static void _driver_stats_seq_stop(struct seq_file *s, void *v)
-__releases(RCU)
 {
-        rcu_read_unlock();
 }
 
 static u64 hfi1_sps_ints(void)
diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
index 8246dc7d0573..303f10555729 100644
--- a/drivers/infiniband/hw/hfi1/driver.c
+++ b/drivers/infiniband/hw/hfi1/driver.c
@@ -888,14 +888,15 @@ void set_all_slowpath(struct hfi1_devdata *dd)
 }
 
 static inline int set_armed_to_active(struct hfi1_ctxtdata *rcd,
-                                      struct hfi1_packet packet,
+                                      struct hfi1_packet *packet,
                                       struct hfi1_devdata *dd)
 {
         struct work_struct *lsaw = &rcd->ppd->linkstate_active_work;
-        struct hfi1_message_header *hdr = hfi1_get_msgheader(packet.rcd->dd,
-                                                             packet.rhf_addr);
+        struct hfi1_message_header *hdr = hfi1_get_msgheader(packet->rcd->dd,
+                                                             packet->rhf_addr);
+        u8 etype = rhf_rcv_type(packet->rhf);
 
-        if (hdr2sc(hdr, packet.rhf) != 0xf) {
+        if (etype == RHF_RCV_TYPE_IB && hdr2sc(hdr, packet->rhf) != 0xf) {
                 int hwstate = read_logical_state(dd);
 
                 if (hwstate != LSTATE_ACTIVE) {
@@ -979,7 +980,7 @@ int handle_receive_interrupt(struct hfi1_ctxtdata *rcd, int thread)
                         /* Auto activate link on non-SC15 packet receive */
                         if (unlikely(rcd->ppd->host_link_state ==
                                      HLS_UP_ARMED) &&
-                            set_armed_to_active(rcd, packet, dd))
+                            set_armed_to_active(rcd, &packet, dd))
                                 goto bail;
                         last = process_rcv_packet(&packet, thread);
                 }
diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
index 1ecbec192358..7e03ccd2554d 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
@@ -183,6 +183,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp)
         if (fd) {
                 fd->rec_cpu_num = -1; /* no cpu affinity by default */
                 fd->mm = current->mm;
+                atomic_inc(&fd->mm->mm_count);
         }
 
         fp->private_data = fd;
@@ -222,7 +223,7 @@ static long hfi1_file_ioctl(struct file *fp, unsigned int cmd,
                 ret = assign_ctxt(fp, &uinfo);
                 if (ret < 0)
                         return ret;
-                setup_ctxt(fp);
+                ret = setup_ctxt(fp);
                 if (ret)
                         return ret;
                 ret = user_init(fp);
@@ -779,6 +780,7 @@ static int hfi1_file_close(struct inode *inode, struct file *fp)
         mutex_unlock(&hfi1_mutex);
         hfi1_free_ctxtdata(dd, uctxt);
 done:
+        mmdrop(fdata->mm);
         kobject_put(&dd->kobj);
         kfree(fdata);
         return 0;
diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
index 1000e0fd96d9..325ec211370f 100644
--- a/drivers/infiniband/hw/hfi1/hfi.h
+++ b/drivers/infiniband/hw/hfi1/hfi.h
@@ -605,6 +605,7 @@ struct hfi1_pportdata {
         struct work_struct freeze_work;
         struct work_struct link_downgrade_work;
         struct work_struct link_bounce_work;
+        struct delayed_work start_link_work;
         /* host link state variables */
         struct mutex hls_lock;
         u32 host_link_state;
@@ -659,6 +660,7 @@ struct hfi1_pportdata {
         u8 linkinit_reason;
         u8 local_tx_rate;       /* rate given to 8051 firmware */
         u8 last_pstate;         /* info only */
+        u8 qsfp_retry_count;
 
         /* placeholders for IB MAD packet settings */
         u8 overrun_threshold;
@@ -1272,9 +1274,26 @@ static inline int hdr2sc(struct hfi1_message_header *hdr, u64 rhf)
                ((!!(rhf_dc_info(rhf))) << 4);
 }
 
+#define HFI1_JKEY_WIDTH       16
+#define HFI1_JKEY_MASK        (BIT(16) - 1)
+#define HFI1_ADMIN_JKEY_RANGE 32
+
+/*
+ * J_KEYs are split and allocated in the following groups:
+ *   0 - 31    - users with administrator privileges
+ *  32 - 63    - kernel protocols using KDETH packets
+ *  64 - 65535 - all other users using KDETH packets
+ */
 static inline u16 generate_jkey(kuid_t uid)
 {
-        return from_kuid(current_user_ns(), uid) & 0xffff;
+        u16 jkey = from_kuid(current_user_ns(), uid) & HFI1_JKEY_MASK;
+
+        if (capable(CAP_SYS_ADMIN))
+                jkey &= HFI1_ADMIN_JKEY_RANGE - 1;
+        else if (jkey < 64)
+                jkey |= BIT(HFI1_JKEY_WIDTH - 1);
+
+        return jkey;
 }
 
 /*
@@ -1656,7 +1675,6 @@ struct cc_state *get_cc_state_protected(struct hfi1_pportdata *ppd)
 struct hfi1_devdata *hfi1_init_dd(struct pci_dev *,
                                   const struct pci_device_id *);
 void hfi1_free_devdata(struct hfi1_devdata *);
-void cc_state_reclaim(struct rcu_head *rcu);
 struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra);
 
 /* LED beaconing functions */
@@ -1788,7 +1806,7 @@ extern unsigned int hfi1_max_mtu;
 extern unsigned int hfi1_cu;
 extern unsigned int user_credit_return_threshold;
 extern int num_user_contexts;
-extern unsigned n_krcvqs;
+extern unsigned long n_krcvqs;
 extern uint krcvqs[];
 extern int krcvqsset;
 extern uint kdeth_qp;
diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c
index a358d23ecd54..384b43d2fd49 100644
--- a/drivers/infiniband/hw/hfi1/init.c
+++ b/drivers/infiniband/hw/hfi1/init.c
@@ -94,7 +94,7 @@ module_param_array(krcvqs, uint, &krcvqsset, S_IRUGO);
 MODULE_PARM_DESC(krcvqs, "Array of the number of non-control kernel receive queues by VL");
 
 /* computed based on above array */
-unsigned n_krcvqs;
+unsigned long n_krcvqs;
 
 static unsigned hfi1_rcvarr_split = 25;
 module_param_named(rcvarr_split, hfi1_rcvarr_split, uint, S_IRUGO);
@@ -500,6 +500,7 @@ void hfi1_init_pportdata(struct pci_dev *pdev, struct hfi1_pportdata *ppd,
         INIT_WORK(&ppd->link_downgrade_work, handle_link_downgrade);
         INIT_WORK(&ppd->sma_message_work, handle_sma_message);
         INIT_WORK(&ppd->link_bounce_work, handle_link_bounce);
+        INIT_DELAYED_WORK(&ppd->start_link_work, handle_start_link);
         INIT_WORK(&ppd->linkstate_active_work, receive_interrupt_work);
         INIT_WORK(&ppd->qsfp_info.qsfp_work, qsfp_event);
 
@@ -1333,7 +1334,7 @@ static void cleanup_device_data(struct hfi1_devdata *dd)
                 spin_unlock(&ppd->cc_state_lock);
 
                 if (cc_state)
-                        call_rcu(&cc_state->rcu, cc_state_reclaim);
+                        kfree_rcu(cc_state, rcu);
         }
 
         free_credit_return(dd);
diff --git a/drivers/infiniband/hw/hfi1/mad.c b/drivers/infiniband/hw/hfi1/mad.c
index 1263abe01999..7ffc14f21523 100644
--- a/drivers/infiniband/hw/hfi1/mad.c
+++ b/drivers/infiniband/hw/hfi1/mad.c
@@ -1819,6 +1819,11 @@ static int __subn_get_opa_cable_info(struct opa_smp *smp, u32 am, u8 *data,
         u32 len = OPA_AM_CI_LEN(am) + 1;
         int ret;
 
+        if (dd->pport->port_type != PORT_TYPE_QSFP) {
+                smp->status |= IB_SMP_INVALID_FIELD;
+                return reply((struct ib_mad_hdr *)smp);
+        }
+
 #define __CI_PAGE_SIZE BIT(7) /* 128 bytes */
 #define __CI_PAGE_MASK ~(__CI_PAGE_SIZE - 1)
 #define __CI_PAGE_NUM(a) ((a) & __CI_PAGE_MASK)
@@ -2599,7 +2604,7 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
         u8 lq, num_vls;
         u8 res_lli, res_ler;
         u64 port_mask;
-        unsigned long port_num;
+        u8 port_num;
         unsigned long vl;
         u32 vl_select_mask;
         int vfi;
@@ -2633,9 +2638,9 @@ static int pma_get_opa_datacounters(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
-        if ((u8)port_num != port) {
+        if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
                 return reply((struct ib_mad_hdr *)pmp);
         }
@@ -2837,7 +2842,7 @@ static int pma_get_opa_porterrors(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3010,7 +3015,7 @@ static int pma_get_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3247,7 +3252,7 @@ static int pma_set_opa_errorinfo(struct opa_pma_mad *pmp,
          */
         port_mask = be64_to_cpu(req->port_select_mask[3]);
         port_num = find_first_bit((unsigned long *)&port_mask,
-                                  sizeof(port_mask));
+                                  sizeof(port_mask) * 8);
 
         if (port_num != port) {
                 pmp->mad_hdr.status |= IB_SMP_INVALID_FIELD;
@@ -3398,7 +3403,7 @@ static void apply_cc_state(struct hfi1_pportdata *ppd)
 
         spin_unlock(&ppd->cc_state_lock);
 
-        call_rcu(&old_cc_state->rcu, cc_state_reclaim);
+        kfree_rcu(old_cc_state, rcu);
 }
 
 static int __subn_set_opa_cong_setting(struct opa_smp *smp, u32 am, u8 *data,
@@ -3553,13 +3558,6 @@ static int __subn_get_opa_cc_table(struct opa_smp *smp, u32 am, u8 *data,
         return reply((struct ib_mad_hdr *)smp);
 }
 
-void cc_state_reclaim(struct rcu_head *rcu)
-{
-        struct cc_state *cc_state = container_of(rcu, struct cc_state, rcu);
-
-        kfree(cc_state);
-}
-
 static int __subn_set_opa_cc_table(struct opa_smp *smp, u32 am, u8 *data,
                                    struct ib_device *ibdev, u8 port,
                                    u32 *resp_len)
diff --git a/drivers/infiniband/hw/hfi1/pio_copy.c b/drivers/infiniband/hw/hfi1/pio_copy.c
index 8c25e1b58849..3a1ef3056282 100644
--- a/drivers/infiniband/hw/hfi1/pio_copy.c
+++ b/drivers/infiniband/hw/hfi1/pio_copy.c
@@ -771,6 +771,9 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_extra_bytes(pbuf, from, to_fill);
                         from += to_fill;
                         nbytes -= to_fill;
+                        /* may not be enough valid bytes left to align */
+                        if (extra > nbytes)
+                                extra = nbytes;
 
                         /* ...now write carry */
                         dest = pbuf->start + (pbuf->qw_written * sizeof(u64));
@@ -798,6 +801,15 @@ void seg_pio_copy_mid(struct pio_buf *pbuf, const void *from, size_t nbytes)
                         read_low_bytes(pbuf, from, extra);
                         from += extra;
                         nbytes -= extra;
+                        /*
+                         * If no bytes are left, return early - we are done.
+                         * NOTE: This short-circuit is *required* because
+                         * "extra" may have been reduced in size and "from"
+                         * is not aligned, as required when leaving this
+                         * if block.
+                         */
+                        if (nbytes == 0)
+                                return;
                 }
 
                 /* at this point, from is QW aligned */
diff --git a/drivers/infiniband/hw/hfi1/qp.c b/drivers/infiniband/hw/hfi1/qp.c
index a5aa3517e7d5..4e4d8317c281 100644
--- a/drivers/infiniband/hw/hfi1/qp.c
+++ b/drivers/infiniband/hw/hfi1/qp.c
@@ -656,10 +656,6 @@ struct qp_iter *qp_iter_init(struct hfi1_ibdev *dev)
 
         iter->dev = dev;
         iter->specials = dev->rdi.ibdev.phys_port_cnt * 2;
-        if (qp_iter_next(iter)) {
-                kfree(iter);
-                return NULL;
-        }
 
         return iter;
 }
diff --git a/drivers/infiniband/hw/hfi1/qsfp.c b/drivers/infiniband/hw/hfi1/qsfp.c
index a207717ade2a..4e95ad810847 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.c
+++ b/drivers/infiniband/hw/hfi1/qsfp.c
@@ -706,8 +706,8 @@ int get_cable_info(struct hfi1_devdata *dd, u32 port_num, u32 addr, u32 len,
                    u8 *data)
 {
         struct hfi1_pportdata *ppd;
-        u32 excess_len = 0;
-        int ret = 0;
+        u32 excess_len = len;
+        int ret = 0, offset = 0;
 
         if (port_num > dd->num_pports || port_num < 1) {
                 dd_dev_info(dd, "%s: Invalid port number %d\n",
@@ -740,6 +740,34 @@ int get_cable_info(struct hfi1_devdata *dd, u32 port_num, u32 addr, u32 len,
         }
 
         memcpy(data, &ppd->qsfp_info.cache[addr], len);
+
+        if (addr <= QSFP_MONITOR_VAL_END &&
+            (addr + len) >= QSFP_MONITOR_VAL_START) {
+                /* Overlap with the dynamic channel monitor range */
+                if (addr < QSFP_MONITOR_VAL_START) {
+                        if (addr + len <= QSFP_MONITOR_VAL_END)
+                                len = addr + len - QSFP_MONITOR_VAL_START;
+                        else
+                                len = QSFP_MONITOR_RANGE;
+                        offset = QSFP_MONITOR_VAL_START - addr;
+                        addr = QSFP_MONITOR_VAL_START;
+                } else if (addr == QSFP_MONITOR_VAL_START) {
+                        offset = 0;
+                        if (addr + len > QSFP_MONITOR_VAL_END)
+                                len = QSFP_MONITOR_RANGE;
+                } else {
+                        offset = 0;
+                        if (addr + len > QSFP_MONITOR_VAL_END)
+                                len = QSFP_MONITOR_VAL_END - addr + 1;
+                }
+                /* Refresh the values of the dynamic monitors from the cable */
+                ret = one_qsfp_read(ppd, dd->hfi1_id, addr, data + offset, len);
+                if (ret != len) {
+                        ret = -EAGAIN;
+                        goto set_zeroes;
+                }
+        }
+
         return 0;
 
 set_zeroes:
diff --git a/drivers/infiniband/hw/hfi1/qsfp.h b/drivers/infiniband/hw/hfi1/qsfp.h
index 69275ebd9597..36cf52359848 100644
--- a/drivers/infiniband/hw/hfi1/qsfp.h
+++ b/drivers/infiniband/hw/hfi1/qsfp.h
@@ -74,6 +74,9 @@
 /* Defined fields that Intel requires of qualified cables */
 /* Byte 0 is Identifier, not checked */
 /* Byte 1 is reserved "status MSB" */
+#define QSFP_MONITOR_VAL_START 22
+#define QSFP_MONITOR_VAL_END 81
+#define QSFP_MONITOR_RANGE (QSFP_MONITOR_VAL_END - QSFP_MONITOR_VAL_START + 1)
 #define QSFP_TX_CTRL_BYTE_OFFS 86
 #define QSFP_PWR_CTRL_BYTE_OFFS 93
 #define QSFP_CDR_CTRL_BYTE_OFFS 98
diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
index 0ecf27903dc2..1694037d1eee 100644
--- a/drivers/infiniband/hw/hfi1/user_sdma.c
+++ b/drivers/infiniband/hw/hfi1/user_sdma.c
@@ -114,6 +114,8 @@ MODULE_PARM_DESC(sdma_comp_size, "Size of User SDMA completion ring. Default: 12
 #define KDETH_HCRC_LOWER_SHIFT    24
 #define KDETH_HCRC_LOWER_MASK     0xff
 
+#define AHG_KDETH_INTR_SHIFT 12
+
 #define PBC2LRH(x) ((((x) & 0xfff) << 2) - 4)
 #define LRH2PBC(x) ((((x) >> 2) + 1) & 0xfff)
 
@@ -1480,7 +1482,8 @@ static int set_txreq_header_ahg(struct user_sdma_request *req,
                 /* Clear KDETH.SH on last packet */
                 if (unlikely(tx->flags & TXREQ_FLAGS_REQ_LAST_PKT)) {
                         val |= cpu_to_le16(KDETH_GET(hdr->kdeth.ver_tid_offset,
-                                                                INTR) >> 16);
+                                                     INTR) <<
+                                           AHG_KDETH_INTR_SHIFT);
                         val &= cpu_to_le16(~(1U << 13));
                         AHG_HEADER_SET(req->ahg, diff, 7, 16, 14, val);
                 } else {
diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h
index b738acdb9b02..8ec09e470f84 100644
--- a/drivers/infiniband/hw/i40iw/i40iw.h
+++ b/drivers/infiniband/hw/i40iw/i40iw.h
@@ -232,7 +232,7 @@ struct i40iw_device {
         struct i40e_client *client;
         struct i40iw_hw hw;
         struct i40iw_cm_core cm_core;
-        unsigned long *mem_resources;
+        u8 *mem_resources;
         unsigned long *allocated_qps;
         unsigned long *allocated_cqs;
         unsigned long *allocated_mrs;
@@ -435,8 +435,8 @@ static inline int i40iw_alloc_resource(struct i40iw_device *iwdev,
         *next = resource_num + 1;
         if (*next == max_resources)
                 *next = 0;
-        spin_unlock_irqrestore(&iwdev->resource_lock, flags);
         *req_resource_num = resource_num;
+        spin_unlock_irqrestore(&iwdev->resource_lock, flags);
 
         return 0;
 }
diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index 5026dc79978a..7ca0638579c0 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -535,8 +535,8 @@ static struct i40iw_puda_buf *i40iw_form_cm_frame(struct i40iw_cm_node *cm_node,
                 buf += hdr_len;
         }
 
-        if (pd_len)
-                memcpy(buf, pdata->addr, pd_len);
+        if (pdata && pdata->addr)
+                memcpy(buf, pdata->addr, pdata->size);
 
         atomic_set(&sqbuf->refcount, 1);
 
@@ -3347,26 +3347,6 @@ int i40iw_cm_disconn(struct i40iw_qp *iwqp)
 }
 
 /**
- * i40iw_loopback_nop - Send a nop
- * @qp: associated hw qp
- */
-static void i40iw_loopback_nop(struct i40iw_sc_qp *qp)
-{
-        u64 *wqe;
-        u64 header;
-
-        wqe = qp->qp_uk.sq_base->elem;
-        set_64bit_val(wqe, 0, 0);
-        set_64bit_val(wqe, 8, 0);
-        set_64bit_val(wqe, 16, 0);
-
-        header = LS_64(I40IWQP_OP_NOP, I40IWQPSQ_OPCODE) |
-            LS_64(0, I40IWQPSQ_SIGCOMPL) |
-            LS_64(qp->qp_uk.swqe_polarity, I40IWQPSQ_VALID);
-        set_64bit_val(wqe, 24, header);
-}
-
-/**
  * i40iw_qp_disconnect - free qp and close cm
  * @iwqp: associate qp for the connection
  */
@@ -3638,7 +3618,7 @@ int i40iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
         } else {
                 if (iwqp->page)
                         iwqp->sc_qp.qp_uk.sq_base = kmap(iwqp->page);
-                i40iw_loopback_nop(&iwqp->sc_qp);
+                dev->iw_priv_qp_ops->qp_send_lsmm(&iwqp->sc_qp, NULL, 0, 0);
         }
 
         if (iwqp->page)
diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c
index 3ee0cad96bc6..0c92a40b3e86 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c
@@ -265,6 +265,7 @@ void i40iw_next_iw_state(struct i40iw_qp *iwqp,
                 info.dont_send_fin = false;
         if (iwqp->sc_qp.term_flags && (state == I40IW_QP_STATE_ERROR))
                 info.reset_tcp_conn = true;
+        iwqp->hw_iwarp_state = state;
         i40iw_hw_modify_qp(iwqp->iwdev, iwqp, &info, 0);
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c b/drivers/infiniband/hw/i40iw/i40iw_main.c
index 6e9081380a27..445e230d5ff8 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
@@ -100,7 +100,7 @@ static struct notifier_block i40iw_net_notifier = {
         .notifier_call = i40iw_net_event
 };
 
-static int i40iw_notifiers_registered;
+static atomic_t i40iw_notifiers_registered;
 
 /**
  * i40iw_find_i40e_handler - find a handler given a client info
@@ -1342,12 +1342,11 @@ exit:
  */
 static void i40iw_register_notifiers(void)
 {
-        if (!i40iw_notifiers_registered) {
+        if (atomic_inc_return(&i40iw_notifiers_registered) == 1) {
                 register_inetaddr_notifier(&i40iw_inetaddr_notifier);
                 register_inet6addr_notifier(&i40iw_inetaddr6_notifier);
                 register_netevent_notifier(&i40iw_net_notifier);
         }
-        i40iw_notifiers_registered++;
 }
 
 /**
@@ -1429,8 +1428,7 @@ static void i40iw_deinit_device(struct i40iw_device *iwdev, bool reset, bool del
                         i40iw_del_macip_entry(iwdev, (u8)iwdev->mac_ip_table_idx);
                 /* fallthrough */
         case INET_NOTIFIER:
-                if (i40iw_notifiers_registered > 0) {
-                        i40iw_notifiers_registered--;
+                if (!atomic_dec_return(&i40iw_notifiers_registered)) {
                         unregister_netevent_notifier(&i40iw_net_notifier);
                         unregister_inetaddr_notifier(&i40iw_inetaddr_notifier);
                         unregister_inet6addr_notifier(&i40iw_inetaddr6_notifier);
@@ -1558,6 +1556,10 @@ static int i40iw_open(struct i40e_info *ldev, struct i40e_client *client)
         enum i40iw_status_code status;
         struct i40iw_handler *hdl;
 
+        hdl = i40iw_find_netdev(ldev->netdev);
+        if (hdl)
+                return 0;
+
         hdl = kzalloc(sizeof(*hdl), GFP_KERNEL);
         if (!hdl)
                 return -ENOMEM;
diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c
index 0e8db0a35141..6fd043b1d714 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c
@@ -673,8 +673,11 @@ enum i40iw_status_code i40iw_free_virt_mem(struct i40iw_hw *hw,
 {
         if (!mem)
                 return I40IW_ERR_PARAM;
+        /*
+         * mem->va points to the parent of mem, so both mem and mem->va
+         * can not be touched once mem->va is freed
+         */
         kfree(mem->va);
-        mem->va = NULL;
         return 0;
 }
 
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
index 2360338877bf..6329c971c22f 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
@@ -794,7 +794,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd,
         return &iwqp->ibqp;
 error:
         i40iw_free_qp_resources(iwdev, iwqp, qp_num);
-        kfree(mem);
         return ERR_PTR(err_code);
 }
 
@@ -1926,8 +1925,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr)
                 }
                 if (iwpbl->pbl_allocated)
                         i40iw_free_pble(iwdev->pble_rsrc, palloc);
-                kfree(iwpbl->iwmr);
-                iwpbl->iwmr = NULL;
+                kfree(iwmr);
                 return 0;
         }
 
diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
index d6fc8a6e8c33..5df63dacaaa3 100644
--- a/drivers/infiniband/hw/mlx4/cq.c
+++ b/drivers/infiniband/hw/mlx4/cq.c
@@ -576,8 +576,8 @@ static int mlx4_ib_ipoib_csum_ok(__be16 status, __be16 checksum)
                 checksum == cpu_to_be16(0xffff);
 }
 
-static int use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct ib_wc *wc,
-                           unsigned tail, struct mlx4_cqe *cqe, int is_eth)
+static void use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct ib_wc *wc,
+                            unsigned tail, struct mlx4_cqe *cqe, int is_eth)
 {
         struct mlx4_ib_proxy_sqp_hdr *hdr;
 
@@ -600,8 +600,6 @@ static int use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct
                 wc->slid        = be16_to_cpu(hdr->tun.slid_mac_47_32);
                 wc->sl          = (u8) (be16_to_cpu(hdr->tun.sl_vid) >> 12);
         }
-
-        return 0;
 }
 
 static void mlx4_ib_qp_sw_comp(struct mlx4_ib_qp *qp, int num_entries,
@@ -689,12 +687,6 @@ repoll:
         is_error = (cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) ==
                 MLX4_CQE_OPCODE_ERROR;
 
-        if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_OPCODE_NOP &&
-                     is_send)) {
-                pr_warn("Completion for NOP opcode detected!\n");
-                return -EINVAL;
-        }
-
         /* Resize CQ in progress */
         if (unlikely((cqe->owner_sr_opcode & MLX4_CQE_OPCODE_MASK) == MLX4_CQE_OPCODE_RESIZE)) {
                 if (cq->resize_buf) {
@@ -720,12 +712,6 @@ repoll:
                  */
                 mqp = __mlx4_qp_lookup(to_mdev(cq->ibcq.device)->dev,
                                        be32_to_cpu(cqe->vlan_my_qpn));
-                if (unlikely(!mqp)) {
-                        pr_warn("CQ %06x with entry for unknown QPN %06x\n",
-                               cq->mcq.cqn, be32_to_cpu(cqe->vlan_my_qpn) & MLX4_CQE_QPN_MASK);
-                        return -EINVAL;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -738,11 +724,6 @@ repoll:
                 /* SRQ is also in the radix tree */
                 msrq = mlx4_srq_lookup(to_mdev(cq->ibcq.device)->dev,
                                        srq_num);
-                if (unlikely(!msrq)) {
-                        pr_warn("CQ %06x with entry for unknown SRQN %06x\n",
-                                cq->mcq.cqn, srq_num);
-                        return -EINVAL;
-                }
         }
 
         if (is_send) {
@@ -852,9 +833,11 @@ repoll:
                 if (mlx4_is_mfunc(to_mdev(cq->ibcq.device)->dev)) {
                         if ((*cur_qp)->mlx4_ib_qp_type &
                             (MLX4_IB_QPT_PROXY_SMI_OWNER |
-                             MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI))
-                                return use_tunnel_data(*cur_qp, cq, wc, tail,
-                                                       cqe, is_eth);
+                             MLX4_IB_QPT_PROXY_SMI | MLX4_IB_QPT_PROXY_GSI)) {
+                                use_tunnel_data(*cur_qp, cq, wc, tail, cqe,
+                                                is_eth);
+                                return 0;
+                        }
                 }
 
                 wc->slid           = be16_to_cpu(cqe->rlid);
@@ -891,7 +874,6 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         struct mlx4_ib_qp *cur_qp = NULL;
         unsigned long flags;
         int npolled;
-        int err = 0;
         struct mlx4_ib_dev *mdev = to_mdev(cq->ibcq.device);
 
         spin_lock_irqsave(&cq->lock, flags);
@@ -901,8 +883,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         }
 
         for (npolled = 0; npolled < num_entries; ++npolled) {
-                err = mlx4_ib_poll_one(cq, &cur_qp, wc + npolled);
-                if (err)
+                if (mlx4_ib_poll_one(cq, &cur_qp, wc + npolled))
                         break;
         }
 
@@ -911,10 +892,7 @@ int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return npolled;
-        else
-                return err;
+        return npolled;
 }
 
 int mlx4_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
index 9c2e53d28f98..0f21c3a25552 100644
--- a/drivers/infiniband/hw/mlx4/mad.c
+++ b/drivers/infiniband/hw/mlx4/mad.c
@@ -1128,6 +1128,27 @@ void handle_port_mgmt_change_event(struct work_struct *work)
 
                 /* Generate GUID changed event */
                 if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
+                        if (mlx4_is_master(dev->dev)) {
+                                union ib_gid gid;
+                                int err = 0;
+
+                                if (!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
+                                        err = __mlx4_ib_query_gid(&dev->ib_dev, port, 0, &gid, 1);
+                                else
+                                        gid.global.subnet_prefix =
+                                                eqe->event.port_mgmt_change.params.port_info.gid_prefix;
+                                if (err) {
+                                        pr_warn("Could not change QP1 subnet prefix for port %d: query_gid error (%d)\n",
+                                                port, err);
+                                } else {
+                                        pr_debug("Changing QP1 subnet prefix for port %d. old=0x%llx. new=0x%llx\n",
+                                                 port,
+                                                 (u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
+                                                 be64_to_cpu(gid.global.subnet_prefix));
+                                        atomic64_set(&dev->sriov.demux[port - 1].subnet_prefix,
+                                                     be64_to_cpu(gid.global.subnet_prefix));
+                                }
+                        }
                         mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
                         /*if master, notify all slaves*/
                         if (mlx4_is_master(dev->dev))
@@ -2202,6 +2223,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
                 if (err)
                         goto demux_err;
                 dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
+                atomic64_set(&dev->sriov.demux[i].subnet_prefix,
+                             be64_to_cpu(gid.global.subnet_prefix));
                 err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 1,
                                       &dev->sriov.sqps[i]);
                 if (err)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 2af44c2de262..87ba9bca4181 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2202,6 +2202,9 @@ static int mlx4_ib_alloc_diag_counters(struct mlx4_ib_dev *ibdev)
         bool per_port = !!(ibdev->dev->caps.flags2 &
                 MLX4_DEV_CAP_FLAG2_DIAG_PER_PORT);
 
+        if (mlx4_is_slave(ibdev->dev))
+                return 0;
+
         for (i = 0; i < MLX4_DIAG_COUNTERS_TYPES; i++) {
                 /* i == 1 means we are building port counters */
                 if (i && !per_port)
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index 8f7ad07915b0..097bfcc4ee99 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group)
                 if (!group->members[i])
                         leave_state |= (1 << i);
 
-        return leave_state & (group->rec.scope_join_state & 7);
+        return leave_state & (group->rec.scope_join_state & 0xf);
 }
 
 static int join_group(struct mcast_group *group, int slave, u8 join_mask)
@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct *work)
                 } else
                         mcg_warn_group(group, "DRIVER BUG\n");
         } else if (group->state == MCAST_LEAVE_SENT) {
-                if (group->rec.scope_join_state & 7)
-                        group->rec.scope_join_state &= 0xf8;
+                if (group->rec.scope_join_state & 0xf)
+                        group->rec.scope_join_state &= 0xf0;
                 group->state = MCAST_IDLE;
                 mutex_unlock(&group->lock);
                 if (release_group(group, 1))
@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 leave_mask,
 static int handle_join_req(struct mcast_group *group, u8 join_mask,
                            struct mcast_req *req)
 {
-        u8 group_join_state = group->rec.scope_join_state & 7;
+        u8 group_join_state = group->rec.scope_join_state & 0xf;
         int ref = 0;
         u16 status;
         struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct *work)
                         u8 cur_join_state;
 
                         resp_join_state = ((struct ib_sa_mcmember_data *)
-                                                group->response_sa_mad.data)->scope_join_state & 7;
-                        cur_join_state = group->rec.scope_join_state & 7;
+                                                group->response_sa_mad.data)->scope_join_state & 0xf;
+                        cur_join_state = group->rec.scope_join_state & 0xf;
 
                         if (method == IB_MGMT_METHOD_GET_RESP) {
                                 /* successfull join */
@@ -710,7 +710,7 @@ process_requests:
                 req = list_first_entry(&group->pending_list, struct mcast_req,
                                        group_list);
                 sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-                req_join_state = sa_data->scope_join_state & 0x7;
+                req_join_state = sa_data->scope_join_state & 0xf;
 
                 /* For a leave request, we will immediately answer the VF, and
                  * update our internal counters. The actual leave will be sent
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 7c5832ede4bd..686ab48ff644 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -448,7 +448,7 @@ struct mlx4_ib_demux_ctx {
         struct workqueue_struct *wq;
         struct workqueue_struct *ud_wq;
         spinlock_t ud_lock;
-        __be64 subnet_prefix;
+        atomic64_t subnet_prefix;
         __be64 guid_cache[128];
         struct mlx4_ib_dev *dev;
         /* the following lock protects both mcg_table and mcg_mgid0_list */
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index 768085f59566..7fb9629bd12b 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -2493,24 +2493,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr,
                 sqp->ud_header.grh.flow_label    =
                         ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
                 sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
-                if (is_eth)
+                if (is_eth) {
                         memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
-                else {
-                if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
-                        /* When multi-function is enabled, the ib_core gid
-                         * indexes don't necessarily match the hw ones, so
-                         * we must use our own cache */
-                        sqp->ud_header.grh.source_gid.global.subnet_prefix =
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-                                                       subnet_prefix;
-                        sqp->ud_header.grh.source_gid.global.interface_id =
-                                to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
-                                               guid_cache[ah->av.ib.gid_index];
-                } else
-                        ib_get_cached_gid(ib_dev,
-                                          be32_to_cpu(ah->av.ib.port_pd) >> 24,
-                                          ah->av.ib.gid_index,
-                                          &sqp->ud_header.grh.source_gid, NULL);
+                } else {
+                        if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+                                /* When multi-function is enabled, the ib_core gid
+                                 * indexes don't necessarily match the hw ones, so
+                                 * we must use our own cache
+                                 */
+                                sqp->ud_header.grh.source_gid.global.subnet_prefix =
+                                        cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
+                                                                    demux[sqp->qp.port - 1].
+                                                                    subnet_prefix)));
+                                sqp->ud_header.grh.source_gid.global.interface_id =
+                                        to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+                                                       guid_cache[ah->av.ib.gid_index];
+                        } else {
+                                ib_get_cached_gid(ib_dev,
+                                                  be32_to_cpu(ah->av.ib.port_pd) >> 24,
+                                                  ah->av.ib.gid_index,
+                                                  &sqp->ud_header.grh.source_gid, NULL);
+                        }
                 }
                 memcpy(sqp->ud_header.grh.destination_gid.raw,
                        ah->av.ib.dgid, 16);
diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
index 308a358e5b46..e4fac9292e4a 100644
--- a/drivers/infiniband/hw/mlx5/cq.c
+++ b/drivers/infiniband/hw/mlx5/cq.c
@@ -553,12 +553,6 @@ repoll:
                  * from the table.
                  */
                 mqp = __mlx5_qp_lookup(dev->mdev, qpn);
-                if (unlikely(!mqp)) {
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown QPN %6x\n",
-                                     cq->mcq.cqn, qpn);
-                        return -EINVAL;
-                }
-
                 *cur_qp = to_mibqp(mqp);
         }
 
@@ -619,13 +613,6 @@ repoll:
                 read_lock(&dev->mdev->priv.mkey_table.lock);
                 mmkey = __mlx5_mr_lookup(dev->mdev,
                                          mlx5_base_mkey(be32_to_cpu(sig_err_cqe->mkey)));
-                if (unlikely(!mmkey)) {
-                        read_unlock(&dev->mdev->priv.mkey_table.lock);
-                        mlx5_ib_warn(dev, "CQE@CQ %06x for unknown MR %6x\n",
-                                     cq->mcq.cqn, be32_to_cpu(sig_err_cqe->mkey));
-                        return -EINVAL;
-                }
-
                 mr = to_mibmr(mmkey);
                 get_sig_err_item(sig_err_cqe, &mr->sig->err_item);
                 mr->sig->sig_err_exists = true;
@@ -676,7 +663,6 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
         unsigned long flags;
         int soft_polled = 0;
         int npolled;
-        int err = 0;
 
         spin_lock_irqsave(&cq->lock, flags);
         if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -688,8 +674,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
                 soft_polled = poll_soft_wc(cq, num_entries, wc);
 
         for (npolled = 0; npolled < num_entries - soft_polled; npolled++) {
-                err = mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled);
-                if (err)
+                if (mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled))
                         break;
         }
 
@@ -698,10 +683,7 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
 out:
         spin_unlock_irqrestore(&cq->lock, flags);
 
-        if (err == 0 || err == -EAGAIN)
-                return soft_polled + npolled;
-        else
-                return err;
+        return soft_polled + npolled;
 }
 
 int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags)
diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
index a84bb766fc62..e19537cf44ab 100644
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -37,7 +37,6 @@
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/slab.h>
-#include <linux/io-mapping.h>
 #if defined(CONFIG_X86)
 #include <asm/pat.h>
 #endif
@@ -289,7 +288,9 @@ __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num,
 
 static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev)
 {
-        return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB)
+                return !MLX5_CAP_GEN(dev->mdev, ib_virt);
+        return 0;
 }
 
 enum {
@@ -1429,6 +1430,13 @@ static int parse_flow_attr(u32 *match_c, u32 *match_v,
                                              dmac_47_16),
                                 ib_spec->eth.val.dst_mac);
 
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+                                             smac_47_16),
+                                ib_spec->eth.mask.src_mac);
+                ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+                                             smac_47_16),
+                                ib_spec->eth.val.src_mac);
+
                 if (ib_spec->eth.mask.vlan_tag) {
                         MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
                                  vlan_tag, 1);
@@ -1850,6 +1858,7 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
                                            int domain)
 {
         struct mlx5_ib_dev *dev = to_mdev(qp->device);
+        struct mlx5_ib_qp *mqp = to_mqp(qp);
         struct mlx5_ib_flow_handler *handler = NULL;
         struct mlx5_flow_destination *dst = NULL;
         struct mlx5_ib_flow_prio *ft_prio;
@@ -1876,7 +1885,10 @@ static struct ib_flow *mlx5_ib_create_flow(struct ib_qp *qp,
         }
 
         dst->type = MLX5_FLOW_DESTINATION_TYPE_TIR;
-        dst->tir_num = to_mqp(qp)->raw_packet_qp.rq.tirn;
+        if (mqp->flags & MLX5_IB_QP_RSS)
+                dst->tir_num = mqp->rss_qp.tirn;
+        else
+                dst->tir_num = mqp->raw_packet_qp.rq.tirn;
 
         if (flow_attr->type == IB_FLOW_ATTR_NORMAL) {
                 if (flow_attr->flags & IB_FLOW_ATTR_FLAGS_DONT_TRAP)  {
diff --git a/drivers/infiniband/hw/mlx5/mem.c b/drivers/infiniband/hw/mlx5/mem.c
index 40df2cca0609..996b54e366b0 100644
--- a/drivers/infiniband/hw/mlx5/mem.c
+++ b/drivers/infiniband/hw/mlx5/mem.c
@@ -71,7 +71,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
 
         addr = addr >> page_shift;
         tmp = (unsigned long)addr;
-        m = find_first_bit(&tmp, sizeof(tmp));
+        m = find_first_bit(&tmp, BITS_PER_LONG);
         skip = 1 << m;
         mask = skip - 1;
         i = 0;
@@ -81,7 +81,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                 for (k = 0; k < len; k++) {
                         if (!(i & mask)) {
                                 tmp = (unsigned long)pfn;
-                                m = min_t(unsigned long, m, find_first_bit(&tmp, sizeof(tmp)));
+                                m = min_t(unsigned long, m, find_first_bit(&tmp, BITS_PER_LONG));
                                 skip = 1 << m;
                                 mask = skip - 1;
                                 base = pfn;
@@ -89,7 +89,7 @@ void mlx5_ib_cont_pages(struct ib_umem *umem, u64 addr, int *count, int *shift,
                         } else {
                                 if (base + p != pfn) {
                                         tmp = (unsigned long)p;
-                                        m = find_first_bit(&tmp, sizeof(tmp));
+                                        m = find_first_bit(&tmp, BITS_PER_LONG);
                                         skip = 1 << m;
                                         mask = skip - 1;
                                         base = pfn;
diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h
index 372385d0f993..95146f4aa3e3 100644
--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
@@ -402,6 +402,7 @@ enum mlx5_ib_qp_flags {
         /* QP uses 1 as its source QP number */
         MLX5_IB_QP_SQPN_QP1                     = 1 << 6,
         MLX5_IB_QP_CAP_SCATTER_FCS              = 1 << 7,
+        MLX5_IB_QP_RSS                          = 1 << 8,
 };
 
 struct mlx5_umr_wr {
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 0dd7d93cac95..affc3f6598ca 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -1449,6 +1449,7 @@ create_tir:
         kvfree(in);
         /* qpn is reserved for that QP */
         qp->trans_qp.base.mqp.qpn = 0;
+        qp->flags |= MLX5_IB_QP_RSS;
         return 0;
 
 err:
@@ -3658,12 +3659,8 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
                      struct ib_send_wr *wr, unsigned *idx,
                      int *size, int nreq)
 {
-        int err = 0;
-
-        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq))) {
-                err = -ENOMEM;
-                return err;
-        }
+        if (unlikely(mlx5_wq_overflow(&qp->sq, nreq, qp->ibqp.send_cq)))
+                return -ENOMEM;
 
         *idx = qp->sq.cur_post & (qp->sq.wqe_cnt - 1);
         *seg = mlx5_get_send_wqe(qp, *idx);
@@ -3679,7 +3676,7 @@ static int begin_wqe(struct mlx5_ib_qp *qp, void **seg,
         *seg += sizeof(**ctrl);
         *size = sizeof(**ctrl) / 16;
 
-        return err;
+        return 0;
 }
 
 static void finish_wqe(struct mlx5_ib_qp *qp,
@@ -3758,7 +3755,7 @@ int mlx5_ib_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
                 num_sge = wr->num_sge;
                 if (unlikely(num_sge > qp->sq.max_gs)) {
                         mlx5_ib_warn(dev, "\n");
-                        err = -ENOMEM;
+                        err = -EINVAL;
                         *bad_wr = wr;
                         goto out;
                 }
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 16740dcb876b..67fc0b6857e1 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -1156,18 +1156,18 @@ static void ocrdma_get_attr(struct ocrdma_dev *dev,
         attr->max_srq =
                 (rsp->max_srq_rpir_qps & OCRDMA_MBX_QUERY_CFG_MAX_SRQ_MASK) >>
                 OCRDMA_MBX_QUERY_CFG_MAX_SRQ_OFFSET;
-        attr->max_send_sge = ((rsp->max_write_send_sge &
+        attr->max_send_sge = ((rsp->max_recv_send_sge &
                                OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK) >>
                               OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT);
-        attr->max_recv_sge = (rsp->max_write_send_sge &
-                              OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK) >>
-            OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT;
+        attr->max_recv_sge = (rsp->max_recv_send_sge &
+                              OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_MASK) >>
+            OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT;
         attr->max_srq_sge = (rsp->max_srq_rqe_sge &
                               OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_MASK) >>
             OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET;
-        attr->max_rdma_sge = (rsp->max_write_send_sge &
-                              OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_MASK) >>
-            OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT;
+        attr->max_rdma_sge = (rsp->max_wr_rd_sge &
+                              OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_MASK) >>
+            OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_SHIFT;
         attr->max_ord_per_qp = (rsp->max_ird_ord_per_qp &
                                 OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_MASK) >>
             OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_SHIFT;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
index 0efc9662c6d8..37df4481bb8f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_sli.h
@@ -554,9 +554,9 @@ enum {
         OCRDMA_MBX_QUERY_CFG_L3_TYPE_MASK               = 0x18,
         OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_SHIFT         = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_SEND_SGE_MASK          = 0xFFFF,
-        OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT        = 16,
-        OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_MASK         = 0xFFFF <<
-                                OCRDMA_MBX_QUERY_CFG_MAX_WRITE_SGE_SHIFT,
+        OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT = 16,
+        OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_MASK          = 0xFFFF <<
+                                OCRDMA_MBX_QUERY_CFG_MAX_RECV_SGE_SHIFT,
 
         OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_SHIFT       = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_ORD_PER_QP_MASK        = 0xFFFF,
@@ -612,6 +612,8 @@ enum {
         OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET         = 0,
         OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_MASK           = 0xFFFF <<
                                 OCRDMA_MBX_QUERY_CFG_MAX_SRQ_SGE_OFFSET,
+        OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_SHIFT           = 0,
+        OCRDMA_MBX_QUERY_CFG_MAX_RD_SGE_MASK            = 0xFFFF,
 };
 
 struct ocrdma_mbx_query_config {
@@ -619,7 +621,7 @@ struct ocrdma_mbx_query_config {
         struct ocrdma_mbx_rsp rsp;
         u32 qp_srq_cq_ird_ord;
         u32 max_pd_ca_ack_delay;
-        u32 max_write_send_sge;
+        u32 max_recv_send_sge;
         u32 max_ird_ord_per_qp;
         u32 max_shared_ird_ord;
         u32 max_mr;
@@ -639,6 +641,8 @@ struct ocrdma_mbx_query_config {
         u32 max_wqes_rqes_per_q;
         u32 max_cq_cqes_per_cq;
         u32 max_srq_rqe_sge;
+        u32 max_wr_rd_sge;
+        u32 ird_pgsz_num_pages;
 };
 
 struct ocrdma_fw_ver_rsp {
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index b1a3d91fe8b9..0aa854737e74 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -125,8 +125,8 @@ int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
                                         IB_DEVICE_SYS_IMAGE_GUID |
                                         IB_DEVICE_LOCAL_DMA_LKEY |
                                         IB_DEVICE_MEM_MGT_EXTENSIONS;
-        attr->max_sge = dev->attr.max_send_sge;
-        attr->max_sge_rd = attr->max_sge;
+        attr->max_sge = min(dev->attr.max_send_sge, dev->attr.max_recv_sge);
+        attr->max_sge_rd = dev->attr.max_rdma_sge;
         attr->max_cq = dev->attr.max_cq;
         attr->max_cqe = dev->attr.max_cqe;
         attr->max_mr = dev->attr.max_mr;
diff --git a/drivers/infiniband/hw/qib/qib_debugfs.c b/drivers/infiniband/hw/qib/qib_debugfs.c
index 5e75b43c596b..5bad8e3b40bb 100644
--- a/drivers/infiniband/hw/qib/qib_debugfs.c
+++ b/drivers/infiniband/hw/qib/qib_debugfs.c
@@ -189,27 +189,32 @@ static int _ctx_stats_seq_show(struct seq_file *s, void *v)
 DEBUGFS_FILE(ctx_stats)
 
 static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
+        __acquires(RCU)
 {
         struct qib_qp_iter *iter;
         loff_t n = *pos;
 
-        rcu_read_lock();
         iter = qib_qp_iter_init(s->private);
+
+        /* stop calls rcu_read_unlock */
+        rcu_read_lock();
+
         if (!iter)
                 return NULL;
 
-        while (n--) {
+        do {
                 if (qib_qp_iter_next(iter)) {
                         kfree(iter);
                         return NULL;
                 }
-        }
+        } while (n--);
 
         return iter;
 }
 
 static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
                                    loff_t *pos)
+        __must_hold(RCU)
 {
         struct qib_qp_iter *iter = iter_ptr;
 
@@ -224,6 +229,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 }
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c
index fcdf37913a26..c3edc033f7c4 100644
--- a/drivers/infiniband/hw/qib/qib_fs.c
+++ b/drivers/infiniband/hw/qib/qib_fs.c
@@ -328,26 +328,12 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
         pos = *ppos;
 
-        if (pos != 0) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        if (count != sizeof(struct qib_flash)) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        tmp = kmalloc(count, GFP_KERNEL);
-        if (!tmp) {
-                ret = -ENOMEM;
-                goto bail;
-        }
+        if (pos != 0 || count != sizeof(struct qib_flash))
+                return -EINVAL;
 
-        if (copy_from_user(tmp, buf, count)) {
-                ret = -EFAULT;
-                goto bail_tmp;
-        }
+        tmp = memdup_user(buf, count);
+        if (IS_ERR(tmp))
+                return PTR_ERR(tmp);
 
         dd = private2dd(file);
         if (qib_eeprom_write(dd, pos, tmp, count)) {
@@ -361,8 +347,6 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
 bail_tmp:
         kfree(tmp);
-
-bail:
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 9cc0aae1d781..f9b8cd2354d1 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -573,10 +573,6 @@ struct qib_qp_iter *qib_qp_iter_init(struct qib_ibdev *dev)
                 return NULL;
 
         iter->dev = dev;
-        if (qib_qp_iter_next(iter)) {
-                kfree(iter);
-                return NULL;
-        }
 
         return iter;
 }
diff --git a/drivers/infiniband/hw/usnic/usnic_ib_main.c b/drivers/infiniband/hw/usnic/usnic_ib_main.c
index c229b9f4a52d..0a89a955550b 100644
--- a/drivers/infiniband/hw/usnic/usnic_ib_main.c
+++ b/drivers/infiniband/hw/usnic/usnic_ib_main.c
@@ -664,7 +664,8 @@ static int __init usnic_ib_init(void)
                 return err;
         }
 
-        if (pci_register_driver(&usnic_ib_pci_driver)) {
+        err = pci_register_driver(&usnic_ib_pci_driver);
+        if (err) {
                 usnic_err("Unable to register with PCI\n");
                 goto out_umem_fini;
         }
diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c
index 80c4b6b401b8..46b64970058e 100644
--- a/drivers/infiniband/sw/rdmavt/mr.c
+++ b/drivers/infiniband/sw/rdmavt/mr.c
@@ -294,7 +294,7 @@ static void __rvt_free_mr(struct rvt_mr *mr)
 {
         rvt_deinit_mregion(&mr->mr);
         rvt_free_lkey(&mr->mr);
-        vfree(mr);
+        kfree(mr);
 }
 
 /**
diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index bdb540f25a88..870b4f212fbc 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -873,7 +873,8 @@ bail_qpn:
         free_qpn(&rdi->qp_dev->qpn_table, qp->ibqp.qp_num);
 
 bail_rq_wq:
-        vfree(qp->r_rq.wq);
+        if (!qp->ip)
+                vfree(qp->r_rq.wq);
 
 bail_driver_priv:
         rdi->driver_f.qp_priv_free(rdi, qp);
diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c
index 55f0e8f0ca79..ddd59270ff6d 100644
--- a/drivers/infiniband/sw/rxe/rxe.c
+++ b/drivers/infiniband/sw/rxe/rxe.c
@@ -362,15 +362,34 @@ static int __init rxe_module_init(void)
                 return err;
         }
 
-        err = rxe_net_init();
+        err = rxe_net_ipv4_init();
         if (err) {
-                pr_err("rxe: unable to init\n");
+                pr_err("rxe: unable to init ipv4 tunnel\n");
                 rxe_cache_exit();
-                return err;
+                goto exit;
+        }
+
+        err = rxe_net_ipv6_init();
+        if (err) {
+                pr_err("rxe: unable to init ipv6 tunnel\n");
+                rxe_cache_exit();
+                goto exit;
         }
+
+        err = register_netdevice_notifier(&rxe_net_notifier);
+        if (err) {
+                pr_err("rxe: Failed to rigister netdev notifier\n");
+                goto exit;
+        }
+
         pr_info("rxe: loaded\n");
 
         return 0;
+
+exit:
+        rxe_release_udp_tunnel(recv_sockets.sk4);
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        return err;
 }
 
 static void __exit rxe_module_exit(void)
diff --git a/drivers/infiniband/sw/rxe/rxe_comp.c b/drivers/infiniband/sw/rxe/rxe_comp.c
index 36f67de44095..1c59ef2c67aa 100644
--- a/drivers/infiniband/sw/rxe/rxe_comp.c
+++ b/drivers/infiniband/sw/rxe/rxe_comp.c
@@ -689,7 +689,14 @@ int rxe_completer(void *arg)
                                         qp->req.need_retry = 1;
                                         rxe_run_task(&qp->req.task, 1);
                                 }
+
+                                if (pkt) {
+                                        rxe_drop_ref(pkt->qp);
+                                        kfree_skb(skb);
+                                }
+
                                 goto exit;
+
                         } else {
                                 wqe->status = IB_WC_RETRY_EXC_ERR;
                                 state = COMPST_ERROR;
@@ -716,6 +723,12 @@ int rxe_completer(void *arg)
                 case COMPST_ERROR:
                         do_complete(qp, wqe);
                         rxe_qp_error(qp);
+
+                        if (pkt) {
+                                rxe_drop_ref(pkt->qp);
+                                kfree_skb(skb);
+                        }
+
                         goto exit;
                 }
         }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 0b8d2ea8b41d..eedf2f1cafdf 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -275,9 +275,10 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port,
         return sock;
 }
 
-static void rxe_release_udp_tunnel(struct socket *sk)
+void rxe_release_udp_tunnel(struct socket *sk)
 {
-        udp_tunnel_sock_release(sk);
+        if (sk)
+                udp_tunnel_sock_release(sk);
 }
 
 static void prepare_udp_hdr(struct sk_buff *skb, __be16 src_port,
@@ -658,51 +659,45 @@ out:
         return NOTIFY_OK;
 }
 
-static struct notifier_block rxe_net_notifier = {
+struct notifier_block rxe_net_notifier = {
         .notifier_call = rxe_notify,
 };
 
-int rxe_net_init(void)
+int rxe_net_ipv4_init(void)
 {
-        int err;
-
         spin_lock_init(&dev_list_lock);
 
-        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), true);
-        if (IS_ERR(recv_sockets.sk6)) {
-                recv_sockets.sk6 = NULL;
-                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
-                return -1;
-        }
-
         recv_sockets.sk4 = rxe_setup_udp_tunnel(&init_net,
-                        htons(ROCE_V2_UDP_DPORT), false);
+                                htons(ROCE_V2_UDP_DPORT), false);
         if (IS_ERR(recv_sockets.sk4)) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
                 recv_sockets.sk4 = NULL;
-                recv_sockets.sk6 = NULL;
                 pr_err("rxe: Failed to create IPv4 UDP tunnel\n");
                 return -1;
         }
 
-        err = register_netdevice_notifier(&rxe_net_notifier);
-        if (err) {
-                rxe_release_udp_tunnel(recv_sockets.sk6);
-                rxe_release_udp_tunnel(recv_sockets.sk4);
-                pr_err("rxe: Failed to rigister netdev notifier\n");
-        }
-
-        return err;
+        return 0;
 }
 
-void rxe_net_exit(void)
+int rxe_net_ipv6_init(void)
 {
-        if (recv_sockets.sk6)
-                rxe_release_udp_tunnel(recv_sockets.sk6);
+#if IS_ENABLED(CONFIG_IPV6)
 
-        if (recv_sockets.sk4)
-                rxe_release_udp_tunnel(recv_sockets.sk4);
+        spin_lock_init(&dev_list_lock);
 
+        recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net,
+                                                htons(ROCE_V2_UDP_DPORT), true);
+        if (IS_ERR(recv_sockets.sk6)) {
+                recv_sockets.sk6 = NULL;
+                pr_err("rxe: Failed to create IPv6 UDP tunnel\n");
+                return -1;
+        }
+#endif
+        return 0;
+}
+
+void rxe_net_exit(void)
+{
+        rxe_release_udp_tunnel(recv_sockets.sk6);
+        rxe_release_udp_tunnel(recv_sockets.sk4);
         unregister_netdevice_notifier(&rxe_net_notifier);
 }
diff --git a/drivers/infiniband/sw/rxe/rxe_net.h b/drivers/infiniband/sw/rxe/rxe_net.h
index 7b06f76d16cc..0daf7f09e5b5 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.h
+++ b/drivers/infiniband/sw/rxe/rxe_net.h
@@ -44,10 +44,13 @@ struct rxe_recv_sockets {
 };
 
 extern struct rxe_recv_sockets recv_sockets;
+extern struct notifier_block rxe_net_notifier;
+void rxe_release_udp_tunnel(struct socket *sk);
 
 struct rxe_dev *rxe_net_add(struct net_device *ndev);
 
-int rxe_net_init(void);
+int rxe_net_ipv4_init(void);
+int rxe_net_ipv6_init(void);
 void rxe_net_exit(void);
 
 #endif /* RXE_NET_H */
diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c
index 3d464c23e08b..144d2f129fcd 100644
--- a/drivers/infiniband/sw/rxe/rxe_recv.c
+++ b/drivers/infiniband/sw/rxe/rxe_recv.c
@@ -312,7 +312,7 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb)
                  * make a copy of the skb to post to the next qp
                  */
                 skb_copy = (mce->qp_list.next != &mcg->qp_list) ?
-                                skb_clone(skb, GFP_KERNEL) : NULL;
+                                skb_clone(skb, GFP_ATOMIC) : NULL;
 
                 pkt->qp = qp;
                 rxe_add_ref(qp);
diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c
index 33b2d9d77021..13a848a518e8 100644
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -511,24 +511,21 @@ static int fill_packet(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
 }
 
 static void update_wqe_state(struct rxe_qp *qp,
-                             struct rxe_send_wqe *wqe,
-                             struct rxe_pkt_info *pkt,
-                             enum wqe_state *prev_state)
+                struct rxe_send_wqe *wqe,
+                struct rxe_pkt_info *pkt)
 {
-        enum wqe_state prev_state_ = wqe->state;
-
         if (pkt->mask & RXE_END_MASK) {
                 if (qp_type(qp) == IB_QPT_RC)
                         wqe->state = wqe_state_pending;
         } else {
                 wqe->state = wqe_state_processing;
         }
-
-        *prev_state = prev_state_;
 }
 
-static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
-                         struct rxe_pkt_info *pkt, int payload)
+static void update_wqe_psn(struct rxe_qp *qp,
+                           struct rxe_send_wqe *wqe,
+                           struct rxe_pkt_info *pkt,
+                           int payload)
 {
         /* number of packets left to send including current one */
         int num_pkt = (wqe->dma.resid + payload + qp->mtu - 1) / qp->mtu;
@@ -546,9 +543,34 @@ static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
                 qp->req.psn = (wqe->first_psn + num_pkt) & BTH_PSN_MASK;
         else
                 qp->req.psn = (qp->req.psn + 1) & BTH_PSN_MASK;
+}
 
-        qp->req.opcode = pkt->opcode;
+static void save_state(struct rxe_send_wqe *wqe,
+                       struct rxe_qp *qp,
+                       struct rxe_send_wqe *rollback_wqe,
+                       struct rxe_qp *rollback_qp)
+{
+        rollback_wqe->state     = wqe->state;
+        rollback_wqe->first_psn = wqe->first_psn;
+        rollback_wqe->last_psn  = wqe->last_psn;
+        rollback_qp->req.psn    = qp->req.psn;
+}
 
+static void rollback_state(struct rxe_send_wqe *wqe,
+                           struct rxe_qp *qp,
+                           struct rxe_send_wqe *rollback_wqe,
+                           struct rxe_qp *rollback_qp)
+{
+        wqe->state     = rollback_wqe->state;
+        wqe->first_psn = rollback_wqe->first_psn;
+        wqe->last_psn  = rollback_wqe->last_psn;
+        qp->req.psn    = rollback_qp->req.psn;
+}
+
+static void update_state(struct rxe_qp *qp, struct rxe_send_wqe *wqe,
+                         struct rxe_pkt_info *pkt, int payload)
+{
+        qp->req.opcode = pkt->opcode;
 
         if (pkt->mask & RXE_END_MASK)
                 qp->req.wqe_index = next_index(qp->sq.queue, qp->req.wqe_index);
@@ -571,7 +593,8 @@ int rxe_requester(void *arg)
         int mtu;
         int opcode;
         int ret;
-        enum wqe_state prev_state;
+        struct rxe_qp rollback_qp;
+        struct rxe_send_wqe rollback_wqe;
 
 next_wqe:
         if (unlikely(!qp->valid || qp->req.state == QP_STATE_ERROR))
@@ -688,13 +711,21 @@ next_wqe:
                 goto err;
         }
 
-        update_wqe_state(qp, wqe, &pkt, &prev_state);
+        /*
+         * To prevent a race on wqe access between requester and completer,
+         * wqe members state and psn need to be set before calling
+         * rxe_xmit_packet().
+         * Otherwise, completer might initiate an unjustified retry flow.
+         */
+        save_state(wqe, qp, &rollback_wqe, &rollback_qp);
+        update_wqe_state(qp, wqe, &pkt);
+        update_wqe_psn(qp, wqe, &pkt, payload);
         ret = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp, &pkt, skb);
         if (ret) {
                 qp->need_req_skb = 1;
                 kfree_skb(skb);
 
-                wqe->state = prev_state;
+                rollback_state(wqe, qp, &rollback_wqe, &rollback_qp);
 
                 if (ret == -EAGAIN) {
                         rxe_run_task(&qp->req.task, 1);
diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
index ebb03b46e2ad..3e0f0f2baace 100644
--- a/drivers/infiniband/sw/rxe/rxe_resp.c
+++ b/drivers/infiniband/sw/rxe/rxe_resp.c
@@ -972,11 +972,13 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
         free_rd_atomic_resource(qp, res);
         rxe_advance_resp_resource(qp);
 
+        memcpy(SKB_TO_PKT(skb), &ack_pkt, sizeof(skb->cb));
+
         res->type = RXE_ATOMIC_MASK;
         res->atomic.skb = skb;
-        res->first_psn = qp->resp.psn;
-        res->last_psn = qp->resp.psn;
-        res->cur_psn = qp->resp.psn;
+        res->first_psn = ack_pkt.psn;
+        res->last_psn  = ack_pkt.psn;
+        res->cur_psn   = ack_pkt.psn;
 
         rc = rxe_xmit_packet(rxe, qp, &ack_pkt, skb_copy);
         if (rc) {
@@ -1116,8 +1118,7 @@ static enum resp_states duplicate_request(struct rxe_qp *qp,
                                 rc = RESPST_CLEANUP;
                                 goto out;
                         }
-                        bth_set_psn(SKB_TO_PKT(skb_copy),
-                                    qp->resp.psn - 1);
+
                         /* Resend the result. */
                         rc = rxe_xmit_packet(to_rdev(qp->ibqp.device), qp,
                                              pkt, skb_copy);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 4f7d9b48df64..9dbfcc0ab577 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 struct ipoib_ah *address, u32 qpn);
 void ipoib_reap_ah(struct work_struct *work);
 
+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
 void ipoib_mark_paths_invalid(struct net_device *dev);
 void ipoib_flush_paths(struct net_device *dev);
 int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 951d9abcca8b..4ad297d3de89 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
         }
 }
 
+#define QPN_AND_OPTIONS_OFFSET  4
+
 static void ipoib_cm_tx_start(struct work_struct *work)
 {
         struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
         struct ipoib_neigh *neigh;
         struct ipoib_cm_tx *p;
         unsigned long flags;
+        struct ipoib_path *path;
         int ret;
 
         struct ib_sa_path_rec pathrec;
@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 p = list_entry(priv->cm.start_list.next, typeof(*p), list);
                 list_del_init(&p->list);
                 neigh = p->neigh;
+
                 qpn = IPOIB_QPN(neigh->daddr);
+                /*
+                 * As long as the search is with these 2 locks,
+                 * path existence indicates its validity.
+                 */
+                path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                if (!path) {
+                        pr_info("%s ignore not valid path %pI6\n",
+                                __func__,
+                                neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+                        goto free_neigh;
+                }
                 memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
 
                 spin_unlock_irqrestore(&priv->lock, flags);
@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
                 spin_lock_irqsave(&priv->lock, flags);
 
                 if (ret) {
+free_neigh:
                         neigh = p->neigh;
                         if (neigh) {
                                 neigh->cm = NULL;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index dc6d241b9406..be11d5d5b8c1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv,
         }
 
         if (level == IPOIB_FLUSH_LIGHT) {
+                int oper_up;
                 ipoib_mark_paths_invalid(dev);
+                /* Set IPoIB operation as down to prevent races between:
+                 * the flush flow which leaves MCG and on the fly joins
+                 * which can happen during that time. mcast restart task
+                 * should deal with join requests we missed.
+                 */
+                oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                 ipoib_mcast_dev_flush(dev);
+                if (oper_up)
+                        set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
                 ipoib_flush_ah(dev);
         }
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 74bcaa064226..cc1c1b062ea5 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
         return -EINVAL;
 }
 
-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct rb_node *n = priv->path_tree.rb_node;
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index ba6be060a476..cae9bbcc27e7 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -403,6 +403,7 @@ isert_init_conn(struct isert_conn *isert_conn)
         INIT_LIST_HEAD(&isert_conn->node);
         init_completion(&isert_conn->login_comp);
         init_completion(&isert_conn->login_req_comp);
+        init_waitqueue_head(&isert_conn->rem_wait);
         kref_init(&isert_conn->kref);
         mutex_init(&isert_conn->mutex);
         INIT_WORK(&isert_conn->release_work, isert_release_work);
@@ -448,7 +449,7 @@ isert_alloc_login_buf(struct isert_conn *isert_conn,
 
         isert_conn->login_rsp_buf = kzalloc(ISER_RX_PAYLOAD_SIZE, GFP_KERNEL);
         if (!isert_conn->login_rsp_buf) {
-                isert_err("Unable to allocate isert_conn->login_rspbuf\n");
+                ret = -ENOMEM;
                 goto out_unmap_login_req_buf;
         }
 
@@ -578,7 +579,8 @@ isert_connect_release(struct isert_conn *isert_conn)
         BUG_ON(!device);
 
         isert_free_rx_descriptors(isert_conn);
-        if (isert_conn->cm_id)
+        if (isert_conn->cm_id &&
+            !isert_conn->dev_removed)
                 rdma_destroy_id(isert_conn->cm_id);
 
         if (isert_conn->qp) {
@@ -593,7 +595,10 @@ isert_connect_release(struct isert_conn *isert_conn)
 
         isert_device_put(device);
 
-        kfree(isert_conn);
+        if (isert_conn->dev_removed)
+                wake_up_interruptible(&isert_conn->rem_wait);
+        else
+                kfree(isert_conn);
 }
 
 static void
@@ -753,6 +758,7 @@ static int
 isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 {
         struct isert_np *isert_np = cma_id->context;
+        struct isert_conn *isert_conn;
         int ret = 0;
 
         isert_info("%s (%d): status %d id %p np %p\n",
@@ -773,10 +779,21 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 break;
         case RDMA_CM_EVENT_ADDR_CHANGE:    /* FALLTHRU */
         case RDMA_CM_EVENT_DISCONNECTED:   /* FALLTHRU */
-        case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
                 ret = isert_disconnected_handler(cma_id, event->event);
                 break;
+        case RDMA_CM_EVENT_DEVICE_REMOVAL:
+                isert_conn = cma_id->qp->qp_context;
+                isert_conn->dev_removed = true;
+                isert_disconnected_handler(cma_id, event->event);
+                wait_event_interruptible(isert_conn->rem_wait,
+                                         isert_conn->state == ISER_CONN_DOWN);
+                kfree(isert_conn);
+                /*
+                 * return non-zero from the callback to destroy
+                 * the rdma cm id
+                 */
+                return 1;
         case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
         case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
         case RDMA_CM_EVENT_CONNECT_ERROR:
diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h
index fc791efe3a10..c02ada57d7f5 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.h
+++ b/drivers/infiniband/ulp/isert/ib_isert.h
@@ -158,6 +158,8 @@ struct isert_conn {
         struct work_struct      release_work;
         bool                    logout_posted;
         bool                    snd_w_inv;
+        wait_queue_head_t       rem_wait;
+        bool                    dev_removed;
 };
 
 #define ISERT_MAX_CQ 64
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index dfa23b075a88..883bbfe08e0e 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -522,6 +522,11 @@ static int srpt_refresh_port(struct srpt_port *sport)
         if (ret)
                 goto err_query_port;
 
+        snprintf(sport->port_guid, sizeof(sport->port_guid),
+                "0x%016llx%016llx",
+                be64_to_cpu(sport->gid.global.subnet_prefix),
+                be64_to_cpu(sport->gid.global.interface_id));
+
         if (!sport->mad_agent) {
                 memset(&reg_req, 0, sizeof(reg_req));
                 reg_req.mgmt_class = IB_MGMT_CLASS_DEVICE_MGMT;
@@ -2548,10 +2553,6 @@ static void srpt_add_one(struct ib_device *device)
                                sdev->device->name, i);
                         goto err_ring;
                 }
-                snprintf(sport->port_guid, sizeof(sport->port_guid),
-                        "0x%016llx%016llx",
-                        be64_to_cpu(sport->gid.global.subnet_prefix),
-                        be64_to_cpu(sport->gid.global.interface_id));
         }
 
         spin_lock(&srpt_dev_lock);
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
index 7d61439be5f2..0c07e1023a46 100644
--- a/drivers/input/keyboard/tegra-kbc.c
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -376,7 +376,7 @@ static int tegra_kbc_start(struct tegra_kbc *kbc)
         /* Reset the KBC controller to clear all previous status.*/
         reset_control_assert(kbc->rst);
         udelay(100);
-        reset_control_assert(kbc->rst);
+        reset_control_deassert(kbc->rst);
         udelay(100);
 
         tegra_kbc_config_pins(kbc);
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index faa295ec4f31..c83bce89028b 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -553,7 +553,6 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
                 goto free_struct_buff;
 
         reg = find_first_bit(rdesc->presense_map, RMI_REG_DESC_PRESENSE_BITS);
-        map_offset = 0;
         for (i = 0; i < rdesc->num_registers; i++) {
                 struct rmi_register_desc_item *item = &rdesc->registers[i];
                 int reg_size = struct_buf[offset];
@@ -576,6 +575,8 @@ int rmi_read_register_desc(struct rmi_device *d, u16 addr,
                 item->reg = reg;
                 item->reg_size = reg_size;
 
+                map_offset = 0;
+
                 do {
                         for (b = 0; b < 7; b++) {
                                 if (struct_buf[offset] & (0x1 << b))
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index b4d34086e73f..405252a884dd 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1305,6 +1305,7 @@ static int __init i8042_create_aux_port(int idx)
         serio->write            = i8042_aux_write;
         serio->start            = i8042_start;
         serio->stop             = i8042_stop;
+        serio->ps2_cmd_mutex    = &i8042_mutex;
         serio->port_data        = port;
         serio->dev.parent       = &i8042_platform_device->dev;
         if (idx < 0) {
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index a61b2153ab8c..1ce3ecbe37f8 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -1473,7 +1473,6 @@ static int ads7846_remove(struct spi_device *spi)
 
         ads784x_hwmon_unregister(spi, ts);
 
-        regulator_disable(ts->reg);
         regulator_put(ts->reg);
 
         if (!ts->get_pendown_state) {
diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c
index 7379fe153cf9..f502c8488be8 100644
--- a/drivers/input/touchscreen/silead.c
+++ b/drivers/input/touchscreen/silead.c
@@ -390,9 +390,10 @@ static void silead_ts_read_props(struct i2c_client *client)
                 data->max_fingers = 5; /* Most devices handle up-to 5 fingers */
         }
 
-        error = device_property_read_string(dev, "touchscreen-fw-name", &str);
+        error = device_property_read_string(dev, "firmware-name", &str);
         if (!error)
-                snprintf(data->fw_name, sizeof(data->fw_name), "%s", str);
+                snprintf(data->fw_name, sizeof(data->fw_name),
+                         "silead/%s", str);
         else
                 dev_dbg(dev, "Firmware file name read error. Using default.");
 }
@@ -410,14 +411,14 @@ static int silead_ts_set_default_fw_name(struct silead_ts_data *data,
                 if (!acpi_id)
                         return -ENODEV;
 
-                snprintf(data->fw_name, sizeof(data->fw_name), "%s.fw",
-                        acpi_id->id);
+                snprintf(data->fw_name, sizeof(data->fw_name),
+                         "silead/%s.fw", acpi_id->id);
 
                 for (i = 0; i < strlen(data->fw_name); i++)
                         data->fw_name[i] = tolower(data->fw_name[i]);
         } else {
-                snprintf(data->fw_name, sizeof(data->fw_name), "%s.fw",
-                        id->name);
+                snprintf(data->fw_name, sizeof(data->fw_name),
+                         "silead/%s.fw", id->name);
         }
 
         return 0;
@@ -426,7 +427,8 @@ static int silead_ts_set_default_fw_name(struct silead_ts_data *data,
 static int silead_ts_set_default_fw_name(struct silead_ts_data *data,
                                          const struct i2c_device_id *id)
 {
-        snprintf(data->fw_name, sizeof(data->fw_name), "%s.fw", id->name);
+        snprintf(data->fw_name, sizeof(data->fw_name),
+                 "silead/%s.fw", id->name);
         return 0;
 }
 #endif
@@ -464,7 +466,7 @@ static int silead_ts_probe(struct i2c_client *client,
                 return -ENODEV;
 
         /* Power GPIO pin */
-        data->gpio_power = gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
+        data->gpio_power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW);
         if (IS_ERR(data->gpio_power)) {
                 if (PTR_ERR(data->gpio_power) != -EPROBE_DEFER)
                         dev_err(dev, "Shutdown GPIO request failed\n");
diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
index ce801170d5f2..641e88761319 100644
--- a/drivers/iommu/arm-smmu-v3.c
+++ b/drivers/iommu/arm-smmu-v3.c
@@ -879,7 +879,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
          * We may have concurrent producers, so we need to be careful
          * not to touch any of the shadow cmdq state.
          */
-        queue_read(cmd, Q_ENT(q, idx), q->ent_dwords);
+        queue_read(cmd, Q_ENT(q, cons), q->ent_dwords);
         dev_err(smmu->dev, "skipping command in error state:\n");
         for (i = 0; i < ARRAY_SIZE(cmd); ++i)
                 dev_err(smmu->dev, "\t0x%016llx\n", (unsigned long long)cmd[i]);
@@ -890,7 +890,7 @@ static void arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu)
                 return;
         }
 
-        queue_write(cmd, Q_ENT(q, idx), q->ent_dwords);
+        queue_write(Q_ENT(q, cons), cmd, q->ent_dwords);
 }
 
 static void arm_smmu_cmdq_issue_cmd(struct arm_smmu_device *smmu,
@@ -1034,6 +1034,9 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
                 case STRTAB_STE_0_CFG_S2_TRANS:
                         ste_live = true;
                         break;
+                case STRTAB_STE_0_CFG_ABORT:
+                        if (disable_bypass)
+                                break;
                 default:
                         BUG(); /* STE corruption */
                 }
diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c
index 4f49fe29f202..2db74ebc3240 100644
--- a/drivers/iommu/arm-smmu.c
+++ b/drivers/iommu/arm-smmu.c
@@ -686,8 +686,7 @@ static struct iommu_gather_ops arm_smmu_gather_ops = {
 
 static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
 {
-        int flags, ret;
-        u32 fsr, fsynr, resume;
+        u32 fsr, fsynr;
         unsigned long iova;
         struct iommu_domain *domain = dev;
         struct arm_smmu_domain *smmu_domain = to_smmu_domain(domain);
@@ -701,34 +700,15 @@ static irqreturn_t arm_smmu_context_fault(int irq, void *dev)
         if (!(fsr & FSR_FAULT))
                 return IRQ_NONE;
 
-        if (fsr & FSR_IGN)
-                dev_err_ratelimited(smmu->dev,
-                                    "Unexpected context fault (fsr 0x%x)\n",
-                                    fsr);
-
         fsynr = readl_relaxed(cb_base + ARM_SMMU_CB_FSYNR0);
-        flags = fsynr & FSYNR0_WNR ? IOMMU_FAULT_WRITE : IOMMU_FAULT_READ;
-
         iova = readq_relaxed(cb_base + ARM_SMMU_CB_FAR);
-        if (!report_iommu_fault(domain, smmu->dev, iova, flags)) {
-                ret = IRQ_HANDLED;
-                resume = RESUME_RETRY;
-        } else {
-                dev_err_ratelimited(smmu->dev,
-                    "Unhandled context fault: iova=0x%08lx, fsynr=0x%x, cb=%d\n",
-                    iova, fsynr, cfg->cbndx);
-                ret = IRQ_NONE;
-                resume = RESUME_TERMINATE;
-        }
-
-        /* Clear the faulting FSR */
-        writel(fsr, cb_base + ARM_SMMU_CB_FSR);
 
-        /* Retry or terminate any stalled transactions */
-        if (fsr & FSR_SS)
-                writel_relaxed(resume, cb_base + ARM_SMMU_CB_RESUME);
+        dev_err_ratelimited(smmu->dev,
+        "Unhandled context fault: fsr=0x%x, iova=0x%08lx, fsynr=0x%x, cb=%d\n",
+                            fsr, iova, fsynr, cfg->cbndx);
 
-        return ret;
+        writel(fsr, cb_base + ARM_SMMU_CB_FSR);
+        return IRQ_HANDLED;
 }
 
 static irqreturn_t arm_smmu_global_fault(int irq, void *dev)
@@ -837,7 +817,7 @@ static void arm_smmu_init_context_bank(struct arm_smmu_domain *smmu_domain,
         }
 
         /* SCTLR */
-        reg = SCTLR_CFCFG | SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
+        reg = SCTLR_CFIE | SCTLR_CFRE | SCTLR_M | SCTLR_EAE_SBOP;
         if (stage1)
                 reg |= SCTLR_S1_ASIDPNE;
 #ifdef __BIG_ENDIAN
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 08a1e2f3690f..00c8a08d56e7 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -68,7 +68,8 @@ void iommu_put_dma_cookie(struct iommu_domain *domain)
         if (!iovad)
                 return;
 
-        put_iova_domain(iovad);
+        if (iovad->granule)
+                put_iova_domain(iovad);
         kfree(iovad);
         domain->iova_cookie = NULL;
 }
@@ -151,12 +152,15 @@ int dma_direction_to_prot(enum dma_data_direction dir, bool coherent)
         }
 }
 
-static struct iova *__alloc_iova(struct iova_domain *iovad, size_t size,
+static struct iova *__alloc_iova(struct iommu_domain *domain, size_t size,
                 dma_addr_t dma_limit)
 {
+        struct iova_domain *iovad = domain->iova_cookie;
         unsigned long shift = iova_shift(iovad);
         unsigned long length = iova_align(iovad, size) >> shift;
 
+        if (domain->geometry.force_aperture)
+                dma_limit = min(dma_limit, domain->geometry.aperture_end);
         /*
          * Enforce size-alignment to be safe - there could perhaps be an
          * attribute to control this per-device, or at least per-domain...
@@ -314,7 +318,7 @@ struct page **iommu_dma_alloc(struct device *dev, size_t size, gfp_t gfp,
         if (!pages)
                 return NULL;
 
-        iova = __alloc_iova(iovad, size, dev->coherent_dma_mask);
+        iova = __alloc_iova(domain, size, dev->coherent_dma_mask);
         if (!iova)
                 goto out_free_pages;
 
@@ -386,7 +390,7 @@ dma_addr_t iommu_dma_map_page(struct device *dev, struct page *page,
         phys_addr_t phys = page_to_phys(page) + offset;
         size_t iova_off = iova_offset(iovad, phys);
         size_t len = iova_align(iovad, size + iova_off);
-        struct iova *iova = __alloc_iova(iovad, len, dma_get_mask(dev));
+        struct iova *iova = __alloc_iova(domain, len, dma_get_mask(dev));
 
         if (!iova)
                 return DMA_ERROR_CODE;
@@ -538,7 +542,7 @@ int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg,
                 prev = s;
         }
 
-        iova = __alloc_iova(iovad, iova_len, dma_get_mask(dev));
+        iova = __alloc_iova(domain, iova_len, dma_get_mask(dev));
         if (!iova)
                 goto out_restore_sg;
 
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c b/drivers/iommu/io-pgtable-arm-v7s.c
index 8c6139986d7d..def8ca1c982d 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -286,12 +286,14 @@ static int arm_v7s_pte_to_prot(arm_v7s_iopte pte, int lvl)
         int prot = IOMMU_READ;
         arm_v7s_iopte attr = pte >> ARM_V7S_ATTR_SHIFT(lvl);
 
-        if (attr & ARM_V7S_PTE_AP_RDONLY)
+        if (!(attr & ARM_V7S_PTE_AP_RDONLY))
                 prot |= IOMMU_WRITE;
         if ((attr & (ARM_V7S_TEX_MASK << ARM_V7S_TEX_SHIFT)) == 0)
                 prot |= IOMMU_MMIO;
         else if (pte & ARM_V7S_ATTR_C)
                 prot |= IOMMU_CACHE;
+        if (pte & ARM_V7S_ATTR_XN(lvl))
+                prot |= IOMMU_NOEXEC;
 
         return prot;
 }
diff --git a/drivers/iommu/mtk_iommu.h b/drivers/iommu/mtk_iommu.h
index 9ed0a8462ccf..3dab13b4a211 100644
--- a/drivers/iommu/mtk_iommu.h
+++ b/drivers/iommu/mtk_iommu.h
@@ -55,19 +55,19 @@ struct mtk_iommu_data {
         bool                            enable_4GB;
 };
 
-static int compare_of(struct device *dev, void *data)
+static inline int compare_of(struct device *dev, void *data)
 {
         return dev->of_node == data;
 }
 
-static int mtk_iommu_bind(struct device *dev)
+static inline int mtk_iommu_bind(struct device *dev)
 {
         struct mtk_iommu_data *data = dev_get_drvdata(dev);
 
         return component_bind_all(dev, &data->smi_imu);
 }
 
-static void mtk_iommu_unbind(struct device *dev)
+static inline void mtk_iommu_unbind(struct device *dev)
 {
         struct mtk_iommu_data *data = dev_get_drvdata(dev);
 
diff --git a/drivers/irqchip/irq-atmel-aic.c b/drivers/irqchip/irq-atmel-aic.c
index 112e17c2768b..37f952dd9fc9 100644
--- a/drivers/irqchip/irq-atmel-aic.c
+++ b/drivers/irqchip/irq-atmel-aic.c
@@ -176,6 +176,7 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
 {
         struct irq_domain_chip_generic *dgc = d->gc;
         struct irq_chip_generic *gc;
+        unsigned long flags;
         unsigned smr;
         int idx;
         int ret;
@@ -194,11 +195,11 @@ static int aic_irq_domain_xlate(struct irq_domain *d,
 
         gc = dgc->gc[idx];
 
-        irq_gc_lock(gc);
+        irq_gc_lock_irqsave(gc, flags);
         smr = irq_reg_readl(gc, AT91_AIC_SMR(*out_hwirq));
         aic_common_set_priority(intspec[2], &smr);
         irq_reg_writel(gc, smr, AT91_AIC_SMR(*out_hwirq));
-        irq_gc_unlock(gc);
+        irq_gc_unlock_irqrestore(gc, flags);
 
         return ret;
 }
diff --git a/drivers/irqchip/irq-atmel-aic5.c b/drivers/irqchip/irq-atmel-aic5.c
index 4f0d068e1abe..2a624d87a035 100644
--- a/drivers/irqchip/irq-atmel-aic5.c
+++ b/drivers/irqchip/irq-atmel-aic5.c
@@ -258,6 +258,7 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
                                  unsigned int *out_type)
 {
         struct irq_chip_generic *bgc = irq_get_domain_generic_chip(d, 0);
+        unsigned long flags;
         unsigned smr;
         int ret;
 
@@ -269,12 +270,12 @@ static int aic5_irq_domain_xlate(struct irq_domain *d,
         if (ret)
                 return ret;
 
-        irq_gc_lock(bgc);
+        irq_gc_lock_irqsave(bgc, flags);
         irq_reg_writel(bgc, *out_hwirq, AT91_AIC5_SSR);
         smr = irq_reg_readl(bgc, AT91_AIC5_SMR);
         aic_common_set_priority(intspec[2], &smr);
         irq_reg_writel(bgc, smr, AT91_AIC5_SMR);
-        irq_gc_unlock(bgc);
+        irq_gc_unlock_irqrestore(bgc, flags);
 
         return ret;
 }
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 7ceaba81efb4..36b9c28a5c91 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -1545,7 +1545,12 @@ static int its_force_quiescent(void __iomem *base)
         u32 val;
 
         val = readl_relaxed(base + GITS_CTLR);
-        if (val & GITS_CTLR_QUIESCENT)
+        /*
+         * GIC architecture specification requires the ITS to be both
+         * disabled and quiescent for writes to GITS_BASER<n> or
+         * GITS_CBASER to not have UNPREDICTABLE results.
+         */
+        if ((val & GITS_CTLR_QUIESCENT) && !(val & GITS_CTLR_ENABLE))
                 return 0;
 
         /* Disable the generation of all interrupts to this ITS */
diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index 6fc56c3466b0..da6c0ba61d4f 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -548,7 +548,7 @@ static int gic_starting_cpu(unsigned int cpu)
 static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
                                    unsigned long cluster_id)
 {
-        int cpu = *base_cpu;
+        int next_cpu, cpu = *base_cpu;
         unsigned long mpidr = cpu_logical_map(cpu);
         u16 tlist = 0;
 
@@ -562,9 +562,10 @@ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
 
                 tlist |= 1 << (mpidr & 0xf);
 
-                cpu = cpumask_next(cpu, mask);
-                if (cpu >= nr_cpu_ids)
+                next_cpu = cpumask_next(cpu, mask);
+                if (next_cpu >= nr_cpu_ids)
                         goto out;
+                cpu = next_cpu;
 
                 mpidr = cpu_logical_map(cpu);
 
@@ -667,13 +668,20 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
 #endif
 
 #ifdef CONFIG_CPU_PM
+/* Check whether it's single security state view */
+static bool gic_dist_security_disabled(void)
+{
+        return readl_relaxed(gic_data.dist_base + GICD_CTLR) & GICD_CTLR_DS;
+}
+
 static int gic_cpu_pm_notifier(struct notifier_block *self,
                                unsigned long cmd, void *v)
 {
         if (cmd == CPU_PM_EXIT) {
-                gic_enable_redist(true);
+                if (gic_dist_security_disabled())
+                        gic_enable_redist(true);
                 gic_cpu_sys_reg_init();
-        } else if (cmd == CPU_PM_ENTER) {
+        } else if (cmd == CPU_PM_ENTER && gic_dist_security_disabled()) {
                 gic_write_grpen1(0);
                 gic_enable_redist(false);
         }
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index c2cab572c511..390fac59c6bc 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -769,6 +769,13 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
         int cpu;
         unsigned long flags, map = 0;
 
+        if (unlikely(nr_cpu_ids == 1)) {
+                /* Only one CPU? let's do a self-IPI... */
+                writel_relaxed(2 << 24 | irq,
+                               gic_data_dist_base(&gic_data[0]) + GIC_DIST_SOFTINT);
+                return;
+        }
+
         raw_spin_lock_irqsave(&irq_controller_lock, flags);
 
         /* Convert our logical CPU mask into a physical one. */
diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c
index c5f33c3bd228..6185696405d5 100644
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -638,27 +638,6 @@ static int gic_local_irq_domain_map(struct irq_domain *d, unsigned int virq,
         if (!gic_local_irq_is_routable(intr))
                 return -EPERM;
 
-        /*
-         * HACK: These are all really percpu interrupts, but the rest
-         * of the MIPS kernel code does not use the percpu IRQ API for
-         * the CP0 timer and performance counter interrupts.
-         */
-        switch (intr) {
-        case GIC_LOCAL_INT_TIMER:
-        case GIC_LOCAL_INT_PERFCTR:
-        case GIC_LOCAL_INT_FDC:
-                irq_set_chip_and_handler(virq,
-                                         &gic_all_vpes_local_irq_controller,
-                                         handle_percpu_irq);
-                break;
-        default:
-                irq_set_chip_and_handler(virq,
-                                         &gic_local_irq_controller,
-                                         handle_percpu_devid_irq);
-                irq_set_percpu_devid(virq);
-                break;
-        }
-
         spin_lock_irqsave(&gic_lock, flags);
         for (i = 0; i < gic_vpes; i++) {
                 u32 val = GIC_MAP_TO_PIN_MSK | gic_cpu_pin;
@@ -713,9 +692,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         unsigned long flags;
         int i;
 
-        irq_set_chip_and_handler(virq, &gic_level_irq_controller,
-                                 handle_level_irq);
-
         spin_lock_irqsave(&gic_lock, flags);
         gic_map_to_pin(intr, gic_cpu_pin);
         gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
@@ -727,12 +703,42 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq,
         return 0;
 }
 
-static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,
-                              irq_hw_number_t hw)
+static int gic_setup_dev_chip(struct irq_domain *d, unsigned int virq,
+                              unsigned int hwirq)
 {
-        if (GIC_HWIRQ_TO_LOCAL(hw) < GIC_NUM_LOCAL_INTRS)
-                return gic_local_irq_domain_map(d, virq, hw);
-        return gic_shared_irq_domain_map(d, virq, hw, 0);
+        struct irq_chip *chip;
+        int err;
+
+        if (hwirq >= GIC_SHARED_HWIRQ_BASE) {
+                err = irq_domain_set_hwirq_and_chip(d, virq, hwirq,
+                                                    &gic_level_irq_controller,
+                                                    NULL);
+        } else {
+                switch (GIC_HWIRQ_TO_LOCAL(hwirq)) {
+                case GIC_LOCAL_INT_TIMER:
+                case GIC_LOCAL_INT_PERFCTR:
+                case GIC_LOCAL_INT_FDC:
+                        /*
+                         * HACK: These are all really percpu interrupts, but
+                         * the rest of the MIPS kernel code does not use the
+                         * percpu IRQ API for them.
+                         */
+                        chip = &gic_all_vpes_local_irq_controller;
+                        irq_set_handler(virq, handle_percpu_irq);
+                        break;
+
+                default:
+                        chip = &gic_local_irq_controller;
+                        irq_set_handler(virq, handle_percpu_devid_irq);
+                        irq_set_percpu_devid(virq);
+                        break;
+                }
+
+                err = irq_domain_set_hwirq_and_chip(d, virq, hwirq,
+                                                    chip, NULL);
+        }
+
+        return err;
 }
 
 static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
@@ -743,15 +749,12 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
         int cpu, ret, i;
 
         if (spec->type == GIC_DEVICE) {
-                /* verify that it doesn't conflict with an IPI irq */
-                if (test_bit(spec->hwirq, ipi_resrv))
+                /* verify that shared irqs don't conflict with an IPI irq */
+                if ((spec->hwirq >= GIC_SHARED_HWIRQ_BASE) &&
+                    test_bit(GIC_HWIRQ_TO_SHARED(spec->hwirq), ipi_resrv))
                         return -EBUSY;
 
-                hwirq = GIC_SHARED_TO_HWIRQ(spec->hwirq);
-
-                return irq_domain_set_hwirq_and_chip(d, virq, hwirq,
-                                                     &gic_level_irq_controller,
-                                                     NULL);
+                return gic_setup_dev_chip(d, virq, spec->hwirq);
         } else {
                 base_hwirq = find_first_bit(ipi_resrv, gic_shared_intrs);
                 if (base_hwirq == gic_shared_intrs) {
@@ -771,11 +774,13 @@ static int gic_irq_domain_alloc(struct irq_domain *d, unsigned int virq,
                         hwirq = GIC_SHARED_TO_HWIRQ(base_hwirq + i);
 
                         ret = irq_domain_set_hwirq_and_chip(d, virq + i, hwirq,
-                                                            &gic_edge_irq_controller,
+                                                            &gic_level_irq_controller,
                                                             NULL);
                         if (ret)
                                 goto error;
 
+                        irq_set_handler(virq + i, handle_level_irq);
+
                         ret = gic_shared_irq_domain_map(d, virq + i, hwirq, cpu);
                         if (ret)
                                 goto error;
@@ -818,7 +823,6 @@ int gic_irq_domain_match(struct irq_domain *d, struct device_node *node,
 }
 
 static const struct irq_domain_ops gic_irq_domain_ops = {
-        .map = gic_irq_domain_map,
         .alloc = gic_irq_domain_alloc,
         .free = gic_irq_domain_free,
         .match = gic_irq_domain_match,
@@ -849,29 +853,20 @@ static int gic_dev_domain_alloc(struct irq_domain *d, unsigned int virq,
         struct irq_fwspec *fwspec = arg;
         struct gic_irq_spec spec = {
                 .type = GIC_DEVICE,
-                .hwirq = fwspec->param[1],
         };
         int i, ret;
-        bool is_shared = fwspec->param[0] == GIC_SHARED;
 
-        if (is_shared) {
-                ret = irq_domain_alloc_irqs_parent(d, virq, nr_irqs, &spec);
-                if (ret)
-                        return ret;
-        }
-
-        for (i = 0; i < nr_irqs; i++) {
-                irq_hw_number_t hwirq;
+        if (fwspec->param[0] == GIC_SHARED)
+                spec.hwirq = GIC_SHARED_TO_HWIRQ(fwspec->param[1]);
+        else
+                spec.hwirq = GIC_LOCAL_TO_HWIRQ(fwspec->param[1]);
 
-                if (is_shared)
-                        hwirq = GIC_SHARED_TO_HWIRQ(spec.hwirq + i);
-                else
-                        hwirq = GIC_LOCAL_TO_HWIRQ(spec.hwirq + i);
+        ret = irq_domain_alloc_irqs_parent(d, virq, nr_irqs, &spec);
+        if (ret)
+                return ret;
 
-                ret = irq_domain_set_hwirq_and_chip(d, virq + i,
-                                                    hwirq,
-                                                    &gic_level_irq_controller,
-                                                    NULL);
+        for (i = 0; i < nr_irqs; i++) {
+                ret = gic_setup_dev_chip(d, virq + i, spec.hwirq + i);
                 if (ret)
                         goto error;
         }
@@ -890,10 +885,20 @@ void gic_dev_domain_free(struct irq_domain *d, unsigned int virq,
         return;
 }
 
+static void gic_dev_domain_activate(struct irq_domain *domain,
+                                    struct irq_data *d)
+{
+        if (GIC_HWIRQ_TO_LOCAL(d->hwirq) < GIC_NUM_LOCAL_INTRS)
+                gic_local_irq_domain_map(domain, d->irq, d->hwirq);
+        else
+                gic_shared_irq_domain_map(domain, d->irq, d->hwirq, 0);
+}
+
 static struct irq_domain_ops gic_dev_domain_ops = {
         .xlate = gic_dev_domain_xlate,
         .alloc = gic_dev_domain_alloc,
         .free = gic_dev_domain_free,
+        .activate = gic_dev_domain_activate,
 };
 
 static int gic_ipi_domain_xlate(struct irq_domain *d, struct device_node *ctrlr,
diff --git a/drivers/macintosh/ams/ams-i2c.c b/drivers/macintosh/ams/ams-i2c.c
index 978eda8d6678..8a3ba565106f 100644
--- a/drivers/macintosh/ams/ams-i2c.c
+++ b/drivers/macintosh/ams/ams-i2c.c
@@ -73,7 +73,6 @@ MODULE_DEVICE_TABLE(i2c, ams_id);
 static struct i2c_driver ams_i2c_driver = {
         .driver = {
                 .name   = "ams",
-                .owner  = THIS_MODULE,
         },
         .probe          = ams_i2c_probe,
         .remove         = ams_i2c_remove,
diff --git a/drivers/macintosh/windfarm_pm112.c b/drivers/macintosh/windfarm_pm112.c
index 3024685e4cca..96d16fca68b2 100644
--- a/drivers/macintosh/windfarm_pm112.c
+++ b/drivers/macintosh/windfarm_pm112.c
@@ -668,7 +668,6 @@ static struct platform_driver wf_pm112_driver = {
         .remove = wf_pm112_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/macintosh/windfarm_pm72.c b/drivers/macintosh/windfarm_pm72.c
index 2f506b9d5a52..e88cfb36a74d 100644
--- a/drivers/macintosh/windfarm_pm72.c
+++ b/drivers/macintosh/windfarm_pm72.c
@@ -789,7 +789,6 @@ static struct platform_driver wf_pm72_driver = {
         .remove = wf_pm72_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/macintosh/windfarm_rm31.c b/drivers/macintosh/windfarm_rm31.c
index 82fc86a90c1a..bdfcb8a8bfbb 100644
--- a/drivers/macintosh/windfarm_rm31.c
+++ b/drivers/macintosh/windfarm_rm31.c
@@ -682,7 +682,6 @@ static struct platform_driver wf_rm31_driver = {
         .remove = wf_rm31_remove,
         .driver = {
                 .name = "windfarm",
-                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/mailbox/Kconfig b/drivers/mailbox/Kconfig
index 97c372908e78..7817d40d81e7 100644
--- a/drivers/mailbox/Kconfig
+++ b/drivers/mailbox/Kconfig
@@ -127,6 +127,7 @@ config XGENE_SLIMPRO_MBOX
 config BCM_PDC_MBOX
         tristate "Broadcom PDC Mailbox"
         depends on ARM64 || COMPILE_TEST
+        depends on HAS_DMA
         default ARCH_BCM_IPROC
         help
           Mailbox implementation for the Broadcom PDC ring manager,
diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c
index cbe0c1ee4ba9..c19dd820ea9b 100644
--- a/drivers/mailbox/bcm-pdc-mailbox.c
+++ b/drivers/mailbox/bcm-pdc-mailbox.c
@@ -469,7 +469,7 @@ static const struct file_operations pdc_debugfs_stats = {
  * this directory for a SPU.
  * @pdcs: PDC state structure
  */
-void pdc_setup_debugfs(struct pdc_state *pdcs)
+static void pdc_setup_debugfs(struct pdc_state *pdcs)
 {
         char spu_stats_name[16];
 
@@ -485,7 +485,7 @@ void pdc_setup_debugfs(struct pdc_state *pdcs)
                                                   &pdc_debugfs_stats);
 }
 
-void pdc_free_debugfs(void)
+static void pdc_free_debugfs(void)
 {
         if (debugfs_dir && simple_empty(debugfs_dir)) {
                 debugfs_remove_recursive(debugfs_dir);
@@ -1191,10 +1191,11 @@ static void pdc_shutdown(struct mbox_chan *chan)
 {
         struct pdc_state *pdcs = chan->con_priv;
 
-        if (pdcs)
-                dev_dbg(&pdcs->pdev->dev,
-                        "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
+        if (!pdcs)
+                return;
 
+        dev_dbg(&pdcs->pdev->dev,
+                "Shutdown mailbox channel for PDC %u", pdcs->pdc_idx);
         pdc_ring_free(pdcs);
 }
 
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 95a4ca6ce6ff..849ad441cd76 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -760,7 +760,8 @@ static int bcache_device_init(struct bcache_device *d, unsigned block_size,
         if (!d->nr_stripes ||
             d->nr_stripes > INT_MAX ||
             d->nr_stripes > SIZE_MAX / sizeof(atomic_t)) {
-                pr_err("nr_stripes too large");
+                pr_err("nr_stripes too large or invalid: %u (start sector beyond end of disk?)",
+                        (unsigned)d->nr_stripes);
                 return -ENOMEM;
         }
 
@@ -1820,7 +1821,7 @@ static int cache_alloc(struct cache *ca)
         free = roundup_pow_of_two(ca->sb.nbuckets) >> 10;
 
         if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) ||
-            !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
+            !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) ||
             !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) ||
             !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) ||
             !init_fifo(&ca->free_inc,   free << 2, GFP_KERNEL) ||
@@ -1844,7 +1845,7 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                                 struct block_device *bdev, struct cache *ca)
 {
         char name[BDEVNAME_SIZE];
-        const char *err = NULL;
+        const char *err = NULL; /* must be set for any error case */
         int ret = 0;
 
         memcpy(&ca->sb, sb, sizeof(struct cache_sb));
@@ -1861,8 +1862,13 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
                 ca->discard = CACHE_DISCARD(&ca->sb);
 
         ret = cache_alloc(ca);
-        if (ret != 0)
+        if (ret != 0) {
+                if (ret == -ENOMEM)
+                        err = "cache_alloc(): -ENOMEM";
+                else
+                        err = "cache_alloc(): unknown error";
                 goto err;
+        }
 
         if (kobject_add(&ca->kobj, &part_to_dev(bdev->bd_part)->kobj, "bcache")) {
                 err = "error calling kobject_add";
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 6fff794e0c72..13041ee37ad6 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -2183,19 +2183,29 @@ location_show(struct mddev *mddev, char *page)
 static ssize_t
 location_store(struct mddev *mddev, const char *buf, size_t len)
 {
+        int rv;
 
+        rv = mddev_lock(mddev);
+        if (rv)
+                return rv;
         if (mddev->pers) {
-                if (!mddev->pers->quiesce)
-                        return -EBUSY;
-                if (mddev->recovery || mddev->sync_thread)
-                        return -EBUSY;
+                if (!mddev->pers->quiesce) {
+                        rv = -EBUSY;
+                        goto out;
+                }
+                if (mddev->recovery || mddev->sync_thread) {
+                        rv = -EBUSY;
+                        goto out;
+                }
         }
 
         if (mddev->bitmap || mddev->bitmap_info.file ||
             mddev->bitmap_info.offset) {
                 /* bitmap already configured.  Only option is to clear it */
-                if (strncmp(buf, "none", 4) != 0)
-                        return -EBUSY;
+                if (strncmp(buf, "none", 4) != 0) {
+                        rv = -EBUSY;
+                        goto out;
+                }
                 if (mddev->pers) {
                         mddev->pers->quiesce(mddev, 1);
                         bitmap_destroy(mddev);
@@ -2214,21 +2224,25 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                         /* nothing to be done */;
                 else if (strncmp(buf, "file:", 5) == 0) {
                         /* Not supported yet */
-                        return -EINVAL;
+                        rv = -EINVAL;
+                        goto out;
                 } else {
-                        int rv;
                         if (buf[0] == '+')
                                 rv = kstrtoll(buf+1, 10, &offset);
                         else
                                 rv = kstrtoll(buf, 10, &offset);
                         if (rv)
-                                return rv;
-                        if (offset == 0)
-                                return -EINVAL;
+                                goto out;
+                        if (offset == 0) {
+                                rv = -EINVAL;
+                                goto out;
+                        }
                         if (mddev->bitmap_info.external == 0 &&
                             mddev->major_version == 0 &&
-                            offset != mddev->bitmap_info.default_offset)
-                                return -EINVAL;
+                            offset != mddev->bitmap_info.default_offset) {
+                                rv = -EINVAL;
+                                goto out;
+                        }
                         mddev->bitmap_info.offset = offset;
                         if (mddev->pers) {
                                 struct bitmap *bitmap;
@@ -2245,7 +2259,7 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                                 mddev->pers->quiesce(mddev, 0);
                                 if (rv) {
                                         bitmap_destroy(mddev);
-                                        return rv;
+                                        goto out;
                                 }
                         }
                 }
@@ -2257,6 +2271,11 @@ location_store(struct mddev *mddev, const char *buf, size_t len)
                 set_bit(MD_CHANGE_DEVS, &mddev->flags);
                 md_wakeup_thread(mddev->thread);
         }
+        rv = 0;
+out:
+        mddev_unlock(mddev);
+        if (rv)
+                return rv;
         return len;
 }
 
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 6571c81465e1..8625040bae92 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1879,7 +1879,7 @@ static int __init dm_bufio_init(void)
         __cache_size_refresh();
         mutex_unlock(&dm_bufio_clients_lock);
 
-        dm_bufio_wq = create_singlethread_workqueue("dm_bufio_cache");
+        dm_bufio_wq = alloc_workqueue("dm_bufio_cache", WQ_MEM_RECLAIM, 0);
         if (!dm_bufio_wq)
                 return -ENOMEM;
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 4e9784b4e0ac..874295757caa 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -181,7 +181,7 @@ struct crypt_config {
         u8 key[0];
 };
 
-#define MIN_IOS        16
+#define MIN_IOS        64
 
 static void clone_init(struct dm_crypt_io *, struct bio *);
 static void kcryptd_queue_crypt(struct dm_crypt_io *io);
@@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode)
         unsigned i;
         int err;
 
-        cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
+        cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
                            GFP_KERNEL);
         if (!cc->tfms)
                 return -ENOMEM;
@@ -1924,6 +1924,13 @@ static int crypt_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_REMAPPED;
         }
 
+        /*
+         * Check if bio is too large, split as needed.
+         */
+        if (unlikely(bio->bi_iter.bi_size > (BIO_MAX_PAGES << PAGE_SHIFT)) &&
+            bio_data_dir(bio) == WRITE)
+                dm_accept_partial_bio(bio, ((BIO_MAX_PAGES << PAGE_SHIFT) >> SECTOR_SHIFT));
+
         io = dm_per_bio_data(bio, cc->per_bio_data_size);
         crypt_io_init(io, cc, bio, dm_target_offset(ti, bio->bi_iter.bi_sector));
         io->ctx.req = (struct skcipher_request *)(io + 1);
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 97e446d54a15..6a2e8dd44a1b 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -289,15 +289,13 @@ static int flakey_map(struct dm_target *ti, struct bio *bio)
                 pb->bio_submitted = true;
 
                 /*
-                 * Map reads as normal only if corrupt_bio_byte set.
+                 * Error reads if neither corrupt_bio_byte or drop_writes are set.
+                 * Otherwise, flakey_end_io() will decide if the reads should be modified.
                  */
                 if (bio_data_dir(bio) == READ) {
-                        /* If flags were specified, only corrupt those that match. */
-                        if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
-                            all_corrupt_bio_flags_match(bio, fc))
-                                goto map_bio;
-                        else
+                        if (!fc->corrupt_bio_byte && !test_bit(DROP_WRITES, &fc->flags))
                                 return -EIO;
+                        goto map_bio;
                 }
 
                 /*
@@ -334,14 +332,21 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio, int error)
         struct flakey_c *fc = ti->private;
         struct per_bio_data *pb = dm_per_bio_data(bio, sizeof(struct per_bio_data));
 
-        /*
-         * Corrupt successful READs while in down state.
-         */
         if (!error && pb->bio_submitted && (bio_data_dir(bio) == READ)) {
-                if (fc->corrupt_bio_byte)
+                if (fc->corrupt_bio_byte && (fc->corrupt_bio_rw == READ) &&
+                    all_corrupt_bio_flags_match(bio, fc)) {
+                        /*
+                         * Corrupt successful matching READs while in down state.
+                         */
                         corrupt_bio_data(bio, fc);
-                else
+
+                } else if (!test_bit(DROP_WRITES, &fc->flags)) {
+                        /*
+                         * Error read during the down_interval if drop_writes
+                         * wasn't configured.
+                         */
                         return -EIO;
+                }
         }
 
         return error;
diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
index 4ab68033f9d1..49e4d8d4558f 100644
--- a/drivers/md/dm-log-writes.c
+++ b/drivers/md/dm-log-writes.c
@@ -259,12 +259,12 @@ static int log_one_block(struct log_writes_c *lc,
                 goto out;
         sector++;
 
-        bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+        atomic_inc(&lc->io_blocks);
+        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
         if (!bio) {
                 DMERR("Couldn't alloc log bio");
                 goto error;
         }
-        atomic_inc(&lc->io_blocks);
         bio->bi_iter.bi_size = 0;
         bio->bi_iter.bi_sector = sector;
         bio->bi_bdev = lc->logdev->bdev;
@@ -282,7 +282,7 @@ static int log_one_block(struct log_writes_c *lc,
                 if (ret != block->vecs[i].bv_len) {
                         atomic_inc(&lc->io_blocks);
                         submit_bio(bio);
-                        bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
+                        bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
                         if (!bio) {
                                 DMERR("Couldn't alloc log bio");
                                 goto error;
@@ -459,9 +459,9 @@ static int log_writes_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad;
         }
 
-        ret = -EINVAL;
         lc->log_kthread = kthread_run(log_writes_kthread, lc, "log-write");
-        if (!lc->log_kthread) {
+        if (IS_ERR(lc->log_kthread)) {
+                ret = PTR_ERR(lc->log_kthread);
                 ti->error = "Couldn't alloc kthread";
                 dm_put_device(ti, lc->dev);
                 dm_put_device(ti, lc->logdev);
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 4ca2d1df5b44..07fc1ad42ec5 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -291,9 +291,10 @@ static void header_from_disk(struct log_header_core *core, struct log_header_dis
         core->nr_regions = le64_to_cpu(disk->nr_regions);
 }
 
-static int rw_header(struct log_c *lc, int rw)
+static int rw_header(struct log_c *lc, int op)
 {
-        lc->io_req.bi_op = rw;
+        lc->io_req.bi_op = op;
+        lc->io_req.bi_op_flags = 0;
 
         return dm_io(&lc->io_req, 1, &lc->header_location, NULL);
 }
@@ -316,7 +317,7 @@ static int read_header(struct log_c *log)
 {
         int r;
 
-        r = rw_header(log, READ);
+        r = rw_header(log, REQ_OP_READ);
         if (r)
                 return r;
 
@@ -630,7 +631,7 @@ static int disk_resume(struct dm_dirty_log *log)
         header_to_disk(&lc->header, lc->disk_header);
 
         /* write the new header */
-        r = rw_header(lc, WRITE);
+        r = rw_header(lc, REQ_OP_WRITE);
         if (!r) {
                 r = flush_header(lc);
                 if (r)
@@ -698,7 +699,7 @@ static int disk_flush(struct dm_dirty_log *log)
                         log_clear_bit(lc, lc->clean_bits, i);
         }
 
-        r = rw_header(lc, WRITE);
+        r = rw_header(lc, REQ_OP_WRITE);
         if (r)
                 fail_log_device(lc);
         else {
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 1b9795d75ef8..8abde6b8cedc 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -191,7 +191,6 @@ struct raid_dev {
 #define RT_FLAG_RS_BITMAP_LOADED        2
 #define RT_FLAG_UPDATE_SBS              3
 #define RT_FLAG_RESHAPE_RS              4
-#define RT_FLAG_KEEP_RS_FROZEN          5
 
 /* Array elements of 64 bit needed for rebuild/failed disk bits */
 #define DISKS_ARRAY_ELEMS ((MAX_RAID_DEVICES + (sizeof(uint64_t) * 8 - 1)) / sizeof(uint64_t) / 8)
@@ -861,6 +860,9 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
 {
         unsigned long min_region_size = rs->ti->len / (1 << 21);
 
+        if (rs_is_raid0(rs))
+                return 0;
+
         if (!region_size) {
                 /*
                  * Choose a reasonable default.  All figures in sectors.
@@ -930,6 +932,8 @@ static int validate_raid_redundancy(struct raid_set *rs)
                         rebuild_cnt++;
 
         switch (rs->raid_type->level) {
+        case 0:
+                break;
         case 1:
                 if (rebuild_cnt >= rs->md.raid_disks)
                         goto too_many;
@@ -2335,6 +2339,13 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
                 case 0:
                         break;
                 default:
+                        /*
+                         * We have to keep any raid0 data/metadata device pairs or
+                         * the MD raid0 personality will fail to start the array.
+                         */
+                        if (rs_is_raid0(rs))
+                                continue;
+
                         dev = container_of(rdev, struct raid_dev, rdev);
                         if (dev->meta_dev)
                                 dm_put_device(ti, dev->meta_dev);
@@ -2579,7 +2590,6 @@ static int rs_prepare_reshape(struct raid_set *rs)
                 } else {
                         /* Process raid1 without delta_disks */
                         mddev->raid_disks = rs->raid_disks;
-                        set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
                         reshape = false;
                 }
         } else {
@@ -2590,7 +2600,6 @@ static int rs_prepare_reshape(struct raid_set *rs)
         if (reshape) {
                 set_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags);
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
-                set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
         } else if (mddev->raid_disks < rs->raid_disks)
                 /* Create new superblocks and bitmaps, if any new disks */
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
@@ -2902,7 +2911,6 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                         goto bad;
 
                 set_bit(RT_FLAG_UPDATE_SBS, &rs->runtime_flags);
-                set_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags);
                 /* Takeover ain't recovery, so disable recovery */
                 rs_setup_recovery(rs, MaxSector);
                 rs_set_new(rs);
@@ -3386,21 +3394,28 @@ static void raid_postsuspend(struct dm_target *ti)
 {
         struct raid_set *rs = ti->private;
 
-        if (test_and_clear_bit(RT_FLAG_RS_RESUMED, &rs->runtime_flags)) {
-                if (!rs->md.suspended)
-                        mddev_suspend(&rs->md);
-                rs->md.ro = 1;
-        }
+        if (!rs->md.suspended)
+                mddev_suspend(&rs->md);
+
+        rs->md.ro = 1;
 }
 
 static void attempt_restore_of_faulty_devices(struct raid_set *rs)
 {
         int i;
-        uint64_t failed_devices, cleared_failed_devices = 0;
+        uint64_t cleared_failed_devices[DISKS_ARRAY_ELEMS];
         unsigned long flags;
+        bool cleared = false;
         struct dm_raid_superblock *sb;
+        struct mddev *mddev = &rs->md;
         struct md_rdev *r;
 
+        /* RAID personalities have to provide hot add/remove methods or we need to bail out. */
+        if (!mddev->pers || !mddev->pers->hot_add_disk || !mddev->pers->hot_remove_disk)
+                return;
+
+        memset(cleared_failed_devices, 0, sizeof(cleared_failed_devices));
+
         for (i = 0; i < rs->md.raid_disks; i++) {
                 r = &rs->dev[i].rdev;
                 if (test_bit(Faulty, &r->flags) && r->sb_page &&
@@ -3420,7 +3435,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
                          * ourselves.
                          */
                         if ((r->raid_disk >= 0) &&
-                            (r->mddev->pers->hot_remove_disk(r->mddev, r) != 0))
+                            (mddev->pers->hot_remove_disk(mddev, r) != 0))
                                 /* Failed to revive this device, try next */
                                 continue;
 
@@ -3430,22 +3445,30 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
                         clear_bit(Faulty, &r->flags);
                         clear_bit(WriteErrorSeen, &r->flags);
                         clear_bit(In_sync, &r->flags);
-                        if (r->mddev->pers->hot_add_disk(r->mddev, r)) {
+                        if (mddev->pers->hot_add_disk(mddev, r)) {
                                 r->raid_disk = -1;
                                 r->saved_raid_disk = -1;
                                 r->flags = flags;
                         } else {
                                 r->recovery_offset = 0;
-                                cleared_failed_devices |= 1 << i;
+                                set_bit(i, (void *) cleared_failed_devices);
+                                cleared = true;
                         }
                 }
         }
-        if (cleared_failed_devices) {
+
+        /* If any failed devices could be cleared, update all sbs failed_devices bits */
+        if (cleared) {
+                uint64_t failed_devices[DISKS_ARRAY_ELEMS];
+
                 rdev_for_each(r, &rs->md) {
                         sb = page_address(r->sb_page);
-                        failed_devices = le64_to_cpu(sb->failed_devices);
-                        failed_devices &= ~cleared_failed_devices;
-                        sb->failed_devices = cpu_to_le64(failed_devices);
+                        sb_retrieve_failed_devices(sb, failed_devices);
+
+                        for (i = 0; i < DISKS_ARRAY_ELEMS; i++)
+                                failed_devices[i] &= ~cleared_failed_devices[i];
+
+                        sb_update_failed_devices(sb, failed_devices);
                 }
         }
 }
@@ -3610,26 +3633,15 @@ static void raid_resume(struct dm_target *ti)
                  * devices are reachable again.
                  */
                 attempt_restore_of_faulty_devices(rs);
-        } else {
-                mddev->ro = 0;
-                mddev->in_sync = 0;
+        }
 
-                /*
-                 * When passing in flags to the ctr, we expect userspace
-                 * to reset them because they made it to the superblocks
-                 * and reload the mapping anyway.
-                 *
-                 * -> only unfreeze recovery in case of a table reload or
-                 *    we'll have a bogus recovery/reshape position
-                 *    retrieved from the superblock by the ctr because
-                 *    the ongoing recovery/reshape will change it after read.
-                 */
-                if (!test_bit(RT_FLAG_KEEP_RS_FROZEN, &rs->runtime_flags))
-                        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+        mddev->ro = 0;
+        mddev->in_sync = 0;
 
-                if (mddev->suspended)
-                        mddev_resume(mddev);
-        }
+        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+
+        if (mddev->suspended)
+                mddev_resume(mddev);
 }
 
 static struct target_type raid_target = {
diff --git a/drivers/md/dm-round-robin.c b/drivers/md/dm-round-robin.c
index 4ace1da17db8..6c25213ab38c 100644
--- a/drivers/md/dm-round-robin.c
+++ b/drivers/md/dm-round-robin.c
@@ -210,14 +210,17 @@ static struct dm_path *rr_select_path(struct path_selector *ps, size_t nr_bytes)
         struct path_info *pi = NULL;
         struct dm_path *current_path = NULL;
 
+        local_irq_save(flags);
         current_path = *this_cpu_ptr(s->current_path);
         if (current_path) {
                 percpu_counter_dec(&s->repeat_count);
-                if (percpu_counter_read_positive(&s->repeat_count) > 0)
+                if (percpu_counter_read_positive(&s->repeat_count) > 0) {
+                        local_irq_restore(flags);
                         return current_path;
+                }
         }
 
-        spin_lock_irqsave(&s->lock, flags);
+        spin_lock(&s->lock);
         if (!list_empty(&s->valid_paths)) {
                 pi = list_entry(s->valid_paths.next, struct path_info, list);
                 list_move_tail(&pi->list, &s->valid_paths);
diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
index 41573f1f626f..34a840d9df76 100644
--- a/drivers/md/md-cluster.c
+++ b/drivers/md/md-cluster.c
@@ -834,8 +834,10 @@ static int join(struct mddev *mddev, int nodes)
                 goto err;
         }
         cinfo->ack_lockres = lockres_init(mddev, "ack", ack_bast, 0);
-        if (!cinfo->ack_lockres)
+        if (!cinfo->ack_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
         /* get sync CR lock on ACK. */
         if (dlm_lock_sync(cinfo->ack_lockres, DLM_LOCK_CR))
                 pr_err("md-cluster: failed to get a sync CR lock on ACK!(%d)\n",
@@ -849,8 +851,10 @@ static int join(struct mddev *mddev, int nodes)
         pr_info("md-cluster: Joined cluster %s slot %d\n", str, cinfo->slot_number);
         snprintf(str, 64, "bitmap%04d", cinfo->slot_number - 1);
         cinfo->bitmap_lockres = lockres_init(mddev, str, NULL, 1);
-        if (!cinfo->bitmap_lockres)
+        if (!cinfo->bitmap_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
         if (dlm_lock_sync(cinfo->bitmap_lockres, DLM_LOCK_PW)) {
                 pr_err("Failed to get bitmap lock\n");
                 ret = -EINVAL;
@@ -858,8 +862,10 @@ static int join(struct mddev *mddev, int nodes)
         }
 
         cinfo->resync_lockres = lockres_init(mddev, "resync", NULL, 0);
-        if (!cinfo->resync_lockres)
+        if (!cinfo->resync_lockres) {
+                ret = -ENOMEM;
                 goto err;
+        }
 
         return 0;
 err:
diff --git a/drivers/md/md.c b/drivers/md/md.c
index d646f6e444f0..915e84d631a2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1604,11 +1604,8 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
                         mddev->new_chunk_sectors = mddev->chunk_sectors;
                 }
 
-                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL) {
+                if (le32_to_cpu(sb->feature_map) & MD_FEATURE_JOURNAL)
                         set_bit(MD_HAS_JOURNAL, &mddev->flags);
-                        if (mddev->recovery_cp == MaxSector)
-                                set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
-                }
         } else if (mddev->pers == NULL) {
                 /* Insist of good event counter while assembling, except for
                  * spares (which don't need an event count) */
@@ -5851,6 +5848,9 @@ static int get_array_info(struct mddev *mddev, void __user *arg)
                         working++;
                         if (test_bit(In_sync, &rdev->flags))
                                 insync++;
+                        else if (test_bit(Journal, &rdev->flags))
+                                /* TODO: add journal count to md_u.h */
+                                ;
                         else
                                 spare++;
                 }
@@ -7610,16 +7610,12 @@ EXPORT_SYMBOL(unregister_md_cluster_operations);
 
 int md_setup_cluster(struct mddev *mddev, int nodes)
 {
-        int err;
-
-        err = request_module("md-cluster");
-        if (err) {
-                pr_err("md-cluster module not found.\n");
-                return -ENOENT;
-        }
-
+        if (!md_cluster_ops)
+                request_module("md-cluster");
         spin_lock(&pers_lock);
+        /* ensure module won't be unloaded */
         if (!md_cluster_ops || !try_module_get(md_cluster_mod)) {
+                pr_err("can't find md-cluster module or get it's reference.\n");
                 spin_unlock(&pers_lock);
                 return -ENOENT;
         }
@@ -7862,6 +7858,7 @@ void md_do_sync(struct md_thread *thread)
          */
 
         do {
+                int mddev2_minor = -1;
                 mddev->curr_resync = 2;
 
         try_again:
@@ -7891,10 +7888,14 @@ void md_do_sync(struct md_thread *thread)
                                 prepare_to_wait(&resync_wait, &wq, TASK_INTERRUPTIBLE);
                                 if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
                                     mddev2->curr_resync >= mddev->curr_resync) {
-                                        printk(KERN_INFO "md: delaying %s of %s"
-                                               " until %s has finished (they"
-                                               " share one or more physical units)\n",
-                                               desc, mdname(mddev), mdname(mddev2));
+                                        if (mddev2_minor != mddev2->md_minor) {
+                                                mddev2_minor = mddev2->md_minor;
+                                                printk(KERN_INFO "md: delaying %s of %s"
+                                                       " until %s has finished (they"
+                                                       " share one or more physical units)\n",
+                                                       desc, mdname(mddev),
+                                                       mdname(mddev2));
+                                        }
                                         mddev_put(mddev2);
                                         if (signal_pending(current))
                                                 flush_signals(current);
@@ -8275,16 +8276,13 @@ no_add:
 static void md_start_sync(struct work_struct *ws)
 {
         struct mddev *mddev = container_of(ws, struct mddev, del_work);
-        int ret = 0;
 
         mddev->sync_thread = md_register_thread(md_do_sync,
                                                 mddev,
                                                 "resync");
         if (!mddev->sync_thread) {
-                if (!(mddev_is_clustered(mddev) && ret == -EAGAIN))
-                        printk(KERN_ERR "%s: could not start resync"
-                               " thread...\n",
-                               mdname(mddev));
+                printk(KERN_ERR "%s: could not start resync thread...\n",
+                       mdname(mddev));
                 /* leave the spares where they are, it shouldn't hurt */
                 clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
                 clear_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 0e4efcd10795..be1a9fca3b2d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1064,6 +1064,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio)
         int max_sectors;
         int sectors;
 
+        md_write_start(mddev, bio);
+
         /*
          * Register the new request and wait if the reconstruction
          * thread has put up a bar for new requests.
@@ -1445,8 +1447,6 @@ static void raid10_make_request(struct mddev *mddev, struct bio *bio)
                 return;
         }
 
-        md_write_start(mddev, bio);
-
         do {
 
                 /*
@@ -2465,20 +2465,21 @@ static int narrow_write_error(struct r10bio *r10_bio, int i)
 
         while (sect_to_write) {
                 struct bio *wbio;
+                sector_t wsector;
                 if (sectors > sect_to_write)
                         sectors = sect_to_write;
                 /* Write at 'sector' for 'sectors' */
                 wbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
                 bio_trim(wbio, sector - bio->bi_iter.bi_sector, sectors);
-                wbio->bi_iter.bi_sector = (r10_bio->devs[i].addr+
-                                   choose_data_offset(r10_bio, rdev) +
-                                   (sector - r10_bio->sector));
+                wsector = r10_bio->devs[i].addr + (sector - r10_bio->sector);
+                wbio->bi_iter.bi_sector = wsector +
+                                   choose_data_offset(r10_bio, rdev);
                 wbio->bi_bdev = rdev->bdev;
                 bio_set_op_attrs(wbio, REQ_OP_WRITE, 0);
 
                 if (submit_bio_wait(wbio) < 0)
                         /* Failure! */
-                        ok = rdev_set_badblocks(rdev, sector,
+                        ok = rdev_set_badblocks(rdev, wsector,
                                                 sectors, 0)
                                 && ok;
 
diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c
index 51f76ddbe265..1b1ab4a1d132 100644
--- a/drivers/md/raid5-cache.c
+++ b/drivers/md/raid5-cache.c
@@ -96,7 +96,6 @@ struct r5l_log {
         spinlock_t no_space_stripes_lock;
 
         bool need_cache_flush;
-        bool in_teardown;
 };
 
 /*
@@ -704,31 +703,22 @@ static void r5l_write_super_and_discard_space(struct r5l_log *log,
 
         mddev = log->rdev->mddev;
         /*
-         * This is to avoid a deadlock. r5l_quiesce holds reconfig_mutex and
-         * wait for this thread to finish. This thread waits for
-         * MD_CHANGE_PENDING clear, which is supposed to be done in
-         * md_check_recovery(). md_check_recovery() tries to get
-         * reconfig_mutex. Since r5l_quiesce already holds the mutex,
-         * md_check_recovery() fails, so the PENDING never get cleared. The
-         * in_teardown check workaround this issue.
+         * Discard could zero data, so before discard we must make sure
+         * superblock is updated to new log tail. Updating superblock (either
+         * directly call md_update_sb() or depend on md thread) must hold
+         * reconfig mutex. On the other hand, raid5_quiesce is called with
+         * reconfig_mutex hold. The first step of raid5_quiesce() is waitting
+         * for all IO finish, hence waitting for reclaim thread, while reclaim
+         * thread is calling this function and waitting for reconfig mutex. So
+         * there is a deadlock. We workaround this issue with a trylock.
+         * FIXME: we could miss discard if we can't take reconfig mutex
          */
-        if (!log->in_teardown) {
-                set_mask_bits(&mddev->flags, 0,
-                              BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
-                md_wakeup_thread(mddev->thread);
-                wait_event(mddev->sb_wait,
-                        !test_bit(MD_CHANGE_PENDING, &mddev->flags) ||
-                        log->in_teardown);
-                /*
-                 * r5l_quiesce could run after in_teardown check and hold
-                 * mutex first. Superblock might get updated twice.
-                 */
-                if (log->in_teardown)
-                        md_update_sb(mddev, 1);
-        } else {
-                WARN_ON(!mddev_is_locked(mddev));
-                md_update_sb(mddev, 1);
-        }
+        set_mask_bits(&mddev->flags, 0,
+                BIT(MD_CHANGE_DEVS) | BIT(MD_CHANGE_PENDING));
+        if (!mddev_trylock(mddev))
+                return;
+        md_update_sb(mddev, 1);
+        mddev_unlock(mddev);
 
         /* discard IO error really doesn't matter, ignore it */
         if (log->last_checkpoint < end) {
@@ -827,7 +817,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
         if (!log || state == 2)
                 return;
         if (state == 0) {
-                log->in_teardown = 0;
                 /*
                  * This is a special case for hotadd. In suspend, the array has
                  * no journal. In resume, journal is initialized as well as the
@@ -838,11 +827,6 @@ void r5l_quiesce(struct r5l_log *log, int state)
                 log->reclaim_thread = md_register_thread(r5l_reclaim_thread,
                                         log->rdev->mddev, "reclaim");
         } else if (state == 1) {
-                /*
-                 * at this point all stripes are finished, so io_unit is at
-                 * least in STRIPE_END state
-                 */
-                log->in_teardown = 1;
                 /* make sure r5l_write_super_and_discard_space exits */
                 mddev = log->rdev->mddev;
                 wake_up(&mddev->sb_wait);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 8912407a4dd0..ee7fc3701700 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -659,6 +659,7 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
 {
         struct stripe_head *sh;
         int hash = stripe_hash_locks_hash(sector);
+        int inc_empty_inactive_list_flag;
 
         pr_debug("get_stripe, sector %llu\n", (unsigned long long)sector);
 
@@ -703,7 +704,12 @@ raid5_get_active_stripe(struct r5conf *conf, sector_t sector,
                                         atomic_inc(&conf->active_stripes);
                                 BUG_ON(list_empty(&sh->lru) &&
                                        !test_bit(STRIPE_EXPANDING, &sh->state));
+                                inc_empty_inactive_list_flag = 0;
+                                if (!list_empty(conf->inactive_list + hash))
+                                        inc_empty_inactive_list_flag = 1;
                                 list_del_init(&sh->lru);
+                                if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                        atomic_inc(&conf->empty_inactive_list_nr);
                                 if (sh->group) {
                                         sh->group->stripes_cnt--;
                                         sh->group = NULL;
@@ -762,6 +768,7 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
         sector_t head_sector, tmp_sec;
         int hash;
         int dd_idx;
+        int inc_empty_inactive_list_flag;
 
         /* Don't cross chunks, so stripe pd_idx/qd_idx is the same */
         tmp_sec = sh->sector;
@@ -779,7 +786,12 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh
                                 atomic_inc(&conf->active_stripes);
                         BUG_ON(list_empty(&head->lru) &&
                                !test_bit(STRIPE_EXPANDING, &head->state));
+                        inc_empty_inactive_list_flag = 0;
+                        if (!list_empty(conf->inactive_list + hash))
+                                inc_empty_inactive_list_flag = 1;
                         list_del_init(&head->lru);
+                        if (list_empty(conf->inactive_list + hash) && inc_empty_inactive_list_flag)
+                                atomic_inc(&conf->empty_inactive_list_nr);
                         if (head->group) {
                                 head->group->stripes_cnt--;
                                 head->group = NULL;
@@ -993,7 +1005,6 @@ again:
 
                         set_bit(STRIPE_IO_STARTED, &sh->state);
 
-                        bio_reset(bi);
                         bi->bi_bdev = rdev->bdev;
                         bio_set_op_attrs(bi, op, op_flags);
                         bi->bi_end_io = op_is_write(op)
@@ -1045,7 +1056,6 @@ again:
 
                         set_bit(STRIPE_IO_STARTED, &sh->state);
 
-                        bio_reset(rbi);
                         rbi->bi_bdev = rrdev->bdev;
                         bio_set_op_attrs(rbi, op, op_flags);
                         BUG_ON(!op_is_write(op));
@@ -1978,9 +1988,11 @@ static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
         put_cpu();
 }
 
-static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
+static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp,
+        int disks)
 {
         struct stripe_head *sh;
+        int i;
 
         sh = kmem_cache_zalloc(sc, gfp);
         if (sh) {
@@ -1989,6 +2001,17 @@ static struct stripe_head *alloc_stripe(struct kmem_cache *sc, gfp_t gfp)
                 INIT_LIST_HEAD(&sh->batch_list);
                 INIT_LIST_HEAD(&sh->lru);
                 atomic_set(&sh->count, 1);
+                for (i = 0; i < disks; i++) {
+                        struct r5dev *dev = &sh->dev[i];
+
+                        bio_init(&dev->req);
+                        dev->req.bi_io_vec = &dev->vec;
+                        dev->req.bi_max_vecs = 1;
+
+                        bio_init(&dev->rreq);
+                        dev->rreq.bi_io_vec = &dev->rvec;
+                        dev->rreq.bi_max_vecs = 1;
+                }
         }
         return sh;
 }
@@ -1996,7 +2019,7 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp)
 {
         struct stripe_head *sh;
 
-        sh = alloc_stripe(conf->slab_cache, gfp);
+        sh = alloc_stripe(conf->slab_cache, gfp, conf->pool_size);
         if (!sh)
                 return 0;
 
@@ -2167,7 +2190,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
         mutex_lock(&conf->cache_size_mutex);
 
         for (i = conf->max_nr_stripes; i; i--) {
-                nsh = alloc_stripe(sc, GFP_KERNEL);
+                nsh = alloc_stripe(sc, GFP_KERNEL, newsize);
                 if (!nsh)
                         break;
 
@@ -2299,6 +2322,7 @@ static void raid5_end_read_request(struct bio * bi)
                 (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                 bi->bi_error);
         if (i == disks) {
+                bio_reset(bi);
                 BUG();
                 return;
         }
@@ -2399,6 +2423,7 @@ static void raid5_end_read_request(struct bio * bi)
                 }
         }
         rdev_dec_pending(rdev, conf->mddev);
+        bio_reset(bi);
         clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
         raid5_release_stripe(sh);
@@ -2436,6 +2461,7 @@ static void raid5_end_write_request(struct bio *bi)
                 (unsigned long long)sh->sector, i, atomic_read(&sh->count),
                 bi->bi_error);
         if (i == disks) {
+                bio_reset(bi);
                 BUG();
                 return;
         }
@@ -2472,6 +2498,7 @@ static void raid5_end_write_request(struct bio *bi)
         if (sh->batch_head && bi->bi_error && !replacement)
                 set_bit(STRIPE_BATCH_ERR, &sh->batch_head->state);
 
+        bio_reset(bi);
         if (!test_and_clear_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags))
                 clear_bit(R5_LOCKED, &sh->dev[i].flags);
         set_bit(STRIPE_HANDLE, &sh->state);
@@ -2485,16 +2512,6 @@ static void raid5_build_block(struct stripe_head *sh, int i, int previous)
 {
         struct r5dev *dev = &sh->dev[i];
 
-        bio_init(&dev->req);
-        dev->req.bi_io_vec = &dev->vec;
-        dev->req.bi_max_vecs = 1;
-        dev->req.bi_private = sh;
-
-        bio_init(&dev->rreq);
-        dev->rreq.bi_io_vec = &dev->rvec;
-        dev->rreq.bi_max_vecs = 1;
-        dev->rreq.bi_private = sh;
-
         dev->flags = 0;
         dev->sector = raid5_compute_blocknr(sh, i, previous);
 }
@@ -4628,7 +4645,9 @@ finish:
         }
 
         if (!bio_list_empty(&s.return_bi)) {
-                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags)) {
+                if (test_bit(MD_CHANGE_PENDING, &conf->mddev->flags) &&
+                                (s.failed <= conf->max_degraded ||
+                                        conf->mddev->external == 0)) {
                         spin_lock_irq(&conf->device_lock);
                         bio_list_merge(&conf->return_bi, &s.return_bi);
                         spin_unlock_irq(&conf->device_lock);
@@ -6620,6 +6639,16 @@ static struct r5conf *setup_conf(struct mddev *mddev)
         }
 
         conf->min_nr_stripes = NR_STRIPES;
+        if (mddev->reshape_position != MaxSector) {
+                int stripes = max_t(int,
+                        ((mddev->chunk_sectors << 9) / STRIPE_SIZE) * 4,
+                        ((mddev->new_chunk_sectors << 9) / STRIPE_SIZE) * 4);
+                conf->min_nr_stripes = max(NR_STRIPES, stripes);
+                if (conf->min_nr_stripes != NR_STRIPES)
+                        printk(KERN_INFO
+                                "md/raid:%s: force stripe size %d for reshape\n",
+                                mdname(mddev), conf->min_nr_stripes);
+        }
         memory = conf->min_nr_stripes * (sizeof(struct stripe_head) +
                  max_disks * ((sizeof(struct bio) + PAGE_SIZE))) / 1024;
         atomic_set(&conf->empty_inactive_list_nr, NR_STRIPE_HASH_LOCKS);
@@ -6826,11 +6855,14 @@ static int raid5_run(struct mddev *mddev)
         if (IS_ERR(conf))
                 return PTR_ERR(conf);
 
-        if (test_bit(MD_HAS_JOURNAL, &mddev->flags) && !journal_dev) {
-                printk(KERN_ERR "md/raid:%s: journal disk is missing, force array readonly\n",
-                       mdname(mddev));
-                mddev->ro = 1;
-                set_disk_ro(mddev->gendisk, 1);
+        if (test_bit(MD_HAS_JOURNAL, &mddev->flags)) {
+                if (!journal_dev) {
+                        pr_err("md/raid:%s: journal disk is missing, force array readonly\n",
+                               mdname(mddev));
+                        mddev->ro = 1;
+                        set_disk_ro(mddev->gendisk, 1);
+                } else if (mddev->recovery_cp == MaxSector)
+                        set_bit(MD_JOURNAL_CLEAN, &mddev->flags);
         }
 
         conf->min_offset_diff = min_offset_diff;
diff --git a/drivers/media/cec-edid.c b/drivers/media/cec-edid.c
index 70018247bdda..5719b991e340 100644
--- a/drivers/media/cec-edid.c
+++ b/drivers/media/cec-edid.c
@@ -70,7 +70,10 @@ static unsigned int cec_get_edid_spa_location(const u8 *edid, unsigned int size)
                                 u8 tag = edid[i] >> 5;
                                 u8 len = edid[i] & 0x1f;
 
-                                if (tag == 3 && len >= 5 && i + len <= end)
+                                if (tag == 3 && len >= 5 && i + len <= end &&
+                                    edid[i + 1] == 0x03 &&
+                                    edid[i + 2] == 0x0c &&
+                                    edid[i + 3] == 0x00)
                                         return i + 4;
                                 i += len + 1;
                         } while (i < end);
diff --git a/drivers/media/pci/cx23885/cx23885-417.c b/drivers/media/pci/cx23885/cx23885-417.c
index efec2d1a7afd..4d080da7afaf 100644
--- a/drivers/media/pci/cx23885/cx23885-417.c
+++ b/drivers/media/pci/cx23885/cx23885-417.c
@@ -1552,6 +1552,7 @@ int cx23885_417_register(struct cx23885_dev *dev)
         q->mem_ops = &vb2_dma_sg_memops;
         q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
         q->lock = &dev->lock;
+        q->dev = &dev->pci->dev;
 
         err = vb2_queue_init(q);
         if (err < 0)
diff --git a/drivers/media/pci/saa7134/saa7134-dvb.c b/drivers/media/pci/saa7134/saa7134-dvb.c
index db987e5b93eb..59a4b5f7724e 100644
--- a/drivers/media/pci/saa7134/saa7134-dvb.c
+++ b/drivers/media/pci/saa7134/saa7134-dvb.c
@@ -1238,6 +1238,7 @@ static int dvb_init(struct saa7134_dev *dev)
         q->buf_struct_size = sizeof(struct saa7134_buf);
         q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
         q->lock = &dev->lock;
+        q->dev = &dev->pci->dev;
         ret = vb2_queue_init(q);
         if (ret) {
                 vb2_dvb_dealloc_frontends(&dev->frontends);
diff --git a/drivers/media/pci/saa7134/saa7134-empress.c b/drivers/media/pci/saa7134/saa7134-empress.c
index ca417a454d67..791a5161809b 100644
--- a/drivers/media/pci/saa7134/saa7134-empress.c
+++ b/drivers/media/pci/saa7134/saa7134-empress.c
@@ -295,6 +295,7 @@ static int empress_init(struct saa7134_dev *dev)
         q->buf_struct_size = sizeof(struct saa7134_buf);
         q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
         q->lock = &dev->lock;
+        q->dev = &dev->pci->dev;
         err = vb2_queue_init(q);
         if (err)
                 return err;
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index f25344bc7912..552b635cfce7 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -169,7 +169,7 @@ config VIDEO_MEDIATEK_VPU
 config VIDEO_MEDIATEK_VCODEC
         tristate "Mediatek Video Codec driver"
         depends on MTK_IOMMU || COMPILE_TEST
-        depends on VIDEO_DEV && VIDEO_V4L2
+        depends on VIDEO_DEV && VIDEO_V4L2 && HAS_DMA
         depends on ARCH_MEDIATEK || COMPILE_TEST
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h b/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h
index 94f0a425be42..3a8e6958adae 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_drv.h
@@ -23,7 +23,6 @@
 #include <media/v4l2-ioctl.h>
 #include <media/videobuf2-core.h>
 
-#include "mtk_vcodec_util.h"
 
 #define MTK_VCODEC_DRV_NAME     "mtk_vcodec_drv"
 #define MTK_VCODEC_ENC_NAME     "mtk-vcodec-enc"
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
index 3ed3f2d31df5..2c5719ac23b2 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c
@@ -487,7 +487,6 @@ static int vidioc_venc_s_fmt_out(struct file *file, void *priv,
         struct mtk_q_data *q_data;
         int ret, i;
         struct mtk_video_fmt *fmt;
-        unsigned int pitch_w_div16;
         struct v4l2_pix_format_mplane *pix_fmt_mp = &f->fmt.pix_mp;
 
         vq = v4l2_m2m_get_vq(ctx->m2m_ctx, f->type);
@@ -530,15 +529,6 @@ static int vidioc_venc_s_fmt_out(struct file *file, void *priv,
         q_data->coded_width = f->fmt.pix_mp.width;
         q_data->coded_height = f->fmt.pix_mp.height;
 
-        pitch_w_div16 = DIV_ROUND_UP(q_data->visible_width, 16);
-        if (pitch_w_div16 % 8 != 0) {
-                /* Adjust returned width/height, so application could correctly
-                 * allocate hw required memory
-                 */
-                q_data->visible_height += 32;
-                vidioc_try_fmt(f, q_data->fmt);
-        }
-
         q_data->field = f->fmt.pix_mp.field;
         ctx->colorspace = f->fmt.pix_mp.colorspace;
         ctx->ycbcr_enc = f->fmt.pix_mp.ycbcr_enc;
@@ -878,7 +868,8 @@ static int mtk_venc_encode_header(void *priv)
 {
         struct mtk_vcodec_ctx *ctx = priv;
         int ret;
-        struct vb2_buffer *dst_buf;
+        struct vb2_buffer *src_buf, *dst_buf;
+        struct vb2_v4l2_buffer *dst_vb2_v4l2, *src_vb2_v4l2;
         struct mtk_vcodec_mem bs_buf;
         struct venc_done_result enc_result;
 
@@ -911,6 +902,15 @@ static int mtk_venc_encode_header(void *priv)
                 mtk_v4l2_err("venc_if_encode failed=%d", ret);
                 return -EINVAL;
         }
+        src_buf = v4l2_m2m_next_src_buf(ctx->m2m_ctx);
+        if (src_buf) {
+                src_vb2_v4l2 = to_vb2_v4l2_buffer(src_buf);
+                dst_vb2_v4l2 = to_vb2_v4l2_buffer(dst_buf);
+                dst_buf->timestamp = src_buf->timestamp;
+                dst_vb2_v4l2->timecode = src_vb2_v4l2->timecode;
+        } else {
+                mtk_v4l2_err("No timestamp for the header buffer.");
+        }
 
         ctx->state = MTK_STATE_HEADER;
         dst_buf->planes[0].bytesused = enc_result.bs_size;
@@ -1003,7 +1003,7 @@ static void mtk_venc_worker(struct work_struct *work)
         struct mtk_vcodec_mem bs_buf;
         struct venc_done_result enc_result;
         int ret, i;
-        struct vb2_v4l2_buffer *vb2_v4l2;
+        struct vb2_v4l2_buffer *dst_vb2_v4l2, *src_vb2_v4l2;
 
         /* check dst_buf, dst_buf may be removed in device_run
          * to stored encdoe header so we need check dst_buf and
@@ -1043,9 +1043,14 @@ static void mtk_venc_worker(struct work_struct *work)
         ret = venc_if_encode(ctx, VENC_START_OPT_ENCODE_FRAME,
                              &frm_buf, &bs_buf, &enc_result);
 
-        vb2_v4l2 = container_of(dst_buf, struct vb2_v4l2_buffer, vb2_buf);
+        src_vb2_v4l2 = to_vb2_v4l2_buffer(src_buf);
+        dst_vb2_v4l2 = to_vb2_v4l2_buffer(dst_buf);
+
+        dst_buf->timestamp = src_buf->timestamp;
+        dst_vb2_v4l2->timecode = src_vb2_v4l2->timecode;
+
         if (enc_result.is_key_frm)
-                vb2_v4l2->flags |= V4L2_BUF_FLAG_KEYFRAME;
+                dst_vb2_v4l2->flags |= V4L2_BUF_FLAG_KEYFRAME;
 
         if (ret) {
                 v4l2_m2m_buf_done(to_vb2_v4l2_buffer(src_buf),
@@ -1217,7 +1222,7 @@ int mtk_vcodec_enc_ctrls_setup(struct mtk_vcodec_ctx *ctx)
                         0, V4L2_MPEG_VIDEO_HEADER_MODE_SEPARATE);
         v4l2_ctrl_new_std_menu(handler, ops, V4L2_CID_MPEG_VIDEO_H264_PROFILE,
                         V4L2_MPEG_VIDEO_H264_PROFILE_HIGH,
-                        0, V4L2_MPEG_VIDEO_H264_PROFILE_MAIN);
+                        0, V4L2_MPEG_VIDEO_H264_PROFILE_HIGH);
         v4l2_ctrl_new_std_menu(handler, ops, V4L2_CID_MPEG_VIDEO_H264_LEVEL,
                         V4L2_MPEG_VIDEO_H264_LEVEL_4_2,
                         0, V4L2_MPEG_VIDEO_H264_LEVEL_4_0);
@@ -1288,5 +1293,10 @@ int mtk_venc_lock(struct mtk_vcodec_ctx *ctx)
 
 void mtk_vcodec_enc_release(struct mtk_vcodec_ctx *ctx)
 {
-        venc_if_deinit(ctx);
+        int ret = venc_if_deinit(ctx);
+
+        if (ret)
+                mtk_v4l2_err("venc_if_deinit failed=%d", ret);
+
+        ctx->state = MTK_STATE_FREE;
 }
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
index c7806ecda2dd..5cd2151431bf 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c
@@ -218,11 +218,15 @@ static int fops_vcodec_release(struct file *file)
         mtk_v4l2_debug(1, "[%d] encoder", ctx->id);
         mutex_lock(&dev->dev_mutex);
 
+        /*
+         * Call v4l2_m2m_ctx_release to make sure the worker thread is not
+         * running after venc_if_deinit.
+         */
+        v4l2_m2m_ctx_release(ctx->m2m_ctx);
         mtk_vcodec_enc_release(ctx);
         v4l2_fh_del(&ctx->fh);
         v4l2_fh_exit(&ctx->fh);
         v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
-        v4l2_m2m_ctx_release(ctx->m2m_ctx);
 
         list_del_init(&ctx->list);
         dev->num_instances--;
diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h b/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h
index 33e890f5aa9c..12131855b46a 100644
--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h
+++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_intr.h
@@ -16,7 +16,6 @@
 #define _MTK_VCODEC_INTR_H_
 
 #define MTK_INST_IRQ_RECEIVED           0x1
-#define MTK_INST_WORK_THREAD_ABORT_DONE 0x2
 
 struct mtk_vcodec_ctx;
 
diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
index 9a600525b3c1..63d4be4ff327 100644
--- a/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
+++ b/drivers/media/platform/mtk-vcodec/venc/venc_h264_if.c
@@ -61,6 +61,8 @@ enum venc_h264_bs_mode {
 
 /*
  * struct venc_h264_vpu_config - Structure for h264 encoder configuration
+ *                               AP-W/R : AP is writer/reader on this item
+ *                               VPU-W/R: VPU is write/reader on this item
  * @input_fourcc: input fourcc
  * @bitrate: target bitrate (in bps)
  * @pic_w: picture width. Picture size is visible stream resolution, in pixels,
@@ -94,13 +96,13 @@ struct venc_h264_vpu_config {
 
 /*
  * struct venc_h264_vpu_buf - Structure for buffer information
- * @align: buffer alignment (in bytes)
+ *                            AP-W/R : AP is writer/reader on this item
+ *                            VPU-W/R: VPU is write/reader on this item
  * @iova: IO virtual address
  * @vpua: VPU side memory addr which is used by RC_CODE
  * @size: buffer size (in bytes)
  */
 struct venc_h264_vpu_buf {
-        u32 align;
         u32 iova;
         u32 vpua;
         u32 size;
@@ -108,6 +110,8 @@ struct venc_h264_vpu_buf {
 
 /*
  * struct venc_h264_vsi - Structure for VPU driver control and info share
+ *                        AP-W/R : AP is writer/reader on this item
+ *                        VPU-W/R: VPU is write/reader on this item
  * This structure is allocated in VPU side and shared to AP side.
  * @config: h264 encoder configuration
  * @work_bufs: working buffer information in VPU side
@@ -150,12 +154,6 @@ struct venc_h264_inst {
         struct mtk_vcodec_ctx *ctx;
 };
 
-static inline void h264_write_reg(struct venc_h264_inst *inst, u32 addr,
-                                  u32 val)
-{
-        writel(val, inst->hw_base + addr);
-}
-
 static inline u32 h264_read_reg(struct venc_h264_inst *inst, u32 addr)
 {
         return readl(inst->hw_base + addr);
@@ -214,6 +212,8 @@ static unsigned int h264_get_level(struct venc_h264_inst *inst,
                 return 40;
         case V4L2_MPEG_VIDEO_H264_LEVEL_4_1:
                 return 41;
+        case V4L2_MPEG_VIDEO_H264_LEVEL_4_2:
+                return 42;
         default:
                 mtk_vcodec_debug(inst, "unsupported level %d", level);
                 return 31;
diff --git a/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c b/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
index 60bbcd2a0510..6d9758479f9a 100644
--- a/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
+++ b/drivers/media/platform/mtk-vcodec/venc/venc_vp8_if.c
@@ -56,6 +56,8 @@ enum venc_vp8_vpu_work_buf {
 
 /*
  * struct venc_vp8_vpu_config - Structure for vp8 encoder configuration
+ *                              AP-W/R : AP is writer/reader on this item
+ *                              VPU-W/R: VPU is write/reader on this item
  * @input_fourcc: input fourcc
  * @bitrate: target bitrate (in bps)
  * @pic_w: picture width. Picture size is visible stream resolution, in pixels,
@@ -83,14 +85,14 @@ struct venc_vp8_vpu_config {
 };
 
 /*
- * struct venc_vp8_vpu_buf -Structure for buffer information
- * @align: buffer alignment (in bytes)
+ * struct venc_vp8_vpu_buf - Structure for buffer information
+ *                           AP-W/R : AP is writer/reader on this item
+ *                           VPU-W/R: VPU is write/reader on this item
  * @iova: IO virtual address
  * @vpua: VPU side memory addr which is used by RC_CODE
  * @size: buffer size (in bytes)
  */
 struct venc_vp8_vpu_buf {
-        u32 align;
         u32 iova;
         u32 vpua;
         u32 size;
@@ -98,6 +100,8 @@ struct venc_vp8_vpu_buf {
 
 /*
  * struct venc_vp8_vsi - Structure for VPU driver control and info share
+ *                       AP-W/R : AP is writer/reader on this item
+ *                       VPU-W/R: VPU is write/reader on this item
  * This structure is allocated in VPU side and shared to AP side.
  * @config: vp8 encoder configuration
  * @work_bufs: working buffer information in VPU side
@@ -138,12 +142,6 @@ struct venc_vp8_inst {
         struct mtk_vcodec_ctx *ctx;
 };
 
-static inline void vp8_enc_write_reg(struct venc_vp8_inst *inst, u32 addr,
-                                     u32 val)
-{
-        writel(val, inst->hw_base + addr);
-}
-
 static inline u32 vp8_enc_read_reg(struct venc_vp8_inst *inst, u32 addr)
 {
         return readl(inst->hw_base + addr);
diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c
index 6a7bcc3028b1..bc50c69ee0c5 100644
--- a/drivers/media/platform/rcar-fcp.c
+++ b/drivers/media/platform/rcar-fcp.c
@@ -99,10 +99,16 @@ EXPORT_SYMBOL_GPL(rcar_fcp_put);
  */
 int rcar_fcp_enable(struct rcar_fcp_device *fcp)
 {
+        int error;
+
         if (!fcp)
                 return 0;
 
-        return pm_runtime_get_sync(fcp->dev);
+        error = pm_runtime_get_sync(fcp->dev);
+        if (error < 0)
+                return error;
+
+        return 0;
 }
 EXPORT_SYMBOL_GPL(rcar_fcp_enable);
 
diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
index 869c83fb3c5d..f00f3e742265 100644
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -2185,7 +2185,7 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
         int ret;
         struct device_node *child;
@@ -2200,11 +2200,11 @@ static int gpmc_probe_dt_children(struct platform_device *pdev)
                 else
                         ret = gpmc_probe_generic_child(pdev, child);
 
-                if (ret)
-                        return ret;
+                if (ret) {
+                        dev_err(&pdev->dev, "failed to probe DT child '%s': %d\n",
+                                child->name, ret);
+                }
         }
-
-        return 0;
 }
 #else
 static int gpmc_probe_dt(struct platform_device *pdev)
@@ -2212,9 +2212,8 @@ static int gpmc_probe_dt(struct platform_device *pdev)
         return 0;
 }
 
-static int gpmc_probe_dt_children(struct platform_device *pdev)
+static void gpmc_probe_dt_children(struct platform_device *pdev)
 {
-        return 0;
 }
 #endif /* CONFIG_OF */
 
@@ -2369,16 +2368,10 @@ static int gpmc_probe(struct platform_device *pdev)
                 goto setup_irq_failed;
         }
 
-        rc = gpmc_probe_dt_children(pdev);
-        if (rc < 0) {
-                dev_err(gpmc->dev, "failed to probe DT children\n");
-                goto dt_children_failed;
-        }
+        gpmc_probe_dt_children(pdev);
 
         return 0;
 
-dt_children_failed:
-        gpmc_free_irq(gpmc);
 setup_irq_failed:
         gpmc_gpio_exit(gpmc);
 gpio_init_failed:
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a216b4667742..d00252828966 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -345,16 +345,6 @@ config SENSORS_TSL2550
           This driver can also be built as a module.  If so, the module
           will be called tsl2550.
 
-config SENSORS_BH1780
-        tristate "ROHM BH1780GLI ambient light sensor"
-        depends on I2C && SYSFS
-        help
-          If you say yes here you get support for the ROHM BH1780GLI
-          ambient light sensor.
-
-          This driver can also be built as a module.  If so, the module
-          will be called bh1780gli.
-
 config SENSORS_BH1770
          tristate "BH1770GLC / SFH7770 combined ALS - Proximity sensor"
          depends on I2C
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 4387ccb79e64..fb32516ddfe2 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -19,7 +19,6 @@ obj-$(CONFIG_TIFM_CORE)       	+= tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
 obj-$(CONFIG_PHANTOM)           += phantom.o
 obj-$(CONFIG_QCOM_COINCELL)     += qcom-coincell.o
-obj-$(CONFIG_SENSORS_BH1780)    += bh1780gli.o
 obj-$(CONFIG_SENSORS_BH1770)    += bh1770glc.o
 obj-$(CONFIG_SENSORS_APDS990X)  += apds990x.o
 obj-$(CONFIG_SGI_IOC4)          += ioc4.o
@@ -69,5 +68,6 @@ OBJCOPYFLAGS :=
 OBJCOPYFLAGS_lkdtm_rodata_objcopy.o := \
                         --set-section-flags .text=alloc,readonly \
                         --rename-section .text=.rodata
-$(obj)/lkdtm_rodata_objcopy.o: $(obj)/lkdtm_rodata.o
+targets += lkdtm_rodata.o lkdtm_rodata_objcopy.o
+$(obj)/lkdtm_rodata_objcopy.o: $(obj)/lkdtm_rodata.o FORCE
         $(call if_changed,objcopy)
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
deleted file mode 100644
index 7f90ce5a569a..000000000000
--- a/drivers/misc/bh1780gli.c
+++ /dev/null
@@ -1,259 +0,0 @@
-/*
- * bh1780gli.c
- * ROHM Ambient Light Sensor Driver
- *
- * Copyright (C) 2010 Texas Instruments
- * Author: Hemanth V <hemanthv@ti.com>
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- * You should have received a copy of the GNU General Public License along with
- * this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-#include <linux/i2c.h>
-#include <linux/slab.h>
-#include <linux/mutex.h>
-#include <linux/platform_device.h>
-#include <linux/delay.h>
-#include <linux/module.h>
-#include <linux/of.h>
-
-#define BH1780_REG_CONTROL      0x80
-#define BH1780_REG_PARTID       0x8A
-#define BH1780_REG_MANFID       0x8B
-#define BH1780_REG_DLOW 0x8C
-#define BH1780_REG_DHIGH        0x8D
-
-#define BH1780_REVMASK          (0xf)
-#define BH1780_POWMASK          (0x3)
-#define BH1780_POFF             (0x0)
-#define BH1780_PON              (0x3)
-
-/* power on settling time in ms */
-#define BH1780_PON_DELAY        2
-
-struct bh1780_data {
-        struct i2c_client *client;
-        int power_state;
-        /* lock for sysfs operations */
-        struct mutex lock;
-};
-
-static int bh1780_write(struct bh1780_data *ddata, u8 reg, u8 val, char *msg)
-{
-        int ret = i2c_smbus_write_byte_data(ddata->client, reg, val);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_write_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-
-static int bh1780_read(struct bh1780_data *ddata, u8 reg, char *msg)
-{
-        int ret = i2c_smbus_read_byte_data(ddata->client, reg);
-        if (ret < 0)
-                dev_err(&ddata->client->dev,
-                        "i2c_smbus_read_byte_data failed error %d Register (%s)\n",
-                        ret, msg);
-        return ret;
-}
-
-static ssize_t bh1780_show_lux(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int lsb, msb;
-
-        lsb = bh1780_read(ddata, BH1780_REG_DLOW, "DLOW");
-        if (lsb < 0)
-                return lsb;
-
-        msb = bh1780_read(ddata, BH1780_REG_DHIGH, "DHIGH");
-        if (msb < 0)
-                return msb;
-
-        return sprintf(buf, "%d\n", (msb << 8) | lsb);
-}
-
-static ssize_t bh1780_show_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        char *buf)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        int state;
-
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-
-        return sprintf(buf, "%d\n", state & BH1780_POWMASK);
-}
-
-static ssize_t bh1780_store_power_state(struct device *dev,
-                                        struct device_attribute *attr,
-                                        const char *buf, size_t count)
-{
-        struct platform_device *pdev = to_platform_device(dev);
-        struct bh1780_data *ddata = platform_get_drvdata(pdev);
-        unsigned long val;
-        int error;
-
-        error = kstrtoul(buf, 0, &val);
-        if (error)
-                return error;
-
-        if (val < BH1780_POFF || val > BH1780_PON)
-                return -EINVAL;
-
-        mutex_lock(&ddata->lock);
-
-        error = bh1780_write(ddata, BH1780_REG_CONTROL, val, "CONTROL");
-        if (error < 0) {
-                mutex_unlock(&ddata->lock);
-                return error;
-        }
-
-        msleep(BH1780_PON_DELAY);
-        ddata->power_state = val;
-        mutex_unlock(&ddata->lock);
-
-        return count;
-}
-
-static DEVICE_ATTR(lux, S_IRUGO, bh1780_show_lux, NULL);
-
-static DEVICE_ATTR(power_state, S_IWUSR | S_IRUGO,
-                bh1780_show_power_state, bh1780_store_power_state);
-
-static struct attribute *bh1780_attributes[] = {
-        &dev_attr_power_state.attr,
-        &dev_attr_lux.attr,
-        NULL
-};
-
-static const struct attribute_group bh1780_attr_group = {
-        .attrs = bh1780_attributes,
-};
-
-static int bh1780_probe(struct i2c_client *client,
-                                                const struct i2c_device_id *id)
-{
-        int ret;
-        struct bh1780_data *ddata;
-        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
-
-        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE))
-                return -EIO;
-
-        ddata = devm_kzalloc(&client->dev, sizeof(struct bh1780_data),
-                             GFP_KERNEL);
-        if (ddata == NULL)
-                return -ENOMEM;
-
-        ddata->client = client;
-        i2c_set_clientdata(client, ddata);
-
-        ret = bh1780_read(ddata, BH1780_REG_PARTID, "PART ID");
-        if (ret < 0)
-                return ret;
-
-        dev_info(&client->dev, "Ambient Light Sensor, Rev : %d\n",
-                        (ret & BH1780_REVMASK));
-
-        mutex_init(&ddata->lock);
-
-        return sysfs_create_group(&client->dev.kobj, &bh1780_attr_group);
-}
-
-static int bh1780_remove(struct i2c_client *client)
-{
-        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-
-        return 0;
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int bh1780_suspend(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-
-        ddata = i2c_get_clientdata(client);
-        state = bh1780_read(ddata, BH1780_REG_CONTROL, "CONTROL");
-        if (state < 0)
-                return state;
-
-        ddata->power_state = state & BH1780_POWMASK;
-
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, BH1780_POFF,
-                                "CONTROL");
-
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-
-static int bh1780_resume(struct device *dev)
-{
-        struct bh1780_data *ddata;
-        int state, ret;
-        struct i2c_client *client = to_i2c_client(dev);
-
-        ddata = i2c_get_clientdata(client);
-        state = ddata->power_state;
-        ret = bh1780_write(ddata, BH1780_REG_CONTROL, state,
-                                "CONTROL");
-
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-#endif /* CONFIG_PM_SLEEP */
-
-static SIMPLE_DEV_PM_OPS(bh1780_pm, bh1780_suspend, bh1780_resume);
-
-static const struct i2c_device_id bh1780_id[] = {
-        { "bh1780", 0 },
-        { },
-};
-
-MODULE_DEVICE_TABLE(i2c, bh1780_id);
-
-#ifdef CONFIG_OF
-static const struct of_device_id of_bh1780_match[] = {
-        { .compatible = "rohm,bh1780gli", },
-        {},
-};
-
-MODULE_DEVICE_TABLE(of, of_bh1780_match);
-#endif
-
-static struct i2c_driver bh1780_driver = {
-        .probe          = bh1780_probe,
-        .remove         = bh1780_remove,
-        .id_table       = bh1780_id,
-        .driver = {
-                .name = "bh1780",
-                .pm     = &bh1780_pm,
-                .of_match_table = of_match_ptr(of_bh1780_match),
-        },
-};
-
-module_i2c_driver(bh1780_driver);
-
-MODULE_DESCRIPTION("BH1780GLI Ambient Light Sensor Driver");
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Hemanth V <hemanthv@ti.com>");
diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
index bdee9a01ef35..c466ee2b0c97 100644
--- a/drivers/misc/cxl/context.c
+++ b/drivers/misc/cxl/context.c
@@ -90,8 +90,7 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master,
          */
         mutex_lock(&afu->contexts_lock);
         idr_preload(GFP_KERNEL);
-        i = idr_alloc(&ctx->afu->contexts_idr, ctx,
-                      ctx->afu->adapter->native->sl_ops->min_pe,
+        i = idr_alloc(&ctx->afu->contexts_idr, ctx, ctx->afu->adapter->min_pe,
                       ctx->afu->num_procs, GFP_NOWAIT);
         idr_preload_end();
         mutex_unlock(&afu->contexts_lock);
diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h
index de090533f18c..344a0ff8f8c7 100644
--- a/drivers/misc/cxl/cxl.h
+++ b/drivers/misc/cxl/cxl.h
@@ -561,7 +561,6 @@ struct cxl_service_layer_ops {
         u64 (*timebase_read)(struct cxl *adapter);
         int capi_mode;
         bool needs_reset_before_disable;
-        int min_pe;
 };
 
 struct cxl_native {
@@ -603,6 +602,7 @@ struct cxl {
         struct bin_attribute cxl_attr;
         int adapter_num;
         int user_irqs;
+        int min_pe;
         u64 ps_size;
         u16 psl_rev;
         u16 base_image;
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 3bcdaee11ba1..e606fdc4bc9c 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -924,7 +924,7 @@ static irqreturn_t native_irq_multiplexed(int irq, void *data)
         return fail_psl_irq(afu, &irq_info);
 }
 
-void native_irq_wait(struct cxl_context *ctx)
+static void native_irq_wait(struct cxl_context *ctx)
 {
         u64 dsisr;
         int timeout = 1000;
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index d152e2de8c93..6f0c4ac4b649 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -379,7 +379,7 @@ static int calc_capp_routing(struct pci_dev *dev, u64 *chipid, u64 *capp_unit_id
 
 static int init_implementation_adapter_psl_regs(struct cxl *adapter, struct pci_dev *dev)
 {
-        u64 psl_dsnctl;
+        u64 psl_dsnctl, psl_fircntl;
         u64 chipid;
         u64 capp_unit_id;
         int rc;
@@ -398,8 +398,11 @@ static int init_implementation_adapter_psl_regs(struct cxl *adapter, struct pci_
         cxl_p1_write(adapter, CXL_PSL_RESLCKTO, 0x20000000200ULL);
         /* snoop write mask */
         cxl_p1_write(adapter, CXL_PSL_SNWRALLOC, 0x00000000FFFFFFFFULL);
-        /* set fir_accum */
-        cxl_p1_write(adapter, CXL_PSL_FIR_CNTL, 0x0800000000000000ULL);
+        /* set fir_cntl to recommended value for production env */
+        psl_fircntl = (0x2ULL << (63-3)); /* ce_report */
+        psl_fircntl |= (0x1ULL << (63-6)); /* FIR_report */
+        psl_fircntl |= 0x1ULL; /* ce_thresh */
+        cxl_p1_write(adapter, CXL_PSL_FIR_CNTL, psl_fircntl);
         /* for debugging with trace arrays */
         cxl_p1_write(adapter, CXL_PSL_TRACE, 0x0000FF7C00000000ULL);
 
@@ -1521,14 +1524,15 @@ static const struct cxl_service_layer_ops xsl_ops = {
         .write_timebase_ctrl = write_timebase_ctrl_xsl,
         .timebase_read = timebase_read_xsl,
         .capi_mode = OPAL_PHB_CAPI_MODE_DMA,
-        .min_pe = 1, /* Workaround for Mellanox CX4 HW bug */
 };
 
 static void set_sl_ops(struct cxl *adapter, struct pci_dev *dev)
 {
         if (dev->vendor == PCI_VENDOR_ID_MELLANOX && dev->device == 0x1013) {
+                /* Mellanox CX-4 */
                 dev_info(&adapter->dev, "Device uses an XSL\n");
                 adapter->native->sl_ops = &xsl_ops;
+                adapter->min_pe = 1; /* Workaround for CX-4 hardware bug */
         } else {
                 dev_info(&adapter->dev, "Device uses a PSL\n");
                 adapter->native->sl_ops = &psl_ops;
diff --git a/drivers/misc/cxl/vphb.c b/drivers/misc/cxl/vphb.c
index dee8def1c193..3519acebfdab 100644
--- a/drivers/misc/cxl/vphb.c
+++ b/drivers/misc/cxl/vphb.c
@@ -221,7 +221,7 @@ int cxl_pci_vphb_add(struct cxl_afu *afu)
         /* Setup the PHB using arch provided callback */
         phb->ops = &cxl_pcie_pci_ops;
         phb->cfg_addr = NULL;
-        phb->cfg_data = 0;
+        phb->cfg_data = NULL;
         phb->private_data = afu;
         phb->controller_ops = cxl_pci_controller_ops;
 
@@ -230,6 +230,11 @@ int cxl_pci_vphb_add(struct cxl_afu *afu)
         if (phb->bus == NULL)
                 return -ENXIO;
 
+        /* Set release hook on root bus */
+        pci_set_host_bridge_release(to_pci_host_bridge(phb->bus->bridge),
+                                    pcibios_free_controller_deferred,
+                                    (void *) phb);
+
         /* Claim resources. This might need some rework as well depending
          * whether we are doing probe-only or not, like assigning unassigned
          * resources etc...
@@ -256,7 +261,10 @@ void cxl_pci_vphb_remove(struct cxl_afu *afu)
         afu->phb = NULL;
 
         pci_remove_root_bus(phb->bus);
-        pcibios_free_controller(phb);
+        /*
+         * We don't free phb here - that's handled by
+         * pcibios_free_controller_deferred()
+         */
 }
 
 static bool _cxl_pci_is_vphb_device(struct pci_controller *phb)
diff --git a/drivers/misc/lkdtm_rodata.c b/drivers/misc/lkdtm_rodata.c
index 166b1db3969f..3564477b8c2d 100644
--- a/drivers/misc/lkdtm_rodata.c
+++ b/drivers/misc/lkdtm_rodata.c
@@ -4,7 +4,7 @@
  */
 #include "lkdtm.h"
 
-void lkdtm_rodata_do_nothing(void)
+void notrace lkdtm_rodata_do_nothing(void)
 {
         /* Does nothing. We just want an architecture agnostic "return". */
 }
diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
index 5a3fd76eec27..1dd611423d8b 100644
--- a/drivers/misc/lkdtm_usercopy.c
+++ b/drivers/misc/lkdtm_usercopy.c
@@ -9,7 +9,15 @@
 #include <linux/uaccess.h>
 #include <asm/cacheflush.h>
 
-static size_t cache_size = 1024;
+/*
+ * Many of the tests here end up using const sizes, but those would
+ * normally be ignored by hardened usercopy, so force the compiler
+ * into choosing the non-const path to make sure we trigger the
+ * hardened usercopy checks by added "unconst" to all the const copies,
+ * and making sure "cache_size" isn't optimized into a const.
+ */
+static volatile size_t unconst = 0;
+static volatile size_t cache_size = 1024;
 static struct kmem_cache *bad_cache;
 
 static const unsigned char test_text[] = "This is a test.\n";
@@ -49,7 +57,7 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
 
         /* This is a pointer to outside our current stack frame. */
         if (bad_frame) {
-                bad_stack = do_usercopy_stack_callee((uintptr_t)bad_stack);
+                bad_stack = do_usercopy_stack_callee((uintptr_t)&bad_stack);
         } else {
                 /* Put start address just inside stack. */
                 bad_stack = task_stack_page(current) + THREAD_SIZE;
@@ -67,14 +75,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
         if (to_user) {
                 pr_info("attempting good copy_to_user of local stack\n");
                 if (copy_to_user((void __user *)user_addr, good_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_to_user of distant stack\n");
                 if (copy_to_user((void __user *)user_addr, bad_stack,
-                                 sizeof(good_stack))) {
+                                 unconst + sizeof(good_stack))) {
                         pr_warn("copy_to_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -88,14 +96,14 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
 
                 pr_info("attempting good copy_from_user of local stack\n");
                 if (copy_from_user(good_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed unexpectedly?!\n");
                         goto free_user;
                 }
 
                 pr_info("attempting bad copy_from_user of distant stack\n");
                 if (copy_from_user(bad_stack, (void __user *)user_addr,
-                                   sizeof(good_stack))) {
+                                   unconst + sizeof(good_stack))) {
                         pr_warn("copy_from_user failed, but lacked Oops\n");
                         goto free_user;
                 }
@@ -109,7 +117,7 @@ static void do_usercopy_heap_size(bool to_user)
 {
         unsigned long user_addr;
         unsigned char *one, *two;
-        const size_t size = 1024;
+        size_t size = unconst + 1024;
 
         one = kmalloc(size, GFP_KERNEL);
         two = kmalloc(size, GFP_KERNEL);
@@ -285,13 +293,14 @@ void lkdtm_USERCOPY_KERNEL(void)
 
         pr_info("attempting good copy_to_user from kernel rodata\n");
         if (copy_to_user((void __user *)user_addr, test_text,
-                         sizeof(test_text))) {
+                         unconst + sizeof(test_text))) {
                 pr_warn("copy_to_user failed unexpectedly?!\n");
                 goto free_user;
         }
 
         pr_info("attempting bad copy_to_user from kernel text\n");
-        if (copy_to_user((void __user *)user_addr, vm_mmap, PAGE_SIZE)) {
+        if (copy_to_user((void __user *)user_addr, vm_mmap,
+                         unconst + PAGE_SIZE)) {
                 pr_warn("copy_to_user failed, but lacked Oops\n");
                 goto free_user;
         }
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index e2fb44cc5c37..dc3a854e02d3 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -1263,8 +1263,14 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
 static bool mei_me_fw_type_sps(struct pci_dev *pdev)
 {
         u32 reg;
-        /* Read ME FW Status check for SPS Firmware */
-        pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+        unsigned int devfn;
+
+        /*
+         * Read ME FW Status register to check for SPS Firmware
+         * The SPS FW is only signaled in pci function 0
+         */
+        devfn = PCI_DEVFN(PCI_SLOT(pdev->devfn), 0);
+        pci_bus_read_config_dword(pdev->bus, devfn, PCI_CFG_HFS_1, &reg);
         trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
         /* if bits [19:16] = 15, running SPS Firmware */
         return (reg & 0xf0000) == 0xf0000;
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 64e64da6da44..71cea9b296b2 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -85,8 +85,8 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT, mei_me_pch8_cfg)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_cfg)},
-        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
+        {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
 
         {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
         {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 48a5dd740f3b..2206d4477dbb 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1726,6 +1726,7 @@ static u8 mmc_blk_prep_packed_list(struct mmc_queue *mq, struct request *req)
                         break;
 
                 if (req_op(next) == REQ_OP_DISCARD ||
+                    req_op(next) == REQ_OP_SECURE_ERASE ||
                     req_op(next) == REQ_OP_FLUSH)
                         break;
 
@@ -2150,6 +2151,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
         struct mmc_card *card = md->queue.card;
         struct mmc_host *host = card->host;
         unsigned long flags;
+        bool req_is_special = mmc_req_is_special(req);
 
         if (req && !mq->mqrq_prev->req)
                 /* claim host only for the first request */
@@ -2190,8 +2192,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
         }
 
 out:
-        if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) ||
-            mmc_req_is_special(req))
+        if ((!req && !(mq->flags & MMC_QUEUE_NEW_REQUEST)) || req_is_special)
                 /*
                  * Release host when there are no more requests
                  * and after special request(discard, flush) is done.
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index bf14642a576a..708057261b38 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -33,7 +33,8 @@ static int mmc_prep_request(struct request_queue *q, struct request *req)
         /*
          * We only like normal block requests and discards.
          */
-        if (req->cmd_type != REQ_TYPE_FS && req_op(req) != REQ_OP_DISCARD) {
+        if (req->cmd_type != REQ_TYPE_FS && req_op(req) != REQ_OP_DISCARD &&
+            req_op(req) != REQ_OP_SECURE_ERASE) {
                 blk_dump_rq_flags(req, "MMC bad request");
                 return BLKPREP_KILL;
         }
@@ -64,6 +65,8 @@ static int mmc_queue_thread(void *d)
                 spin_unlock_irq(q->queue_lock);
 
                 if (req || mq->mqrq_prev->req) {
+                        bool req_is_special = mmc_req_is_special(req);
+
                         set_current_state(TASK_RUNNING);
                         mq->issue_fn(mq, req);
                         cond_resched();
@@ -79,7 +82,7 @@ static int mmc_queue_thread(void *d)
                          * has been finished. Do not assign it to previous
                          * request.
                          */
-                        if (mmc_req_is_special(req))
+                        if (req_is_special)
                                 mq->mqrq_cur->req = NULL;
 
                         mq->mqrq_prev->brq.mrq.data = NULL;
diff --git a/drivers/mmc/card/queue.h b/drivers/mmc/card/queue.h
index d62531124d54..fee5e1271465 100644
--- a/drivers/mmc/card/queue.h
+++ b/drivers/mmc/card/queue.h
@@ -4,7 +4,9 @@
 static inline bool mmc_req_is_special(struct request *req)
 {
         return req &&
-                (req_op(req) == REQ_OP_FLUSH || req_op(req) == REQ_OP_DISCARD);
+                (req_op(req) == REQ_OP_FLUSH ||
+                 req_op(req) == REQ_OP_DISCARD ||
+                 req_op(req) == REQ_OP_SECURE_ERASE);
 }
 
 struct request;
diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 32380d5d4f6b..767af2026f8b 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -1112,11 +1112,12 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit)
 
                 div = (host->bus_hz != clock) ? DIV_ROUND_UP(div, 2) : 0;
 
-                dev_info(&slot->mmc->class_dev,
-                         "Bus speed (slot %d) = %dHz (slot req %dHz, actual %dHZ div = %d)\n",
-                         slot->id, host->bus_hz, clock,
-                         div ? ((host->bus_hz / div) >> 1) :
-                         host->bus_hz, div);
+                if (clock != slot->__clk_old || force_clkinit)
+                        dev_info(&slot->mmc->class_dev,
+                                 "Bus speed (slot %d) = %dHz (slot req %dHz, actual %dHZ div = %d)\n",
+                                 slot->id, host->bus_hz, clock,
+                                 div ? ((host->bus_hz / div) >> 1) :
+                                 host->bus_hz, div);
 
                 /* disable clock */
                 mci_writel(host, CLKENA, 0);
@@ -1139,6 +1140,9 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit)
 
                 /* inform CIU */
                 mci_send_cmd(slot, sdmmc_cmd_bits, 0);
+
+                /* keep the last clock value that was requested from core */
+                slot->__clk_old = clock;
         }
 
         host->current_speed = clock;
diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h
index 9e740bc232a8..e8cd2dec3263 100644
--- a/drivers/mmc/host/dw_mmc.h
+++ b/drivers/mmc/host/dw_mmc.h
@@ -249,6 +249,8 @@ extern int dw_mci_resume(struct dw_mci *host);
  * @queue_node: List node for placing this node in the @queue list of
  *      &struct dw_mci.
  * @clock: Clock rate configured by set_ios(). Protected by host->lock.
+ * @__clk_old: The last clock value that was requested from core.
+ *      Keeping track of this helps us to avoid spamming the console.
  * @flags: Random state bits associated with the slot.
  * @id: Number of this slot.
  * @sdio_id: Number of this slot in the SDIO interrupt registers.
@@ -263,6 +265,7 @@ struct dw_mci_slot {
         struct list_head        queue_node;
 
         unsigned int            clock;
+        unsigned int            __clk_old;
 
         unsigned long           flags;
 #define DW_MMC_CARD_PRESENT     0
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index f23d65eb070d..be3c49fa7382 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -1016,14 +1016,16 @@ mmc_omap_prepare_data(struct mmc_omap_host *host, struct mmc_request *req)
 
                 /* Only reconfigure if we have a different burst size */
                 if (*bp != burst) {
-                        struct dma_slave_config cfg;
-
-                        cfg.src_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
-                        cfg.dst_addr = host->phys_base + OMAP_MMC_REG(host, DATA);
-                        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-                        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-                        cfg.src_maxburst = burst;
-                        cfg.dst_maxburst = burst;
+                        struct dma_slave_config cfg = {
+                                .src_addr = host->phys_base +
+                                            OMAP_MMC_REG(host, DATA),
+                                .dst_addr = host->phys_base +
+                                            OMAP_MMC_REG(host, DATA),
+                                .src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
+                                .dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES,
+                                .src_maxburst = burst,
+                                .dst_maxburst = burst,
+                        };
 
                         if (dmaengine_slave_config(c, &cfg))
                                 goto use_pio;
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
index 24ebc9a8de89..5f2f24a7360d 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -1409,11 +1409,18 @@ static int omap_hsmmc_pre_dma_transfer(struct omap_hsmmc_host *host,
 static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
                                         struct mmc_request *req)
 {
-        struct dma_slave_config cfg;
         struct dma_async_tx_descriptor *tx;
         int ret = 0, i;
         struct mmc_data *data = req->data;
         struct dma_chan *chan;
+        struct dma_slave_config cfg = {
+                .src_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .dst_addr = host->mapbase + OMAP_HSMMC_DATA,
+                .src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES,
+                .src_maxburst = data->blksz / 4,
+                .dst_maxburst = data->blksz / 4,
+        };
 
         /* Sanity check: all the SG entries must be aligned by block size. */
         for (i = 0; i < data->sg_len; i++) {
@@ -1433,13 +1440,6 @@ static int omap_hsmmc_setup_dma_transfer(struct omap_hsmmc_host *host,
 
         chan = omap_hsmmc_get_dma_chan(host, data);
 
-        cfg.src_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.dst_addr = host->mapbase + OMAP_HSMMC_DATA;
-        cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-        cfg.src_maxburst = data->blksz / 4;
-        cfg.dst_maxburst = data->blksz / 4;
-
         ret = dmaengine_slave_config(chan, &cfg);
         if (ret)
                 return ret;
diff --git a/drivers/mmc/host/sdhci-st.c b/drivers/mmc/host/sdhci-st.c
index c95ba83366a0..ed92ce729dde 100644
--- a/drivers/mmc/host/sdhci-st.c
+++ b/drivers/mmc/host/sdhci-st.c
@@ -28,6 +28,7 @@
 
 struct st_mmc_platform_data {
         struct  reset_control *rstc;
+        struct  clk *icnclk;
         void __iomem *top_ioaddr;
 };
 
@@ -353,7 +354,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         struct sdhci_host *host;
         struct st_mmc_platform_data *pdata;
         struct sdhci_pltfm_host *pltfm_host;
-        struct clk *clk;
+        struct clk *clk, *icnclk;
         int ret = 0;
         u16 host_version;
         struct resource *res;
@@ -365,6 +366,11 @@ static int sdhci_st_probe(struct platform_device *pdev)
                 return PTR_ERR(clk);
         }
 
+        /* ICN clock isn't compulsory, but use it if it's provided. */
+        icnclk = devm_clk_get(&pdev->dev, "icn");
+        if (IS_ERR(icnclk))
+                icnclk = NULL;
+
         rstc = devm_reset_control_get(&pdev->dev, NULL);
         if (IS_ERR(rstc))
                 rstc = NULL;
@@ -389,6 +395,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         }
 
         clk_prepare_enable(clk);
+        clk_prepare_enable(icnclk);
 
         /* Configure the FlashSS Top registers for setting eMMC TX/RX delay */
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -400,6 +407,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         }
 
         pltfm_host->clk = clk;
+        pdata->icnclk = icnclk;
 
         /* Configure the Arasan HC inside the flashSS */
         st_mmcss_cconfig(np, host);
@@ -422,6 +430,7 @@ static int sdhci_st_probe(struct platform_device *pdev)
         return 0;
 
 err_out:
+        clk_disable_unprepare(icnclk);
         clk_disable_unprepare(clk);
 err_of:
         sdhci_pltfm_free(pdev);
@@ -442,6 +451,8 @@ static int sdhci_st_remove(struct platform_device *pdev)
 
         ret = sdhci_pltfm_unregister(pdev);
 
+        clk_disable_unprepare(pdata->icnclk);
+
         if (rstc)
                 reset_control_assert(rstc);
 
@@ -462,6 +473,7 @@ static int sdhci_st_suspend(struct device *dev)
         if (pdata->rstc)
                 reset_control_assert(pdata->rstc);
 
+        clk_disable_unprepare(pdata->icnclk);
         clk_disable_unprepare(pltfm_host->clk);
 out:
         return ret;
@@ -475,6 +487,7 @@ static int sdhci_st_resume(struct device *dev)
         struct device_node *np = dev->of_node;
 
         clk_prepare_enable(pltfm_host->clk);
+        clk_prepare_enable(pdata->icnclk);
 
         if (pdata->rstc)
                 reset_control_deassert(pdata->rstc);
diff --git a/drivers/mtd/nand/mtk_ecc.c b/drivers/mtd/nand/mtk_ecc.c
index 25a4fbd4d24a..d54f666417e1 100644
--- a/drivers/mtd/nand/mtk_ecc.c
+++ b/drivers/mtd/nand/mtk_ecc.c
@@ -366,7 +366,8 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
                    u8 *data, u32 bytes)
 {
         dma_addr_t addr;
-        u32 *p, len, i;
+        u8 *p;
+        u32 len, i, val;
         int ret = 0;
 
         addr = dma_map_single(ecc->dev, data, bytes, DMA_TO_DEVICE);
@@ -392,11 +393,14 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
 
         /* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */
         len = (config->strength * ECC_PARITY_BITS + 7) >> 3;
-        p = (u32 *)(data + bytes);
+        p = data + bytes;
 
         /* write the parity bytes generated by the ECC back to the OOB region */
-        for (i = 0; i < len; i++)
-                p[i] = readl(ecc->regs + ECC_ENCPAR(i));
+        for (i = 0; i < len; i++) {
+                if ((i % 4) == 0)
+                        val = readl(ecc->regs + ECC_ENCPAR(i / 4));
+                p[i] = (val >> ((i % 4) * 8)) & 0xff;
+        }
 timeout:
 
         dma_unmap_single(ecc->dev, addr, bytes, DMA_TO_DEVICE);
diff --git a/drivers/mtd/nand/mtk_nand.c b/drivers/mtd/nand/mtk_nand.c
index ddaa2acb9dd7..5223a2182ee4 100644
--- a/drivers/mtd/nand/mtk_nand.c
+++ b/drivers/mtd/nand/mtk_nand.c
@@ -93,6 +93,9 @@
 #define         NFI_FSM_MASK            (0xf << 16)
 #define NFI_ADDRCNTR            (0x70)
 #define         CNTR_MASK               GENMASK(16, 12)
+#define         ADDRCNTR_SEC_SHIFT      (12)
+#define         ADDRCNTR_SEC(val) \
+                (((val) & CNTR_MASK) >> ADDRCNTR_SEC_SHIFT)
 #define NFI_STRADDR             (0x80)
 #define NFI_BYTELEN             (0x84)
 #define NFI_CSEL                (0x90)
@@ -699,7 +702,7 @@ static int mtk_nfc_do_write_page(struct mtd_info *mtd, struct nand_chip *chip,
         }
 
         ret = readl_poll_timeout_atomic(nfc->regs + NFI_ADDRCNTR, reg,
-                                        (reg & CNTR_MASK) >= chip->ecc.steps,
+                                        ADDRCNTR_SEC(reg) >= chip->ecc.steps,
                                         10, MTK_TIMEOUT);
         if (ret)
                 dev_err(dev, "hwecc write timeout\n");
@@ -902,7 +905,7 @@ static int mtk_nfc_read_subpage(struct mtd_info *mtd, struct nand_chip *chip,
                 dev_warn(nfc->dev, "read ahb/dma done timeout\n");
 
         rc = readl_poll_timeout_atomic(nfc->regs + NFI_BYTELEN, reg,
-                                       (reg & CNTR_MASK) >= sectors, 10,
+                                       ADDRCNTR_SEC(reg) >= sectors, 10,
                                        MTK_TIMEOUT);
         if (rc < 0) {
                 dev_err(nfc->dev, "subpage done timeout\n");
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 5173fadc9a4e..57cbe2b83849 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -943,7 +943,7 @@ static int mxc_v2_ooblayout_free(struct mtd_info *mtd, int section,
         struct nand_chip *nand_chip = mtd_to_nand(mtd);
         int stepsize = nand_chip->ecc.bytes == 9 ? 16 : 26;
 
-        if (section > nand_chip->ecc.steps)
+        if (section >= nand_chip->ecc.steps)
                 return -ERANGE;
 
         if (!section) {
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 1f276fa30ba6..9599ed6f1213 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -152,7 +152,7 @@ module_param(lacp_rate, charp, 0);
 MODULE_PARM_DESC(lacp_rate, "LACPDU tx rate to request from 802.3ad partner; "
                             "0 for slow, 1 for fast");
 module_param(ad_select, charp, 0);
-MODULE_PARM_DESC(ad_select, "803.ad aggregation selection logic; "
+MODULE_PARM_DESC(ad_select, "802.3ad aggregation selection logic; "
                             "0 for stable (default), 1 for bandwidth, "
                             "2 for count");
 module_param(min_links, int, 0);
@@ -1341,9 +1341,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
                             slave_dev->name);
         }
 
-        /* already enslaved */
-        if (slave_dev->flags & IFF_SLAVE) {
-                netdev_dbg(bond_dev, "Error: Device was already enslaved\n");
+        /* already in-use? */
+        if (netdev_is_rx_handler_busy(slave_dev)) {
+                netdev_err(bond_dev,
+                           "Error: Device is in use and cannot be enslaved\n");
                 return -EBUSY;
         }
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 41c0fc9f3b14..16f7cadda5c3 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1268,11 +1268,10 @@ static int __maybe_unused flexcan_suspend(struct device *device)
         struct flexcan_priv *priv = netdev_priv(dev);
         int err;
 
-        err = flexcan_chip_disable(priv);
-        if (err)
-                return err;
-
         if (netif_running(dev)) {
+                err = flexcan_chip_disable(priv);
+                if (err)
+                        return err;
                 netif_stop_queue(dev);
                 netif_device_detach(dev);
         }
@@ -1285,13 +1284,17 @@ static int __maybe_unused flexcan_resume(struct device *device)
 {
         struct net_device *dev = dev_get_drvdata(device);
         struct flexcan_priv *priv = netdev_priv(dev);
+        int err;
 
         priv->can.state = CAN_STATE_ERROR_ACTIVE;
         if (netif_running(dev)) {
                 netif_device_attach(dev);
                 netif_start_queue(dev);
+                err = flexcan_chip_enable(priv);
+                if (err)
+                        return err;
         }
-        return flexcan_chip_enable(priv);
+        return 0;
 }
 
 static SIMPLE_DEV_PM_OPS(flexcan_pm_ops, flexcan_suspend, flexcan_resume);
diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c
index 2d1d22eec750..368bb0710d8f 100644
--- a/drivers/net/can/ifi_canfd/ifi_canfd.c
+++ b/drivers/net/can/ifi_canfd/ifi_canfd.c
@@ -81,6 +81,10 @@
 #define IFI_CANFD_TIME_SET_TIMEA_4_12_6_6       BIT(15)
 
 #define IFI_CANFD_TDELAY                        0x1c
+#define IFI_CANFD_TDELAY_DEFAULT                0xb
+#define IFI_CANFD_TDELAY_MASK                   0x3fff
+#define IFI_CANFD_TDELAY_ABS                    BIT(14)
+#define IFI_CANFD_TDELAY_EN                     BIT(15)
 
 #define IFI_CANFD_ERROR                         0x20
 #define IFI_CANFD_ERROR_TX_OFFSET               0
@@ -641,7 +645,7 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
         struct ifi_canfd_priv *priv = netdev_priv(ndev);
         const struct can_bittiming *bt = &priv->can.bittiming;
         const struct can_bittiming *dbt = &priv->can.data_bittiming;
-        u16 brp, sjw, tseg1, tseg2;
+        u16 brp, sjw, tseg1, tseg2, tdc;
 
         /* Configure bit timing */
         brp = bt->brp - 2;
@@ -664,6 +668,11 @@ static void ifi_canfd_set_bittiming(struct net_device *ndev)
                (brp << IFI_CANFD_TIME_PRESCALE_OFF) |
                (sjw << IFI_CANFD_TIME_SJW_OFF_7_9_8_8),
                priv->base + IFI_CANFD_FTIME);
+
+        /* Configure transmitter delay */
+        tdc = (dbt->brp * (dbt->phase_seg1 + 1)) & IFI_CANFD_TDELAY_MASK;
+        writel(IFI_CANFD_TDELAY_EN | IFI_CANFD_TDELAY_ABS | tdc,
+               priv->base + IFI_CANFD_TDELAY);
 }
 
 static void ifi_canfd_set_filter(struct net_device *ndev, const u32 id,
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index 8f12bddd5dc9..a0b453ea34c9 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -258,7 +258,7 @@
  * BCM5325 and BCM5365 share most definitions below
  */
 #define B53_ARLTBL_MAC_VID_ENTRY(n)     (0x10 * (n))
-#define   ARLTBL_MAC_MASK               0xffffffffffff
+#define   ARLTBL_MAC_MASK               0xffffffffffffULL
 #define   ARLTBL_VID_S                  48
 #define   ARLTBL_VID_MASK_25            0xff
 #define   ARLTBL_VID_MASK               0xfff
diff --git a/drivers/net/dsa/bcm_sf2.h b/drivers/net/dsa/bcm_sf2.h
index 463bed8cbe4c..dd446e466699 100644
--- a/drivers/net/dsa/bcm_sf2.h
+++ b/drivers/net/dsa/bcm_sf2.h
@@ -205,8 +205,8 @@ static inline void name##_writeq(struct bcm_sf2_priv *priv, u64 val,	\
 static inline void intrl2_##which##_mask_clear(struct bcm_sf2_priv *priv, \
                                                 u32 mask)               \
 {                                                                       \
-        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
         priv->irq##which##_mask &= ~(mask);                             \
+        intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR);     \
 }                                                                       \
 static inline void intrl2_##which##_mask_set(struct bcm_sf2_priv *priv, \
                                                 u32 mask)               \
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index d36aedde8cb9..710679067594 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2656,15 +2656,19 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
                         return ret;
         }
 
+        /* Rate Control: disable ingress rate limiting. */
         if (mv88e6xxx_6352_family(chip) || mv88e6xxx_6351_family(chip) ||
             mv88e6xxx_6165_family(chip) || mv88e6xxx_6097_family(chip) ||
-            mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip) ||
             mv88e6xxx_6320_family(chip)) {
-                /* Rate Control: disable ingress rate limiting. */
                 ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
                                            PORT_RATE_CONTROL, 0x0001);
                 if (ret)
                         return ret;
+        } else if (mv88e6xxx_6185_family(chip) || mv88e6xxx_6095_family(chip)) {
+                ret = _mv88e6xxx_reg_write(chip, REG_PORT(port),
+                                           PORT_RATE_CONTROL, 0x0000);
+                if (ret)
+                        return ret;
         }
 
         /* Port Control 1: disable trunking, disable sending
@@ -3187,6 +3191,7 @@ static int mv88e6xxx_set_addr(struct dsa_switch *ds, u8 *addr)
         return err;
 }
 
+#ifdef CONFIG_NET_DSA_HWMON
 static int mv88e6xxx_mdio_page_read(struct dsa_switch *ds, int port, int page,
                                     int reg)
 {
@@ -3212,6 +3217,7 @@ static int mv88e6xxx_mdio_page_write(struct dsa_switch *ds, int port, int page,
 
         return ret;
 }
+#endif
 
 static int mv88e6xxx_port_to_mdio_addr(struct mv88e6xxx_chip *chip, int port)
 {
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 37a0f463b8de..18bb9556dd00 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -793,6 +793,8 @@ int xgene_enet_phy_connect(struct net_device *ndev)
                         netdev_err(ndev, "Could not connect to PHY\n");
                         return  -ENODEV;
                 }
+#else
+                return -ENODEV;
 #endif
         }
 
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index 4bff0f3040df..b0da9693f28a 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -771,8 +771,10 @@ int arc_emac_probe(struct net_device *ndev, int interface)
         priv->dev = dev;
 
         priv->regs = devm_ioremap_resource(dev, &res_regs);
-        if (IS_ERR(priv->regs))
-                return PTR_ERR(priv->regs);
+        if (IS_ERR(priv->regs)) {
+                err = PTR_ERR(priv->regs);
+                goto out_put_node;
+        }
 
         dev_dbg(dev, "Registers base address is 0x%p\n", priv->regs);
 
diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
index 6453148d066a..4eb17daefc4f 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1545,6 +1545,8 @@ static const struct pci_device_id alx_pci_tbl[] = {
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2400),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
+        { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_E2500),
+          .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8162),
           .driver_data = ALX_DEV_QUIRK_MSI_INTX_DISABLE_BUG },
         { PCI_VDEVICE(ATTANSIC, ALX_DEV_ID_AR8171) },
diff --git a/drivers/net/ethernet/atheros/alx/reg.h b/drivers/net/ethernet/atheros/alx/reg.h
index 0959e6824cb6..1fc2d852249f 100644
--- a/drivers/net/ethernet/atheros/alx/reg.h
+++ b/drivers/net/ethernet/atheros/alx/reg.h
@@ -38,6 +38,7 @@
 #define ALX_DEV_ID_AR8161                               0x1091
 #define ALX_DEV_ID_E2200                                0xe091
 #define ALX_DEV_ID_E2400                                0xe0a1
+#define ALX_DEV_ID_E2500                                0xe0b1
 #define ALX_DEV_ID_AR8162                               0x1090
 #define ALX_DEV_ID_AR8171                               0x10A1
 #define ALX_DEV_ID_AR8172                               0x10A0
diff --git a/drivers/net/ethernet/broadcom/bgmac-bcma.c b/drivers/net/ethernet/broadcom/bgmac-bcma.c
index 9a9745c4047c..625235db644f 100644
--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
+++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
@@ -159,7 +159,7 @@ static int bgmac_probe(struct bcma_device *core)
 
         if (!bgmac_is_bcm4707_family(core)) {
                 mii_bus = bcma_mdio_mii_register(core, bgmac->phyaddr);
-                if (!IS_ERR(mii_bus)) {
+                if (IS_ERR(mii_bus)) {
                         err = PTR_ERR(mii_bus);
                         goto err;
                 }
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index 8fc3f3c137f8..505ceaf451e2 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -6356,10 +6356,6 @@ bnx2_open(struct net_device *dev)
         struct bnx2 *bp = netdev_priv(dev);
         int rc;
 
-        rc = bnx2_request_firmware(bp);
-        if (rc < 0)
-                goto out;
-
         netif_carrier_off(dev);
 
         bnx2_disable_int(bp);
@@ -6428,7 +6424,6 @@ open_err:
         bnx2_free_irq(bp);
         bnx2_free_mem(bp);
         bnx2_del_napi(bp);
-        bnx2_release_firmware(bp);
         goto out;
 }
 
@@ -8575,6 +8570,12 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         pci_set_drvdata(pdev, dev);
 
+        rc = bnx2_request_firmware(bp);
+        if (rc < 0)
+                goto error;
+
+
+        bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
         memcpy(dev->dev_addr, bp->mac_addr, ETH_ALEN);
 
         dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_SG |
@@ -8607,6 +8608,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         return 0;
 
 error:
+        bnx2_release_firmware(bp);
         pci_iounmap(pdev, bp->regview);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 97e892511666..fa3386bb14f7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -772,6 +772,11 @@ void bnx2x_fw_dump_lvl(struct bnx2x *bp, const char *lvl)
                 (bp->common.bc_ver & 0xff00) >> 8,
                 (bp->common.bc_ver & 0xff));
 
+        if (pci_channel_offline(bp->pdev)) {
+                BNX2X_ERR("Cannot dump MCP info while in PCI error\n");
+                return;
+        }
+
         val = REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER);
         if (val == REG_RD(bp, MCP_REG_MCPR_CPU_PROGRAM_COUNTER))
                 BNX2X_ERR("%s" "MCP PC at 0x%x\n", lvl, val);
@@ -9415,10 +9420,16 @@ unload_error:
         /* Release IRQs */
         bnx2x_free_irq(bp);
 
-        /* Reset the chip */
-        rc = bnx2x_reset_hw(bp, reset_code);
-        if (rc)
-                BNX2X_ERR("HW_RESET failed\n");
+        /* Reset the chip, unless PCI function is offline. If we reach this
+         * point following a PCI error handling, it means device is really
+         * in a bad state and we're about to remove it, so reset the chip
+         * is not a good idea.
+         */
+        if (!pci_channel_offline(bp->pdev)) {
+                rc = bnx2x_reset_hw(bp, reset_code);
+                if (rc)
+                        BNX2X_ERR("HW_RESET failed\n");
+        }
 
         /* Report UNLOAD_DONE to MCP */
         bnx2x_send_unload_done(bp, keep_link);
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 2cf79100c9cb..228c964e709a 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -353,8 +353,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 push_len = (length + sizeof(*tx_push) + 7) / 8;
                 if (push_len > 16) {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf, 16);
-                        __iowrite64_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
-                                         push_len - 16);
+                        __iowrite32_copy(txr->tx_doorbell + 4, tx_push_buf + 1,
+                                         (push_len - 16) << 1);
                 } else {
                         __iowrite64_copy(txr->tx_doorbell, tx_push_buf,
                                          push_len);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index ff300f7cf529..a2551bcd1027 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -12552,10 +12552,6 @@ static int tg3_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info,
                                 info->data = TG3_RSS_MAX_NUM_QS;
                 }
 
-                /* The first interrupt vector only
-                 * handles link interrupts.
-                 */
-                info->data -= 1;
                 return 0;
 
         default:
@@ -14014,7 +14010,9 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
         }
 
         if ((ec->rx_coalesce_usecs > MAX_RXCOL_TICKS) ||
+            (!ec->rx_coalesce_usecs) ||
             (ec->tx_coalesce_usecs > MAX_TXCOL_TICKS) ||
+            (!ec->tx_coalesce_usecs) ||
             (ec->rx_max_coalesced_frames > MAX_RXMAX_FRAMES) ||
             (ec->tx_max_coalesced_frames > MAX_TXMAX_FRAMES) ||
             (ec->rx_coalesce_usecs_irq > max_rxcoal_tick_int) ||
@@ -14025,16 +14023,6 @@ static int tg3_set_coalesce(struct net_device *dev, struct ethtool_coalesce *ec)
             (ec->stats_block_coalesce_usecs < min_stat_coal_ticks))
                 return -EINVAL;
 
-        /* No rx interrupts will be generated if both are zero */
-        if ((ec->rx_coalesce_usecs == 0) &&
-            (ec->rx_max_coalesced_frames == 0))
-                return -EINVAL;
-
-        /* No tx interrupts will be generated if both are zero */
-        if ((ec->tx_coalesce_usecs == 0) &&
-            (ec->tx_max_coalesced_frames == 0))
-                return -EINVAL;
-
         /* Only copy relevant parameters, ignore all others. */
         tp->coal.rx_coalesce_usecs = ec->rx_coalesce_usecs;
         tp->coal.tx_coalesce_usecs = ec->tx_coalesce_usecs;
diff --git a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
index 0e4fdc3dd729..31f61a744d66 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
@@ -31,15 +31,10 @@
 #define BNAD_NUM_TXF_COUNTERS 12
 #define BNAD_NUM_RXF_COUNTERS 10
 #define BNAD_NUM_CQ_COUNTERS (3 + 5)
-#define BNAD_NUM_RXQ_COUNTERS 6
+#define BNAD_NUM_RXQ_COUNTERS 7
 #define BNAD_NUM_TXQ_COUNTERS 5
 
-#define BNAD_ETHTOOL_STATS_NUM                                          \
-        (sizeof(struct rtnl_link_stats64) / sizeof(u64) +       \
-        sizeof(struct bnad_drv_stats) / sizeof(u64) +           \
-        offsetof(struct bfi_enet_stats, rxf_stats[0]) / sizeof(u64))
-
-static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
+static const char *bnad_net_stats_strings[] = {
         "rx_packets",
         "tx_packets",
         "rx_bytes",
@@ -50,22 +45,10 @@ static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
         "tx_dropped",
         "multicast",
         "collisions",
-
         "rx_length_errors",
-        "rx_over_errors",
         "rx_crc_errors",
         "rx_frame_errors",
-        "rx_fifo_errors",
-        "rx_missed_errors",
-
-        "tx_aborted_errors",
-        "tx_carrier_errors",
         "tx_fifo_errors",
-        "tx_heartbeat_errors",
-        "tx_window_errors",
-
-        "rx_compressed",
-        "tx_compressed",
 
         "netif_queue_stop",
         "netif_queue_wakeup",
@@ -254,6 +237,8 @@ static const char *bnad_net_stats_strings[BNAD_ETHTOOL_STATS_NUM] = {
         "fc_tx_fid_parity_errors",
 };
 
+#define BNAD_ETHTOOL_STATS_NUM  ARRAY_SIZE(bnad_net_stats_strings)
+
 static int
 bnad_get_settings(struct net_device *netdev, struct ethtool_cmd *cmd)
 {
@@ -658,6 +643,8 @@ bnad_get_strings(struct net_device *netdev, u32 stringset, u8 *string)
                                 string += ETH_GSTRING_LEN;
                                 sprintf(string, "rxq%d_allocbuf_failed", q_num);
                                 string += ETH_GSTRING_LEN;
+                                sprintf(string, "rxq%d_mapbuf_failed", q_num);
+                                string += ETH_GSTRING_LEN;
                                 sprintf(string, "rxq%d_producer_index", q_num);
                                 string += ETH_GSTRING_LEN;
                                 sprintf(string, "rxq%d_consumer_index", q_num);
@@ -678,6 +665,9 @@ bnad_get_strings(struct net_device *netdev, u32 stringset, u8 *string)
                                         sprintf(string, "rxq%d_allocbuf_failed",
                                                                 q_num);
                                         string += ETH_GSTRING_LEN;
+                                        sprintf(string, "rxq%d_mapbuf_failed",
+                                                q_num);
+                                        string += ETH_GSTRING_LEN;
                                         sprintf(string, "rxq%d_producer_index",
                                                                 q_num);
                                         string += ETH_GSTRING_LEN;
@@ -854,9 +844,9 @@ bnad_get_ethtool_stats(struct net_device *netdev, struct ethtool_stats *stats,
                        u64 *buf)
 {
         struct bnad *bnad = netdev_priv(netdev);
-        int i, j, bi;
+        int i, j, bi = 0;
         unsigned long flags;
-        struct rtnl_link_stats64 *net_stats64;
+        struct rtnl_link_stats64 net_stats64;
         u64 *stats64;
         u32 bmap;
 
@@ -871,14 +861,25 @@ bnad_get_ethtool_stats(struct net_device *netdev, struct ethtool_stats *stats,
          * under the same lock
          */
         spin_lock_irqsave(&bnad->bna_lock, flags);
-        bi = 0;
-        memset(buf, 0, stats->n_stats * sizeof(u64));
-
-        net_stats64 = (struct rtnl_link_stats64 *)buf;
-        bnad_netdev_qstats_fill(bnad, net_stats64);
-        bnad_netdev_hwstats_fill(bnad, net_stats64);
 
-        bi = sizeof(*net_stats64) / sizeof(u64);
+        memset(&net_stats64, 0, sizeof(net_stats64));
+        bnad_netdev_qstats_fill(bnad, &net_stats64);
+        bnad_netdev_hwstats_fill(bnad, &net_stats64);
+
+        buf[bi++] = net_stats64.rx_packets;
+        buf[bi++] = net_stats64.tx_packets;
+        buf[bi++] = net_stats64.rx_bytes;
+        buf[bi++] = net_stats64.tx_bytes;
+        buf[bi++] = net_stats64.rx_errors;
+        buf[bi++] = net_stats64.tx_errors;
+        buf[bi++] = net_stats64.rx_dropped;
+        buf[bi++] = net_stats64.tx_dropped;
+        buf[bi++] = net_stats64.multicast;
+        buf[bi++] = net_stats64.collisions;
+        buf[bi++] = net_stats64.rx_length_errors;
+        buf[bi++] = net_stats64.rx_crc_errors;
+        buf[bi++] = net_stats64.rx_frame_errors;
+        buf[bi++] = net_stats64.tx_fifo_errors;
 
         /* Get netif_queue_stopped from stack */
         bnad->stats.drv_stats.netif_queue_stopped = netif_queue_stopped(netdev);
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index 89c0cfa9719f..d954a97b0b0b 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -1323,6 +1323,24 @@ dma_error:
         return 0;
 }
 
+static inline int macb_clear_csum(struct sk_buff *skb)
+{
+        /* no change for packets without checksum offloading */
+        if (skb->ip_summed != CHECKSUM_PARTIAL)
+                return 0;
+
+        /* make sure we can modify the header */
+        if (unlikely(skb_cow_head(skb, 0)))
+                return -1;
+
+        /* initialize checksum field
+         * This is required - at least for Zynq, which otherwise calculates
+         * wrong UDP header checksums for UDP packets with UDP data len <=2
+         */
+        *(__sum16 *)(skb_checksum_start(skb) + skb->csum_offset) = 0;
+        return 0;
+}
+
 static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         u16 queue_index = skb_get_queue_mapping(skb);
@@ -1362,6 +1380,11 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
+        if (macb_clear_csum(skb)) {
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
+        }
+
         /* Map socket buffer for DMA transfer */
         if (!macb_tx_map(bp, queue, skb)) {
                 dev_kfree_skb_any(skb);
diff --git a/drivers/net/ethernet/cadence/macb.h b/drivers/net/ethernet/cadence/macb.h
index 36893d8958d4..b6fcf10621b6 100644
--- a/drivers/net/ethernet/cadence/macb.h
+++ b/drivers/net/ethernet/cadence/macb.h
@@ -403,11 +403,11 @@
 #define MACB_CAPS_USRIO_DEFAULT_IS_MII_GMII     0x00000004
 #define MACB_CAPS_NO_GIGABIT_HALF               0x00000008
 #define MACB_CAPS_USRIO_DISABLED                0x00000010
+#define MACB_CAPS_JUMBO                         0x00000020
 #define MACB_CAPS_FIFO_MODE                     0x10000000
 #define MACB_CAPS_GIGABIT_MODE_AVAILABLE        0x20000000
 #define MACB_CAPS_SG_DISABLED                   0x40000000
 #define MACB_CAPS_MACB_IS_GEM                   0x80000000
-#define MACB_CAPS_JUMBO                         0x00000010
 
 /* Bit manipulation macros */
 #define MACB_BIT(name)                                  \
diff --git a/drivers/net/ethernet/cavium/thunder/nic.h b/drivers/net/ethernet/cavium/thunder/nic.h
index 83025bb4737c..e29815d9e6f4 100644
--- a/drivers/net/ethernet/cavium/thunder/nic.h
+++ b/drivers/net/ethernet/cavium/thunder/nic.h
@@ -279,6 +279,7 @@ struct nicvf {
         u8                      sqs_id;
         bool                    sqs_mode;
         bool                    hw_tso;
+        bool                    t88;
 
         /* Receive buffer alloc */
         u32                     rb_page_offset;
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 16ed20357c5c..85cc782b9060 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -251,9 +251,14 @@ static void nic_set_tx_pkt_pad(struct nicpf *nic, int size)
         int lmac;
         u64 lmac_cfg;
 
-        /* Max value that can be set is 60 */
-        if (size > 60)
-                size = 60;
+        /* There is a issue in HW where-in while sending GSO sized
+         * pkts as part of TSO, if pkt len falls below this size
+         * NIC will zero PAD packet and also updates IP total length.
+         * Hence set this value to lessthan min pkt size of MAC+IP+TCP
+         * headers, BGX will do the padding to transmit 64 byte pkt.
+         */
+        if (size > 52)
+                size = 52;
 
         for (lmac = 0; lmac < (MAX_BGX_PER_CN88XX * MAX_LMAC_PER_BGX); lmac++) {
                 lmac_cfg = nic_reg_read(nic, NIC_PF_LMAC_0_7_CFG | (lmac << 3));
diff --git a/drivers/net/ethernet/cavium/thunder/nic_reg.h b/drivers/net/ethernet/cavium/thunder/nic_reg.h
index afb10e326b4f..fab35a593898 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_reg.h
+++ b/drivers/net/ethernet/cavium/thunder/nic_reg.h
@@ -170,7 +170,6 @@
 #define   NIC_QSET_SQ_0_7_DOOR                  (0x010838)
 #define   NIC_QSET_SQ_0_7_STATUS                (0x010840)
 #define   NIC_QSET_SQ_0_7_DEBUG                 (0x010848)
-#define   NIC_QSET_SQ_0_7_CNM_CHG               (0x010860)
 #define   NIC_QSET_SQ_0_7_STAT_0_1              (0x010900)
 
 #define   NIC_QSET_RBDR_0_1_CFG                 (0x010C00)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
index d2d8ef270142..ad4fddb55421 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_ethtool.c
@@ -382,7 +382,10 @@ static void nicvf_get_regs(struct net_device *dev,
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DOOR, q);
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STATUS, q);
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_DEBUG, q);
-                p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_CNM_CHG, q);
+                /* Padding, was NIC_QSET_SQ_0_7_CNM_CHG, which
+                 * produces bus errors when read
+                 */
+                p[i++] = 0;
                 p[i++] = nicvf_queue_reg_read(nic, NIC_QSET_SQ_0_7_STAT_0_1, q);
                 reg_offset = NIC_QSET_SQ_0_7_STAT_0_1 | (1 << 3);
                 p[i++] = nicvf_queue_reg_read(nic, reg_offset, q);
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index a19e73f11d73..3240349615bd 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -513,6 +513,7 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
         struct nicvf *nic = netdev_priv(netdev);
         struct snd_queue *sq;
         struct sq_hdr_subdesc *hdr;
+        struct sq_hdr_subdesc *tso_sqe;
 
         sq = &nic->qs->sq[cqe_tx->sq_idx];
 
@@ -527,17 +528,21 @@ static void nicvf_snd_pkt_handler(struct net_device *netdev,
 
         nicvf_check_cqe_tx_errs(nic, cq, cqe_tx);
         skb = (struct sk_buff *)sq->skbuff[cqe_tx->sqe_ptr];
-        /* For TSO offloaded packets only one SQE will have a valid SKB */
         if (skb) {
+                /* Check for dummy descriptor used for HW TSO offload on 88xx */
+                if (hdr->dont_send) {
+                        /* Get actual TSO descriptors and free them */
+                        tso_sqe =
+                         (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, hdr->rsvd2);
+                        nicvf_put_sq_desc(sq, tso_sqe->subdesc_cnt + 1);
+                }
                 nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
                 prefetch(skb);
                 dev_consume_skb_any(skb);
                 sq->skbuff[cqe_tx->sqe_ptr] = (u64)NULL;
         } else {
-                /* In case of HW TSO, HW sends a CQE for each segment of a TSO
-                 * packet instead of a single CQE for the whole TSO packet
-                 * transmitted. Each of this CQE points to the same SQE, so
-                 * avoid freeing same SQE multiple times.
+                /* In case of SW TSO on 88xx, only last segment will have
+                 * a SKB attached, so just free SQEs here.
                  */
                 if (!nic->hw_tso)
                         nicvf_put_sq_desc(sq, hdr->subdesc_cnt + 1);
@@ -1502,6 +1507,7 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct net_device *netdev;
         struct nicvf *nic;
         int    err, qcount;
+        u16    sdevid;
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -1575,6 +1581,10 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!pass1_silicon(nic->pdev))
                 nic->hw_tso = true;
 
+        pci_read_config_word(nic->pdev, PCI_SUBSYSTEM_ID, &sdevid);
+        if (sdevid == 0xA134)
+                nic->t88 = true;
+
         /* Check if this VF is in QS only mode */
         if (nic->sqs_mode)
                 return 0;
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
index 0ff8e60deccb..dda3ea3f3bb6 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_queues.c
@@ -938,6 +938,8 @@ static int nicvf_tso_count_subdescs(struct sk_buff *skb)
         return num_edescs + sh->gso_segs;
 }
 
+#define POST_CQE_DESC_COUNT 2
+
 /* Get the number of SQ descriptors needed to xmit this skb */
 static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
 {
@@ -948,6 +950,10 @@ static int nicvf_sq_subdesc_required(struct nicvf *nic, struct sk_buff *skb)
                 return subdesc_cnt;
         }
 
+        /* Dummy descriptors to get TSO pkt completion notification */
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size)
+                subdesc_cnt += POST_CQE_DESC_COUNT;
+
         if (skb_shinfo(skb)->nr_frags)
                 subdesc_cnt += skb_shinfo(skb)->nr_frags;
 
@@ -965,14 +971,21 @@ nicvf_sq_add_hdr_subdesc(struct nicvf *nic, struct snd_queue *sq, int qentry,
         struct sq_hdr_subdesc *hdr;
 
         hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
-        sq->skbuff[qentry] = (u64)skb;
-
         memset(hdr, 0, SND_QUEUE_DESC_SIZE);
         hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
-        /* Enable notification via CQE after processing SQE */
-        hdr->post_cqe = 1;
-        /* No of subdescriptors following this */
-        hdr->subdesc_cnt = subdesc_cnt;
+
+        if (nic->t88 && nic->hw_tso && skb_shinfo(skb)->gso_size) {
+                /* post_cqe = 0, to avoid HW posting a CQE for every TSO
+                 * segment transmitted on 88xx.
+                 */
+                hdr->subdesc_cnt = subdesc_cnt - POST_CQE_DESC_COUNT;
+        } else {
+                sq->skbuff[qentry] = (u64)skb;
+                /* Enable notification via CQE after processing SQE */
+                hdr->post_cqe = 1;
+                /* No of subdescriptors following this */
+                hdr->subdesc_cnt = subdesc_cnt;
+        }
         hdr->tot_len = len;
 
         /* Offload checksum calculation to HW */
@@ -1023,6 +1036,37 @@ static inline void nicvf_sq_add_gather_subdesc(struct snd_queue *sq, int qentry,
         gather->addr = data;
 }
 
+/* Add HDR + IMMEDIATE subdescriptors right after descriptors of a TSO
+ * packet so that a CQE is posted as a notifation for transmission of
+ * TSO packet.
+ */
+static inline void nicvf_sq_add_cqe_subdesc(struct snd_queue *sq, int qentry,
+                                            int tso_sqe, struct sk_buff *skb)
+{
+        struct sq_imm_subdesc *imm;
+        struct sq_hdr_subdesc *hdr;
+
+        sq->skbuff[qentry] = (u64)skb;
+
+        hdr = (struct sq_hdr_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(hdr, 0, SND_QUEUE_DESC_SIZE);
+        hdr->subdesc_type = SQ_DESC_TYPE_HEADER;
+        /* Enable notification via CQE after processing SQE */
+        hdr->post_cqe = 1;
+        /* There is no packet to transmit here */
+        hdr->dont_send = 1;
+        hdr->subdesc_cnt = POST_CQE_DESC_COUNT - 1;
+        hdr->tot_len = 1;
+        /* Actual TSO header SQE index, needed for cleanup */
+        hdr->rsvd2 = tso_sqe;
+
+        qentry = nicvf_get_nxt_sqentry(sq, qentry);
+        imm = (struct sq_imm_subdesc *)GET_SQ_DESC(sq, qentry);
+        memset(imm, 0, SND_QUEUE_DESC_SIZE);
+        imm->subdesc_type = SQ_DESC_TYPE_IMMEDIATE;
+        imm->len = 1;
+}
+
 /* Segment a TSO packet into 'gso_size' segments and append
  * them to SQ for transfer
  */
@@ -1096,7 +1140,7 @@ static int nicvf_sq_append_tso(struct nicvf *nic, struct snd_queue *sq,
 int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
 {
         int i, size;
-        int subdesc_cnt;
+        int subdesc_cnt, tso_sqe = 0;
         int sq_num, qentry;
         struct queue_set *qs;
         struct snd_queue *sq;
@@ -1131,6 +1175,7 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         /* Add SQ header subdesc */
         nicvf_sq_add_hdr_subdesc(nic, sq, qentry, subdesc_cnt - 1,
                                  skb, skb->len);
+        tso_sqe = qentry;
 
         /* Add SQ gather subdescs */
         qentry = nicvf_get_nxt_sqentry(sq, qentry);
@@ -1154,6 +1199,11 @@ int nicvf_sq_append_skb(struct nicvf *nic, struct sk_buff *skb)
         }
 
 doorbell:
+        if (nic->t88 && skb_shinfo(skb)->gso_size) {
+                qentry = nicvf_get_nxt_sqentry(sq, qentry);
+                nicvf_sq_add_cqe_subdesc(sq, qentry, tso_sqe, skb);
+        }
+
         /* make sure all memory stores are done before ringing doorbell */
         smp_wmb();
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 2e2aa9fec9bb..edd23386b47d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -419,8 +419,8 @@ struct link_config {
         unsigned short supported;        /* link capabilities */
         unsigned short advertising;      /* advertised capabilities */
         unsigned short lp_advertising;   /* peer advertised capabilities */
-        unsigned short requested_speed;  /* speed user has requested */
-        unsigned short speed;            /* actual link speed */
+        unsigned int   requested_speed;  /* speed user has requested */
+        unsigned int   speed;            /* actual link speed */
         unsigned char  requested_fc;     /* flow control user has requested */
         unsigned char  fc;               /* actual link flow control */
         unsigned char  autoneg;          /* autonegotiating? */
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index c45de49dc963..3ceafb55d6da 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -4305,10 +4305,17 @@ static const struct pci_error_handlers cxgb4_eeh = {
         .resume         = eeh_resume,
 };
 
+/* Return true if the Link Configuration supports "High Speeds" (those greater
+ * than 1Gb/s).
+ */
 static inline bool is_x_10g_port(const struct link_config *lc)
 {
-        return (lc->supported & FW_PORT_CAP_SPEED_10G) != 0 ||
-               (lc->supported & FW_PORT_CAP_SPEED_40G) != 0;
+        unsigned int speeds, high_speeds;
+
+        speeds = FW_PORT_CAP_SPEED_V(FW_PORT_CAP_SPEED_G(lc->supported));
+        high_speeds = speeds & ~(FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G);
+
+        return high_speeds != 0;
 }
 
 static inline void init_rspq(struct adapter *adap, struct sge_rspq *q,
@@ -4335,6 +4342,11 @@ static void cfg_queues(struct adapter *adap)
 #endif
         int ciq_size;
 
+        /* Reduce memory usage in kdump environment, disable all offload.
+         */
+        if (is_kdump_kernel())
+                adap->params.offload = 0;
+
         for_each_port(adap, i)
                 n10g += is_x_10g_port(&adap2pinfo(adap, i)->link_cfg);
 #ifdef CONFIG_CHELSIO_T4_DCB
@@ -4365,11 +4377,6 @@ static void cfg_queues(struct adapter *adap)
         if (q10g > netif_get_num_default_rss_queues())
                 q10g = netif_get_num_default_rss_queues();
 
-        /* Reduce memory usage in kdump environment, disable all offload.
-         */
-        if (is_kdump_kernel())
-                adap->params.offload = 0;
-
         for_each_port(adap, i) {
                 struct port_info *pi = adap2pinfo(adap, i);
 
@@ -4756,8 +4763,12 @@ static void print_port_info(const struct net_device *dev)
                 bufp += sprintf(bufp, "1000/");
         if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_10G)
                 bufp += sprintf(bufp, "10G/");
+        if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_25G)
+                bufp += sprintf(bufp, "25G/");
         if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_40G)
                 bufp += sprintf(bufp, "40G/");
+        if (pi->link_cfg.supported & FW_PORT_CAP_SPEED_100G)
+                bufp += sprintf(bufp, "100G/");
         if (bufp != buf)
                 --bufp;
         sprintf(bufp, "BASE-%s", t4_get_port_type_description(pi->port_type));
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index dc92c80a75f4..660204bff726 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3627,7 +3627,8 @@ void t4_ulprx_read_la(struct adapter *adap, u32 *la_buf)
 }
 
 #define ADVERT_MASK (FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G |\
-                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_40G | \
+                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_25G | \
+                     FW_PORT_CAP_SPEED_40G | FW_PORT_CAP_SPEED_100G | \
                      FW_PORT_CAP_ANEG)
 
 /**
@@ -7196,8 +7197,12 @@ void t4_handle_get_port_info(struct port_info *pi, const __be64 *rpl)
                 speed = 1000;
         else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_10G))
                 speed = 10000;
+        else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_25G))
+                speed = 25000;
         else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_40G))
                 speed = 40000;
+        else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_100G))
+                speed = 100000;
 
         lc = &pi->link_cfg;
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
index a89b30720e38..30507d44422c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4fw_api.h
@@ -2265,6 +2265,12 @@ enum fw_port_cap {
         FW_PORT_CAP_802_3_ASM_DIR       = 0x8000,
 };
 
+#define FW_PORT_CAP_SPEED_S     0
+#define FW_PORT_CAP_SPEED_M     0x3f
+#define FW_PORT_CAP_SPEED_V(x)  ((x) << FW_PORT_CAP_SPEED_S)
+#define FW_PORT_CAP_SPEED_G(x) \
+        (((x) >> FW_PORT_CAP_SPEED_S) & FW_PORT_CAP_SPEED_M)
+
 enum fw_port_mdi {
         FW_PORT_CAP_MDI_UNCHANGED,
         FW_PORT_CAP_MDI_AUTO,
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 8ee541431e8b..17a2bbcf93f0 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -108,8 +108,8 @@ struct link_config {
         unsigned int   supported;        /* link capabilities */
         unsigned int   advertising;      /* advertised capabilities */
         unsigned short lp_advertising;   /* peer advertised capabilities */
-        unsigned short requested_speed;  /* speed user has requested */
-        unsigned short speed;            /* actual link speed */
+        unsigned int   requested_speed;  /* speed user has requested */
+        unsigned int   speed;            /* actual link speed */
         unsigned char  requested_fc;     /* flow control user has requested */
         unsigned char  fc;               /* actual link flow control */
         unsigned char  autoneg;          /* autonegotiating? */
@@ -271,10 +271,17 @@ static inline bool is_10g_port(const struct link_config *lc)
         return (lc->supported & FW_PORT_CAP_SPEED_10G) != 0;
 }
 
+/* Return true if the Link Configuration supports "High Speeds" (those greater
+ * than 1Gb/s).
+ */
 static inline bool is_x_10g_port(const struct link_config *lc)
 {
-        return (lc->supported & FW_PORT_CAP_SPEED_10G) != 0 ||
-                (lc->supported & FW_PORT_CAP_SPEED_40G) != 0;
+        unsigned int speeds, high_speeds;
+
+        speeds = FW_PORT_CAP_SPEED_V(FW_PORT_CAP_SPEED_G(lc->supported));
+        high_speeds = speeds & ~(FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G);
+
+        return high_speeds != 0;
 }
 
 static inline unsigned int core_ticks_per_usec(const struct adapter *adapter)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index 427bfa71388b..b5622b1689e9 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -314,8 +314,9 @@ int t4vf_wr_mbox_core(struct adapter *adapter, const void *cmd, int size,
 }
 
 #define ADVERT_MASK (FW_PORT_CAP_SPEED_100M | FW_PORT_CAP_SPEED_1G |\
-                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_40G | \
-                     FW_PORT_CAP_SPEED_100G | FW_PORT_CAP_ANEG)
+                     FW_PORT_CAP_SPEED_10G | FW_PORT_CAP_SPEED_25G | \
+                     FW_PORT_CAP_SPEED_40G | FW_PORT_CAP_SPEED_100G | \
+                     FW_PORT_CAP_ANEG)
 
 /**
  *      init_link_config - initialize a link's SW state
@@ -1712,8 +1713,12 @@ int t4vf_handle_fw_rpl(struct adapter *adapter, const __be64 *rpl)
                         speed = 1000;
                 else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_10G))
                         speed = 10000;
+                else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_25G))
+                        speed = 25000;
                 else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_40G))
                         speed = 40000;
+                else if (stat & FW_PORT_CMD_LSPEED_V(FW_PORT_CAP_SPEED_100G))
+                        speed = 100000;
 
                 /*
                  * Scan all of our "ports" (Virtual Interfaces) looking for
diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
index 1471e16ba719..f45385f5c6e5 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -1299,6 +1299,7 @@ static int
 dm9000_open(struct net_device *dev)
 {
         struct board_info *db = netdev_priv(dev);
+        unsigned int irq_flags = irq_get_trigger_type(dev->irq);
 
         if (netif_msg_ifup(db))
                 dev_dbg(db->dev, "enabling %s\n", dev->name);
@@ -1306,9 +1307,11 @@ dm9000_open(struct net_device *dev)
         /* If there is no IRQ type specified, tell the user that this is a
          * problem
          */
-        if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE)
+        if (irq_flags == IRQF_TRIGGER_NONE)
                 dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n");
 
+        irq_flags |= IRQF_SHARED;
+
         /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
         iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
         mdelay(1); /* delay needs by DM9000B */
@@ -1316,8 +1319,7 @@ dm9000_open(struct net_device *dev)
         /* Initialize DM9000 board */
         dm9000_init_dm9000(dev);
 
-        if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED,
-                        dev->name, dev))
+        if (request_irq(dev->irq, dm9000_interrupt, irq_flags, dev->name, dev))
                 return -EAGAIN;
         /* Now that we have an interrupt handler hooked up we can unmask
          * our interrupts
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index d20935dc8399..4b4f5bc0e279 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2922,17 +2922,25 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus,
 {
         unsigned int size = lstatus & BD_LENGTH_MASK;
         struct page *page = rxb->page;
+        bool last = !!(lstatus & BD_LFLAG(RXBD_LAST));
 
         /* Remove the FCS from the packet length */
-        if (likely(lstatus & BD_LFLAG(RXBD_LAST)))
+        if (last)
                 size -= ETH_FCS_LEN;
 
-        if (likely(first))
+        if (likely(first)) {
                 skb_put(skb, size);
-        else
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
-                                rxb->page_offset + RXBUF_ALIGNMENT,
-                                size, GFAR_RXB_TRUESIZE);
+        } else {
+                /* the last fragments' length contains the full frame length */
+                if (last)
+                        size -= skb->len;
+
+                /* in case the last fragment consisted only of the FCS */
+                if (size > 0)
+                        skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                        rxb->page_offset + RXBUF_ALIGNMENT,
+                                        size, GFAR_RXB_TRUESIZE);
+        }
 
         /* try reuse page */
         if (unlikely(page_count(page) != 1))
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index 373fd094f2f3..6e8a9c8467b9 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -100,7 +100,8 @@ extern const char gfar_driver_version[];
 #define DEFAULT_RX_LFC_THR  16
 #define DEFAULT_LFC_PTVVAL  4
 
-#define GFAR_RXB_SIZE 1536
+/* prevent fragmenation by HW in DSA environments */
+#define GFAR_RXB_SIZE roundup(1536 + 8, 64)
 #define GFAR_SKBFRAG_SIZE (RXBUF_ALIGNMENT + GFAR_RXB_SIZE \
                           + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
 #define GFAR_RXB_TRUESIZE 2048
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
index 1235c7f2564b..1e1eb92998fb 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c
@@ -17,7 +17,7 @@ static const struct mac_stats_string g_gmac_stats_string[] = {
         {"gmac_rx_octets_total_ok", MAC_STATS_FIELD_OFF(rx_good_bytes)},
         {"gmac_rx_octets_bad", MAC_STATS_FIELD_OFF(rx_bad_bytes)},
         {"gmac_rx_uc_pkts", MAC_STATS_FIELD_OFF(rx_uc_pkts)},
-        {"gamc_rx_mc_pkts", MAC_STATS_FIELD_OFF(rx_mc_pkts)},
+        {"gmac_rx_mc_pkts", MAC_STATS_FIELD_OFF(rx_mc_pkts)},
         {"gmac_rx_bc_pkts", MAC_STATS_FIELD_OFF(rx_bc_pkts)},
         {"gmac_rx_pkts_64octets", MAC_STATS_FIELD_OFF(rx_64bytes)},
         {"gmac_rx_pkts_65to127", MAC_STATS_FIELD_OFF(rx_65to127)},
diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
index ff8b6a468b24..6ea872287307 100644
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c
@@ -328,9 +328,10 @@ static void hns_ppe_init_hw(struct hns_ppe_cb *ppe_cb)
 static void hns_ppe_uninit_hw(struct hns_ppe_cb *ppe_cb)
 {
         u32 port;
-        struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
 
         if (ppe_cb->ppe_common_cb) {
+                struct dsaf_device *dsaf_dev = ppe_cb->ppe_common_cb->dsaf_dev;
+
                 port = ppe_cb->index;
                 dsaf_dev->misc_op->ppe_srst(dsaf_dev, port, 0);
         }
diff --git a/drivers/net/ethernet/ibm/emac/core.c b/drivers/net/ethernet/ibm/emac/core.c
index 4c9771d57d6e..7af09cbc53f0 100644
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -977,7 +977,37 @@ static void emac_set_multicast_list(struct net_device *ndev)
                 dev->mcast_pending = 1;
                 return;
         }
+
+        mutex_lock(&dev->link_lock);
         __emac_set_multicast_list(dev);
+        mutex_unlock(&dev->link_lock);
+}
+
+static int emac_set_mac_address(struct net_device *ndev, void *sa)
+{
+        struct emac_instance *dev = netdev_priv(ndev);
+        struct sockaddr *addr = sa;
+        struct emac_regs __iomem *p = dev->emacp;
+
+        if (!is_valid_ether_addr(addr->sa_data))
+               return -EADDRNOTAVAIL;
+
+        mutex_lock(&dev->link_lock);
+
+        memcpy(ndev->dev_addr, addr->sa_data, ndev->addr_len);
+
+        emac_rx_disable(dev);
+        emac_tx_disable(dev);
+        out_be32(&p->iahr, (ndev->dev_addr[0] << 8) | ndev->dev_addr[1]);
+        out_be32(&p->ialr, (ndev->dev_addr[2] << 24) |
+                (ndev->dev_addr[3] << 16) | (ndev->dev_addr[4] << 8) |
+                ndev->dev_addr[5]);
+        emac_tx_enable(dev);
+        emac_rx_enable(dev);
+
+        mutex_unlock(&dev->link_lock);
+
+        return 0;
 }
 
 static int emac_resize_rx_ring(struct emac_instance *dev, int new_mtu)
@@ -2686,7 +2716,7 @@ static const struct net_device_ops emac_netdev_ops = {
         .ndo_do_ioctl           = emac_ioctl,
         .ndo_tx_timeout         = emac_tx_timeout,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = emac_set_mac_address,
         .ndo_start_xmit         = emac_start_xmit,
         .ndo_change_mtu         = eth_change_mtu,
 };
@@ -2699,7 +2729,7 @@ static const struct net_device_ops emac_gige_netdev_ops = {
         .ndo_do_ioctl           = emac_ioctl,
         .ndo_tx_timeout         = emac_tx_timeout,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = emac_set_mac_address,
         .ndo_start_xmit         = emac_start_xmit_sg,
         .ndo_change_mtu         = emac_change_mtu,
 };
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 7fd4d54599e4..6b03c8553e59 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -2032,7 +2032,8 @@ const struct e1000_info e1000_82574_info = {
                                   | FLAG2_DISABLE_ASPM_L0S
                                   | FLAG2_DISABLE_ASPM_L1
                                   | FLAG2_NO_DISABLE_RX
-                                  | FLAG2_DMA_BURST,
+                                  | FLAG2_DMA_BURST
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -2053,7 +2054,8 @@ const struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
         .flags2                 = FLAG2_DISABLE_ASPM_L0S
                                   | FLAG2_DISABLE_ASPM_L1
-                                  | FLAG2_NO_DISABLE_RX,
+                                  | FLAG2_NO_DISABLE_RX
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 32,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index ef96cd11d6d2..879cca47b021 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -452,6 +452,7 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca);
 #define FLAG2_PCIM2PCI_ARBITER_WA         BIT(11)
 #define FLAG2_DFLT_CRC_STRIPPING          BIT(12)
 #define FLAG2_CHECK_RX_HWTSTAMP           BIT(13)
+#define FLAG2_CHECK_SYSTIM_OVERFLOW       BIT(14)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 3e11322d8d58..f3aaca743ea3 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -5885,7 +5885,8 @@ const struct e1000_info e1000_pch_lpt_info = {
                                   | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_APME_IN_WUC,
         .flags2                 = FLAG2_HAS_PHY_STATS
-                                  | FLAG2_HAS_EEE,
+                                  | FLAG2_HAS_EEE
+                                  | FLAG2_CHECK_SYSTIM_OVERFLOW,
         .pba                    = 26,
         .max_hw_frame_size      = 9022,
         .get_variants           = e1000_get_variants_ich8lan,
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 02f443958f31..7017281ba2dc 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -4303,6 +4303,42 @@ void e1000e_reinit_locked(struct e1000_adapter *adapter)
 }
 
 /**
+ * e1000e_sanitize_systim - sanitize raw cycle counter reads
+ * @hw: pointer to the HW structure
+ * @systim: cycle_t value read, sanitized and returned
+ *
+ * Errata for 82574/82583 possible bad bits read from SYSTIMH/L:
+ * check to see that the time is incrementing at a reasonable
+ * rate and is a multiple of incvalue.
+ **/
+static cycle_t e1000e_sanitize_systim(struct e1000_hw *hw, cycle_t systim)
+{
+        u64 time_delta, rem, temp;
+        cycle_t systim_next;
+        u32 incvalue;
+        int i;
+
+        incvalue = er32(TIMINCA) & E1000_TIMINCA_INCVALUE_MASK;
+        for (i = 0; i < E1000_MAX_82574_SYSTIM_REREADS; i++) {
+                /* latch SYSTIMH on read of SYSTIML */
+                systim_next = (cycle_t)er32(SYSTIML);
+                systim_next |= (cycle_t)er32(SYSTIMH) << 32;
+
+                time_delta = systim_next - systim;
+                temp = time_delta;
+                /* VMWare users have seen incvalue of zero, don't div / 0 */
+                rem = incvalue ? do_div(temp, incvalue) : (time_delta != 0);
+
+                systim = systim_next;
+
+                if ((time_delta < E1000_82574_SYSTIM_EPSILON) && (rem == 0))
+                        break;
+        }
+
+        return systim;
+}
+
+/**
  * e1000e_cyclecounter_read - read raw cycle counter (used by time counter)
  * @cc: cyclecounter structure
  **/
@@ -4312,7 +4348,7 @@ static cycle_t e1000e_cyclecounter_read(const struct cyclecounter *cc)
                                                      cc);
         struct e1000_hw *hw = &adapter->hw;
         u32 systimel, systimeh;
-        cycle_t systim, systim_next;
+        cycle_t systim;
         /* SYSTIMH latching upon SYSTIML read does not work well.
          * This means that if SYSTIML overflows after we read it but before
          * we read SYSTIMH, the value of SYSTIMH has been incremented and we
@@ -4335,33 +4371,9 @@ static cycle_t e1000e_cyclecounter_read(const struct cyclecounter *cc)
         systim = (cycle_t)systimel;
         systim |= (cycle_t)systimeh << 32;
 
-        if ((hw->mac.type == e1000_82574) || (hw->mac.type == e1000_82583)) {
-                u64 time_delta, rem, temp;
-                u32 incvalue;
-                int i;
-
-                /* errata for 82574/82583 possible bad bits read from SYSTIMH/L
-                 * check to see that the time is incrementing at a reasonable
-                 * rate and is a multiple of incvalue
-                 */
-                incvalue = er32(TIMINCA) & E1000_TIMINCA_INCVALUE_MASK;
-                for (i = 0; i < E1000_MAX_82574_SYSTIM_REREADS; i++) {
-                        /* latch SYSTIMH on read of SYSTIML */
-                        systim_next = (cycle_t)er32(SYSTIML);
-                        systim_next |= (cycle_t)er32(SYSTIMH) << 32;
-
-                        time_delta = systim_next - systim;
-                        temp = time_delta;
-                        /* VMWare users have seen incvalue of zero, don't div / 0 */
-                        rem = incvalue ? do_div(temp, incvalue) : (time_delta != 0);
-
-                        systim = systim_next;
+        if (adapter->flags2 & FLAG2_CHECK_SYSTIM_OVERFLOW)
+                systim = e1000e_sanitize_systim(hw, systim);
 
-                        if ((time_delta < E1000_82574_SYSTIM_EPSILON) &&
-                            (rem == 0))
-                                break;
-                }
-        }
         return systim;
 }
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index e1370c556a3c..618f18436618 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -199,6 +199,7 @@ void i40e_notify_client_of_l2_param_changes(struct i40e_vsi *vsi)
 void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
 {
         struct i40e_client_instance *cdev;
+        int ret = 0;
 
         if (!vsi)
                 return;
@@ -211,7 +212,14 @@ void i40e_notify_client_of_netdev_open(struct i40e_vsi *vsi)
                                         "Cannot locate client instance open routine\n");
                                 continue;
                         }
-                        cdev->client->ops->open(&cdev->lan_info, cdev->client);
+                        if (!(test_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                       &cdev->state))) {
+                                ret = cdev->client->ops->open(&cdev->lan_info,
+                                                              cdev->client);
+                                if (!ret)
+                                        set_bit(__I40E_CLIENT_INSTANCE_OPENED,
+                                                &cdev->state);
+                        }
                 }
         }
         mutex_unlock(&i40e_client_instance_mutex);
@@ -407,12 +415,14 @@ struct i40e_vsi *i40e_vsi_lookup(struct i40e_pf *pf,
  * i40e_client_add_instance - add a client instance struct to the instance list
  * @pf: pointer to the board struct
  * @client: pointer to a client struct in the client list.
+ * @existing: if there was already an existing instance
  *
- * Returns cdev ptr on success, NULL on failure
+ * Returns cdev ptr on success or if already exists, NULL on failure
  **/
 static
 struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
-                                                      struct i40e_client *client)
+                                                     struct i40e_client *client,
+                                                     bool *existing)
 {
         struct i40e_client_instance *cdev;
         struct netdev_hw_addr *mac = NULL;
@@ -421,7 +431,7 @@ struct i40e_client_instance *i40e_client_add_instance(struct i40e_pf *pf,
         mutex_lock(&i40e_client_instance_mutex);
         list_for_each_entry(cdev, &i40e_client_instances, list) {
                 if ((cdev->lan_info.pf == pf) && (cdev->client == client)) {
-                        cdev = NULL;
+                        *existing = true;
                         goto out;
                 }
         }
@@ -505,6 +515,7 @@ void i40e_client_subtask(struct i40e_pf *pf)
 {
         struct i40e_client_instance *cdev;
         struct i40e_client *client;
+        bool existing = false;
         int ret = 0;
 
         if (!(pf->flags & I40E_FLAG_SERVICE_CLIENT_REQUESTED))
@@ -528,18 +539,25 @@ void i40e_client_subtask(struct i40e_pf *pf)
                         /* check if L2 VSI is up, if not we are not ready */
                         if (test_bit(__I40E_DOWN, &pf->vsi[pf->lan_vsi]->state))
                                 continue;
+                } else {
+                        dev_warn(&pf->pdev->dev, "This client %s is being instanciated at probe\n",
+                                 client->name);
                 }
 
                 /* Add the client instance to the instance list */
-                cdev = i40e_client_add_instance(pf, client);
+                cdev = i40e_client_add_instance(pf, client, &existing);
                 if (!cdev)
                         continue;
 
-                /* Also up the ref_cnt of no. of instances of this client */
-                atomic_inc(&client->ref_cnt);
-                dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
-                         client->name, pf->hw.pf_id,
-                         pf->hw.bus.device, pf->hw.bus.func);
+                if (!existing) {
+                        /* Also up the ref_cnt for no. of instances of this
+                         * client.
+                         */
+                        atomic_inc(&client->ref_cnt);
+                        dev_info(&pf->pdev->dev, "Added instance of Client %s to PF%d bus=0x%02x func=0x%02x\n",
+                                 client->name, pf->hw.pf_id,
+                                 pf->hw.bus.device, pf->hw.bus.func);
+                }
 
                 /* Send an Open request to the client */
                 atomic_inc(&cdev->ref_cnt);
@@ -588,7 +606,8 @@ int i40e_lan_add_device(struct i40e_pf *pf)
                  pf->hw.pf_id, pf->hw.bus.device, pf->hw.bus.func);
 
         /* Since in some cases register may have happened before a device gets
-         * added, we can schedule a subtask to go initiate the clients.
+         * added, we can schedule a subtask to go initiate the clients if
+         * they can be launched at probe time.
          */
         pf->flags |= I40E_FLAG_SERVICE_CLIENT_REQUESTED;
         i40e_service_event_schedule(pf);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 81c99e1be708..d0b3a1bb82ca 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -4554,23 +4554,38 @@ static u8 i40e_get_iscsi_tc_map(struct i40e_pf *pf)
  **/
 static u8 i40e_dcb_get_num_tc(struct i40e_dcbx_config *dcbcfg)
 {
+        int i, tc_unused = 0;
         u8 num_tc = 0;
-        int i;
+        u8 ret = 0;
 
         /* Scan the ETS Config Priority Table to find
          * traffic class enabled for a given priority
-         * and use the traffic class index to get the
-         * number of traffic classes enabled
+         * and create a bitmask of enabled TCs
          */
-        for (i = 0; i < I40E_MAX_USER_PRIORITY; i++) {
-                if (dcbcfg->etscfg.prioritytable[i] > num_tc)
-                        num_tc = dcbcfg->etscfg.prioritytable[i];
-        }
+        for (i = 0; i < I40E_MAX_USER_PRIORITY; i++)
+                num_tc |= BIT(dcbcfg->etscfg.prioritytable[i]);
 
-        /* Traffic class index starts from zero so
-         * increment to return the actual count
+        /* Now scan the bitmask to check for
+         * contiguous TCs starting with TC0
          */
-        return num_tc + 1;
+        for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) {
+                if (num_tc & BIT(i)) {
+                        if (!tc_unused) {
+                                ret++;
+                        } else {
+                                pr_err("Non-contiguous TC - Disabling DCB\n");
+                                return 1;
+                        }
+                } else {
+                        tc_unused = 1;
+                }
+        }
+
+        /* There is always at least TC0 */
+        if (!ret)
+                ret = 1;
+
+        return ret;
 }
 
 /**
@@ -5098,9 +5113,13 @@ static int i40e_init_pf_dcb(struct i40e_pf *pf)
                                        DCB_CAP_DCBX_VER_IEEE;
 
                         pf->flags |= I40E_FLAG_DCB_CAPABLE;
-                        /* Enable DCB tagging only when more than one TC */
+                        /* Enable DCB tagging only when more than one TC
+                         * or explicitly disable if only one TC
+                         */
                         if (i40e_dcb_get_num_tc(&hw->local_dcbx_config) > 1)
                                 pf->flags |= I40E_FLAG_DCB_ENABLED;
+                        else
+                                pf->flags &= ~I40E_FLAG_DCB_ENABLED;
                         dev_dbg(&pf->pdev->dev,
                                 "DCBX offload is supported for this PF.\n");
                 }
@@ -5416,7 +5435,6 @@ int i40e_open(struct net_device *netdev)
         wr32(&pf->hw, I40E_GLLAN_TSOMSK_L, be32_to_cpu(TCP_FLAG_CWR) >> 16);
 
         udp_tunnel_get_rx_info(netdev);
-        i40e_notify_client_of_netdev_open(vsi);
 
         return 0;
 }
@@ -5702,7 +5720,7 @@ static int i40e_handle_lldp_event(struct i40e_pf *pf,
         u8 type;
 
         /* Not DCB capable or capability disabled */
-        if (!(pf->flags & I40E_FLAG_DCB_CAPABLE))
+        if (!(pf->flags & I40E_FLAG_DCB_ENABLED))
                 return ret;
 
         /* Ignore if event is not for Nearest Bridge */
@@ -7882,6 +7900,7 @@ static int i40e_init_interrupt_scheme(struct i40e_pf *pf)
 #endif
                                        I40E_FLAG_RSS_ENABLED    |
                                        I40E_FLAG_DCB_CAPABLE    |
+                                       I40E_FLAG_DCB_ENABLED    |
                                        I40E_FLAG_SRIOV_ENABLED  |
                                        I40E_FLAG_FD_SB_ENABLED  |
                                        I40E_FLAG_FD_ATR_ENABLED |
@@ -10488,6 +10507,7 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                                I40E_FLAG_FD_SB_ENABLED  |
                                I40E_FLAG_FD_ATR_ENABLED |
                                I40E_FLAG_DCB_CAPABLE    |
+                               I40E_FLAG_DCB_ENABLED    |
                                I40E_FLAG_SRIOV_ENABLED  |
                                I40E_FLAG_VMDQ_ENABLED);
         } else if (!(pf->flags & (I40E_FLAG_RSS_ENABLED |
@@ -10511,7 +10531,8 @@ static void i40e_determine_queue_usage(struct i40e_pf *pf)
                 /* Not enough queues for all TCs */
                 if ((pf->flags & I40E_FLAG_DCB_CAPABLE) &&
                     (queues_left < I40E_MAX_TRAFFIC_CLASS)) {
-                        pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                        pf->flags &= ~(I40E_FLAG_DCB_CAPABLE |
+                                        I40E_FLAG_DCB_ENABLED);
                         dev_info(&pf->pdev->dev, "not enough queues for DCB. DCB is disabled.\n");
                 }
                 pf->num_lan_qps = max_t(int, pf->rss_size_max,
@@ -10908,7 +10929,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         err = i40e_init_pf_dcb(pf);
         if (err) {
                 dev_info(&pdev->dev, "DCB init failed %d, disabled\n", err);
-                pf->flags &= ~I40E_FLAG_DCB_CAPABLE;
+                pf->flags &= ~(I40E_FLAG_DCB_CAPABLE & I40E_FLAG_DCB_ENABLED);
                 /* Continue without DCB enabled */
         }
 #endif /* CONFIG_I40E_DCB */
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index e61b647f5f2a..336c103ae374 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -744,7 +744,8 @@ static void igb_ptp_tx_hwtstamp(struct igb_adapter *adapter)
                 }
         }
 
-        shhwtstamps.hwtstamp = ktime_sub_ns(shhwtstamps.hwtstamp, adjust);
+        shhwtstamps.hwtstamp =
+                ktime_add_ns(shhwtstamps.hwtstamp, adjust);
 
         skb_tstamp_tx(adapter->ptp_tx_skb, &shhwtstamps);
         dev_kfree_skb_any(adapter->ptp_tx_skb);
@@ -767,13 +768,32 @@ void igb_ptp_rx_pktstamp(struct igb_q_vector *q_vector,
                          struct sk_buff *skb)
 {
         __le64 *regval = (__le64 *)va;
+        struct igb_adapter *adapter = q_vector->adapter;
+        int adjust = 0;
 
         /* The timestamp is recorded in little endian format.
          * DWORD: 0        1        2        3
          * Field: Reserved Reserved SYSTIML  SYSTIMH
          */
-        igb_ptp_systim_to_hwtstamp(q_vector->adapter, skb_hwtstamps(skb),
+        igb_ptp_systim_to_hwtstamp(adapter, skb_hwtstamps(skb),
                                    le64_to_cpu(regval[1]));
+
+        /* adjust timestamp for the RX latency based on link speed */
+        if (adapter->hw.mac.type == e1000_i210) {
+                switch (adapter->link_speed) {
+                case SPEED_10:
+                        adjust = IGB_I210_RX_LATENCY_10;
+                        break;
+                case SPEED_100:
+                        adjust = IGB_I210_RX_LATENCY_100;
+                        break;
+                case SPEED_1000:
+                        adjust = IGB_I210_RX_LATENCY_1000;
+                        break;
+                }
+        }
+        skb_hwtstamps(skb)->hwtstamp =
+                ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
 }
 
 /**
@@ -825,7 +845,7 @@ void igb_ptp_rx_rgtstamp(struct igb_q_vector *q_vector,
                 }
         }
         skb_hwtstamps(skb)->hwtstamp =
-                ktime_add_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
+                ktime_sub_ns(skb_hwtstamps(skb)->hwtstamp, adjust);
 
         /* Update the last_rx_timestamp timer in order to enable watchdog check
          * for error case of latched timestamp on a dropped packet.
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index b4217f30e89c..c47b605e8651 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -2958,8 +2958,10 @@ s32 ixgbe_clear_vmdq_generic(struct ixgbe_hw *hw, u32 rar, u32 vmdq)
         }
 
         /* was that the last pool using this rar? */
-        if (mpsar_lo == 0 && mpsar_hi == 0 && rar != 0)
+        if (mpsar_lo == 0 && mpsar_hi == 0 &&
+            rar != 0 && rar != hw->mac.san_mac_rar_index)
                 hw->mac.ops.clear_rar(hw, rar);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 5418c69a7463..b4f03748adc0 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4100,6 +4100,8 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         u32 vlnctrl, i;
 
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+
         switch (hw->mac.type) {
         case ixgbe_mac_82599EB:
         case ixgbe_mac_X540:
@@ -4112,8 +4114,7 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
                 /* fall through */
         case ixgbe_mac_82598EB:
                 /* legacy case, we can just disable VLAN filtering */
-                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
-                vlnctrl &= ~(IXGBE_VLNCTRL_VFE | IXGBE_VLNCTRL_CFIEN);
+                vlnctrl &= ~IXGBE_VLNCTRL_VFE;
                 IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 return;
         }
@@ -4125,6 +4126,10 @@ static void ixgbe_vlan_promisc_enable(struct ixgbe_adapter *adapter)
         /* Set flag so we don't redo unnecessary work */
         adapter->flags2 |= IXGBE_FLAG2_VLAN_PROMISC;
 
+        /* For VMDq and SR-IOV we must leave VLAN filtering enabled */
+        vlnctrl |= IXGBE_VLNCTRL_VFE;
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+
         /* Add PF to all active pools */
         for (i = IXGBE_VLVF_ENTRIES; --i;) {
                 u32 reg_offset = IXGBE_VLVFB(i * 2 + VMDQ_P(0) / 32);
@@ -4191,6 +4196,11 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
         struct ixgbe_hw *hw = &adapter->hw;
         u32 vlnctrl, i;
 
+        /* Set VLAN filtering to enabled */
+        vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
+        vlnctrl |= IXGBE_VLNCTRL_VFE;
+        IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
+
         switch (hw->mac.type) {
         case ixgbe_mac_82599EB:
         case ixgbe_mac_X540:
@@ -4202,10 +4212,6 @@ static void ixgbe_vlan_promisc_disable(struct ixgbe_adapter *adapter)
                         break;
                 /* fall through */
         case ixgbe_mac_82598EB:
-                vlnctrl = IXGBE_READ_REG(hw, IXGBE_VLNCTRL);
-                vlnctrl &= ~IXGBE_VLNCTRL_CFIEN;
-                vlnctrl |= IXGBE_VLNCTRL_VFE;
-                IXGBE_WRITE_REG(hw, IXGBE_VLNCTRL, vlnctrl);
                 return;
         }
 
@@ -8390,12 +8396,14 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
                             struct tcf_exts *exts, u64 *action, u8 *queue)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
         int err;
 
         if (tc_no_actions(exts))
                 return -EINVAL;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
 
                 /* Drop action */
                 if (is_tcf_gact_shot(a)) {
@@ -9517,6 +9525,7 @@ skip_sriov:
 
         /* copy netdev features into list of user selectable features */
         netdev->hw_features |= netdev->features |
+                               NETIF_F_HW_VLAN_CTAG_FILTER |
                                NETIF_F_HW_VLAN_CTAG_RX |
                                NETIF_F_HW_VLAN_CTAG_TX |
                                NETIF_F_RXALL |
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index b57ae3afb994..3743af8f1ded 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -50,6 +50,10 @@ static const struct mtk_ethtool_stats {
         MTK_ETHTOOL_STAT(rx_flow_control_packets),
 };
 
+static const char * const mtk_clks_source_name[] = {
+        "ethif", "esw", "gp1", "gp2"
+};
+
 void mtk_w32(struct mtk_eth *eth, u32 val, unsigned reg)
 {
         __raw_writel(val, eth->base + reg);
@@ -245,12 +249,16 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         case PHY_INTERFACE_MODE_MII:
                 ge_mode = 1;
                 break;
-        case PHY_INTERFACE_MODE_RMII:
+        case PHY_INTERFACE_MODE_REVMII:
                 ge_mode = 2;
                 break;
+        case PHY_INTERFACE_MODE_RMII:
+                if (!mac->id)
+                        goto err_phy;
+                ge_mode = 3;
+                break;
         default:
-                dev_err(eth->dev, "invalid phy_mode\n");
-                return -1;
+                goto err_phy;
         }
 
         /* put the gmac into the right mode */
@@ -263,19 +271,31 @@ static int mtk_phy_connect(struct mtk_mac *mac)
         mac->phy_dev->autoneg = AUTONEG_ENABLE;
         mac->phy_dev->speed = 0;
         mac->phy_dev->duplex = 0;
+
+        if (of_phy_is_fixed_link(mac->of_node))
+                mac->phy_dev->supported |=
+                SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+
         mac->phy_dev->supported &= PHY_GBIT_FEATURES | SUPPORTED_Pause |
                                    SUPPORTED_Asym_Pause;
         mac->phy_dev->advertising = mac->phy_dev->supported |
                                     ADVERTISED_Autoneg;
         phy_start_aneg(mac->phy_dev);
 
+        of_node_put(np);
+
         return 0;
+
+err_phy:
+        of_node_put(np);
+        dev_err(eth->dev, "invalid phy_mode\n");
+        return -EINVAL;
 }
 
 static int mtk_mdio_init(struct mtk_eth *eth)
 {
         struct device_node *mii_np;
-        int err;
+        int ret;
 
         mii_np = of_get_child_by_name(eth->dev->of_node, "mdio-bus");
         if (!mii_np) {
@@ -284,13 +304,13 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         }
 
         if (!of_device_is_available(mii_np)) {
-                err = 0;
+                ret = -ENODEV;
                 goto err_put_node;
         }
 
-        eth->mii_bus = mdiobus_alloc();
+        eth->mii_bus = devm_mdiobus_alloc(eth->dev);
         if (!eth->mii_bus) {
-                err = -ENOMEM;
+                ret = -ENOMEM;
                 goto err_put_node;
         }
 
@@ -301,19 +321,11 @@ static int mtk_mdio_init(struct mtk_eth *eth)
         eth->mii_bus->parent = eth->dev;
 
         snprintf(eth->mii_bus->id, MII_BUS_ID_SIZE, "%s", mii_np->name);
-        err = of_mdiobus_register(eth->mii_bus, mii_np);
-        if (err)
-                goto err_free_bus;
-
-        return 0;
-
-err_free_bus:
-        mdiobus_free(eth->mii_bus);
+        ret = of_mdiobus_register(eth->mii_bus, mii_np);
 
 err_put_node:
         of_node_put(mii_np);
-        eth->mii_bus = NULL;
-        return err;
+        return ret;
 }
 
 static void mtk_mdio_cleanup(struct mtk_eth *eth)
@@ -322,8 +334,6 @@ static void mtk_mdio_cleanup(struct mtk_eth *eth)
                 return;
 
         mdiobus_unregister(eth->mii_bus);
-        of_node_put(eth->mii_bus->dev.of_node);
-        mdiobus_free(eth->mii_bus);
 }
 
 static inline void mtk_irq_disable(struct mtk_eth *eth, u32 mask)
@@ -542,15 +552,15 @@ static inline struct mtk_tx_buf *mtk_desc_to_tx_buf(struct mtk_tx_ring *ring,
         return &ring->buf[idx];
 }
 
-static void mtk_tx_unmap(struct device *dev, struct mtk_tx_buf *tx_buf)
+static void mtk_tx_unmap(struct mtk_eth *eth, struct mtk_tx_buf *tx_buf)
 {
         if (tx_buf->flags & MTK_TX_FLAGS_SINGLE0) {
-                dma_unmap_single(dev,
+                dma_unmap_single(eth->dev,
                                  dma_unmap_addr(tx_buf, dma_addr0),
                                  dma_unmap_len(tx_buf, dma_len0),
                                  DMA_TO_DEVICE);
         } else if (tx_buf->flags & MTK_TX_FLAGS_PAGE0) {
-                dma_unmap_page(dev,
+                dma_unmap_page(eth->dev,
                                dma_unmap_addr(tx_buf, dma_addr0),
                                dma_unmap_len(tx_buf, dma_len0),
                                DMA_TO_DEVICE);
@@ -572,14 +582,15 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         dma_addr_t mapped_addr;
         unsigned int nr_frags;
         int i, n_desc = 1;
-        u32 txd4 = 0;
+        u32 txd4 = 0, fport;
 
         itxd = ring->next_free;
         if (itxd == ring->last_free)
                 return -ENOMEM;
 
         /* set the forward port */
-        txd4 |= (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        fport = (mac->id + 1) << TX_DMA_FPORT_SHIFT;
+        txd4 |= fport;
 
         tx_buf = mtk_desc_to_tx_buf(ring, itxd);
         memset(tx_buf, 0, sizeof(*tx_buf));
@@ -595,9 +606,9 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
         if (skb_vlan_tag_present(skb))
                 txd4 |= TX_DMA_INS_VLAN | skb_vlan_tag_get(skb);
 
-        mapped_addr = dma_map_single(&dev->dev, skb->data,
+        mapped_addr = dma_map_single(eth->dev, skb->data,
                                      skb_headlen(skb), DMA_TO_DEVICE);
-        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
+        if (unlikely(dma_mapping_error(eth->dev, mapped_addr)))
                 return -ENOMEM;
 
         WRITE_ONCE(itxd->txd1, mapped_addr);
@@ -623,10 +634,10 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
 
                         n_desc++;
                         frag_map_size = min(frag_size, MTK_TX_DMA_BUF_LEN);
-                        mapped_addr = skb_frag_dma_map(&dev->dev, frag, offset,
+                        mapped_addr = skb_frag_dma_map(eth->dev, frag, offset,
                                                        frag_map_size,
                                                        DMA_TO_DEVICE);
-                        if (unlikely(dma_mapping_error(&dev->dev, mapped_addr)))
+                        if (unlikely(dma_mapping_error(eth->dev, mapped_addr)))
                                 goto err_dma;
 
                         if (i == nr_frags - 1 &&
@@ -637,7 +648,7 @@ static int mtk_tx_map(struct sk_buff *skb, struct net_device *dev,
                         WRITE_ONCE(txd->txd3, (TX_DMA_SWC |
                                                TX_DMA_PLEN0(frag_map_size) |
                                                last_frag * TX_DMA_LS0));
-                        WRITE_ONCE(txd->txd4, 0);
+                        WRITE_ONCE(txd->txd4, fport);
 
                         tx_buf->skb = (struct sk_buff *)MTK_DMA_DUMMY_DESC;
                         tx_buf = mtk_desc_to_tx_buf(ring, txd);
@@ -679,7 +690,7 @@ err_dma:
                 tx_buf = mtk_desc_to_tx_buf(ring, itxd);
 
                 /* unmap dma */
-                mtk_tx_unmap(&dev->dev, tx_buf);
+                mtk_tx_unmap(eth, tx_buf);
 
                 itxd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
                 itxd = mtk_qdma_phys_to_virt(ring, itxd->txd2);
@@ -836,11 +847,11 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                         netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
-                dma_addr = dma_map_single(&eth->netdev[mac]->dev,
+                dma_addr = dma_map_single(eth->dev,
                                           new_data + NET_SKB_PAD,
                                           ring->buf_size,
                                           DMA_FROM_DEVICE);
-                if (unlikely(dma_mapping_error(&netdev->dev, dma_addr))) {
+                if (unlikely(dma_mapping_error(eth->dev, dma_addr))) {
                         skb_free_frag(new_data);
                         netdev->stats.rx_dropped++;
                         goto release_desc;
@@ -849,13 +860,13 @@ static int mtk_poll_rx(struct napi_struct *napi, int budget,
                 /* receive data */
                 skb = build_skb(data, ring->frag_size);
                 if (unlikely(!skb)) {
-                        put_page(virt_to_head_page(new_data));
+                        skb_free_frag(new_data);
                         netdev->stats.rx_dropped++;
                         goto release_desc;
                 }
                 skb_reserve(skb, NET_SKB_PAD + NET_IP_ALIGN);
 
-                dma_unmap_single(&netdev->dev, trxd.rxd1,
+                dma_unmap_single(eth->dev, trxd.rxd1,
                                  ring->buf_size, DMA_FROM_DEVICE);
                 pktlen = RX_DMA_GET_PLEN0(trxd.rxd2);
                 skb->dev = netdev;
@@ -937,7 +948,7 @@ static int mtk_poll_tx(struct mtk_eth *eth, int budget)
                         done[mac]++;
                         budget--;
                 }
-                mtk_tx_unmap(eth->dev, tx_buf);
+                mtk_tx_unmap(eth, tx_buf);
 
                 ring->last_free = desc;
                 atomic_inc(&ring->free_count);
@@ -1092,7 +1103,7 @@ static void mtk_tx_clean(struct mtk_eth *eth)
 
         if (ring->buf) {
                 for (i = 0; i < MTK_DMA_SIZE; i++)
-                        mtk_tx_unmap(eth->dev, &ring->buf[i]);
+                        mtk_tx_unmap(eth, &ring->buf[i]);
                 kfree(ring->buf);
                 ring->buf = NULL;
         }
@@ -1490,10 +1501,7 @@ static void mtk_uninit(struct net_device *dev)
         struct mtk_eth *eth = mac->hw;
 
         phy_disconnect(mac->phy_dev);
-        mtk_mdio_cleanup(eth);
         mtk_irq_disable(eth, ~0);
-        free_irq(eth->irq[1], dev);
-        free_irq(eth->irq[2], dev);
 }
 
 static int mtk_do_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
@@ -1751,6 +1759,7 @@ static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
                 goto free_netdev;
         }
         spin_lock_init(&mac->hw_stats->stats_lock);
+        u64_stats_init(&mac->hw_stats->syncp);
         mac->hw_stats->reg_offset = id * MTK_STAT_OFFSET;
 
         SET_NETDEV_DEV(eth->netdev[id], eth->dev);
@@ -1796,6 +1805,7 @@ static int mtk_probe(struct platform_device *pdev)
         if (!eth)
                 return -ENOMEM;
 
+        eth->dev = &pdev->dev;
         eth->base = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(eth->base))
                 return PTR_ERR(eth->base);
@@ -1830,21 +1840,21 @@ static int mtk_probe(struct platform_device *pdev)
                         return -ENXIO;
                 }
         }
+        for (i = 0; i < ARRAY_SIZE(eth->clks); i++) {
+                eth->clks[i] = devm_clk_get(eth->dev,
+                                            mtk_clks_source_name[i]);
+                if (IS_ERR(eth->clks[i])) {
+                        if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER)
+                                return -EPROBE_DEFER;
+                        return -ENODEV;
+                }
+        }
 
-        eth->clk_ethif = devm_clk_get(&pdev->dev, "ethif");
-        eth->clk_esw = devm_clk_get(&pdev->dev, "esw");
-        eth->clk_gp1 = devm_clk_get(&pdev->dev, "gp1");
-        eth->clk_gp2 = devm_clk_get(&pdev->dev, "gp2");
-        if (IS_ERR(eth->clk_esw) || IS_ERR(eth->clk_gp1) ||
-            IS_ERR(eth->clk_gp2) || IS_ERR(eth->clk_ethif))
-                return -ENODEV;
-
-        clk_prepare_enable(eth->clk_ethif);
-        clk_prepare_enable(eth->clk_esw);
-        clk_prepare_enable(eth->clk_gp1);
-        clk_prepare_enable(eth->clk_gp2);
+        clk_prepare_enable(eth->clks[MTK_CLK_ETHIF]);
+        clk_prepare_enable(eth->clks[MTK_CLK_ESW]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP1]);
+        clk_prepare_enable(eth->clks[MTK_CLK_GP2]);
 
-        eth->dev = &pdev->dev;
         eth->msg_enable = netif_msg_init(mtk_msg_level, MTK_DEFAULT_MSG_ENABLE);
         INIT_WORK(&eth->pending_work, mtk_pending_work);
 
@@ -1886,15 +1896,24 @@ err_free_dev:
 static int mtk_remove(struct platform_device *pdev)
 {
         struct mtk_eth *eth = platform_get_drvdata(pdev);
+        int i;
 
-        clk_disable_unprepare(eth->clk_ethif);
-        clk_disable_unprepare(eth->clk_esw);
-        clk_disable_unprepare(eth->clk_gp1);
-        clk_disable_unprepare(eth->clk_gp2);
+        /* stop all devices to make sure that dma is properly shut down */
+        for (i = 0; i < MTK_MAC_COUNT; i++) {
+                if (!eth->netdev[i])
+                        continue;
+                mtk_stop(eth->netdev[i]);
+        }
+
+        clk_disable_unprepare(eth->clks[MTK_CLK_ETHIF]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_ESW]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP1]);
+        clk_disable_unprepare(eth->clks[MTK_CLK_GP2]);
 
         netif_napi_del(&eth->tx_napi);
         netif_napi_del(&eth->rx_napi);
         mtk_cleanup(eth);
+        mtk_mdio_cleanup(eth);
         platform_set_drvdata(pdev, NULL);
 
         return 0;
@@ -1904,6 +1923,7 @@ const struct of_device_id of_mtk_match[] = {
         { .compatible = "mediatek,mt7623-eth" },
         {},
 };
+MODULE_DEVICE_TABLE(of, of_mtk_match);
 
 static struct platform_driver mtk_driver = {
         .probe = mtk_probe,
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.h b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
index f82e3acb947b..6e1ade7a25c5 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
@@ -290,6 +290,17 @@ enum mtk_tx_flags {
         MTK_TX_FLAGS_PAGE0      = 0x02,
 };
 
+/* This enum allows us to identify how the clock is defined on the array of the
+ * clock in the order
+ */
+enum mtk_clks_map {
+        MTK_CLK_ETHIF,
+        MTK_CLK_ESW,
+        MTK_CLK_GP1,
+        MTK_CLK_GP2,
+        MTK_CLK_MAX
+};
+
 /* struct mtk_tx_buf -  This struct holds the pointers to the memory pointed at
  *                      by the TX descriptor    s
  * @skb:                The SKB pointer of the packet being sent
@@ -370,10 +381,7 @@ struct mtk_rx_ring {
  * @scratch_ring:       Newer SoCs need memory for a second HW managed TX ring
  * @phy_scratch_ring:   physical address of scratch_ring
  * @scratch_head:       The scratch memory that scratch_ring points to.
- * @clk_ethif:          The ethif clock
- * @clk_esw:            The switch clock
- * @clk_gp1:            The gmac1 clock
- * @clk_gp2:            The gmac2 clock
+ * @clks:               clock array for all clocks required
  * @mii_bus:            If there is a bus we need to create an instance for it
  * @pending_work:       The workqueue used to reset the dma ring
  */
@@ -400,10 +408,8 @@ struct mtk_eth {
         struct mtk_tx_dma               *scratch_ring;
         dma_addr_t                      phy_scratch_ring;
         void                            *scratch_head;
-        struct clk                      *clk_ethif;
-        struct clk                      *clk_esw;
-        struct clk                      *clk_gp1;
-        struct clk                      *clk_gp2;
+        struct clk                      *clks[MTK_CLK_MAX];
+
         struct mii_bus                  *mii_bus;
         struct work_struct              pending_work;
 };
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
index 99c6bbdff501..b04760a5034b 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c
@@ -94,7 +94,7 @@ static u8 mlx4_en_dcbnl_getcap(struct net_device *dev, int capid, u8 *cap)
                 *cap = true;
                 break;
         case DCB_CAP_ATTR_DCBX:
-                *cap = priv->cee_params.dcbx_cap;
+                *cap = priv->dcbx_cap;
                 break;
         case DCB_CAP_ATTR_PFC_TCS:
                 *cap = 1 <<  mlx4_max_tc(priv->mdev->dev);
@@ -111,14 +111,14 @@ static u8 mlx4_en_dcbnl_getpfcstate(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        return priv->cee_params.dcb_cfg.pfc_state;
+        return priv->cee_config.pfc_state;
 }
 
 static void mlx4_en_dcbnl_setpfcstate(struct net_device *netdev, u8 state)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.pfc_state = state;
+        priv->cee_config.pfc_state = state;
 }
 
 static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
@@ -126,7 +126,7 @@ static void mlx4_en_dcbnl_get_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        *setting = priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc;
+        *setting = priv->cee_config.dcb_pfc[priority];
 }
 
 static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
@@ -134,8 +134,8 @@ static void mlx4_en_dcbnl_set_pfc_cfg(struct net_device *netdev, int priority,
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
 
-        priv->cee_params.dcb_cfg.tc_config[priority].dcb_pfc = setting;
-        priv->cee_params.dcb_cfg.pfc_state = true;
+        priv->cee_config.dcb_pfc[priority] = setting;
+        priv->cee_config.pfc_state = true;
 }
 
 static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num)
@@ -157,13 +157,11 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
 {
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct mlx4_en_dev *mdev = priv->mdev;
-        struct mlx4_en_cee_config *dcb_cfg = &priv->cee_params.dcb_cfg;
-        int err = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
-                return -EINVAL;
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+                return 1;
 
-        if (dcb_cfg->pfc_state) {
+        if (priv->cee_config.pfc_state) {
                 int tc;
 
                 priv->prof->rx_pause = 0;
@@ -171,7 +169,7 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) {
                         u8 tc_mask = 1 << tc;
 
-                        switch (dcb_cfg->tc_config[tc].dcb_pfc) {
+                        switch (priv->cee_config.dcb_pfc[tc]) {
                         case pfc_disabled:
                                 priv->prof->tx_ppp &= ~tc_mask;
                                 priv->prof->rx_ppp &= ~tc_mask;
@@ -199,15 +197,17 @@ static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev)
                 en_dbg(DRV, priv, "Set pfc off\n");
         }
 
-        err = mlx4_SET_PORT_general(mdev->dev, priv->port,
-                                    priv->rx_skb_size + ETH_FCS_LEN,
-                                    priv->prof->tx_pause,
-                                    priv->prof->tx_ppp,
-                                    priv->prof->rx_pause,
-                                    priv->prof->rx_ppp);
-        if (err)
+        if (mlx4_SET_PORT_general(mdev->dev, priv->port,
+                                  priv->rx_skb_size + ETH_FCS_LEN,
+                                  priv->prof->tx_pause,
+                                  priv->prof->tx_ppp,
+                                  priv->prof->rx_pause,
+                                  priv->prof->rx_ppp)) {
                 en_err(priv, "Failed setting pause params\n");
-        return err;
+                return 1;
+        }
+
+        return 0;
 }
 
 static u8 mlx4_en_dcbnl_get_state(struct net_device *dev)
@@ -225,7 +225,7 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
         struct mlx4_en_priv *priv = netdev_priv(dev);
         int num_tcs = 0;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 1;
 
         if (!!(state) == !!(priv->flags & MLX4_EN_FLAG_DCB_ENABLED))
@@ -238,7 +238,10 @@ static u8 mlx4_en_dcbnl_set_state(struct net_device *dev, u8 state)
                 priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
         }
 
-        return mlx4_en_setup_tc(dev, num_tcs);
+        if (mlx4_en_setup_tc(dev, num_tcs))
+                return 1;
+
+        return 0;
 }
 
 /* On success returns a non-zero 802.1p user priority bitmap
@@ -252,7 +255,7 @@ static int mlx4_en_dcbnl_getapp(struct net_device *netdev, u8 idtype, u16 id)
                                 .selector = idtype,
                                 .protocol = id,
                              };
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return 0;
 
         return dcb_getapp(netdev, &app);
@@ -264,7 +267,7 @@ static int mlx4_en_dcbnl_setapp(struct net_device *netdev, u8 idtype,
         struct mlx4_en_priv *priv = netdev_priv(netdev);
         struct dcb_app app;
 
-        if (!(priv->cee_params.dcbx_cap & DCB_CAP_DCBX_VER_CEE))
+        if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE))
                 return -EINVAL;
 
         memset(&app, 0, sizeof(struct dcb_app));
@@ -433,7 +436,7 @@ static u8 mlx4_en_dcbnl_getdcbx(struct net_device *dev)
 {
         struct mlx4_en_priv *priv = netdev_priv(dev);
 
-        return priv->cee_params.dcbx_cap;
+        return priv->dcbx_cap;
 }
 
 static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
@@ -442,7 +445,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
         struct ieee_ets ets = {0};
         struct ieee_pfc pfc = {0};
 
-        if (mode == priv->cee_params.dcbx_cap)
+        if (mode == priv->dcbx_cap)
                 return 0;
 
         if ((mode & DCB_CAP_DCBX_LLD_MANAGED) ||
@@ -451,7 +454,7 @@ static u8 mlx4_en_dcbnl_setdcbx(struct net_device *dev, u8 mode)
             !(mode & DCB_CAP_DCBX_HOST))
                 goto err;
 
-        priv->cee_params.dcbx_cap = mode;
+        priv->dcbx_cap = mode;
 
         ets.ets_cap = IEEE_8021QAZ_MAX_TCS;
         pfc.pfc_cap = IEEE_8021QAZ_MAX_TCS;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 4198e9bf89d0..fedb829276f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -71,10 +71,11 @@ int mlx4_en_setup_tc(struct net_device *dev, u8 up)
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
                 if (up) {
-                        priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
+                        if (priv->dcbx_cap)
+                                priv->flags |= MLX4_EN_FLAG_DCB_ENABLED;
                 } else {
                         priv->flags &= ~MLX4_EN_FLAG_DCB_ENABLED;
-                        priv->cee_params.dcb_cfg.pfc_state = false;
+                        priv->cee_config.pfc_state = false;
                 }
         }
 #endif /* CONFIG_MLX4_EN_DCB */
@@ -3048,9 +3049,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         struct mlx4_en_priv *priv;
         int i;
         int err;
-#ifdef CONFIG_MLX4_EN_DCB
-        struct tc_configuration *tc;
-#endif
 
         dev = alloc_etherdev_mqs(sizeof(struct mlx4_en_priv),
                                  MAX_TX_RINGS, MAX_RX_RINGS);
@@ -3117,16 +3115,13 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         priv->msg_enable = MLX4_EN_MSG_LEVEL;
 #ifdef CONFIG_MLX4_EN_DCB
         if (!mlx4_is_slave(priv->mdev->dev)) {
-                priv->cee_params.dcbx_cap = DCB_CAP_DCBX_VER_CEE |
-                                            DCB_CAP_DCBX_HOST |
-                                            DCB_CAP_DCBX_VER_IEEE;
+                priv->dcbx_cap = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_HOST |
+                        DCB_CAP_DCBX_VER_IEEE;
                 priv->flags |= MLX4_EN_DCB_ENABLED;
-                priv->cee_params.dcb_cfg.pfc_state = false;
+                priv->cee_config.pfc_state = false;
 
-                for (i = 0; i < MLX4_EN_NUM_UP; i++) {
-                        tc = &priv->cee_params.dcb_cfg.tc_config[i];
-                        tc->dcb_pfc = pfc_disabled;
-                }
+                for (i = 0; i < MLX4_EN_NUM_UP; i++)
+                        priv->cee_config.dcb_pfc[i] = pfc_disabled;
 
                 if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_ETS_CFG) {
                         dev->dcbnl_ops = &mlx4_en_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 9df87ca0515a..e2509bba3e7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -818,7 +818,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         real_size = get_real_size(skb, shinfo, dev, &lso_header_size,
                                   &inline_ok, &fragptr);
         if (unlikely(!real_size))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* Align descriptor to TXBB size */
         desc_size = ALIGN(real_size, TXBB_SIZE);
@@ -826,7 +826,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
         if (unlikely(nr_txbb > MAX_DESC_TXBBS)) {
                 if (netif_msg_tx_err(priv))
                         en_warn(priv, "Oversized header or SG list\n");
-                goto tx_drop;
+                goto tx_drop_count;
         }
 
         bf_ok = ring->bf_enabled;
@@ -1071,9 +1071,10 @@ tx_drop_unmap:
                                PCI_DMA_TODEVICE);
         }
 
+tx_drop_count:
+        ring->tx_dropped++;
 tx_drop:
         dev_kfree_skb_any(skb);
-        ring->tx_dropped++;
         return NETDEV_TX_OK;
 }
 
@@ -1106,7 +1107,7 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
                 goto tx_drop;
 
         if (mlx4_en_is_tx_ring_full(ring))
-                goto tx_drop;
+                goto tx_drop_count;
 
         /* fetch ring->cons far ahead before needing it to avoid stall */
         ring_cons = READ_ONCE(ring->cons);
@@ -1176,7 +1177,8 @@ netdev_tx_t mlx4_en_xmit_frame(struct mlx4_en_rx_alloc *frame,
 
         return NETDEV_TX_OK;
 
-tx_drop:
+tx_drop_count:
         ring->tx_dropped++;
+tx_drop:
         return NETDEV_TX_BUSY;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index f613977455e0..cf8f8a72a801 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1305,8 +1305,8 @@ int mlx4_init_eq_table(struct mlx4_dev *dev)
         return 0;
 
 err_out_unmap:
-        while (i >= 0)
-                mlx4_free_eq(dev, &priv->eq_table.eq[i--]);
+        while (i > 0)
+                mlx4_free_eq(dev, &priv->eq_table.eq[--i]);
 #ifdef CONFIG_RFS_ACCEL
         for (i = 1; i <= dev->caps.num_ports; i++) {
                 if (mlx4_priv(dev)->port[i].rmap) {
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 75dd2e3d3059..7183ac4135d2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -2970,6 +2970,7 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port)
                 mlx4_err(dev, "Failed to create mtu file for port %d\n", port);
                 device_remove_file(&info->dev->persist->pdev->dev,
                                    &info->port_attr);
+                devlink_port_unregister(&info->devlink_port);
                 info->port = -1;
         }
 
@@ -2984,6 +2985,8 @@ static void mlx4_cleanup_port_info(struct mlx4_port_info *info)
         device_remove_file(&info->dev->persist->pdev->dev, &info->port_attr);
         device_remove_file(&info->dev->persist->pdev->dev,
                            &info->port_mtu_attr);
+        devlink_port_unregister(&info->devlink_port);
+
 #ifdef CONFIG_RFS_ACCEL
         free_irq_cpu_rmap(info->rmap);
         info->rmap = NULL;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 2c2913dcae98..9099dbd04951 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -482,20 +482,10 @@ enum dcb_pfc_type {
         pfc_enabled_rx
 };
 
-struct tc_configuration {
-        enum dcb_pfc_type  dcb_pfc;
-};
-
 struct mlx4_en_cee_config {
         bool    pfc_state;
-        struct  tc_configuration tc_config[MLX4_EN_NUM_UP];
+        enum    dcb_pfc_type dcb_pfc[MLX4_EN_NUM_UP];
 };
-
-struct mlx4_en_cee_params {
-        u8 dcbx_cap;
-        struct mlx4_en_cee_config dcb_cfg;
-};
-
 #endif
 
 struct ethtool_flow_id {
@@ -624,7 +614,8 @@ struct mlx4_en_priv {
         struct ieee_ets ets;
         u16 maxrate[IEEE_8021QAZ_MAX_TCS];
         enum dcbnl_cndd_states cndd_state[IEEE_8021QAZ_MAX_TCS];
-        struct mlx4_en_cee_params cee_params;
+        struct mlx4_en_cee_config cee_config;
+        u8 dcbx_cap;
 #endif
 #ifdef CONFIG_RFS_ACCEL
         spinlock_t filters_lock;
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 3d2095e5c61c..c5b2064297a1 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -52,7 +52,7 @@
 
 #define MLX4_FLAG_V_IGNORE_FCS_MASK             0x2
 #define MLX4_IGNORE_FCS_MASK                    0x1
-#define MLNX4_TX_MAX_NUMBER                     8
+#define MLX4_TC_MAX_NUMBER                      8
 
 void mlx4_init_mac_table(struct mlx4_dev *dev, struct mlx4_mac_table *table)
 {
@@ -2022,7 +2022,7 @@ int mlx4_max_tc(struct mlx4_dev *dev)
         u8 num_tc = dev->caps.max_tc_eth;
 
         if (!num_tc)
-                num_tc = MLNX4_TX_MAX_NUMBER;
+                num_tc = MLX4_TC_MAX_NUMBER;
 
         return num_tc;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index d6e2a1cae19a..c2ec01a22d55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -143,13 +143,14 @@ static struct mlx5_cmd_layout *get_inst(struct mlx5_cmd *cmd, int idx)
         return cmd->cmd_buf + (idx << cmd->log_stride);
 }
 
-static u8 xor8_buf(void *buf, int len)
+static u8 xor8_buf(void *buf, size_t offset, int len)
 {
         u8 *ptr = buf;
         u8 sum = 0;
         int i;
+        int end = len + offset;
 
-        for (i = 0; i < len; i++)
+        for (i = offset; i < end; i++)
                 sum ^= ptr[i];
 
         return sum;
@@ -157,41 +158,49 @@ static u8 xor8_buf(void *buf, int len)
 
 static int verify_block_sig(struct mlx5_cmd_prot_block *block)
 {
-        if (xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 1) != 0xff)
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+        int xor_len = sizeof(*block) - sizeof(block->data) - 1;
+
+        if (xor8_buf(block, rsvd0_off, xor_len) != 0xff)
                 return -EINVAL;
 
-        if (xor8_buf(block, sizeof(*block)) != 0xff)
+        if (xor8_buf(block, 0, sizeof(*block)) != 0xff)
                 return -EINVAL;
 
         return 0;
 }
 
-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
-                           int csum)
+static void calc_block_sig(struct mlx5_cmd_prot_block *block)
 {
-        block->token = token;
-        if (csum) {
-                block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
-                                            sizeof(block->data) - 2);
-                block->sig = ~xor8_buf(block, sizeof(*block) - 1);
-        }
+        int ctrl_xor_len = sizeof(*block) - sizeof(block->data) - 2;
+        size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
+
+        block->ctrl_sig = ~xor8_buf(block, rsvd0_off, ctrl_xor_len);
+        block->sig = ~xor8_buf(block, 0, sizeof(*block) - 1);
 }
 
-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
+static void calc_chain_sig(struct mlx5_cmd_msg *msg)
 {
         struct mlx5_cmd_mailbox *next = msg->next;
-
-        while (next) {
-                calc_block_sig(next->buf, token, csum);
+        int size = msg->len;
+        int blen = size - min_t(int, sizeof(msg->first.data), size);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
+
+        for (i = 0; i < n && next; i++)  {
+                calc_block_sig(next->buf);
                 next = next->next;
         }
 }
 
 static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
 {
-        ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
-        calc_chain_sig(ent->in, ent->token, csum);
-        calc_chain_sig(ent->out, ent->token, csum);
+        ent->lay->sig = ~xor8_buf(ent->lay, 0,  sizeof(*ent->lay));
+        if (csum) {
+                calc_chain_sig(ent->in);
+                calc_chain_sig(ent->out);
+        }
 }
 
 static void poll_timeout(struct mlx5_cmd_work_ent *ent)
@@ -222,12 +231,17 @@ static int verify_signature(struct mlx5_cmd_work_ent *ent)
         struct mlx5_cmd_mailbox *next = ent->out->next;
         int err;
         u8 sig;
+        int size = ent->out->len;
+        int blen = size - min_t(int, sizeof(ent->out->first.data), size);
+        int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
+                / MLX5_CMD_DATA_BLOCK_SIZE;
+        int i = 0;
 
-        sig = xor8_buf(ent->lay, sizeof(*ent->lay));
+        sig = xor8_buf(ent->lay, 0, sizeof(*ent->lay));
         if (sig != 0xff)
                 return -EINVAL;
 
-        while (next) {
+        for (i = 0; i < n && next; i++) {
                 err = verify_block_sig(next->buf);
                 if (err)
                         return err;
@@ -656,7 +670,6 @@ static void cmd_work_handler(struct work_struct *work)
                 spin_unlock_irqrestore(&cmd->alloc_lock, flags);
         }
 
-        ent->token = alloc_token(cmd);
         cmd->ent_arr[ent->idx] = ent;
         lay = get_inst(cmd, ent->idx);
         ent->lay = lay;
@@ -766,7 +779,8 @@ static u8 *get_status_ptr(struct mlx5_outbox_hdr *out)
 static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
                            struct mlx5_cmd_msg *out, void *uout, int uout_size,
                            mlx5_cmd_cbk_t callback,
-                           void *context, int page_queue, u8 *status)
+                           void *context, int page_queue, u8 *status,
+                           u8 token)
 {
         struct mlx5_cmd *cmd = &dev->cmd;
         struct mlx5_cmd_work_ent *ent;
@@ -783,6 +797,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
         if (IS_ERR(ent))
                 return PTR_ERR(ent);
 
+        ent->token = token;
+
         if (!callback)
                 init_completion(&ent->done);
 
@@ -854,7 +870,8 @@ static const struct file_operations fops = {
         .write  = dbg_write,
 };
 
-static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
+static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size,
+                            u8 token)
 {
         struct mlx5_cmd_prot_block *block;
         struct mlx5_cmd_mailbox *next;
@@ -880,6 +897,7 @@ static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
                 memcpy(block->data, from, copy);
                 from += copy;
                 size -= copy;
+                block->token = token;
                 next = next->next;
         }
 
@@ -949,7 +967,8 @@ static void free_cmd_box(struct mlx5_core_dev *dev,
 }
 
 static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
-                                               gfp_t flags, int size)
+                                               gfp_t flags, int size,
+                                               u8 token)
 {
         struct mlx5_cmd_mailbox *tmp, *head = NULL;
         struct mlx5_cmd_prot_block *block;
@@ -978,6 +997,7 @@ static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
                 tmp->next = head;
                 block->next = cpu_to_be64(tmp->next ? tmp->next->dma : 0);
                 block->block_num = cpu_to_be32(n - i - 1);
+                block->token = token;
                 head = tmp;
         }
         msg->next = head;
@@ -1352,7 +1372,7 @@ static struct mlx5_cmd_msg *alloc_msg(struct mlx5_core_dev *dev, int in_size,
         }
 
         if (IS_ERR(msg))
-                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size);
+                msg = mlx5_alloc_cmd_msg(dev, gfp, in_size, 0);
 
         return msg;
 }
@@ -1377,6 +1397,7 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
         int err;
         u8 status = 0;
         u32 drv_synd;
+        u8 token;
 
         if (pci_channel_offline(dev->pdev) ||
             dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
@@ -1395,20 +1416,22 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,
                 return err;
         }
 
-        err = mlx5_copy_to_msg(inb, in, in_size);
+        token = alloc_token(&dev->cmd);
+
+        err = mlx5_copy_to_msg(inb, in, in_size, token);
         if (err) {
                 mlx5_core_warn(dev, "err %d\n", err);
                 goto out_in;
         }
 
-        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size);
+        outb = mlx5_alloc_cmd_msg(dev, gfp, out_size, token);
         if (IS_ERR(outb)) {
                 err = PTR_ERR(outb);
                 goto out_in;
         }
 
         err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
-                              pages_queue, &status);
+                              pages_queue, &status, token);
         if (err)
                 goto out_out;
 
@@ -1476,7 +1499,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
         INIT_LIST_HEAD(&cmd->cache.med.head);
 
         for (i = 0; i < NUM_LONG_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE, 0);
                 if (IS_ERR(msg)) {
                         err = PTR_ERR(msg);
                         goto ex_err;
@@ -1486,7 +1509,7 @@ static int create_msg_cache(struct mlx5_core_dev *dev)
         }
 
         for (i = 0; i < NUM_MED_LISTS; i++) {
-                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE);
+                msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE, 0);
                 if (IS_ERR(msg)) {
                         err = PTR_ERR(msg);
                         goto ex_err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 1b495efa7490..bf722aa88cf0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -73,8 +73,12 @@
 #define MLX5_MPWRQ_PAGES_PER_WQE                BIT(MLX5_MPWRQ_WQE_PAGE_ORDER)
 #define MLX5_MPWRQ_STRIDES_PER_PAGE             (MLX5_MPWRQ_NUM_STRIDES >> \
                                                  MLX5_MPWRQ_WQE_PAGE_ORDER)
-#define MLX5_CHANNEL_MAX_NUM_MTTS (ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8) * \
-                                   BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW))
+
+#define MLX5_MTT_OCTW(npages) (ALIGN(npages, 8) / 2)
+#define MLX5E_REQUIRED_MTTS(rqs, wqes)\
+        (rqs * wqes * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8))
+#define MLX5E_VALID_NUM_MTTS(num_mtts) (MLX5_MTT_OCTW(num_mtts) <= U16_MAX)
+
 #define MLX5_UMR_ALIGN                          (2048)
 #define MLX5_MPWRQ_SMALL_PACKET_THRESHOLD       (128)
 
@@ -219,9 +223,8 @@ struct mlx5e_tstamp {
 };
 
 enum {
-        MLX5E_RQ_STATE_POST_WQES_ENABLE,
+        MLX5E_RQ_STATE_FLUSH,
         MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS,
-        MLX5E_RQ_STATE_FLUSH_TIMEOUT,
         MLX5E_RQ_STATE_AM,
 };
 
@@ -304,6 +307,7 @@ struct mlx5e_rq {
 
         unsigned long          state;
         int                    ix;
+        u32                    mpwqe_mtt_offset;
 
         struct mlx5e_rx_am     am; /* Adaptive Moderation */
 
@@ -365,9 +369,8 @@ struct mlx5e_sq_dma {
 };
 
 enum {
-        MLX5E_SQ_STATE_WAKE_TXQ_ENABLE,
+        MLX5E_SQ_STATE_FLUSH,
         MLX5E_SQ_STATE_BF_ENABLE,
-        MLX5E_SQ_STATE_TX_TIMEOUT,
 };
 
 struct mlx5e_ico_wqe_info {
@@ -698,7 +701,6 @@ int mlx5e_napi_poll(struct napi_struct *napi, int budget);
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget);
 int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget);
 void mlx5e_free_tx_descs(struct mlx5e_sq *sq);
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq);
 
 void mlx5e_handle_rx_cqe(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
 void mlx5e_handle_rx_cqe_mpwrq(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe);
@@ -814,11 +816,6 @@ static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev)
                      MLX5E_MAX_NUM_CHANNELS);
 }
 
-static inline int mlx5e_get_mtt_octw(int npages)
-{
-        return ALIGN(npages, 8) / 2;
-}
-
 extern const struct ethtool_ops mlx5e_ethtool_ops;
 #ifdef CONFIG_MLX5_CORE_EN_DCB
 extern const struct dcbnl_rtnl_ops mlx5e_dcbnl_ops;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 673043ccd76c..9cce153e1035 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -139,7 +139,7 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
         struct mlx5e_tir *tir;
         void *in;
         int inlen;
-        int err;
+        int err = 0;
 
         inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
         in = mlx5_vzalloc(inlen);
@@ -151,10 +151,11 @@ int mlx5e_refresh_tirs_self_loopback_enable(struct mlx5_core_dev *mdev)
         list_for_each_entry(tir, &mdev->mlx5e_res.td.tirs_list, list) {
                 err = mlx5_core_modify_tir(mdev, tir->tirn, in, inlen);
                 if (err)
-                        return err;
+                        goto out;
         }
 
+out:
         kvfree(in);
 
-        return 0;
+        return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index caa9a3ccc3f3..762af16ed021 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -127,29 +127,40 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets)
         return mlx5_set_port_tc_bw_alloc(mdev, tc_tx_bw);
 }
 
-static int mlx5e_dbcnl_validate_ets(struct ieee_ets *ets)
+static int mlx5e_dbcnl_validate_ets(struct net_device *netdev,
+                                    struct ieee_ets *ets)
 {
         int bw_sum = 0;
         int i;
 
         /* Validate Priority */
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
-                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY)
+                if (ets->prio_tc[i] >= MLX5E_MAX_PRIORITY) {
+                        netdev_err(netdev,
+                                   "Failed to validate ETS: priority value greater than max(%d)\n",
+                                    MLX5E_MAX_PRIORITY);
                         return -EINVAL;
+                }
         }
 
         /* Validate Bandwidth Sum */
         for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
                 if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) {
-                        if (!ets->tc_tx_bw[i])
+                        if (!ets->tc_tx_bw[i]) {
+                                netdev_err(netdev,
+                                           "Failed to validate ETS: BW 0 is illegal\n");
                                 return -EINVAL;
+                        }
 
                         bw_sum += ets->tc_tx_bw[i];
                 }
         }
 
-        if (bw_sum != 0 && bw_sum != 100)
+        if (bw_sum != 0 && bw_sum != 100) {
+                netdev_err(netdev,
+                           "Failed to validate ETS: BW sum is illegal\n");
                 return -EINVAL;
+        }
         return 0;
 }
 
@@ -159,7 +170,7 @@ static int mlx5e_dcbnl_ieee_setets(struct net_device *netdev,
         struct mlx5e_priv *priv = netdev_priv(netdev);
         int err;
 
-        err = mlx5e_dbcnl_validate_ets(ets);
+        err = mlx5e_dbcnl_validate_ets(netdev, ets);
         if (err)
                 return err;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 4a3757e60441..7a346bb2ed00 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -331,7 +331,7 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
         if (mlx5e_query_global_pause_combined(priv)) {
                 for (i = 0; i < NUM_PPORT_PER_PRIO_PFC_COUNTERS; i++) {
                         data[idx++] = MLX5E_READ_CTR64_BE(&priv->stats.pport.per_prio_counters[0],
-                                                          pport_per_prio_pfc_stats_desc, 0);
+                                                          pport_per_prio_pfc_stats_desc, i);
                 }
         }
 
@@ -352,15 +352,61 @@ static void mlx5e_get_ethtool_stats(struct net_device *dev,
                                                                    sq_stats_desc, j);
 }
 
+static u32 mlx5e_rx_wqes_to_packets(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_wqe)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_wqe;
+
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        return (1 << (order_base_2(num_wqe * packets_per_wqe) - 1));
+}
+
+static u32 mlx5e_packets_to_rx_wqes(struct mlx5e_priv *priv, int rq_wq_type,
+                                    int num_packets)
+{
+        int packets_per_wqe;
+        int stride_size;
+        int num_strides;
+        int wqe_size;
+        int num_wqes;
+
+        if (rq_wq_type != MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ)
+                return num_packets;
+
+        stride_size = 1 << priv->params.mpwqe_log_stride_sz;
+        num_strides = 1 << priv->params.mpwqe_log_num_strides;
+        wqe_size = stride_size * num_strides;
+
+        num_packets = (1 << order_base_2(num_packets));
+
+        packets_per_wqe = wqe_size /
+                          ALIGN(ETH_DATA_LEN, stride_size);
+        num_wqes = DIV_ROUND_UP(num_packets, packets_per_wqe);
+        return 1 << (order_base_2(num_wqes));
+}
+
 static void mlx5e_get_ringparam(struct net_device *dev,
                                 struct ethtool_ringparam *param)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
         int rq_wq_type = priv->params.rq_wq_type;
 
-        param->rx_max_pending = 1 << mlx5_max_log_rq_size(rq_wq_type);
+        param->rx_max_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                         1 << mlx5_max_log_rq_size(rq_wq_type));
         param->tx_max_pending = 1 << MLX5E_PARAMS_MAXIMUM_LOG_SQ_SIZE;
-        param->rx_pending     = 1 << priv->params.log_rq_size;
+        param->rx_pending = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                                     1 << priv->params.log_rq_size);
         param->tx_pending     = 1 << priv->params.log_sq_size;
 }
 
@@ -370,9 +416,13 @@ static int mlx5e_set_ringparam(struct net_device *dev,
         struct mlx5e_priv *priv = netdev_priv(dev);
         bool was_opened;
         int rq_wq_type = priv->params.rq_wq_type;
+        u32 rx_pending_wqes;
+        u32 min_rq_size;
+        u32 max_rq_size;
         u16 min_rx_wqes;
         u8 log_rq_size;
         u8 log_sq_size;
+        u32 num_mtts;
         int err = 0;
 
         if (param->rx_jumbo_pending) {
@@ -385,18 +435,36 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                             __func__);
                 return -EINVAL;
         }
-        if (param->rx_pending < (1 << mlx5_min_log_rq_size(rq_wq_type))) {
+
+        min_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_min_log_rq_size(rq_wq_type));
+        max_rq_size = mlx5e_rx_wqes_to_packets(priv, rq_wq_type,
+                                               1 << mlx5_max_log_rq_size(rq_wq_type));
+        rx_pending_wqes = mlx5e_packets_to_rx_wqes(priv, rq_wq_type,
+                                                   param->rx_pending);
+
+        if (param->rx_pending < min_rq_size) {
                 netdev_info(dev, "%s: rx_pending (%d) < min (%d)\n",
                             __func__, param->rx_pending,
-                            1 << mlx5_min_log_rq_size(rq_wq_type));
+                            min_rq_size);
                 return -EINVAL;
         }
-        if (param->rx_pending > (1 << mlx5_max_log_rq_size(rq_wq_type))) {
+        if (param->rx_pending > max_rq_size) {
                 netdev_info(dev, "%s: rx_pending (%d) > max (%d)\n",
                             __func__, param->rx_pending,
-                            1 << mlx5_max_log_rq_size(rq_wq_type));
+                            max_rq_size);
                 return -EINVAL;
         }
+
+        num_mtts = MLX5E_REQUIRED_MTTS(priv->params.num_channels,
+                                       rx_pending_wqes);
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx_pending (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, param->rx_pending);
+                return -EINVAL;
+        }
+
         if (param->tx_pending < (1 << MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE)) {
                 netdev_info(dev, "%s: tx_pending (%d) < min (%d)\n",
                             __func__, param->tx_pending,
@@ -410,9 +478,9 @@ static int mlx5e_set_ringparam(struct net_device *dev,
                 return -EINVAL;
         }
 
-        log_rq_size = order_base_2(param->rx_pending);
+        log_rq_size = order_base_2(rx_pending_wqes);
         log_sq_size = order_base_2(param->tx_pending);
-        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, param->rx_pending);
+        min_rx_wqes = mlx5_min_rx_wqes(rq_wq_type, rx_pending_wqes);
 
         if (log_rq_size == priv->params.log_rq_size &&
             log_sq_size == priv->params.log_sq_size &&
@@ -454,6 +522,7 @@ static int mlx5e_set_channels(struct net_device *dev,
         unsigned int count = ch->combined_count;
         bool arfs_enabled;
         bool was_opened;
+        u32 num_mtts;
         int err = 0;
 
         if (!count) {
@@ -472,6 +541,14 @@ static int mlx5e_set_channels(struct net_device *dev,
                 return -EINVAL;
         }
 
+        num_mtts = MLX5E_REQUIRED_MTTS(count, BIT(priv->params.log_rq_size));
+        if (priv->params.rq_wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ &&
+            !MLX5E_VALID_NUM_MTTS(num_mtts)) {
+                netdev_info(dev, "%s: rx count (%d) request can't be satisfied, try to reduce.\n",
+                            __func__, count);
+                return -EINVAL;
+        }
+
         if (priv->params.num_channels == count)
                 return 0;
 
@@ -582,9 +659,10 @@ out:
 static void ptys2ethtool_supported_link(unsigned long *supported_modes,
                                         u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(supported_modes, supported_modes,
                           ptys2ethtool_table[proto].supported,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
@@ -593,9 +671,10 @@ static void ptys2ethtool_supported_link(unsigned long *supported_modes,
 static void ptys2ethtool_adver_link(unsigned long *advertising_modes,
                                     u32 eth_proto_cap)
 {
+        unsigned long proto_cap = eth_proto_cap;
         int proto;
 
-        for_each_set_bit(proto, (unsigned long *)&eth_proto_cap, MLX5E_LINK_MODES_NUMBER)
+        for_each_set_bit(proto, &proto_cap, MLX5E_LINK_MODES_NUMBER)
                 bitmap_or(advertising_modes, advertising_modes,
                           ptys2ethtool_table[proto].advertised,
                           __ETHTOOL_LINK_MODE_MASK_NBITS);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 870bea37c57c..2459c7f3db8d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -39,13 +39,6 @@
 #include "eswitch.h"
 #include "vxlan.h"
 
-enum {
-        MLX5_EN_QP_FLUSH_TIMEOUT_MS     = 5000,
-        MLX5_EN_QP_FLUSH_MSLEEP_QUANT   = 20,
-        MLX5_EN_QP_FLUSH_MAX_ITER       = MLX5_EN_QP_FLUSH_TIMEOUT_MS /
-                                          MLX5_EN_QP_FLUSH_MSLEEP_QUANT,
-};
-
 struct mlx5e_rq_param {
         u32                     rqc[MLX5_ST_SZ_DW(rqc)];
         struct mlx5_wq_param    wq;
@@ -162,6 +155,7 @@ static void mlx5e_update_sw_counters(struct mlx5e_priv *priv)
                         s->tx_queue_stopped     += sq_stats->stopped;
                         s->tx_queue_wake        += sq_stats->wake;
                         s->tx_queue_dropped     += sq_stats->dropped;
+                        s->tx_xmit_more         += sq_stats->xmit_more;
                         s->tx_csum_partial_inner += sq_stats->csum_partial_inner;
                         tx_offload_none         += sq_stats->csum_none;
                 }
@@ -340,6 +334,9 @@ static int mlx5e_create_rq(struct mlx5e_channel *c,
                 rq->alloc_wqe = mlx5e_alloc_rx_mpwqe;
                 rq->dealloc_wqe = mlx5e_dealloc_rx_mpwqe;
 
+                rq->mpwqe_mtt_offset = c->ix *
+                        MLX5E_REQUIRED_MTTS(1, BIT(priv->params.log_rq_size));
+
                 rq->mpwqe_stride_sz = BIT(priv->params.mpwqe_log_stride_sz);
                 rq->mpwqe_num_strides = BIT(priv->params.mpwqe_log_num_strides);
                 rq->wqe_sz = rq->mpwqe_stride_sz * rq->mpwqe_num_strides;
@@ -428,7 +425,6 @@ static int mlx5e_enable_rq(struct mlx5e_rq *rq, struct mlx5e_rq_param *param)
 
         MLX5_SET(rqc,  rqc, cqn,                rq->cq.mcq.cqn);
         MLX5_SET(rqc,  rqc, state,              MLX5_RQC_STATE_RST);
-        MLX5_SET(rqc,  rqc, flush_in_error_en,  1);
         MLX5_SET(rqc,  rqc, vsd, priv->params.vlan_strip_disable);
         MLX5_SET(wq,   wq,  log_wq_pg_sz,       rq->wq_ctrl.buf.page_shift -
                                                 MLX5_ADAPTER_PAGE_SHIFT);
@@ -525,6 +521,27 @@ static int mlx5e_wait_for_min_rx_wqes(struct mlx5e_rq *rq)
         return -ETIMEDOUT;
 }
 
+static void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
+{
+        struct mlx5_wq_ll *wq = &rq->wq;
+        struct mlx5e_rx_wqe *wqe;
+        __be16 wqe_ix_be;
+        u16 wqe_ix;
+
+        /* UMR WQE (if in progress) is always at wq->head */
+        if (test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+
+        while (!mlx5_wq_ll_is_empty(wq)) {
+                wqe_ix_be = *wq->tail_next;
+                wqe_ix    = be16_to_cpu(wqe_ix_be);
+                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
+                rq->dealloc_wqe(rq, wqe_ix);
+                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
+                               &wqe->next.next_wqe_index);
+        }
+}
+
 static int mlx5e_open_rq(struct mlx5e_channel *c,
                          struct mlx5e_rq_param *param,
                          struct mlx5e_rq *rq)
@@ -548,8 +565,6 @@ static int mlx5e_open_rq(struct mlx5e_channel *c,
         if (param->am_enabled)
                 set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
 
-        set_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
-
         sq->ico_wqe_info[pi].opcode     = MLX5_OPCODE_NOP;
         sq->ico_wqe_info[pi].num_wqebbs = 1;
         mlx5e_send_nop(sq, true); /* trigger mlx5e_post_rx_wqes() */
@@ -566,23 +581,8 @@ err_destroy_rq:
 
 static void mlx5e_close_rq(struct mlx5e_rq *rq)
 {
-        int tout = 0;
-        int err;
-
-        clear_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state);
+        set_bit(MLX5E_RQ_STATE_FLUSH, &rq->state);
         napi_synchronize(&rq->channel->napi); /* prevent mlx5e_post_rx_wqes */
-
-        err = mlx5e_modify_rq_state(rq, MLX5_RQC_STATE_RDY, MLX5_RQC_STATE_ERR);
-        while (!mlx5_wq_ll_is_empty(&rq->wq) && !err &&
-               tout++ < MLX5_EN_QP_FLUSH_MAX_ITER)
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-
-        if (err || tout == MLX5_EN_QP_FLUSH_MAX_ITER)
-                set_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state);
-
-        /* avoid destroying rq before mlx5e_poll_rx_cq() is done with it */
-        napi_synchronize(&rq->channel->napi);
-
         cancel_work_sync(&rq->am.work);
 
         mlx5e_disable_rq(rq);
@@ -821,7 +821,6 @@ static int mlx5e_open_sq(struct mlx5e_channel *c,
                 goto err_disable_sq;
 
         if (sq->txq) {
-                set_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
                 netdev_tx_reset_queue(sq->txq);
                 netif_tx_start_queue(sq->txq);
         }
@@ -845,38 +844,20 @@ static inline void netif_tx_disable_queue(struct netdev_queue *txq)
 
 static void mlx5e_close_sq(struct mlx5e_sq *sq)
 {
-        int tout = 0;
-        int err;
+        set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
+        /* prevent netif_tx_wake_queue */
+        napi_synchronize(&sq->channel->napi);
 
         if (sq->txq) {
-                clear_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state);
-                /* prevent netif_tx_wake_queue */
-                napi_synchronize(&sq->channel->napi);
                 netif_tx_disable_queue(sq->txq);
 
-                /* ensure hw is notified of all pending wqes */
+                /* last doorbell out, godspeed .. */
                 if (mlx5e_sq_has_room_for(sq, 1))
                         mlx5e_send_nop(sq, true);
-
-                err = mlx5e_modify_sq(sq, MLX5_SQC_STATE_RDY,
-                                      MLX5_SQC_STATE_ERR, false, 0);
-                if (err)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
-        }
-
-        /* wait till sq is empty, unless a TX timeout occurred on this SQ */
-        while (sq->cc != sq->pc &&
-               !test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)) {
-                msleep(MLX5_EN_QP_FLUSH_MSLEEP_QUANT);
-                if (tout++ > MLX5_EN_QP_FLUSH_MAX_ITER)
-                        set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
         }
 
-        /* avoid destroying sq before mlx5e_poll_tx_cq() is done with it */
-        napi_synchronize(&sq->channel->napi);
-
-        mlx5e_free_tx_descs(sq);
         mlx5e_disable_sq(sq);
+        mlx5e_free_tx_descs(sq);
         mlx5e_destroy_sq(sq);
 }
 
@@ -1826,10 +1807,6 @@ int mlx5e_open_locked(struct net_device *netdev)
         netif_set_real_num_tx_queues(netdev, num_txqs);
         netif_set_real_num_rx_queues(netdev, priv->params.num_channels);
 
-        err = mlx5e_set_dev_port_mtu(netdev);
-        if (err)
-                goto err_clear_state_opened_flag;
-
         err = mlx5e_open_channels(priv);
         if (err) {
                 netdev_err(netdev, "%s: mlx5e_open_channels failed, %d\n",
@@ -2573,6 +2550,7 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
         u16 max_mtu;
         u16 min_mtu;
         int err = 0;
+        bool reset;
 
         mlx5_query_port_max_mtu(mdev, &max_mtu, 1);
 
@@ -2588,13 +2566,18 @@ static int mlx5e_change_mtu(struct net_device *netdev, int new_mtu)
 
         mutex_lock(&priv->state_lock);
 
+        reset = !priv->params.lro_en &&
+                (priv->params.rq_wq_type !=
+                 MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ);
+
         was_opened = test_bit(MLX5E_STATE_OPENED, &priv->state);
-        if (was_opened)
+        if (was_opened && reset)
                 mlx5e_close_locked(netdev);
 
         netdev->mtu = new_mtu;
+        mlx5e_set_dev_port_mtu(netdev);
 
-        if (was_opened)
+        if (was_opened && reset)
                 err = mlx5e_open_locked(netdev);
 
         mutex_unlock(&priv->state_lock);
@@ -2794,7 +2777,7 @@ static void mlx5e_tx_timeout(struct net_device *dev)
                 if (!netif_xmit_stopped(netdev_get_tx_queue(dev, i)))
                         continue;
                 sched_work = true;
-                set_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state);
+                set_bit(MLX5E_SQ_STATE_FLUSH, &sq->state);
                 netdev_err(dev, "TX timeout on queue: %d, SQ: 0x%x, CQ: 0x%x, SQ Cons: 0x%x SQ Prod: 0x%x\n",
                            i, sq->sqn, sq->cq.mcq.cqn, sq->cc, sq->pc);
         }
@@ -3231,8 +3214,8 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
         struct mlx5_create_mkey_mbox_in *in;
         struct mlx5_mkey_seg *mkc;
         int inlen = sizeof(*in);
-        u64 npages =
-                priv->profile->max_nch(mdev) * MLX5_CHANNEL_MAX_NUM_MTTS;
+        u64 npages = MLX5E_REQUIRED_MTTS(priv->profile->max_nch(mdev),
+                                         BIT(MLX5E_PARAMS_MAXIMUM_LOG_RQ_SIZE_MPW));
         int err;
 
         in = mlx5_vzalloc(inlen);
@@ -3246,10 +3229,12 @@ static int mlx5e_create_umr_mkey(struct mlx5e_priv *priv)
                      MLX5_PERM_LOCAL_WRITE |
                      MLX5_ACCESS_MODE_MTT;
 
+        npages = min_t(u32, ALIGN(U16_MAX, 4) * 2, npages);
+
         mkc->qpn_mkey7_0 = cpu_to_be32(0xffffff << 8);
         mkc->flags_pd = cpu_to_be32(mdev->mlx5e_res.pdn);
         mkc->len = cpu_to_be64(npages << PAGE_SHIFT);
-        mkc->xlt_oct_size = cpu_to_be32(mlx5e_get_mtt_octw(npages));
+        mkc->xlt_oct_size = cpu_to_be32(MLX5_MTT_OCTW(npages));
         mkc->log2_page_size = PAGE_SHIFT;
 
         err = mlx5_core_create_mkey(mdev, &priv->umr_mkey, in, inlen, NULL,
@@ -3385,6 +3370,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv)
         queue_work(priv->wq, &priv->set_rx_mode_work);
 
         if (MLX5_CAP_GEN(mdev, vport_group_manager)) {
+                mlx5_query_nic_vport_mac_address(mdev, 0, rep.hw_id);
                 rep.load = mlx5e_nic_rep_load;
                 rep.unload = mlx5e_nic_rep_unload;
                 rep.vport = 0;
@@ -3463,6 +3449,8 @@ void *mlx5e_create_netdev(struct mlx5_core_dev *mdev,
 
         mlx5e_init_l2_addr(priv);
 
+        mlx5e_set_dev_port_mtu(netdev);
+
         err = register_netdev(netdev);
         if (err) {
                 mlx5_core_err(mdev, "register_netdev failed, %d\n", err);
@@ -3501,16 +3489,20 @@ static void mlx5e_register_vport_rep(struct mlx5_core_dev *mdev)
         struct mlx5_eswitch *esw = mdev->priv.eswitch;
         int total_vfs = MLX5_TOTAL_VPORTS(mdev);
         int vport;
+        u8 mac[ETH_ALEN];
 
         if (!MLX5_CAP_GEN(mdev, vport_group_manager))
                 return;
 
+        mlx5_query_nic_vport_mac_address(mdev, 0, mac);
+
         for (vport = 1; vport < total_vfs; vport++) {
                 struct mlx5_eswitch_rep rep;
 
                 rep.load = mlx5e_vport_rep_load;
                 rep.unload = mlx5e_vport_rep_unload;
                 rep.vport = vport;
+                ether_addr_copy(rep.hw_id, mac);
                 mlx5_eswitch_register_vport_rep(esw, &rep);
         }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 1c7d8b8314bf..134de4a11f1d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -135,17 +135,16 @@ static const struct ethtool_ops mlx5e_rep_ethtool_ops = {
 int mlx5e_attr_get(struct net_device *dev, struct switchdev_attr *attr)
 {
         struct mlx5e_priv *priv = netdev_priv(dev);
+        struct mlx5_eswitch_rep *rep = priv->ppriv;
         struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
-        u8 mac[ETH_ALEN];
 
         if (esw->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
         switch (attr->id) {
         case SWITCHDEV_ATTR_ID_PORT_PARENT_ID:
-                mlx5_query_nic_vport_mac_address(priv->mdev, 0, mac);
                 attr->u.ppid.id_len = ETH_ALEN;
-                memcpy(&attr->u.ppid.id, &mac, ETH_ALEN);
+                ether_addr_copy(attr->u.ppid.id, rep->hw_id);
                 break;
         default:
                 return -EOPNOTSUPP;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 9f2a16a507e0..e7c969df3dad 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -324,9 +324,9 @@ mlx5e_copy_skb_header_fragmented_mpwqe(struct device *pdev,
         }
 }
 
-static u16 mlx5e_get_wqe_mtt_offset(u16 rq_ix, u16 wqe_ix)
+static u32 mlx5e_get_wqe_mtt_offset(struct mlx5e_rq *rq, u16 wqe_ix)
 {
-        return rq_ix * MLX5_CHANNEL_MAX_NUM_MTTS +
+        return rq->mpwqe_mtt_offset +
                 wqe_ix * ALIGN(MLX5_MPWRQ_PAGES_PER_WQE, 8);
 }
 
@@ -340,7 +340,7 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
         struct mlx5_wqe_data_seg      *dseg = &wqe->data;
         struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
         u8 ds_cnt = DIV_ROUND_UP(sizeof(*wqe), MLX5_SEND_WQE_DS);
-        u16 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix);
+        u32 umr_wqe_mtt_offset = mlx5e_get_wqe_mtt_offset(rq, ix);
 
         memset(wqe, 0, sizeof(*wqe));
         cseg->opmod_idx_opcode =
@@ -353,9 +353,9 @@ static void mlx5e_build_umr_wqe(struct mlx5e_rq *rq,
 
         ucseg->flags = MLX5_UMR_TRANSLATION_OFFSET_EN;
         ucseg->klm_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(MLX5_MPWRQ_PAGES_PER_WQE));
+                cpu_to_be16(MLX5_MTT_OCTW(MLX5_MPWRQ_PAGES_PER_WQE));
         ucseg->bsf_octowords =
-                cpu_to_be16(mlx5e_get_mtt_octw(umr_wqe_mtt_offset));
+                cpu_to_be16(MLX5_MTT_OCTW(umr_wqe_mtt_offset));
         ucseg->mkey_mask     = cpu_to_be64(MLX5_MKEY_MASK_FREE);
 
         dseg->lkey = sq->mkey_be;
@@ -423,7 +423,7 @@ static int mlx5e_alloc_rx_fragmented_mpwqe(struct mlx5e_rq *rq,
 {
         struct mlx5e_mpw_info *wi = &rq->wqe_info[ix];
         int mtt_sz = mlx5e_get_wqe_mtt_sz();
-        u32 dma_offset = mlx5e_get_wqe_mtt_offset(rq->ix, ix) << PAGE_SHIFT;
+        u64 dma_offset = (u64)mlx5e_get_wqe_mtt_offset(rq, ix) << PAGE_SHIFT;
         int i;
 
         wi->umr.dma_info = kmalloc(sizeof(*wi->umr.dma_info) *
@@ -506,6 +506,12 @@ void mlx5e_post_rx_fragmented_mpwqe(struct mlx5e_rq *rq)
         struct mlx5e_rx_wqe *wqe = mlx5_wq_ll_get_wqe(wq, wq->head);
 
         clear_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state);
+
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state))) {
+                mlx5e_free_rx_fragmented_mpwqe(rq, &rq->wqe_info[wq->head]);
+                return;
+        }
+
         mlx5_wq_ll_push(wq, be16_to_cpu(wqe->next.next_wqe_index));
         rq->stats.mpwqe_frag++;
 
@@ -595,26 +601,9 @@ void mlx5e_dealloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix)
         wi->free_wqe(rq, wi);
 }
 
-void mlx5e_free_rx_descs(struct mlx5e_rq *rq)
-{
-        struct mlx5_wq_ll *wq = &rq->wq;
-        struct mlx5e_rx_wqe *wqe;
-        __be16 wqe_ix_be;
-        u16 wqe_ix;
-
-        while (!mlx5_wq_ll_is_empty(wq)) {
-                wqe_ix_be = *wq->tail_next;
-                wqe_ix    = be16_to_cpu(wqe_ix_be);
-                wqe       = mlx5_wq_ll_get_wqe(&rq->wq, wqe_ix);
-                rq->dealloc_wqe(rq, wqe_ix);
-                mlx5_wq_ll_pop(&rq->wq, wqe_ix_be,
-                               &wqe->next.next_wqe_index);
-        }
-}
-
 #define RQ_CANNOT_POST(rq) \
-                (!test_bit(MLX5E_RQ_STATE_POST_WQES_ENABLE, &rq->state) || \
-                 test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
+        (test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state) || \
+         test_bit(MLX5E_RQ_STATE_UMR_WQE_IN_PROGRESS, &rq->state))
 
 bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 {
@@ -648,24 +637,32 @@ bool mlx5e_post_rx_wqes(struct mlx5e_rq *rq)
 static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe,
                                  u32 cqe_bcnt)
 {
-        struct ethhdr   *eth    = (struct ethhdr *)(skb->data);
-        struct iphdr    *ipv4   = (struct iphdr *)(skb->data + ETH_HLEN);
-        struct ipv6hdr  *ipv6   = (struct ipv6hdr *)(skb->data + ETH_HLEN);
+        struct ethhdr   *eth = (struct ethhdr *)(skb->data);
+        struct iphdr    *ipv4;
+        struct ipv6hdr  *ipv6;
         struct tcphdr   *tcp;
+        int network_depth = 0;
+        __be16 proto;
+        u16 tot_len;
 
         u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe);
         int tcp_ack = ((CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA  == l4_hdr_type) ||
                        (CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA == l4_hdr_type));
 
-        u16 tot_len = cqe_bcnt - ETH_HLEN;
+        skb->mac_len = ETH_HLEN;
+        proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth);
+
+        ipv4 = (struct iphdr *)(skb->data + network_depth);
+        ipv6 = (struct ipv6hdr *)(skb->data + network_depth);
+        tot_len = cqe_bcnt - network_depth;
 
-        if (eth->h_proto == htons(ETH_P_IP)) {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+        if (proto == htons(ETH_P_IP)) {
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct iphdr));
                 ipv6 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
         } else {
-                tcp = (struct tcphdr *)(skb->data + ETH_HLEN +
+                tcp = (struct tcphdr *)(skb->data + network_depth +
                                         sizeof(struct ipv6hdr));
                 ipv4 = NULL;
                 skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
@@ -916,7 +913,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
         struct mlx5e_rq *rq = container_of(cq, struct mlx5e_rq, cq);
         int work_done = 0;
 
-        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH_TIMEOUT, &rq->state)))
+        if (unlikely(test_bit(MLX5E_RQ_STATE_FLUSH, &rq->state)))
                 return 0;
 
         if (cq->decmprs_left)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
index 7b9d8a989b52..499487ce3b53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
@@ -70,6 +70,7 @@ struct mlx5e_sw_stats {
         u64 tx_queue_stopped;
         u64 tx_queue_wake;
         u64 tx_queue_dropped;
+        u64 tx_xmit_more;
         u64 rx_wqe_err;
         u64 rx_mpwqe_filler;
         u64 rx_mpwqe_frag;
@@ -101,6 +102,7 @@ static const struct counter_desc sw_stats_desc[] = {
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_stopped) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_wake) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_queue_dropped) },
+        { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, tx_xmit_more) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_wqe_err) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_filler) },
         { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_mpwqe_frag) },
@@ -298,6 +300,7 @@ struct mlx5e_sq_stats {
         /* commonly accessed in data path */
         u64 packets;
         u64 bytes;
+        u64 xmit_more;
         u64 tso_packets;
         u64 tso_bytes;
         u64 tso_inner_packets;
@@ -324,6 +327,7 @@ static const struct counter_desc sq_stats_desc[] = {
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, stopped) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, wake) },
         { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, dropped) },
+        { MLX5E_DECLARE_TX_STAT(struct mlx5e_sq_stats, xmit_more) },
 };
 
 #define NUM_SW_COUNTERS                 ARRAY_SIZE(sw_stats_desc)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 0f19b01e3fff..22cfc4ac1837 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -170,7 +170,7 @@ static int parse_cls_flower(struct mlx5e_priv *priv, struct mlx5_flow_spec *spec
         if (dissector_uses_key(f->dissector, FLOW_DISSECTOR_KEY_CONTROL)) {
                 struct flow_dissector_key_control *key =
                         skb_flow_dissector_target(f->dissector,
-                                                  FLOW_DISSECTOR_KEY_BASIC,
+                                                  FLOW_DISSECTOR_KEY_CONTROL,
                                                   f->key);
                 addr_type = key->addr_type;
         }
@@ -318,6 +318,7 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 u32 *action, u32 *flow_tag)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
 
         if (tc_no_actions(exts))
                 return -EINVAL;
@@ -325,7 +326,8 @@ static int parse_tc_nic_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
         *flow_tag = MLX5_FS_DEFAULT_FLOW_TAG;
         *action = 0;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 /* Only support a single action per rule */
                 if (*action)
                         return -EINVAL;
@@ -362,13 +364,15 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts,
                                 u32 *action, u32 *dest_vport)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
 
         if (tc_no_actions(exts))
                 return -EINVAL;
 
         *action = 0;
 
-        tc_for_each_action(a, exts) {
+        tcf_exts_to_list(exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 /* Only support a single action per rule */
                 if (*action)
                         return -EINVAL;
@@ -503,6 +507,7 @@ int mlx5e_stats_flower(struct mlx5e_priv *priv,
         struct mlx5e_tc_flow *flow;
         struct tc_action *a;
         struct mlx5_fc *counter;
+        LIST_HEAD(actions);
         u64 bytes;
         u64 packets;
         u64 lastuse;
@@ -518,7 +523,8 @@ int mlx5e_stats_flower(struct mlx5e_priv *priv,
 
         mlx5_fc_query_cached(counter, &bytes, &packets, &lastuse);
 
-        tc_for_each_action(a, f->exts)
+        tcf_exts_to_list(f->exts, &actions);
+        list_for_each_entry(a, &actions, list)
                 tcf_action_stats_update(a, bytes, packets, lastuse);
 
         return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
index e073bf59890d..eb0e72537f10 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -356,6 +356,7 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_sq *sq, struct sk_buff *skb)
                 sq->stats.stopped++;
         }
 
+        sq->stats.xmit_more += skb->xmit_more;
         if (!skb->xmit_more || netif_xmit_stopped(sq->txq)) {
                 int bf_sz = 0;
 
@@ -394,35 +395,6 @@ netdev_tx_t mlx5e_xmit(struct sk_buff *skb, struct net_device *dev)
         return mlx5e_sq_xmit(sq, skb);
 }
 
-void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
-{
-        struct mlx5e_tx_wqe_info *wi;
-        struct sk_buff *skb;
-        u16 ci;
-        int i;
-
-        while (sq->cc != sq->pc) {
-                ci = sq->cc & sq->wq.sz_m1;
-                skb = sq->skb[ci];
-                wi = &sq->wqe_info[ci];
-
-                if (!skb) { /* nop */
-                        sq->cc++;
-                        continue;
-                }
-
-                for (i = 0; i < wi->num_dma; i++) {
-                        struct mlx5e_sq_dma *dma =
-                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
-
-                        mlx5e_tx_dma_unmap(sq->pdev, dma);
-                }
-
-                dev_kfree_skb_any(skb);
-                sq->cc += wi->num_wqebbs;
-        }
-}
-
 bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 {
         struct mlx5e_sq *sq;
@@ -434,7 +406,7 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
 
         sq = container_of(cq, struct mlx5e_sq, cq);
 
-        if (unlikely(test_bit(MLX5E_SQ_STATE_TX_TIMEOUT, &sq->state)))
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
                 return false;
 
         npkts = 0;
@@ -512,11 +484,39 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
         netdev_tx_completed_queue(sq->txq, npkts, nbytes);
 
         if (netif_tx_queue_stopped(sq->txq) &&
-            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM) &&
-            likely(test_bit(MLX5E_SQ_STATE_WAKE_TXQ_ENABLE, &sq->state))) {
-                                netif_tx_wake_queue(sq->txq);
-                                sq->stats.wake++;
+            mlx5e_sq_has_room_for(sq, MLX5E_SQ_STOP_ROOM)) {
+                netif_tx_wake_queue(sq->txq);
+                sq->stats.wake++;
         }
 
         return (i == MLX5E_TX_CQ_POLL_BUDGET);
 }
+
+void mlx5e_free_tx_descs(struct mlx5e_sq *sq)
+{
+        struct mlx5e_tx_wqe_info *wi;
+        struct sk_buff *skb;
+        u16 ci;
+        int i;
+
+        while (sq->cc != sq->pc) {
+                ci = sq->cc & sq->wq.sz_m1;
+                skb = sq->skb[ci];
+                wi = &sq->wqe_info[ci];
+
+                if (!skb) { /* nop */
+                        sq->cc++;
+                        continue;
+                }
+
+                for (i = 0; i < wi->num_dma; i++) {
+                        struct mlx5e_sq_dma *dma =
+                                mlx5e_dma_get(sq, sq->dma_fifo_cc++);
+
+                        mlx5e_tx_dma_unmap(sq->pdev, dma);
+                }
+
+                dev_kfree_skb_any(skb);
+                sq->cc += wi->num_wqebbs;
+        }
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
index 64ae2e800daa..9bf33bb69210 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_txrx.c
@@ -51,16 +51,18 @@ struct mlx5_cqe64 *mlx5e_get_cqe(struct mlx5e_cq *cq)
 
 static void mlx5e_poll_ico_cq(struct mlx5e_cq *cq)
 {
+        struct mlx5e_sq *sq = container_of(cq, struct mlx5e_sq, cq);
         struct mlx5_wq_cyc *wq;
         struct mlx5_cqe64 *cqe;
-        struct mlx5e_sq *sq;
         u16 sqcc;
 
+        if (unlikely(test_bit(MLX5E_SQ_STATE_FLUSH, &sq->state)))
+                return;
+
         cqe = mlx5e_get_cqe(cq);
         if (likely(!cqe))
                 return;
 
-        sq = container_of(cq, struct mlx5e_sq, cq);
         wq = &sq->wq;
 
         /* sq->cc must be updated only after mlx5_cqwq_update_db_record(),
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index f6d667797ee1..b247949df135 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1451,7 +1451,8 @@ static void esw_enable_vport(struct mlx5_eswitch *esw, int vport_num,
 
         esw_debug(esw->dev, "Enabling VPORT(%d)\n", vport_num);
 
-        if (vport_num) { /* Only VFs need ACLs for VST and spoofchk filtering */
+        /* Only VFs need ACLs for VST and spoofchk filtering */
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                 esw_vport_ingress_config(esw, vport);
                 esw_vport_egress_config(esw, vport);
         }
@@ -1502,7 +1503,7 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, int vport_num)
          */
         esw_vport_change_handle_locked(vport);
         vport->enabled_events = 0;
-        if (vport_num) {
+        if (vport_num && esw->mode == SRIOV_LEGACY) {
                 esw_vport_disable_egress_acl(esw, vport);
                 esw_vport_disable_ingress_acl(esw, vport);
         }
@@ -1553,6 +1554,7 @@ int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode)
 
 abort:
         esw_enable_vport(esw, 0, UC_ADDR_CHANGE);
+        esw->mode = SRIOV_NONE;
         return err;
 }
 
@@ -1767,7 +1769,7 @@ int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw,
                                vport, err);
 
         mutex_lock(&esw->state_lock);
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY)
                 err = esw_vport_ingress_config(esw, evport);
         mutex_unlock(&esw->state_lock);
         return err;
@@ -1839,7 +1841,7 @@ int mlx5_eswitch_set_vport_vlan(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         evport->vlan = vlan;
         evport->qos = qos;
-        if (evport->enabled) {
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                 err = esw_vport_ingress_config(esw, evport);
                 if (err)
                         goto out;
@@ -1868,10 +1870,11 @@ int mlx5_eswitch_set_vport_spoofchk(struct mlx5_eswitch *esw,
         mutex_lock(&esw->state_lock);
         pschk = evport->spoofchk;
         evport->spoofchk = spoofchk;
-        if (evport->enabled)
+        if (evport->enabled && esw->mode == SRIOV_LEGACY) {
                 err = esw_vport_ingress_config(esw, evport);
-        if (err)
-                evport->spoofchk = pschk;
+                if (err)
+                        evport->spoofchk = pschk;
+        }
         mutex_unlock(&esw->state_lock);
 
         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index c0b05603fc31..a96140971d77 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -174,6 +174,7 @@ struct mlx5_eswitch_rep {
         void                  *priv_data;
         struct list_head       vport_sqs_list;
         bool                   valid;
+        u8                     hw_id[ETH_ALEN];
 };
 
 struct mlx5_esw_offload {
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index a357e8eeeed8..7de40e6b0c25 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -113,7 +113,7 @@ mlx5_eswitch_add_send_to_vport_rule(struct mlx5_eswitch *esw, int vport, u32 sqn
         dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
         dest.vport_num = vport;
 
-        flow_rule = mlx5_add_flow_rule(esw->fdb_table.fdb, spec,
+        flow_rule = mlx5_add_flow_rule(esw->fdb_table.offloads.fdb, spec,
                                        MLX5_FLOW_CONTEXT_ACTION_FWD_DEST,
                                        0, &dest);
         if (IS_ERR(flow_rule))
@@ -446,7 +446,7 @@ out:
 
 static int esw_offloads_start(struct mlx5_eswitch *esw)
 {
-        int err, num_vfs = esw->dev->priv.sriov.num_vfs;
+        int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
 
         if (esw->mode != SRIOV_LEGACY) {
                 esw_warn(esw->dev, "Can't set offloads mode, SRIOV legacy not enabled\n");
@@ -455,8 +455,12 @@ static int esw_offloads_start(struct mlx5_eswitch *esw)
 
         mlx5_eswitch_disable_sriov(esw);
         err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_OFFLOADS);
-        if (err)
-                esw_warn(esw->dev, "Failed set eswitch to offloads, err %d\n", err);
+        if (err) {
+                esw_warn(esw->dev, "Failed setting eswitch to offloads, err %d\n", err);
+                err1 = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
+                if (err1)
+                        esw_warn(esw->dev, "Failed setting eswitch back to legacy, err %d\n", err);
+        }
         return err;
 }
 
@@ -508,12 +512,16 @@ create_ft_err:
 
 static int esw_offloads_stop(struct mlx5_eswitch *esw)
 {
-        int err, num_vfs = esw->dev->priv.sriov.num_vfs;
+        int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs;
 
         mlx5_eswitch_disable_sriov(esw);
         err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY);
-        if (err)
-                esw_warn(esw->dev, "Failed set eswitch legacy mode. err %d\n", err);
+        if (err) {
+                esw_warn(esw->dev, "Failed setting eswitch to legacy, err %d\n", err);
+                err1 = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_OFFLOADS);
+                if (err1)
+                        esw_warn(esw->dev, "Failed setting eswitch back to offloads, err %d\n", err);
+        }
 
         return err;
 }
@@ -535,7 +543,7 @@ void esw_offloads_cleanup(struct mlx5_eswitch *esw, int nvports)
         esw_destroy_offloads_fdb_table(esw);
 }
 
-static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
+static int esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
 {
         switch (mode) {
         case DEVLINK_ESWITCH_MODE_LEGACY:
@@ -551,6 +559,22 @@ static int mlx5_esw_mode_from_devlink(u16 mode, u16 *mlx5_mode)
         return 0;
 }
 
+static int esw_mode_to_devlink(u16 mlx5_mode, u16 *mode)
+{
+        switch (mlx5_mode) {
+        case SRIOV_LEGACY:
+                *mode = DEVLINK_ESWITCH_MODE_LEGACY;
+                break;
+        case SRIOV_OFFLOADS:
+                *mode = DEVLINK_ESWITCH_MODE_SWITCHDEV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
 {
         struct mlx5_core_dev *dev;
@@ -566,7 +590,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode)
         if (cur_mlx5_mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
-        if (mlx5_esw_mode_from_devlink(mode, &mlx5_mode))
+        if (esw_mode_from_devlink(mode, &mlx5_mode))
                 return -EINVAL;
 
         if (cur_mlx5_mode == mlx5_mode)
@@ -592,9 +616,7 @@ int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode)
         if (dev->priv.eswitch->mode == SRIOV_NONE)
                 return -EOPNOTSUPP;
 
-        *mode = dev->priv.eswitch->mode;
-
-        return 0;
+        return esw_mode_to_devlink(dev->priv.eswitch->mode, mode);
 }
 
 void mlx5_eswitch_register_vport_rep(struct mlx5_eswitch *esw,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
index 9134010e2921..287ade151ec8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c
@@ -425,11 +425,11 @@ struct mlx5_cmd_fc_bulk *
 mlx5_cmd_fc_bulk_alloc(struct mlx5_core_dev *dev, u16 id, int num)
 {
         struct mlx5_cmd_fc_bulk *b;
-        int outlen = sizeof(*b) +
+        int outlen =
                 MLX5_ST_SZ_BYTES(query_flow_counter_out) +
                 MLX5_ST_SZ_BYTES(traffic_counter) * num;
 
-        b = kzalloc(outlen, GFP_KERNEL);
+        b = kzalloc(sizeof(*b) + outlen, GFP_KERNEL);
         if (!b)
                 return NULL;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 75bb8c864557..3d6c1f65e586 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -80,7 +80,7 @@
                            LEFTOVERS_NUM_PRIOS)
 
 #define ETHTOOL_PRIO_NUM_LEVELS 1
-#define ETHTOOL_NUM_PRIOS 10
+#define ETHTOOL_NUM_PRIOS 11
 #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS)
 /* Vlan, mac, ttc, aRFS */
 #define KERNEL_NIC_PRIO_NUM_LEVELS 4
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index c2877e9de8a1..3a9195b4169d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -126,12 +126,21 @@ static struct rb_node *mlx5_fc_stats_query(struct mlx5_core_dev *dev,
         for (node = &first->node; node; node = rb_next(node)) {
                 struct mlx5_fc *counter = rb_entry(node, struct mlx5_fc, node);
                 struct mlx5_fc_cache *c = &counter->cache;
+                u64 packets;
+                u64 bytes;
 
                 if (counter->id > last_id)
                         break;
 
                 mlx5_cmd_fc_bulk_get(dev, b,
-                                     counter->id, &c->packets, &c->bytes);
+                                     counter->id, &packets, &bytes);
+
+                if (c->packets == packets)
+                        continue;
+
+                c->packets = packets;
+                c->bytes = bytes;
+                c->lastuse = jiffies;
         }
 
 out:
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 4f491d43e77d..2385bae92672 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1420,36 +1420,12 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev,
         dev_info(&pdev->dev, "%s was called\n", __func__);
         mlx5_enter_error_state(dev);
         mlx5_unload_one(dev, priv);
+        pci_save_state(pdev);
         mlx5_pci_disable_device(dev);
         return state == pci_channel_io_perm_failure ?
                 PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
 }
 
-static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
-{
-        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        int err = 0;
-
-        dev_info(&pdev->dev, "%s was called\n", __func__);
-
-        err = mlx5_pci_enable_device(dev);
-        if (err) {
-                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
-                        , __func__, err);
-                return PCI_ERS_RESULT_DISCONNECT;
-        }
-        pci_set_master(pdev);
-        pci_set_power_state(pdev, PCI_D0);
-        pci_restore_state(pdev);
-
-        return err ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
-}
-
-void mlx5_disable_device(struct mlx5_core_dev *dev)
-{
-        mlx5_pci_err_detected(dev->pdev, 0);
-}
-
 /* wait for the device to show vital signs by waiting
  * for the health counter to start counting.
  */
@@ -1477,21 +1453,44 @@ static int wait_vital(struct pci_dev *pdev)
         return -ETIMEDOUT;
 }
 
-static void mlx5_pci_resume(struct pci_dev *pdev)
+static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
 {
         struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-        struct mlx5_priv *priv = &dev->priv;
         int err;
 
         dev_info(&pdev->dev, "%s was called\n", __func__);
 
-        pci_save_state(pdev);
-        err = wait_vital(pdev);
+        err = mlx5_pci_enable_device(dev);
         if (err) {
+                dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
+                        , __func__, err);
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+
+        pci_set_master(pdev);
+        pci_restore_state(pdev);
+
+        if (wait_vital(pdev)) {
                 dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
-                return;
+                return PCI_ERS_RESULT_DISCONNECT;
         }
 
+        return PCI_ERS_RESULT_RECOVERED;
+}
+
+void mlx5_disable_device(struct mlx5_core_dev *dev)
+{
+        mlx5_pci_err_detected(dev->pdev, 0);
+}
+
+static void mlx5_pci_resume(struct pci_dev *pdev)
+{
+        struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+        struct mlx5_priv *priv = &dev->priv;
+        int err;
+
+        dev_info(&pdev->dev, "%s was called\n", __func__);
+
         err = mlx5_load_one(dev, priv);
         if (err)
                 dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n"
diff --git a/drivers/net/ethernet/mellanox/mlxsw/port.h b/drivers/net/ethernet/mellanox/mlxsw/port.h
index f33b997f2b61..af371a82c35b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/port.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/port.h
@@ -56,6 +56,7 @@
 #define MLXSW_PORT_PHY_BITS_MASK        (MLXSW_PORT_MAX_PHY_PORTS - 1)
 
 #define MLXSW_PORT_CPU_PORT             0x0
+#define MLXSW_PORT_ROUTER_PORT          (MLXSW_PORT_MAX_PHY_PORTS + 2)
 
 #define MLXSW_PORT_DONT_CARE            (MLXSW_PORT_MAX_PORTS)
 
diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
index 7ca9201f7dcb..1721098eef13 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
@@ -3383,6 +3383,15 @@ MLXSW_ITEM32(reg, ritr, ipv4_fe, 0x04, 29, 1);
  */
 MLXSW_ITEM32(reg, ritr, ipv6_fe, 0x04, 28, 1);
 
+/* reg_ritr_lb_en
+ * Loop-back filter enable for unicast packets.
+ * If the flag is set then loop-back filter for unicast packets is
+ * implemented on the RIF. Multicast packets are always subject to
+ * loop-back filtering.
+ * Access: RW
+ */
+MLXSW_ITEM32(reg, ritr, lb_en, 0x04, 24, 1);
+
 /* reg_ritr_virtual_router
  * Virtual router ID associated with the router interface.
  * Access: RW
@@ -3484,6 +3493,7 @@ static inline void mlxsw_reg_ritr_pack(char *payload, bool enable,
         mlxsw_reg_ritr_op_set(payload, op);
         mlxsw_reg_ritr_rif_set(payload, rif);
         mlxsw_reg_ritr_ipv4_fe_set(payload, 1);
+        mlxsw_reg_ritr_lb_en_set(payload, 1);
         mlxsw_reg_ritr_mtu_set(payload, mtu);
         mlxsw_reg_ritr_if_mac_memcpy_to(payload, mac);
 }
@@ -4000,6 +4010,7 @@ static inline void mlxsw_reg_ralue_pack(char *payload,
 {
         MLXSW_REG_ZERO(ralue, payload);
         mlxsw_reg_ralue_protocol_set(payload, protocol);
+        mlxsw_reg_ralue_op_set(payload, op);
         mlxsw_reg_ralue_virtual_router_set(payload, virtual_router);
         mlxsw_reg_ralue_prefix_len_set(payload, prefix_len);
         mlxsw_reg_ralue_entry_type_set(payload,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index c3e61500819d..d48873bcbddf 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -56,6 +56,7 @@
 #include <generated/utsrelease.h>
 #include <net/pkt_cls.h>
 #include <net/tc_act/tc_mirred.h>
+#include <net/netevent.h>
 
 #include "spectrum.h"
 #include "core.h"
@@ -942,8 +943,8 @@ static void mlxsw_sp_port_vport_destroy(struct mlxsw_sp_port *mlxsw_sp_vport)
         kfree(mlxsw_sp_vport);
 }
 
-int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
-                          u16 vid)
+static int mlxsw_sp_port_add_vid(struct net_device *dev,
+                                 __be16 __always_unused proto, u16 vid)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp_port *mlxsw_sp_vport;
@@ -956,16 +957,12 @@ int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
         if (!vid)
                 return 0;
 
-        if (mlxsw_sp_port_vport_find(mlxsw_sp_port, vid)) {
-                netdev_warn(dev, "VID=%d already configured\n", vid);
+        if (mlxsw_sp_port_vport_find(mlxsw_sp_port, vid))
                 return 0;
-        }
 
         mlxsw_sp_vport = mlxsw_sp_port_vport_create(mlxsw_sp_port, vid);
-        if (!mlxsw_sp_vport) {
-                netdev_err(dev, "Failed to create vPort for VID=%d\n", vid);
+        if (!mlxsw_sp_vport)
                 return -ENOMEM;
-        }
 
         /* When adding the first VLAN interface on a bridged port we need to
          * transition all the active 802.1Q bridge VLANs to use explicit
@@ -973,24 +970,17 @@ int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
          */
         if (list_is_singular(&mlxsw_sp_port->vports_list)) {
                 err = mlxsw_sp_port_vp_mode_trans(mlxsw_sp_port);
-                if (err) {
-                        netdev_err(dev, "Failed to set to Virtual mode\n");
+                if (err)
                         goto err_port_vp_mode_trans;
-                }
         }
 
         err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, false);
-        if (err) {
-                netdev_err(dev, "Failed to disable learning for VID=%d\n", vid);
+        if (err)
                 goto err_port_vid_learning_set;
-        }
 
         err = mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, true, untagged);
-        if (err) {
-                netdev_err(dev, "Failed to set VLAN membership for VID=%d\n",
-                           vid);
+        if (err)
                 goto err_port_add_vid;
-        }
 
         return 0;
 
@@ -1010,7 +1000,6 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
         struct mlxsw_sp_port *mlxsw_sp_vport;
         struct mlxsw_sp_fid *f;
-        int err;
 
         /* VLAN 0 is removed from HW filter when device goes down, but
          * it is reserved in our case, so simply return.
@@ -1019,23 +1008,12 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
                 return 0;
 
         mlxsw_sp_vport = mlxsw_sp_port_vport_find(mlxsw_sp_port, vid);
-        if (!mlxsw_sp_vport) {
-                netdev_warn(dev, "VID=%d does not exist\n", vid);
+        if (WARN_ON(!mlxsw_sp_vport))
                 return 0;
-        }
 
-        err = mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, false, false);
-        if (err) {
-                netdev_err(dev, "Failed to set VLAN membership for VID=%d\n",
-                           vid);
-                return err;
-        }
+        mlxsw_sp_port_vlan_set(mlxsw_sp_vport, vid, vid, false, false);
 
-        err = mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, true);
-        if (err) {
-                netdev_err(dev, "Failed to enable learning for VID=%d\n", vid);
-                return err;
-        }
+        mlxsw_sp_port_vid_learning_set(mlxsw_sp_vport, vid, true);
 
         /* Drop FID reference. If this was the last reference the
          * resources will be freed.
@@ -1048,13 +1026,8 @@ static int mlxsw_sp_port_kill_vid(struct net_device *dev,
          * transition all active 802.1Q bridge VLANs to use VID to FID
          * mappings and set port's mode to VLAN mode.
          */
-        if (list_is_singular(&mlxsw_sp_port->vports_list)) {
-                err = mlxsw_sp_port_vlan_mode_trans(mlxsw_sp_port);
-                if (err) {
-                        netdev_err(dev, "Failed to set to VLAN mode\n");
-                        return err;
-                }
-        }
+        if (list_is_singular(&mlxsw_sp_port->vports_list))
+                mlxsw_sp_port_vlan_mode_trans(mlxsw_sp_port);
 
         mlxsw_sp_port_vport_destroy(mlxsw_sp_vport);
 
@@ -1149,6 +1122,7 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                                           bool ingress)
 {
         const struct tc_action *a;
+        LIST_HEAD(actions);
         int err;
 
         if (!tc_single_action(cls->exts)) {
@@ -1156,7 +1130,8 @@ static int mlxsw_sp_port_add_cls_matchall(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOTSUPP;
         }
 
-        tc_for_each_action(a, cls->exts) {
+        tcf_exts_to_list(cls->exts, &actions);
+        list_for_each_entry(a, &actions, list) {
                 if (!is_tcf_mirred_mirror(a) || protocol != htons(ETH_P_ALL))
                         return -ENOTSUPP;
 
@@ -2076,6 +2051,18 @@ static int mlxsw_sp_port_ets_init(struct mlxsw_sp_port *mlxsw_sp_port)
         return 0;
 }
 
+static int mlxsw_sp_port_pvid_vport_create(struct mlxsw_sp_port *mlxsw_sp_port)
+{
+        mlxsw_sp_port->pvid = 1;
+
+        return mlxsw_sp_port_add_vid(mlxsw_sp_port->dev, 0, 1);
+}
+
+static int mlxsw_sp_port_pvid_vport_destroy(struct mlxsw_sp_port *mlxsw_sp_port)
+{
+        return mlxsw_sp_port_kill_vid(mlxsw_sp_port->dev, 0, 1);
+}
+
 static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                                 bool split, u8 module, u8 width, u8 lane)
 {
@@ -2119,6 +2106,13 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
         dev->netdev_ops = &mlxsw_sp_port_netdev_ops;
         dev->ethtool_ops = &mlxsw_sp_port_ethtool_ops;
 
+        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
+                        mlxsw_sp_port->local_port);
+                goto err_port_swid_set;
+        }
+
         err = mlxsw_sp_port_dev_addr_init(mlxsw_sp_port);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Unable to init port mac address\n",
@@ -2144,13 +2138,6 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_port_system_port_mapping_set;
         }
 
-        err = mlxsw_sp_port_swid_set(mlxsw_sp_port, 0);
-        if (err) {
-                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to set SWID\n",
-                        mlxsw_sp_port->local_port);
-                goto err_port_swid_set;
-        }
-
         err = mlxsw_sp_port_speed_by_width_set(mlxsw_sp_port, width);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to enable speeds\n",
@@ -2191,7 +2178,15 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_port_dcb_init;
         }
 
+        err = mlxsw_sp_port_pvid_vport_create(mlxsw_sp_port);
+        if (err) {
+                dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to create PVID vPort\n",
+                        mlxsw_sp_port->local_port);
+                goto err_port_pvid_vport_create;
+        }
+
         mlxsw_sp_port_switchdev_init(mlxsw_sp_port);
+        mlxsw_sp->ports[local_port] = mlxsw_sp_port;
         err = register_netdev(dev);
         if (err) {
                 dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to register netdev\n",
@@ -2208,27 +2203,26 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port,
                 goto err_core_port_init;
         }
 
-        err = mlxsw_sp_port_vlan_init(mlxsw_sp_port);
-        if (err)
-                goto err_port_vlan_init;
-
-        mlxsw_sp->ports[local_port] = mlxsw_sp_port;
         return 0;
 
-err_port_vlan_init:
-        mlxsw_core_port_fini(&mlxsw_sp_port->core_port);
 err_core_port_init:
         unregister_netdev(dev);
 err_register_netdev:
+        mlxsw_sp->ports[local_port] = NULL;
+        mlxsw_sp_port_switchdev_fini(mlxsw_sp_port);
+        mlxsw_sp_port_pvid_vport_destroy(mlxsw_sp_port);
+err_port_pvid_vport_create:
+        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
 err_port_dcb_init:
 err_port_ets_init:
 err_port_buffers_init:
 err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_by_width_set:
-err_port_swid_set:
 err_port_system_port_mapping_set:
 err_dev_addr_init:
+        mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
+err_port_swid_set:
         free_percpu(mlxsw_sp_port->pcpu_stats);
 err_alloc_stats:
         kfree(mlxsw_sp_port->untagged_vlans);
@@ -2245,12 +2239,12 @@ static void mlxsw_sp_port_remove(struct mlxsw_sp *mlxsw_sp, u8 local_port)
 
         if (!mlxsw_sp_port)
                 return;
-        mlxsw_sp->ports[local_port] = NULL;
         mlxsw_core_port_fini(&mlxsw_sp_port->core_port);
         unregister_netdev(mlxsw_sp_port->dev); /* This calls ndo_stop */
-        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
-        mlxsw_sp_port_kill_vid(mlxsw_sp_port->dev, 0, 1);
+        mlxsw_sp->ports[local_port] = NULL;
         mlxsw_sp_port_switchdev_fini(mlxsw_sp_port);
+        mlxsw_sp_port_pvid_vport_destroy(mlxsw_sp_port);
+        mlxsw_sp_port_dcb_fini(mlxsw_sp_port);
         mlxsw_sp_port_swid_set(mlxsw_sp_port, MLXSW_PORT_SWID_DISABLED_PORT);
         mlxsw_sp_port_module_unmap(mlxsw_sp, mlxsw_sp_port->local_port);
         free_percpu(mlxsw_sp_port->pcpu_stats);
@@ -2662,6 +2656,26 @@ static const struct mlxsw_rx_listener mlxsw_sp_rx_listener[] = {
         {
                 .func = mlxsw_sp_rx_listener_func,
                 .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_MTUERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_TTLERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_LBERROR,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
+                .trap_id = MLXSW_TRAP_ID_OSPF,
+        },
+        {
+                .func = mlxsw_sp_rx_listener_func,
+                .local_port = MLXSW_PORT_DONT_CARE,
                 .trap_id = MLXSW_TRAP_ID_IP2ME,
         },
         {
@@ -3311,6 +3325,39 @@ static struct mlxsw_sp_fid *mlxsw_sp_bridge_fid_get(struct mlxsw_sp *mlxsw_sp,
         return mlxsw_sp_fid_find(mlxsw_sp, fid);
 }
 
+static enum mlxsw_flood_table_type mlxsw_sp_flood_table_type_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? MLXSW_REG_SFGC_TABLE_TYPE_FID :
+               MLXSW_REG_SFGC_TABLE_TYPE_FID_OFFEST;
+}
+
+static u16 mlxsw_sp_flood_table_index_get(u16 fid)
+{
+        return mlxsw_sp_fid_is_vfid(fid) ? mlxsw_sp_fid_to_vfid(fid) : fid;
+}
+
+static int mlxsw_sp_router_port_flood_set(struct mlxsw_sp *mlxsw_sp, u16 fid,
+                                          bool set)
+{
+        enum mlxsw_flood_table_type table_type;
+        char *sftr_pl;
+        u16 index;
+        int err;
+
+        sftr_pl = kmalloc(MLXSW_REG_SFTR_LEN, GFP_KERNEL);
+        if (!sftr_pl)
+                return -ENOMEM;
+
+        table_type = mlxsw_sp_flood_table_type_get(fid);
+        index = mlxsw_sp_flood_table_index_get(fid);
+        mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, index, table_type,
+                            1, MLXSW_PORT_ROUTER_PORT, set);
+        err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
+
+        kfree(sftr_pl);
+        return err;
+}
+
 static enum mlxsw_reg_ritr_if_type mlxsw_sp_rif_type_get(u16 fid)
 {
         if (mlxsw_sp_fid_is_vfid(fid))
@@ -3347,10 +3394,14 @@ static int mlxsw_sp_rif_bridge_create(struct mlxsw_sp *mlxsw_sp,
         if (rif == MLXSW_SP_RIF_MAX)
                 return -ERANGE;
 
-        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        err = mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, true);
         if (err)
                 return err;
 
+        err = mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, true);
+        if (err)
+                goto err_rif_bridge_op;
+
         err = mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, true);
         if (err)
                 goto err_rif_fdb_op;
@@ -3372,6 +3423,8 @@ err_rif_alloc:
         mlxsw_sp_rif_fdb_op(mlxsw_sp, l3_dev->dev_addr, f->fid, false);
 err_rif_fdb_op:
         mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
+err_rif_bridge_op:
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
         return err;
 }
 
@@ -3391,6 +3444,8 @@ void mlxsw_sp_rif_bridge_destroy(struct mlxsw_sp *mlxsw_sp,
 
         mlxsw_sp_rif_bridge_op(mlxsw_sp, l3_dev, f->fid, rif, false);
 
+        mlxsw_sp_router_port_flood_set(mlxsw_sp, f->fid, false);
+
         netdev_dbg(l3_dev, "RIF=%d destroyed\n", rif);
 }
 
@@ -4487,18 +4542,26 @@ static struct notifier_block mlxsw_sp_inetaddr_nb __read_mostly = {
         .priority = 10, /* Must be called before FIB notifier block */
 };
 
+static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
+        .notifier_call = mlxsw_sp_router_netevent_event,
+};
+
 static int __init mlxsw_sp_module_init(void)
 {
         int err;
 
         register_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         register_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
+        register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+
         err = mlxsw_core_driver_register(&mlxsw_sp_driver);
         if (err)
                 goto err_core_driver_register;
         return 0;
 
 err_core_driver_register:
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
+        unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
         return err;
 }
@@ -4506,6 +4569,7 @@ err_core_driver_register:
 static void __exit mlxsw_sp_module_exit(void)
 {
         mlxsw_core_driver_unregister(&mlxsw_sp_driver);
+        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         unregister_inetaddr_notifier(&mlxsw_sp_inetaddr_nb);
         unregister_netdevice_notifier(&mlxsw_sp_netdevice_nb);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
index f69aa37d1521..ac48abebe904 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
@@ -536,8 +536,6 @@ int mlxsw_sp_port_vid_to_fid_set(struct mlxsw_sp_port *mlxsw_sp_port,
                                  u16 vid);
 int mlxsw_sp_port_vlan_set(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid_begin,
                            u16 vid_end, bool is_member, bool untagged);
-int mlxsw_sp_port_add_vid(struct net_device *dev, __be16 __always_unused proto,
-                          u16 vid);
 int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 fid,
                              bool set);
 void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port);
@@ -589,6 +587,8 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                                     struct neighbour *n);
 void mlxsw_sp_router_neigh_destroy(struct net_device *dev,
                                    struct neighbour *n);
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr);
 
 int mlxsw_sp_kvdl_alloc(struct mlxsw_sp *mlxsw_sp, unsigned int entry_count);
 void mlxsw_sp_kvdl_free(struct mlxsw_sp *mlxsw_sp, int entry_index);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
index 074cdda7b6f3..953b214f38d0 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c
@@ -330,7 +330,7 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_cpu_port_sb_cms[] = {
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
-        MLXSW_SP_CPU_PORT_SB_CM,
+        MLXSW_SP_SB_CM(MLXSW_SP_BYTES_TO_CELLS(10000), 0, 0),
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
         MLXSW_SP_CPU_PORT_SB_CM,
@@ -717,22 +717,18 @@ int mlxsw_sp_sb_tc_pool_bind_set(struct mlxsw_core_port *mlxsw_core_port,
         u8 local_port = mlxsw_sp_port->local_port;
         u8 pg_buff = tc_index;
         enum mlxsw_reg_sbxx_dir dir = pool_type;
-        u8 pool = pool_index;
+        u8 pool = pool_get(pool_index);
         u32 max_buff;
         int err;
 
+        if (dir != dir_get(pool_index))
+                return -EINVAL;
+
         err = mlxsw_sp_sb_threshold_in(mlxsw_sp, pool, dir,
                                        threshold, &max_buff);
         if (err)
                 return err;
 
-        if (pool_type == DEVLINK_SB_POOL_TYPE_EGRESS) {
-                if (pool < MLXSW_SP_SB_POOL_COUNT)
-                        return -EINVAL;
-                pool -= MLXSW_SP_SB_POOL_COUNT;
-        } else if (pool >= MLXSW_SP_SB_POOL_COUNT) {
-                return -EINVAL;
-        }
         return mlxsw_sp_sb_cm_write(mlxsw_sp, local_port, pg_buff, dir,
                                     0, max_buff, pool);
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
index 01cfb7512827..b6ed7f7c531e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
@@ -341,6 +341,8 @@ static int mlxsw_sp_port_pfc_set(struct mlxsw_sp_port *mlxsw_sp_port,
         char pfcc_pl[MLXSW_REG_PFCC_LEN];
 
         mlxsw_reg_pfcc_pack(pfcc_pl, mlxsw_sp_port->local_port);
+        mlxsw_reg_pfcc_pprx_set(pfcc_pl, mlxsw_sp_port->link.rx_pause);
+        mlxsw_reg_pfcc_pptx_set(pfcc_pl, mlxsw_sp_port->link.tx_pause);
         mlxsw_reg_pfcc_prio_pack(pfcc_pl, pfc->pfc_en);
 
         return mlxsw_reg_write(mlxsw_sp_port->mlxsw_sp->core, MLXSW_REG(pfcc),
@@ -351,17 +353,17 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
                                       struct ieee_pfc *pfc)
 {
         struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(dev);
+        bool pause_en = mlxsw_sp_port_is_pause_en(mlxsw_sp_port);
         int err;
 
-        if ((mlxsw_sp_port->link.tx_pause || mlxsw_sp_port->link.rx_pause) &&
-            pfc->pfc_en) {
+        if (pause_en && pfc->pfc_en) {
                 netdev_err(dev, "PAUSE frames already enabled on port\n");
                 return -EINVAL;
         }
 
         err = __mlxsw_sp_port_headroom_set(mlxsw_sp_port, dev->mtu,
                                            mlxsw_sp_port->dcb.ets->prio_tc,
-                                           false, pfc);
+                                           pause_en, pfc);
         if (err) {
                 netdev_err(dev, "Failed to configure port's headroom for PFC\n");
                 return err;
@@ -380,7 +382,7 @@ static int mlxsw_sp_dcbnl_ieee_setpfc(struct net_device *dev,
 
 err_port_pfc_set:
         __mlxsw_sp_port_headroom_set(mlxsw_sp_port, dev->mtu,
-                                     mlxsw_sp_port->dcb.ets->prio_tc, false,
+                                     mlxsw_sp_port->dcb.ets->prio_tc, pause_en,
                                      mlxsw_sp_port->dcb.pfc);
         return err;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 81418d629231..3f5c51da6d3e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -107,6 +107,7 @@ mlxsw_sp_prefix_usage_clear(struct mlxsw_sp_prefix_usage *prefix_usage,
 }
 
 struct mlxsw_sp_fib_key {
+        struct net_device *dev;
         unsigned char addr[sizeof(struct in6_addr)];
         unsigned char prefix_len;
 };
@@ -123,7 +124,7 @@ struct mlxsw_sp_fib_entry {
         struct rhash_head ht_node;
         struct mlxsw_sp_fib_key key;
         enum mlxsw_sp_fib_entry_type type;
-        u8 added:1;
+        unsigned int ref_count;
         u16 rif; /* used for action local */
         struct mlxsw_sp_vr *vr;
         struct list_head nexthop_group_node;
@@ -171,13 +172,15 @@ static void mlxsw_sp_fib_entry_remove(struct mlxsw_sp_fib *fib,
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_create(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
         struct mlxsw_sp_fib_entry *fib_entry;
 
         fib_entry = kzalloc(sizeof(*fib_entry), GFP_KERNEL);
         if (!fib_entry)
                 return NULL;
+        fib_entry->key.dev = dev;
         memcpy(fib_entry->key.addr, addr, addr_len);
         fib_entry->key.prefix_len = prefix_len;
         return fib_entry;
@@ -190,10 +193,13 @@ static void mlxsw_sp_fib_entry_destroy(struct mlxsw_sp_fib_entry *fib_entry)
 
 static struct mlxsw_sp_fib_entry *
 mlxsw_sp_fib_entry_lookup(struct mlxsw_sp_fib *fib, const void *addr,
-                          size_t addr_len, unsigned char prefix_len)
+                          size_t addr_len, unsigned char prefix_len,
+                          struct net_device *dev)
 {
-        struct mlxsw_sp_fib_key key = {{ 0 } };
+        struct mlxsw_sp_fib_key key;
 
+        memset(&key, 0, sizeof(key));
+        key.dev = dev;
         memcpy(key.addr, addr, addr_len);
         key.prefix_len = prefix_len;
         return rhashtable_lookup_fast(&fib->ht, &key, mlxsw_sp_fib_ht_params);
@@ -657,7 +663,7 @@ int mlxsw_sp_router_neigh_construct(struct net_device *dev,
                 return 0;
         }
 
-        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, dev);
+        r = mlxsw_sp_rif_find_by_dev(mlxsw_sp, n->dev);
         if (WARN_ON(!r))
                 return -EINVAL;
 
@@ -938,8 +944,8 @@ static void mlxsw_sp_router_neigh_update_hw(struct work_struct *work)
         mlxsw_sp_port_dev_put(mlxsw_sp_port);
 }
 
-static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
-                                          unsigned long event, void *ptr)
+int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
+                                   unsigned long event, void *ptr)
 {
         struct mlxsw_sp_neigh_entry *neigh_entry;
         struct mlxsw_sp_port *mlxsw_sp_port;
@@ -1009,10 +1015,6 @@ static int mlxsw_sp_router_netevent_event(struct notifier_block *unused,
         return NOTIFY_DONE;
 }
 
-static struct notifier_block mlxsw_sp_router_netevent_nb __read_mostly = {
-        .notifier_call = mlxsw_sp_router_netevent_event,
-};
-
 static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
 {
         int err;
@@ -1027,10 +1029,6 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
          */
         mlxsw_sp_router_neighs_update_interval_init(mlxsw_sp);
 
-        err = register_netevent_notifier(&mlxsw_sp_router_netevent_nb);
-        if (err)
-                goto err_register_netevent_notifier;
-
         /* Create the delayed works for the activity_update */
         INIT_DELAYED_WORK(&mlxsw_sp->router.neighs_update.dw,
                           mlxsw_sp_router_neighs_update_work);
@@ -1039,17 +1037,12 @@ static int mlxsw_sp_neigh_init(struct mlxsw_sp *mlxsw_sp)
         mlxsw_core_schedule_dw(&mlxsw_sp->router.neighs_update.dw, 0);
         mlxsw_core_schedule_dw(&mlxsw_sp->router.nexthop_probe_dw, 0);
         return 0;
-
-err_register_netevent_notifier:
-        rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
-        return err;
 }
 
 static void mlxsw_sp_neigh_fini(struct mlxsw_sp *mlxsw_sp)
 {
         cancel_delayed_work_sync(&mlxsw_sp->router.neighs_update.dw);
         cancel_delayed_work_sync(&mlxsw_sp->router.nexthop_probe_dw);
-        unregister_netevent_notifier(&mlxsw_sp_router_netevent_nb);
         rhashtable_destroy(&mlxsw_sp->router.neigh_ht);
 }
 
@@ -1524,7 +1517,14 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp)
                 return err;
         mlxsw_sp_lpm_init(mlxsw_sp);
         mlxsw_sp_vrs_init(mlxsw_sp);
-        return mlxsw_sp_neigh_init(mlxsw_sp);
+        err = mlxsw_sp_neigh_init(mlxsw_sp);
+        if (err)
+                goto err_neigh_init;
+        return 0;
+
+err_neigh_init:
+        __mlxsw_sp_router_fini(mlxsw_sp);
+        return err;
 }
 
 void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp)
@@ -1626,11 +1626,8 @@ static int mlxsw_sp_fib_entry_op(struct mlxsw_sp *mlxsw_sp,
 static int mlxsw_sp_fib_entry_update(struct mlxsw_sp *mlxsw_sp,
                                      struct mlxsw_sp_fib_entry *fib_entry)
 {
-        enum mlxsw_reg_ralue_op op;
-
-        op = !fib_entry->added ? MLXSW_REG_RALUE_OP_WRITE_WRITE :
-                                 MLXSW_REG_RALUE_OP_WRITE_UPDATE;
-        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry, op);
+        return mlxsw_sp_fib_entry_op(mlxsw_sp, fib_entry,
+                                     MLXSW_REG_RALUE_OP_WRITE_WRITE);
 }
 
 static int mlxsw_sp_fib_entry_del(struct mlxsw_sp *mlxsw_sp,
@@ -1651,9 +1648,10 @@ static void mlxsw_sp_router_fib4_add_info_destroy(void const *data)
         const struct mlxsw_sp_router_fib4_add_info *info = data;
         struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry;
         struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp;
+        struct mlxsw_sp_vr *vr = fib_entry->vr;
 
         mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, fib_entry->vr);
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
         kfree(info);
 }
 
@@ -1694,34 +1692,93 @@ mlxsw_sp_router_fib4_entry_fini(struct mlxsw_sp *mlxsw_sp,
         mlxsw_sp_nexthop_group_put(mlxsw_sp, fib_entry);
 }
 
-static int
-mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
-                                 const struct switchdev_obj_ipv4_fib *fib4,
-                                 struct switchdev_trans *trans)
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_get(struct mlxsw_sp *mlxsw_sp,
+                       const struct switchdev_obj_ipv4_fib *fib4)
 {
-        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
-        struct mlxsw_sp_router_fib4_add_info *info;
         struct mlxsw_sp_fib_entry *fib_entry;
+        struct fib_info *fi = fib4->fi;
         struct mlxsw_sp_vr *vr;
         int err;
 
         vr = mlxsw_sp_vr_get(mlxsw_sp, fib4->dst_len, fib4->tb_id,
                              MLXSW_SP_L3_PROTO_IPV4);
         if (IS_ERR(vr))
-                return PTR_ERR(vr);
+                return ERR_CAST(vr);
 
+        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
+        if (fib_entry) {
+                /* Already exists, just take a reference */
+                fib_entry->ref_count++;
+                return fib_entry;
+        }
         fib_entry = mlxsw_sp_fib_entry_create(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+                                              sizeof(fib4->dst),
+                                              fib4->dst_len, fi->fib_dev);
         if (!fib_entry) {
                 err = -ENOMEM;
                 goto err_fib_entry_create;
         }
         fib_entry->vr = vr;
+        fib_entry->ref_count = 1;
 
         err = mlxsw_sp_router_fib4_entry_init(mlxsw_sp, fib4, fib_entry);
         if (err)
                 goto err_fib4_entry_init;
 
+        return fib_entry;
+
+err_fib4_entry_init:
+        mlxsw_sp_fib_entry_destroy(fib_entry);
+err_fib_entry_create:
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        return ERR_PTR(err);
+}
+
+static struct mlxsw_sp_fib_entry *
+mlxsw_sp_fib_entry_find(struct mlxsw_sp *mlxsw_sp,
+                        const struct switchdev_obj_ipv4_fib *fib4)
+{
+        struct mlxsw_sp_vr *vr;
+
+        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
+        if (!vr)
+                return NULL;
+
+        return mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
+                                         sizeof(fib4->dst), fib4->dst_len,
+                                         fib4->fi->fib_dev);
+}
+
+void mlxsw_sp_fib_entry_put(struct mlxsw_sp *mlxsw_sp,
+                            struct mlxsw_sp_fib_entry *fib_entry)
+{
+        struct mlxsw_sp_vr *vr = fib_entry->vr;
+
+        if (--fib_entry->ref_count == 0) {
+                mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_destroy(fib_entry);
+        }
+        mlxsw_sp_vr_put(mlxsw_sp, vr);
+}
+
+static int
+mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
+                                 const struct switchdev_obj_ipv4_fib *fib4,
+                                 struct switchdev_trans *trans)
+{
+        struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+        struct mlxsw_sp_router_fib4_add_info *info;
+        struct mlxsw_sp_fib_entry *fib_entry;
+        int err;
+
+        fib_entry = mlxsw_sp_fib_entry_get(mlxsw_sp, fib4);
+        if (IS_ERR(fib_entry))
+                return PTR_ERR(fib_entry);
+
         info = kmalloc(sizeof(*info), GFP_KERNEL);
         if (!info) {
                 err = -ENOMEM;
@@ -1735,11 +1792,7 @@ mlxsw_sp_router_fib4_add_prepare(struct mlxsw_sp_port *mlxsw_sp_port,
         return 0;
 
 err_alloc_info:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-err_fib4_entry_init:
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-err_fib_entry_create:
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1758,11 +1811,14 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
         fib_entry = info->fib_entry;
         kfree(info);
 
+        if (fib_entry->ref_count != 1)
+                return 0;
+
         vr = fib_entry->vr;
-        err = mlxsw_sp_fib_entry_insert(fib_entry->vr->fib, fib_entry);
+        err = mlxsw_sp_fib_entry_insert(vr->fib, fib_entry);
         if (err)
                 goto err_fib_entry_insert;
-        err = mlxsw_sp_fib_entry_update(mlxsw_sp, fib_entry);
+        err = mlxsw_sp_fib_entry_update(mlxsw_sp_port->mlxsw_sp, fib_entry);
         if (err)
                 goto err_fib_entry_add;
         return 0;
@@ -1770,9 +1826,7 @@ mlxsw_sp_router_fib4_add_commit(struct mlxsw_sp_port *mlxsw_sp_port,
 err_fib_entry_add:
         mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
 err_fib_entry_insert:
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return err;
 }
 
@@ -1792,23 +1846,18 @@ int mlxsw_sp_router_fib4_del(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         struct mlxsw_sp_fib_entry *fib_entry;
-        struct mlxsw_sp_vr *vr;
 
-        vr = mlxsw_sp_vr_find(mlxsw_sp, fib4->tb_id, MLXSW_SP_L3_PROTO_IPV4);
-        if (!vr) {
-                dev_warn(mlxsw_sp->bus_info->dev, "Failed to find virtual router for FIB4 entry being removed.\n");
-                return -ENOENT;
-        }
-        fib_entry = mlxsw_sp_fib_entry_lookup(vr->fib, &fib4->dst,
-                                              sizeof(fib4->dst), fib4->dst_len);
+        fib_entry = mlxsw_sp_fib_entry_find(mlxsw_sp, fib4);
         if (!fib_entry) {
                 dev_warn(mlxsw_sp->bus_info->dev, "Failed to find FIB4 entry being removed.\n");
                 return -ENOENT;
         }
-        mlxsw_sp_fib_entry_del(mlxsw_sp_port->mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_remove(vr->fib, fib_entry);
-        mlxsw_sp_router_fib4_entry_fini(mlxsw_sp, fib_entry);
-        mlxsw_sp_fib_entry_destroy(fib_entry);
-        mlxsw_sp_vr_put(mlxsw_sp, vr);
+
+        if (fib_entry->ref_count == 1) {
+                mlxsw_sp_fib_entry_del(mlxsw_sp, fib_entry);
+                mlxsw_sp_fib_entry_remove(fib_entry->vr->fib, fib_entry);
+        }
+
+        mlxsw_sp_fib_entry_put(mlxsw_sp, fib_entry);
         return 0;
 }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index a1ad5e6bdfa8..7b654c517b91 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -167,8 +167,8 @@ static int mlxsw_sp_port_attr_stp_state_set(struct mlxsw_sp_port *mlxsw_sp_port,
 }
 
 static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
-                                     u16 idx_begin, u16 idx_end, bool set,
-                                     bool only_uc)
+                                     u16 idx_begin, u16 idx_end, bool uc_set,
+                                     bool bm_set)
 {
         struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
         u16 local_port = mlxsw_sp_port->local_port;
@@ -187,28 +187,22 @@ static int __mlxsw_sp_port_flood_set(struct mlxsw_sp_port *mlxsw_sp_port,
                 return -ENOMEM;
 
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, uc_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto buffer_out;
 
-        /* Flooding control allows one to decide whether a given port will
-         * flood unicast traffic for which there is no FDB entry.
-         */
-        if (only_uc)
-                goto buffer_out;
-
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_BM, idx_begin,
-                            table_type, range, local_port, set);
+                            table_type, range, local_port, bm_set);
         err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
         if (err)
                 goto err_flood_bm_set;
-        else
-                goto buffer_out;
+
+        goto buffer_out;
 
 err_flood_bm_set:
         mlxsw_reg_sftr_pack(sftr_pl, MLXSW_SP_FLOOD_TABLE_UC, idx_begin,
-                            table_type, range, local_port, !set);
+                            table_type, range, local_port, !uc_set);
         mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sftr), sftr_pl);
 buffer_out:
         kfree(sftr_pl);
@@ -257,8 +251,7 @@ int mlxsw_sp_vport_flood_set(struct mlxsw_sp_port *mlxsw_sp_vport, u16 fid,
          * the start of the vFIDs range.
          */
         vfid = mlxsw_sp_fid_to_vfid(fid);
-        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set,
-                                         false);
+        return __mlxsw_sp_port_flood_set(mlxsw_sp_vport, vfid, vfid, set, set);
 }
 
 static int mlxsw_sp_port_attr_br_flags_set(struct mlxsw_sp_port *mlxsw_sp_port,
@@ -450,6 +443,8 @@ void mlxsw_sp_fid_destroy(struct mlxsw_sp *mlxsw_sp, struct mlxsw_sp_fid *f)
 
         kfree(f);
 
+        mlxsw_sp_fid_map(mlxsw_sp, fid, false);
+
         mlxsw_sp_fid_op(mlxsw_sp, fid, false);
 }
 
@@ -458,6 +453,9 @@ static int __mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
 {
         struct mlxsw_sp_fid *f;
 
+        if (test_bit(fid, mlxsw_sp_port->active_vlans))
+                return 0;
+
         f = mlxsw_sp_fid_find(mlxsw_sp_port->mlxsw_sp, fid);
         if (!f) {
                 f = mlxsw_sp_fid_create(mlxsw_sp_port->mlxsw_sp, fid);
@@ -515,7 +513,7 @@ static int mlxsw_sp_port_fid_join(struct mlxsw_sp_port *mlxsw_sp_port,
         }
 
         err = __mlxsw_sp_port_flood_set(mlxsw_sp_port, fid_begin, fid_end,
-                                        true, false);
+                                        mlxsw_sp_port->uc_flood, true);
         if (err)
                 goto err_port_flood_set;
 
@@ -997,13 +995,13 @@ static int mlxsw_sp_port_obj_add(struct net_device *dev,
 }
 
 static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
-                                     u16 vid_begin, u16 vid_end, bool init)
+                                     u16 vid_begin, u16 vid_end)
 {
         struct net_device *dev = mlxsw_sp_port->dev;
         u16 vid, pvid;
         int err;
 
-        if (!init && !mlxsw_sp_port->bridged)
+        if (!mlxsw_sp_port->bridged)
                 return -EINVAL;
 
         err = __mlxsw_sp_port_vlans_set(mlxsw_sp_port, vid_begin, vid_end,
@@ -1014,9 +1012,6 @@ static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
                 return err;
         }
 
-        if (init)
-                goto out;
-
         pvid = mlxsw_sp_port->pvid;
         if (pvid >= vid_begin && pvid <= vid_end) {
                 err = mlxsw_sp_port_pvid_set(mlxsw_sp_port, 0);
@@ -1028,7 +1023,6 @@ static int __mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
 
         mlxsw_sp_port_fid_leave(mlxsw_sp_port, vid_begin, vid_end);
 
-out:
         /* Changing activity bits only if HW operation succeded */
         for (vid = vid_begin; vid <= vid_end; vid++)
                 clear_bit(vid, mlxsw_sp_port->active_vlans);
@@ -1039,8 +1033,8 @@ out:
 static int mlxsw_sp_port_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port,
                                    const struct switchdev_obj_port_vlan *vlan)
 {
-        return __mlxsw_sp_port_vlans_del(mlxsw_sp_port,
-                                         vlan->vid_begin, vlan->vid_end, false);
+        return __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vlan->vid_begin,
+                                         vlan->vid_end);
 }
 
 void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port)
@@ -1048,7 +1042,7 @@ void mlxsw_sp_port_active_vlans_del(struct mlxsw_sp_port *mlxsw_sp_port)
         u16 vid;
 
         for_each_set_bit(vid, mlxsw_sp_port->active_vlans, VLAN_N_VID)
-                __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vid, vid, false);
+                __mlxsw_sp_port_vlans_del(mlxsw_sp_port, vid, vid);
 }
 
 static int
@@ -1546,32 +1540,6 @@ void mlxsw_sp_switchdev_fini(struct mlxsw_sp *mlxsw_sp)
         mlxsw_sp_fdb_fini(mlxsw_sp);
 }
 
-int mlxsw_sp_port_vlan_init(struct mlxsw_sp_port *mlxsw_sp_port)
-{
-        struct net_device *dev = mlxsw_sp_port->dev;
-        int err;
-
-        /* Allow only untagged packets to ingress and tag them internally
-         * with VID 1.
-         */
-        mlxsw_sp_port->pvid = 1;
-        err = __mlxsw_sp_port_vlans_del(mlxsw_sp_port, 0, VLAN_N_VID - 1,
-                                        true);
-        if (err) {
-                netdev_err(dev, "Unable to init VLANs\n");
-                return err;
-        }
-
-        /* Add implicit VLAN interface in the device, so that untagged
-         * packets will be classified to the default vFID.
-         */
-        err = mlxsw_sp_port_add_vid(dev, 0, 1);
-        if (err)
-                netdev_err(dev, "Failed to configure default vFID\n");
-
-        return err;
-}
-
 void mlxsw_sp_port_switchdev_init(struct mlxsw_sp_port *mlxsw_sp_port)
 {
         mlxsw_sp_port->dev->switchdev_ops = &mlxsw_sp_port_switchdev_ops;
diff --git a/drivers/net/ethernet/mellanox/mlxsw/trap.h b/drivers/net/ethernet/mellanox/mlxsw/trap.h
index 470d7696e9fe..ed8e30186400 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/trap.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/trap.h
@@ -56,6 +56,10 @@ enum {
         MLXSW_TRAP_ID_IGMP_V3_REPORT = 0x34,
         MLXSW_TRAP_ID_ARPBC = 0x50,
         MLXSW_TRAP_ID_ARPUC = 0x51,
+        MLXSW_TRAP_ID_MTUERROR = 0x52,
+        MLXSW_TRAP_ID_TTLERROR = 0x53,
+        MLXSW_TRAP_ID_LBERROR = 0x54,
+        MLXSW_TRAP_ID_OSPF = 0x55,
         MLXSW_TRAP_ID_IP2ME = 0x5F,
         MLXSW_TRAP_ID_RTR_INGRESS0 = 0x70,
         MLXSW_TRAP_ID_HOST_MISS_IPV4 = 0x90,
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
index 88678c172b19..39dadfca84ef 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
@@ -41,7 +41,6 @@
  *          Chris Telfer <chris.telfer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -1441,10 +1440,6 @@ static int nfp_net_rx(struct nfp_net_rx_ring *rx_ring, int budget)
 
                 nfp_net_set_hash(nn->netdev, skb, rxd);
 
-                /* Pad small frames to minimum */
-                if (skb_put_padto(skb, 60))
-                        break;
-
                 /* Stats update */
                 u64_stats_update_begin(&r_vec->rx_sync);
                 r_vec->rx_pkts++;
@@ -2049,12 +2044,16 @@ static int nfp_net_netdev_open(struct net_device *netdev)
 
         nn->rx_rings = kcalloc(nn->num_rx_rings, sizeof(*nn->rx_rings),
                                GFP_KERNEL);
-        if (!nn->rx_rings)
+        if (!nn->rx_rings) {
+                err = -ENOMEM;
                 goto err_free_lsc;
+        }
         nn->tx_rings = kcalloc(nn->num_tx_rings, sizeof(*nn->tx_rings),
                                GFP_KERNEL);
-        if (!nn->tx_rings)
+        if (!nn->tx_rings) {
+                err = -ENOMEM;
                 goto err_free_rx_rings;
+        }
 
         for (r = 0; r < nn->num_r_vecs; r++) {
                 err = nfp_net_prepare_vector(nn, &nn->r_vecs[r], r);
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
index 7d7933d00b8f..4c9897220969 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c
@@ -40,7 +40,6 @@
  *          Brad Petrus <brad.petrus@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
index 37abef016a0a..f7062cb648e1 100644
--- a/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
+++ b/drivers/net/ethernet/netronome/nfp/nfp_netvf_main.c
@@ -38,7 +38,6 @@
  *         Rolf Neugebauer <rolf.neugebauer@netronome.com>
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
@@ -134,7 +133,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         nfp_net_get_fw_version(&fw_ver, ctrl_bar);
-        if (fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
+        if (fw_ver.resv || fw_ver.class != NFP_NET_CFG_VERSION_CLASS_GENERIC) {
                 dev_err(&pdev->dev, "Unknown Firmware ABI %d.%d.%d.%d\n",
                         fw_ver.resv, fw_ver.class, fw_ver.major, fw_ver.minor);
                 err = -EINVAL;
@@ -142,9 +141,7 @@ static int nfp_netvf_pci_probe(struct pci_dev *pdev,
         }
 
         /* Determine stride */
-        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 0) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1) ||
-            nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0x12, 0x48)) {
+        if (nfp_net_fw_ver_eq(&fw_ver, 0, 0, 0, 1)) {
                 stride = 2;
                 tx_bar_no = NFP_NET_Q0_BAR;
                 rx_bar_no = NFP_NET_Q1_BAR;
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 4d4ecba0aad9..8e13ec84c538 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -475,14 +475,6 @@ static void __lpc_get_mac(struct netdata_local *pldat, u8 *mac)
         mac[5] = tmp >> 8;
 }
 
-static void __lpc_eth_clock_enable(struct netdata_local *pldat, bool enable)
-{
-        if (enable)
-                clk_prepare_enable(pldat->clk);
-        else
-                clk_disable_unprepare(pldat->clk);
-}
-
 static void __lpc_params_setup(struct netdata_local *pldat)
 {
         u32 tmp;
@@ -1056,7 +1048,7 @@ static int lpc_eth_close(struct net_device *ndev)
         writel(0, LPC_ENET_MAC2(pldat->net_base));
         spin_unlock_irqrestore(&pldat->lock, flags);
 
-        __lpc_eth_clock_enable(pldat, false);
+        clk_disable_unprepare(pldat->clk);
 
         return 0;
 }
@@ -1197,11 +1189,14 @@ static int lpc_eth_ioctl(struct net_device *ndev, struct ifreq *req, int cmd)
 static int lpc_eth_open(struct net_device *ndev)
 {
         struct netdata_local *pldat = netdev_priv(ndev);
+        int ret;
 
         if (netif_msg_ifup(pldat))
                 dev_dbg(&pldat->pdev->dev, "enabling %s\n", ndev->name);
 
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                return ret;
 
         /* Suspended PHY makes LPC ethernet core block, so resume now */
         phy_resume(ndev->phydev);
@@ -1320,7 +1315,9 @@ static int lpc_eth_drv_probe(struct platform_device *pdev)
         }
 
         /* Enable network clock */
-        __lpc_eth_clock_enable(pldat, true);
+        ret = clk_prepare_enable(pldat->clk);
+        if (ret)
+                goto err_out_clk_put;
 
         /* Map IO space */
         pldat->net_base = ioremap(res->start, resource_size(res));
@@ -1454,6 +1451,7 @@ err_out_iounmap:
         iounmap(pldat->net_base);
 err_out_disable_clocks:
         clk_disable_unprepare(pldat->clk);
+err_out_clk_put:
         clk_put(pldat->clk);
 err_out_free_dev:
         free_netdev(ndev);
diff --git a/drivers/net/ethernet/qlogic/qed/qed.h b/drivers/net/ethernet/qlogic/qed/qed.h
index 35e53771533f..45ab74676573 100644
--- a/drivers/net/ethernet/qlogic/qed/qed.h
+++ b/drivers/net/ethernet/qlogic/qed/qed.h
@@ -561,9 +561,18 @@ struct qed_dev {
 static inline u8 qed_concrete_to_sw_fid(struct qed_dev *cdev,
                                         u32 concrete_fid)
 {
+        u8 vfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_VFID);
         u8 pfid = GET_FIELD(concrete_fid, PXP_CONCRETE_FID_PFID);
+        u8 vf_valid = GET_FIELD(concrete_fid,
+                                PXP_CONCRETE_FID_VFVALID);
+        u8 sw_fid;
 
-        return pfid;
+        if (vf_valid)
+                sw_fid = vfid + MAX_NUM_PFS;
+        else
+                sw_fid = pfid;
+
+        return sw_fid;
 }
 
 #define PURE_LB_TC 8
diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index d0dc28f93c0e..3656d2fd673d 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -19,6 +19,7 @@
 #include "qed_dcbx.h"
 #include "qed_hsi.h"
 #include "qed_sp.h"
+#include "qed_sriov.h"
 #ifdef CONFIG_DCB
 #include <linux/qed/qed_eth_if.h>
 #endif
@@ -52,40 +53,94 @@ static bool qed_dcbx_app_ethtype(u32 app_info_bitmap)
                   DCBX_APP_SF_ETHTYPE);
 }
 
+static bool qed_dcbx_ieee_app_ethtype(u32 app_info_bitmap)
+{
+        u8 mfw_val = QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF_IEEE);
+
+        /* Old MFW */
+        if (mfw_val == DCBX_APP_SF_IEEE_RESERVED)
+                return qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(mfw_val == DCBX_APP_SF_IEEE_ETHTYPE);
+}
+
 static bool qed_dcbx_app_port(u32 app_info_bitmap)
 {
         return !!(QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF) ==
                   DCBX_APP_SF_PORT);
 }
 
-static bool qed_dcbx_default_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_ieee_app_port(u32 app_info_bitmap, u8 type)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_DEFAULT);
+        u8 mfw_val = QED_MFW_GET_FIELD(app_info_bitmap, DCBX_APP_SF_IEEE);
+
+        /* Old MFW */
+        if (mfw_val == DCBX_APP_SF_IEEE_RESERVED)
+                return qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(mfw_val == type || mfw_val == DCBX_APP_SF_IEEE_TCP_UDP_PORT);
 }
 
-static bool qed_dcbx_iscsi_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_default_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_port(app_info_bitmap) &&
-                  proto_id == QED_TCP_PORT_ISCSI);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_DEFAULT));
 }
 
-static bool qed_dcbx_fcoe_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_iscsi_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_FCOE);
+        bool port;
+
+        if (ieee)
+                port = qed_dcbx_ieee_app_port(app_info_bitmap,
+                                              DCBX_APP_SF_IEEE_TCP_PORT);
+        else
+                port = qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(port && (proto_id == QED_TCP_PORT_ISCSI));
 }
 
-static bool qed_dcbx_roce_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_fcoe_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_ethtype(app_info_bitmap) &&
-                  proto_id == QED_ETH_TYPE_ROCE);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_FCOE));
 }
 
-static bool qed_dcbx_roce_v2_tlv(u32 app_info_bitmap, u16 proto_id)
+static bool qed_dcbx_roce_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
 {
-        return !!(qed_dcbx_app_port(app_info_bitmap) &&
-                  proto_id == QED_UDP_PORT_TYPE_ROCE_V2);
+        bool ethtype;
+
+        if (ieee)
+                ethtype = qed_dcbx_ieee_app_ethtype(app_info_bitmap);
+        else
+                ethtype = qed_dcbx_app_ethtype(app_info_bitmap);
+
+        return !!(ethtype && (proto_id == QED_ETH_TYPE_ROCE));
+}
+
+static bool qed_dcbx_roce_v2_tlv(u32 app_info_bitmap, u16 proto_id, bool ieee)
+{
+        bool port;
+
+        if (ieee)
+                port = qed_dcbx_ieee_app_port(app_info_bitmap,
+                                              DCBX_APP_SF_IEEE_UDP_PORT);
+        else
+                port = qed_dcbx_app_port(app_info_bitmap);
+
+        return !!(port && (proto_id == QED_UDP_PORT_TYPE_ROCE_V2));
 }
 
 static void
@@ -164,17 +219,17 @@ qed_dcbx_update_app_info(struct qed_dcbx_results *p_data,
 static bool
 qed_dcbx_get_app_protocol_type(struct qed_hwfn *p_hwfn,
                                u32 app_prio_bitmap,
-                               u16 id, enum dcbx_protocol_type *type)
+                               u16 id, enum dcbx_protocol_type *type, bool ieee)
 {
-        if (qed_dcbx_fcoe_tlv(app_prio_bitmap, id)) {
+        if (qed_dcbx_fcoe_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_FCOE;
-        } else if (qed_dcbx_roce_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_roce_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ROCE;
-        } else if (qed_dcbx_iscsi_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_iscsi_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ISCSI;
-        } else if (qed_dcbx_default_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_default_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ETH;
-        } else if (qed_dcbx_roce_v2_tlv(app_prio_bitmap, id)) {
+        } else if (qed_dcbx_roce_v2_tlv(app_prio_bitmap, id, ieee)) {
                 *type = DCBX_PROTOCOL_ROCE_V2;
         } else {
                 *type = DCBX_MAX_PROTOCOL_TYPE;
@@ -194,17 +249,18 @@ static int
 qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
                      struct qed_dcbx_results *p_data,
                      struct dcbx_app_priority_entry *p_tbl,
-                     u32 pri_tc_tbl, int count, bool dcbx_enabled)
+                     u32 pri_tc_tbl, int count, u8 dcbx_version)
 {
         u8 tc, priority_map;
         enum dcbx_protocol_type type;
+        bool enable, ieee;
         u16 protocol_id;
         int priority;
-        bool enable;
         int i;
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB, "Num APP entries = %d\n", count);
 
+        ieee = (dcbx_version == DCBX_CONFIG_VERSION_IEEE);
         /* Parse APP TLV */
         for (i = 0; i < count; i++) {
                 protocol_id = QED_MFW_GET_FIELD(p_tbl[i].entry,
@@ -219,7 +275,7 @@ qed_dcbx_process_tlv(struct qed_hwfn *p_hwfn,
 
                 tc = QED_DCBX_PRIO2TC(pri_tc_tbl, priority);
                 if (qed_dcbx_get_app_protocol_type(p_hwfn, p_tbl[i].entry,
-                                                   protocol_id, &type)) {
+                                                   protocol_id, &type, ieee)) {
                         /* ETH always have the enable bit reset, as it gets
                          * vlan information per packet. For other protocols,
                          * should be set according to the dcbx_enabled
@@ -275,15 +331,12 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
         struct dcbx_ets_feature *p_ets;
         struct qed_hw_info *p_info;
         u32 pri_tc_tbl, flags;
-        bool dcbx_enabled;
+        u8 dcbx_version;
         int num_entries;
         int rc = 0;
 
-        /* If DCBx version is non zero, then negotiation was
-         * successfuly performed
-         */
         flags = p_hwfn->p_dcbx_info->operational.flags;
-        dcbx_enabled = !!QED_MFW_GET_FIELD(flags, DCBX_CONFIG_VERSION);
+        dcbx_version = QED_MFW_GET_FIELD(flags, DCBX_CONFIG_VERSION);
 
         p_app = &p_hwfn->p_dcbx_info->operational.features.app;
         p_tbl = p_app->app_pri_tbl;
@@ -295,13 +348,13 @@ static int qed_dcbx_process_mib_info(struct qed_hwfn *p_hwfn)
         num_entries = QED_MFW_GET_FIELD(p_app->flags, DCBX_APP_NUM_ENTRIES);
 
         rc = qed_dcbx_process_tlv(p_hwfn, &data, p_tbl, pri_tc_tbl,
-                                  num_entries, dcbx_enabled);
+                                  num_entries, dcbx_version);
         if (rc)
                 return rc;
 
         p_info->num_tc = QED_MFW_GET_FIELD(p_ets->flags, DCBX_ETS_MAX_TCS);
         data.pf_id = p_hwfn->rel_pf_id;
-        data.dcbx_enabled = dcbx_enabled;
+        data.dcbx_enabled = !!dcbx_version;
 
         qed_dcbx_dp_protocol(p_hwfn, &data);
 
@@ -400,7 +453,7 @@ static void
 qed_dcbx_get_app_data(struct qed_hwfn *p_hwfn,
                       struct dcbx_app_priority_feature *p_app,
                       struct dcbx_app_priority_entry *p_tbl,
-                      struct qed_dcbx_params *p_params)
+                      struct qed_dcbx_params *p_params, bool ieee)
 {
         struct qed_app_entry *entry;
         u8 pri_map;
@@ -414,15 +467,46 @@ qed_dcbx_get_app_data(struct qed_hwfn *p_hwfn,
                                                       DCBX_APP_NUM_ENTRIES);
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_params->app_entry[i];
-                entry->ethtype = !(QED_MFW_GET_FIELD(p_tbl[i].entry,
-                                                     DCBX_APP_SF));
+                if (ieee) {
+                        u8 sf_ieee;
+                        u32 val;
+
+                        sf_ieee = QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                    DCBX_APP_SF_IEEE);
+                        switch (sf_ieee) {
+                        case DCBX_APP_SF_IEEE_RESERVED:
+                                /* Old MFW */
+                                val = QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                        DCBX_APP_SF);
+                                entry->sf_ieee = val ?
+                                    QED_DCBX_SF_IEEE_TCP_UDP_PORT :
+                                    QED_DCBX_SF_IEEE_ETHTYPE;
+                                break;
+                        case DCBX_APP_SF_IEEE_ETHTYPE:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_ETHTYPE;
+                                break;
+                        case DCBX_APP_SF_IEEE_TCP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_TCP_PORT;
+                                break;
+                        case DCBX_APP_SF_IEEE_UDP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_UDP_PORT;
+                                break;
+                        case DCBX_APP_SF_IEEE_TCP_UDP_PORT:
+                                entry->sf_ieee = QED_DCBX_SF_IEEE_TCP_UDP_PORT;
+                                break;
+                        }
+                } else {
+                        entry->ethtype = !(QED_MFW_GET_FIELD(p_tbl[i].entry,
+                                                             DCBX_APP_SF));
+                }
+
                 pri_map = QED_MFW_GET_FIELD(p_tbl[i].entry, DCBX_APP_PRI_MAP);
                 entry->prio = ffs(pri_map) - 1;
                 entry->proto_id = QED_MFW_GET_FIELD(p_tbl[i].entry,
                                                     DCBX_APP_PROTOCOL_ID);
                 qed_dcbx_get_app_protocol_type(p_hwfn, p_tbl[i].entry,
                                                entry->proto_id,
-                                               &entry->proto_type);
+                                               &entry->proto_type, ieee);
         }
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB,
@@ -483,7 +567,7 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
         bw_map[1] = be32_to_cpu(p_ets->tc_bw_tbl[1]);
         tsa_map[0] = be32_to_cpu(p_ets->tc_tsa_tbl[0]);
         tsa_map[1] = be32_to_cpu(p_ets->tc_tsa_tbl[1]);
-        pri_map = be32_to_cpu(p_ets->pri_tc_tbl[0]);
+        pri_map = p_ets->pri_tc_tbl[0];
         for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++) {
                 p_params->ets_tc_bw_tbl[i] = ((u8 *)bw_map)[i];
                 p_params->ets_tc_tsa_tbl[i] = ((u8 *)tsa_map)[i];
@@ -500,9 +584,9 @@ qed_dcbx_get_common_params(struct qed_hwfn *p_hwfn,
                            struct dcbx_app_priority_feature *p_app,
                            struct dcbx_app_priority_entry *p_tbl,
                            struct dcbx_ets_feature *p_ets,
-                           u32 pfc, struct qed_dcbx_params *p_params)
+                           u32 pfc, struct qed_dcbx_params *p_params, bool ieee)
 {
-        qed_dcbx_get_app_data(p_hwfn, p_app, p_tbl, p_params);
+        qed_dcbx_get_app_data(p_hwfn, p_app, p_tbl, p_params, ieee);
         qed_dcbx_get_ets_data(p_hwfn, p_ets, p_params);
         qed_dcbx_get_pfc_data(p_hwfn, pfc, p_params);
 }
@@ -516,7 +600,7 @@ qed_dcbx_get_local_params(struct qed_hwfn *p_hwfn,
         p_feat = &p_hwfn->p_dcbx_info->local_admin.features;
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->local.params);
+                                   p_feat->pfc, &params->local.params, false);
         params->local.valid = true;
 }
 
@@ -529,7 +613,7 @@ qed_dcbx_get_remote_params(struct qed_hwfn *p_hwfn,
         p_feat = &p_hwfn->p_dcbx_info->remote.features;
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->remote.params);
+                                   p_feat->pfc, &params->remote.params, false);
         params->remote.valid = true;
 }
 
@@ -574,7 +658,8 @@ qed_dcbx_get_operational_params(struct qed_hwfn *p_hwfn,
 
         qed_dcbx_get_common_params(p_hwfn, &p_feat->app,
                                    p_feat->app.app_pri_tbl, &p_feat->ets,
-                                   p_feat->pfc, &params->operational.params);
+                                   p_feat->pfc, &params->operational.params,
+                                   p_operational->ieee);
         qed_dcbx_get_priority_info(p_hwfn, &p_operational->app_prio, p_results);
         err = QED_MFW_GET_FIELD(p_feat->app.flags, DCBX_APP_ERROR);
         p_operational->err = err;
@@ -861,6 +946,9 @@ static int qed_dcbx_query_params(struct qed_hwfn *p_hwfn,
         struct qed_ptt *p_ptt;
         int rc;
 
+        if (IS_VF(p_hwfn->cdev))
+                return -EINVAL;
+
         p_ptt = qed_ptt_acquire(p_hwfn);
         if (!p_ptt)
                 return -EBUSY;
@@ -900,6 +988,7 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
                 if (p_params->pfc.prio[i])
                         pfc_map |= BIT(i);
 
+        *pfc &= ~DCBX_PFC_PRI_EN_BITMAP_MASK;
         *pfc |= (pfc_map << DCBX_PFC_PRI_EN_BITMAP_SHIFT);
 
         DP_VERBOSE(p_hwfn, QED_MSG_DCB, "pfc = 0x%x\n", *pfc);
@@ -944,7 +1033,6 @@ qed_dcbx_set_ets_data(struct qed_hwfn *p_hwfn,
                 val = (((u32)p_params->ets_pri_tc_tbl[i]) << ((7 - i) * 4));
                 p_ets->pri_tc_tbl[0] |= val;
         }
-        p_ets->pri_tc_tbl[0] = cpu_to_be32(p_ets->pri_tc_tbl[0]);
         for (i = 0; i < 2; i++) {
                 p_ets->tc_bw_tbl[i] = cpu_to_be32(p_ets->tc_bw_tbl[i]);
                 p_ets->tc_tsa_tbl[i] = cpu_to_be32(p_ets->tc_tsa_tbl[i]);
@@ -954,7 +1042,7 @@ qed_dcbx_set_ets_data(struct qed_hwfn *p_hwfn,
 static void
 qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
                       struct dcbx_app_priority_feature *p_app,
-                      struct qed_dcbx_params *p_params)
+                      struct qed_dcbx_params *p_params, bool ieee)
 {
         u32 *entry;
         int i;
@@ -975,12 +1063,45 @@ qed_dcbx_set_app_data(struct qed_hwfn *p_hwfn,
 
         for (i = 0; i < DCBX_MAX_APP_PROTOCOL; i++) {
                 entry = &p_app->app_pri_tbl[i].entry;
-                *entry &= ~DCBX_APP_SF_MASK;
-                if (p_params->app_entry[i].ethtype)
-                        *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
-                                   DCBX_APP_SF_SHIFT);
-                else
-                        *entry |= ((u32)DCBX_APP_SF_PORT << DCBX_APP_SF_SHIFT);
+                *entry = 0;
+                if (ieee) {
+                        *entry &= ~(DCBX_APP_SF_IEEE_MASK | DCBX_APP_SF_MASK);
+                        switch (p_params->app_entry[i].sf_ieee) {
+                        case QED_DCBX_SF_IEEE_ETHTYPE:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_ETHTYPE <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_TCP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_UDP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_UDP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        case QED_DCBX_SF_IEEE_TCP_UDP_PORT:
+                                *entry |= ((u32)DCBX_APP_SF_IEEE_TCP_UDP_PORT <<
+                                           DCBX_APP_SF_IEEE_SHIFT);
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                                break;
+                        }
+                } else {
+                        *entry &= ~DCBX_APP_SF_MASK;
+                        if (p_params->app_entry[i].ethtype)
+                                *entry |= ((u32)DCBX_APP_SF_ETHTYPE <<
+                                           DCBX_APP_SF_SHIFT);
+                        else
+                                *entry |= ((u32)DCBX_APP_SF_PORT <<
+                                           DCBX_APP_SF_SHIFT);
+                }
+
                 *entry &= ~DCBX_APP_PROTOCOL_ID_MASK;
                 *entry |= ((u32)p_params->app_entry[i].proto_id <<
                            DCBX_APP_PROTOCOL_ID_SHIFT);
@@ -995,15 +1116,19 @@ qed_dcbx_set_local_params(struct qed_hwfn *p_hwfn,
                           struct dcbx_local_params *local_admin,
                           struct qed_dcbx_set *params)
 {
+        bool ieee = false;
+
         local_admin->flags = 0;
         memcpy(&local_admin->features,
                &p_hwfn->p_dcbx_info->operational.features,
                sizeof(local_admin->features));
 
-        if (params->enabled)
+        if (params->enabled) {
                 local_admin->config = params->ver_num;
-        else
+                ieee = !!(params->ver_num & DCBX_CONFIG_VERSION_IEEE);
+        } else {
                 local_admin->config = DCBX_CONFIG_VERSION_DISABLED;
+        }
 
         if (params->override_flags & QED_DCBX_OVERRIDE_PFC_CFG)
                 qed_dcbx_set_pfc_data(p_hwfn, &local_admin->features.pfc,
@@ -1015,7 +1140,7 @@ qed_dcbx_set_local_params(struct qed_hwfn *p_hwfn,
 
         if (params->override_flags & QED_DCBX_OVERRIDE_APP_CFG)
                 qed_dcbx_set_app_data(p_hwfn, &local_admin->features.app,
-                                      &params->config.params);
+                                      &params->config.params, ieee);
 }
 
 int qed_dcbx_config_params(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
@@ -1064,7 +1189,7 @@ int qed_dcbx_get_config_params(struct qed_hwfn *p_hwfn,
                 return 0;
         }
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(p_hwfn, "Failed to allocate struct qed_dcbx_info\n");
                 return -ENOMEM;
@@ -1101,7 +1226,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
         struct qed_dcbx_get *dcbx_info;
 
-        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
         if (!dcbx_info) {
                 DP_ERR(hwfn->cdev, "Failed to allocate memory for dcbx_info\n");
                 return NULL;
@@ -1596,8 +1721,10 @@ static int qed_dcbnl_setapp(struct qed_dev *cdev,
                 if ((entry->ethtype == ethtype) && (entry->proto_id == idval))
                         break;
                 /* First empty slot */
-                if (!entry->proto_id)
+                if (!entry->proto_id) {
+                        dcbx_set.config.params.num_app_entries++;
                         break;
+                }
         }
 
         if (i == QED_DCBX_MAX_APP_PROTOCOL) {
@@ -2117,8 +2244,10 @@ int qed_dcbnl_ieee_setapp(struct qed_dev *cdev, struct dcb_app *app)
                     (entry->proto_id == app->protocol))
                         break;
                 /* First empty slot */
-                if (!entry->proto_id)
+                if (!entry->proto_id) {
+                        dcbx_set.config.params.num_app_entries++;
                         break;
+                }
         }
 
         if (i == QED_DCBX_MAX_APP_PROTOCOL) {
diff --git a/drivers/net/ethernet/qlogic/qed/qed_hsi.h b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
index 592784019994..6f9d3b831a2a 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
@@ -6850,6 +6850,14 @@ struct dcbx_app_priority_entry {
 #define DCBX_APP_SF_SHIFT               8
 #define DCBX_APP_SF_ETHTYPE             0
 #define DCBX_APP_SF_PORT                1
+#define DCBX_APP_SF_IEEE_MASK           0x0000f000
+#define DCBX_APP_SF_IEEE_SHIFT          12
+#define DCBX_APP_SF_IEEE_RESERVED       0
+#define DCBX_APP_SF_IEEE_ETHTYPE        1
+#define DCBX_APP_SF_IEEE_TCP_PORT       2
+#define DCBX_APP_SF_IEEE_UDP_PORT       3
+#define DCBX_APP_SF_IEEE_TCP_UDP_PORT   4
+
 #define DCBX_APP_PROTOCOL_ID_MASK       0xffff0000
 #define DCBX_APP_PROTOCOL_ID_SHIFT      16
 };
diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
index a240f26344a4..f776a77794c5 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
@@ -1153,8 +1153,8 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
         p_drv_version = &union_data.drv_version;
         p_drv_version->version = p_ver->version;
 
-        for (i = 0; i < MCP_DRV_VER_STR_SIZE - 1; i += 4) {
-                val = cpu_to_be32(p_ver->name[i]);
+        for (i = 0; i < (MCP_DRV_VER_STR_SIZE - 4) / sizeof(u32); i++) {
+                val = cpu_to_be32(*((u32 *)&p_ver->name[i * sizeof(u32)]));
                 *(__be32 *)&p_drv_version->name[i * sizeof(u32)] = val;
         }
 
diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c
index e4bd02e46e57..9544e4c41359 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -722,11 +722,14 @@ netdev_tx_t qede_start_xmit(struct sk_buff *skb,
         txq->tx_db.data.bd_prod =
                 cpu_to_le16(qed_chain_get_prod_idx(&txq->tx_pbl));
 
-        if (!skb->xmit_more || netif_tx_queue_stopped(netdev_txq))
+        if (!skb->xmit_more || netif_xmit_stopped(netdev_txq))
                 qede_update_tx_producer(txq);
 
         if (unlikely(qed_chain_get_elem_left(&txq->tx_pbl)
                       < (MAX_SKB_FRAGS + 1))) {
+                if (skb->xmit_more)
+                        qede_update_tx_producer(txq);
+
                 netif_tx_stop_queue(netdev_txq);
                 DP_VERBOSE(edev, NETIF_MSG_TX_QUEUED,
                            "Stop queue was called\n");
@@ -2517,7 +2520,8 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level,
         edev->ops->register_ops(cdev, &qede_ll_ops, edev);
 
 #ifdef CONFIG_DCB
-        qede_set_dcbnl_ops(edev->ndev);
+        if (!IS_VF(edev))
+                qede_set_dcbnl_ops(edev->ndev);
 #endif
 
         INIT_DELAYED_WORK(&edev->sp_task, qede_sp_task);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index fd973f4f16c7..49bad00a0f8f 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -37,8 +37,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 3
-#define _QLCNIC_LINUX_SUBVERSION 64
-#define QLCNIC_LINUX_VERSIONID  "5.3.64"
+#define _QLCNIC_LINUX_SUBVERSION 65
+#define QLCNIC_LINUX_VERSIONID  "5.3.65"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 87c642d3b075..fedd7366713c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -102,7 +102,6 @@
 #define QLCNIC_RESPONSE_DESC    0x05
 #define QLCNIC_LRO_DESC         0x12
 
-#define QLCNIC_TX_POLL_BUDGET           128
 #define QLCNIC_TCP_HDR_SIZE             20
 #define QLCNIC_TCP_TS_OPTION_SIZE       12
 #define QLCNIC_FETCH_RING_ID(handle)    ((handle) >> 63)
@@ -2008,7 +2007,6 @@ static int qlcnic_83xx_msix_tx_poll(struct napi_struct *napi, int budget)
         struct qlcnic_host_tx_ring *tx_ring;
         struct qlcnic_adapter *adapter;
 
-        budget = QLCNIC_TX_POLL_BUDGET;
         tx_ring = container_of(napi, struct qlcnic_host_tx_ring, napi);
         adapter = tx_ring->adapter;
         work_done = qlcnic_process_cmd_ring(adapter, tx_ring, budget);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
index 017d8c2c8285..24061b9b92e8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
@@ -156,10 +156,8 @@ struct qlcnic_vf_info {
         spinlock_t                      vlan_list_lock; /* Lock for VLAN list */
 };
 
-struct qlcnic_async_work_list {
+struct qlcnic_async_cmd {
         struct list_head        list;
-        struct work_struct      work;
-        void                    *ptr;
         struct qlcnic_cmd_args  *cmd;
 };
 
@@ -168,7 +166,10 @@ struct qlcnic_back_channel {
         struct workqueue_struct *bc_trans_wq;
         struct workqueue_struct *bc_async_wq;
         struct workqueue_struct *bc_flr_wq;
-        struct list_head        async_list;
+        struct qlcnic_adapter   *adapter;
+        struct list_head        async_cmd_list;
+        struct work_struct      vf_async_work;
+        spinlock_t              queue_lock; /* async_cmd_list queue lock */
 };
 
 struct qlcnic_sriov {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
index 7327b729ba2e..d7107055ec60 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
@@ -29,6 +29,7 @@
 #define QLC_83XX_VF_RESET_FAIL_THRESH   8
 #define QLC_BC_CMD_MAX_RETRY_CNT        5
 
+static void qlcnic_sriov_handle_async_issue_cmd(struct work_struct *work);
 static void qlcnic_sriov_vf_free_mac_list(struct qlcnic_adapter *);
 static int qlcnic_sriov_alloc_bc_mbx_args(struct qlcnic_cmd_args *, u32);
 static void qlcnic_sriov_vf_poll_dev_state(struct work_struct *);
@@ -177,7 +178,10 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs)
         }
 
         bc->bc_async_wq =  wq;
-        INIT_LIST_HEAD(&bc->async_list);
+        INIT_LIST_HEAD(&bc->async_cmd_list);
+        INIT_WORK(&bc->vf_async_work, qlcnic_sriov_handle_async_issue_cmd);
+        spin_lock_init(&bc->queue_lock);
+        bc->adapter = adapter;
 
         for (i = 0; i < num_vfs; i++) {
                 vf = &sriov->vf_info[i];
@@ -1517,17 +1521,21 @@ static void qlcnic_vf_add_mc_list(struct net_device *netdev, const u8 *mac,
 
 void qlcnic_sriov_cleanup_async_list(struct qlcnic_back_channel *bc)
 {
-        struct list_head *head = &bc->async_list;
-        struct qlcnic_async_work_list *entry;
+        struct list_head *head = &bc->async_cmd_list;
+        struct qlcnic_async_cmd *entry;
 
         flush_workqueue(bc->bc_async_wq);
+        cancel_work_sync(&bc->vf_async_work);
+
+        spin_lock(&bc->queue_lock);
         while (!list_empty(head)) {
-                entry = list_entry(head->next, struct qlcnic_async_work_list,
+                entry = list_entry(head->next, struct qlcnic_async_cmd,
                                    list);
-                cancel_work_sync(&entry->work);
                 list_del(&entry->list);
+                kfree(entry->cmd);
                 kfree(entry);
         }
+        spin_unlock(&bc->queue_lock);
 }
 
 void qlcnic_sriov_vf_set_multi(struct net_device *netdev)
@@ -1587,57 +1595,64 @@ void qlcnic_sriov_vf_set_multi(struct net_device *netdev)
 
 static void qlcnic_sriov_handle_async_issue_cmd(struct work_struct *work)
 {
-        struct qlcnic_async_work_list *entry;
-        struct qlcnic_adapter *adapter;
+        struct qlcnic_async_cmd *entry, *tmp;
+        struct qlcnic_back_channel *bc;
         struct qlcnic_cmd_args *cmd;
+        struct list_head *head;
+        LIST_HEAD(del_list);
+
+        bc = container_of(work, struct qlcnic_back_channel, vf_async_work);
+        head = &bc->async_cmd_list;
+
+        spin_lock(&bc->queue_lock);
+        list_splice_init(head, &del_list);
+        spin_unlock(&bc->queue_lock);
+
+        list_for_each_entry_safe(entry, tmp, &del_list, list) {
+                list_del(&entry->list);
+                cmd = entry->cmd;
+                __qlcnic_sriov_issue_cmd(bc->adapter, cmd);
+                kfree(entry);
+        }
+
+        if (!list_empty(head))
+                queue_work(bc->bc_async_wq, &bc->vf_async_work);
 
-        entry = container_of(work, struct qlcnic_async_work_list, work);
-        adapter = entry->ptr;
-        cmd = entry->cmd;
-        __qlcnic_sriov_issue_cmd(adapter, cmd);
         return;
 }
 
-static struct qlcnic_async_work_list *
-qlcnic_sriov_get_free_node_async_work(struct qlcnic_back_channel *bc)
+static struct qlcnic_async_cmd *
+qlcnic_sriov_alloc_async_cmd(struct qlcnic_back_channel *bc,
+                             struct qlcnic_cmd_args *cmd)
 {
-        struct list_head *node;
-        struct qlcnic_async_work_list *entry = NULL;
-        u8 empty = 0;
+        struct qlcnic_async_cmd *entry = NULL;
 
-        list_for_each(node, &bc->async_list) {
-                entry = list_entry(node, struct qlcnic_async_work_list, list);
-                if (!work_pending(&entry->work)) {
-                        empty = 1;
-                        break;
-                }
-        }
+        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
+        if (!entry)
+                return NULL;
 
-        if (!empty) {
-                entry = kzalloc(sizeof(struct qlcnic_async_work_list),
-                                GFP_ATOMIC);
-                if (entry == NULL)
-                        return NULL;
-                list_add_tail(&entry->list, &bc->async_list);
-        }
+        entry->cmd = cmd;
+
+        spin_lock(&bc->queue_lock);
+        list_add_tail(&entry->list, &bc->async_cmd_list);
+        spin_unlock(&bc->queue_lock);
 
         return entry;
 }
 
 static void qlcnic_sriov_schedule_async_cmd(struct qlcnic_back_channel *bc,
-                                            work_func_t func, void *data,
                                             struct qlcnic_cmd_args *cmd)
 {
-        struct qlcnic_async_work_list *entry = NULL;
+        struct qlcnic_async_cmd *entry = NULL;
 
-        entry = qlcnic_sriov_get_free_node_async_work(bc);
-        if (!entry)
+        entry = qlcnic_sriov_alloc_async_cmd(bc, cmd);
+        if (!entry) {
+                qlcnic_free_mbx_args(cmd);
+                kfree(cmd);
                 return;
+        }
 
-        entry->ptr = data;
-        entry->cmd = cmd;
-        INIT_WORK(&entry->work, func);
-        queue_work(bc->bc_async_wq, &entry->work);
+        queue_work(bc->bc_async_wq, &bc->vf_async_work);
 }
 
 static int qlcnic_sriov_async_issue_cmd(struct qlcnic_adapter *adapter,
@@ -1649,8 +1664,8 @@ static int qlcnic_sriov_async_issue_cmd(struct qlcnic_adapter *adapter,
         if (adapter->need_fw_reset)
                 return -EIO;
 
-        qlcnic_sriov_schedule_async_cmd(bc, qlcnic_sriov_handle_async_issue_cmd,
-                                        adapter, cmd);
+        qlcnic_sriov_schedule_async_cmd(bc, cmd);
+
         return 0;
 }
 
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index deae10d7426d..5297bf77211c 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -467,8 +467,8 @@ static int cp_rx_poll(struct napi_struct *napi, int budget)
         unsigned int rx_tail = cp->rx_tail;
         int rx;
 
-rx_status_loop:
         rx = 0;
+rx_status_loop:
         cpw16(IntrStatus, cp_rx_intr_mask);
 
         while (rx < budget) {
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 799d58d86e6d..054e795df90f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -201,9 +201,14 @@ static const u16 sh_eth_offset_fast_rz[SH_ETH_MAX_REGISTER_OFFSET] = {
 
         [ARSTR]         = 0x0000,
         [TSU_CTRST]     = 0x0004,
+        [TSU_FWSLC]     = 0x0038,
         [TSU_VTAG0]     = 0x0058,
         [TSU_ADSBSY]    = 0x0060,
         [TSU_TEN]       = 0x0064,
+        [TSU_POST1]     = 0x0070,
+        [TSU_POST2]     = 0x0074,
+        [TSU_POST3]     = 0x0078,
+        [TSU_POST4]     = 0x007c,
         [TSU_ADRH0]     = 0x0100,
 
         [TXNLCR0]       = 0x0080,
@@ -2786,6 +2791,8 @@ static void sh_eth_tsu_init(struct sh_eth_private *mdp)
 {
         if (sh_eth_is_rz_fast_ether(mdp)) {
                 sh_eth_tsu_write(mdp, 0, TSU_TEN); /* Disable all CAM entry */
+                sh_eth_tsu_write(mdp, TSU_FWSLC_POSTENU | TSU_FWSLC_POSTENL,
+                                 TSU_FWSLC);    /* Enable POST registers */
                 return;
         }
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index f658fee74f18..e00a669e9e09 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1517,13 +1517,14 @@ static void efx_ef10_get_stat_mask(struct efx_nic *efx, unsigned long *mask)
         }
 
 #if BITS_PER_LONG == 64
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2);
         mask[0] = raw_mask[0];
         mask[1] = raw_mask[1];
 #else
+        BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3);
         mask[0] = raw_mask[0] & 0xffffffff;
         mask[1] = raw_mask[0] >> 32;
         mask[2] = raw_mask[1] & 0xffffffff;
-        mask[3] = raw_mask[1] >> 32;
 #endif
 }
 
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 726b80f45906..503a3b6dce91 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -2275,6 +2275,13 @@ static int smc_drv_probe(struct platform_device *pdev)
         if (pd) {
                 memcpy(&lp->cfg, pd, sizeof(lp->cfg));
                 lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
+
+                if (!SMC_8BIT(lp) && !SMC_16BIT(lp)) {
+                        dev_err(&pdev->dev,
+                                "at least one of 8-bit or 16-bit access support is required.\n");
+                        ret = -ENXIO;
+                        goto out_free_netdev;
+                }
         }
 
 #if IS_BUILTIN(CONFIG_OF)
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 1a55c7976df0..ea8465467469 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -37,6 +37,27 @@
 #include <linux/smc91x.h>
 
 /*
+ * Any 16-bit access is performed with two 8-bit accesses if the hardware
+ * can't do it directly. Most registers are 16-bit so those are mandatory.
+ */
+#define SMC_outw_b(x, a, r)                                             \
+        do {                                                            \
+                unsigned int __val16 = (x);                             \
+                unsigned int __reg = (r);                               \
+                SMC_outb(__val16, a, __reg);                            \
+                SMC_outb(__val16 >> 8, a, __reg + (1 << SMC_IO_SHIFT)); \
+        } while (0)
+
+#define SMC_inw_b(a, r)                                                 \
+        ({                                                              \
+                unsigned int __val16;                                   \
+                unsigned int __reg = r;                                 \
+                __val16  = SMC_inb(a, __reg);                           \
+                __val16 |= SMC_inb(a, __reg + (1 << SMC_IO_SHIFT)) << 8; \
+                __val16;                                                \
+        })
+
+/*
  * Define your architecture specific bus configuration parameters here.
  */
 
@@ -55,10 +76,30 @@
 #define SMC_IO_SHIFT            (lp->io_shift)
 
 #define SMC_inb(a, r)           readb((a) + (r))
-#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inw(a, r)                                                   \
+        ({                                                              \
+                unsigned int __smc_r = r;                               \
+                SMC_16BIT(lp) ? readw((a) + __smc_r) :                  \
+                SMC_8BIT(lp) ? SMC_inw_b(a, __smc_r) :                  \
+                ({ BUG(); 0; });                                        \
+        })
+
 #define SMC_inl(a, r)           readl((a) + (r))
 #define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)                                               \
+        do {                                                            \
+                unsigned int __v = v, __smc_r = r;                      \
+                if (SMC_16BIT(lp))                                      \
+                        __SMC_outw(__v, a, __smc_r);                    \
+                else if (SMC_8BIT(lp))                                  \
+                        SMC_outw_b(__v, a, __smc_r);                    \
+                else                                                    \
+                        BUG();                                          \
+        } while (0)
+
 #define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insb(a, r, p, l)    readsb((a) + (r), p, l)
+#define SMC_outsb(a, r, p, l)   writesb((a) + (r), p, l)
 #define SMC_insw(a, r, p, l)    readsw((a) + (r), p, l)
 #define SMC_outsw(a, r, p, l)   writesw((a) + (r), p, l)
 #define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
@@ -66,7 +107,7 @@
 #define SMC_IRQ_FLAGS           (-1)    /* from resource */
 
 /* We actually can't write halfwords properly if not word aligned */
-static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
+static inline void __SMC_outw(u16 val, void __iomem *ioaddr, int reg)
 {
         if ((machine_is_mainstone() || machine_is_stargate2() ||
              machine_is_pxa_idp()) && reg & 2) {
@@ -416,24 +457,8 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 
 #if ! SMC_CAN_USE_16BIT
 
-/*
- * Any 16-bit access is performed with two 8-bit accesses if the hardware
- * can't do it directly. Most registers are 16-bit so those are mandatory.
- */
-#define SMC_outw(x, ioaddr, reg)                                        \
-        do {                                                            \
-                unsigned int __val16 = (x);                             \
-                SMC_outb( __val16, ioaddr, reg );                       \
-                SMC_outb( __val16 >> 8, ioaddr, reg + (1 << SMC_IO_SHIFT));\
-        } while (0)
-#define SMC_inw(ioaddr, reg)                                            \
-        ({                                                              \
-                unsigned int __val16;                                   \
-                __val16 =  SMC_inb( ioaddr, reg );                      \
-                __val16 |= SMC_inb( ioaddr, reg + (1 << SMC_IO_SHIFT)) << 8; \
-                __val16;                                                \
-        })
-
+#define SMC_outw(x, ioaddr, reg)        SMC_outw_b(x, ioaddr, reg)
+#define SMC_inw(ioaddr, reg)            SMC_inw_b(ioaddr, reg)
 #define SMC_insw(a, r, p, l)            BUG()
 #define SMC_outsw(a, r, p, l)           BUG()
 
@@ -445,7 +470,9 @@ smc_pxa_dma_insw(void __iomem *ioaddr, struct smc_local *lp, int reg, int dma,
 #endif
 
 #if ! SMC_CAN_USE_8BIT
+#undef SMC_inb
 #define SMC_inb(ioaddr, reg)            ({ BUG(); 0; })
+#undef SMC_outb
 #define SMC_outb(x, ioaddr, reg)        BUG()
 #define SMC_insb(a, r, p, l)            BUG()
 #define SMC_outsb(a, r, p, l)           BUG()
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index ca3134540d2d..4f8910b7db2e 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1099,15 +1099,8 @@ static int smsc911x_mii_init(struct platform_device *pdev,
                 goto err_out_free_bus_2;
         }
 
-        if (smsc911x_mii_probe(dev) < 0) {
-                SMSC_WARN(pdata, probe, "Error registering mii bus");
-                goto err_out_unregister_bus_3;
-        }
-
         return 0;
 
-err_out_unregister_bus_3:
-        mdiobus_unregister(pdata->mii_bus);
 err_out_free_bus_2:
         mdiobus_free(pdata->mii_bus);
 err_out_1:
@@ -1514,23 +1507,90 @@ static void smsc911x_disable_irq_chip(struct net_device *dev)
         smsc911x_reg_write(pdata, INT_STS, 0xFFFFFFFF);
 }
 
+static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
+{
+        struct net_device *dev = dev_id;
+        struct smsc911x_data *pdata = netdev_priv(dev);
+        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
+        u32 inten = smsc911x_reg_read(pdata, INT_EN);
+        int serviced = IRQ_NONE;
+        u32 temp;
+
+        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
+                temp = smsc911x_reg_read(pdata, INT_EN);
+                temp &= (~INT_EN_SW_INT_EN_);
+                smsc911x_reg_write(pdata, INT_EN, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
+                pdata->software_irq_signal = 1;
+                smp_wmb();
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
+                /* Called when there is a multicast update scheduled and
+                 * it is now safe to complete the update */
+                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
+                if (pdata->multicast_update_pending)
+                        smsc911x_rx_multicast_update_workaround(pdata);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (intsts & inten & INT_STS_TDFA_) {
+                temp = smsc911x_reg_read(pdata, FIFO_INT);
+                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
+                smsc911x_reg_write(pdata, FIFO_INT, temp);
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
+                netif_wake_queue(dev);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (unlikely(intsts & inten & INT_STS_RXE_)) {
+                SMSC_TRACE(pdata, intr, "RX Error interrupt");
+                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
+                serviced = IRQ_HANDLED;
+        }
+
+        if (likely(intsts & inten & INT_STS_RSFL_)) {
+                if (likely(napi_schedule_prep(&pdata->napi))) {
+                        /* Disable Rx interrupts */
+                        temp = smsc911x_reg_read(pdata, INT_EN);
+                        temp &= (~INT_EN_RSFL_EN_);
+                        smsc911x_reg_write(pdata, INT_EN, temp);
+                        /* Schedule a NAPI poll */
+                        __napi_schedule(&pdata->napi);
+                } else {
+                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
+                }
+                serviced = IRQ_HANDLED;
+        }
+
+        return serviced;
+}
+
 static int smsc911x_open(struct net_device *dev)
 {
         struct smsc911x_data *pdata = netdev_priv(dev);
         unsigned int timeout;
         unsigned int temp;
         unsigned int intcfg;
+        int retval;
+        int irq_flags;
 
-        /* if the phy is not yet registered, retry later*/
+        /* find and start the given phy */
         if (!dev->phydev) {
-                SMSC_WARN(pdata, hw, "phy_dev is NULL");
-                return -EAGAIN;
+                retval = smsc911x_mii_probe(dev);
+                if (retval < 0) {
+                        SMSC_WARN(pdata, probe, "Error starting phy");
+                        goto out;
+                }
         }
 
         /* Reset the LAN911x */
-        if (smsc911x_soft_reset(pdata)) {
+        retval = smsc911x_soft_reset(pdata);
+        if (retval) {
                 SMSC_WARN(pdata, hw, "soft reset failed");
-                return -EIO;
+                goto mii_free_out;
         }
 
         smsc911x_reg_write(pdata, HW_CFG, 0x00050000);
@@ -1586,6 +1646,15 @@ static int smsc911x_open(struct net_device *dev)
         pdata->software_irq_signal = 0;
         smp_wmb();
 
+        irq_flags = irq_get_trigger_type(dev->irq);
+        retval = request_irq(dev->irq, smsc911x_irqhandler,
+                             irq_flags | IRQF_SHARED, dev->name, dev);
+        if (retval) {
+                SMSC_WARN(pdata, probe,
+                          "Unable to claim requested irq: %d", dev->irq);
+                goto mii_free_out;
+        }
+
         temp = smsc911x_reg_read(pdata, INT_EN);
         temp |= INT_EN_SW_INT_EN_;
         smsc911x_reg_write(pdata, INT_EN, temp);
@@ -1600,7 +1669,8 @@ static int smsc911x_open(struct net_device *dev)
         if (!pdata->software_irq_signal) {
                 netdev_warn(dev, "ISR failed signaling test (IRQ %d)\n",
                             dev->irq);
-                return -ENODEV;
+                retval = -ENODEV;
+                goto irq_stop_out;
         }
         SMSC_TRACE(pdata, ifup, "IRQ handler passed test using IRQ %d",
                    dev->irq);
@@ -1646,6 +1716,14 @@ static int smsc911x_open(struct net_device *dev)
 
         netif_start_queue(dev);
         return 0;
+
+irq_stop_out:
+        free_irq(dev->irq, dev);
+mii_free_out:
+        phy_disconnect(dev->phydev);
+        dev->phydev = NULL;
+out:
+        return retval;
 }
 
 /* Entry point for stopping the interface */
@@ -1667,9 +1745,15 @@ static int smsc911x_stop(struct net_device *dev)
         dev->stats.rx_dropped += smsc911x_reg_read(pdata, RX_DROP);
         smsc911x_tx_update_txcounters(dev);
 
+        free_irq(dev->irq, dev);
+
         /* Bring the PHY down */
-        if (dev->phydev)
+        if (dev->phydev) {
                 phy_stop(dev->phydev);
+                phy_disconnect(dev->phydev);
+                dev->phydev = NULL;
+        }
+        netif_carrier_off(dev);
 
         SMSC_TRACE(pdata, ifdown, "Interface stopped");
         return 0;
@@ -1811,67 +1895,6 @@ static void smsc911x_set_multicast_list(struct net_device *dev)
         spin_unlock_irqrestore(&pdata->mac_lock, flags);
 }
 
-static irqreturn_t smsc911x_irqhandler(int irq, void *dev_id)
-{
-        struct net_device *dev = dev_id;
-        struct smsc911x_data *pdata = netdev_priv(dev);
-        u32 intsts = smsc911x_reg_read(pdata, INT_STS);
-        u32 inten = smsc911x_reg_read(pdata, INT_EN);
-        int serviced = IRQ_NONE;
-        u32 temp;
-
-        if (unlikely(intsts & inten & INT_STS_SW_INT_)) {
-                temp = smsc911x_reg_read(pdata, INT_EN);
-                temp &= (~INT_EN_SW_INT_EN_);
-                smsc911x_reg_write(pdata, INT_EN, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_SW_INT_);
-                pdata->software_irq_signal = 1;
-                smp_wmb();
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXSTOP_INT_)) {
-                /* Called when there is a multicast update scheduled and
-                 * it is now safe to complete the update */
-                SMSC_TRACE(pdata, intr, "RX Stop interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXSTOP_INT_);
-                if (pdata->multicast_update_pending)
-                        smsc911x_rx_multicast_update_workaround(pdata);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (intsts & inten & INT_STS_TDFA_) {
-                temp = smsc911x_reg_read(pdata, FIFO_INT);
-                temp |= FIFO_INT_TX_AVAIL_LEVEL_;
-                smsc911x_reg_write(pdata, FIFO_INT, temp);
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_TDFA_);
-                netif_wake_queue(dev);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (unlikely(intsts & inten & INT_STS_RXE_)) {
-                SMSC_TRACE(pdata, intr, "RX Error interrupt");
-                smsc911x_reg_write(pdata, INT_STS, INT_STS_RXE_);
-                serviced = IRQ_HANDLED;
-        }
-
-        if (likely(intsts & inten & INT_STS_RSFL_)) {
-                if (likely(napi_schedule_prep(&pdata->napi))) {
-                        /* Disable Rx interrupts */
-                        temp = smsc911x_reg_read(pdata, INT_EN);
-                        temp &= (~INT_EN_RSFL_EN_);
-                        smsc911x_reg_write(pdata, INT_EN, temp);
-                        /* Schedule a NAPI poll */
-                        __napi_schedule(&pdata->napi);
-                } else {
-                        SMSC_WARN(pdata, rx_err, "napi_schedule_prep failed");
-                }
-                serviced = IRQ_HANDLED;
-        }
-
-        return serviced;
-}
-
 #ifdef CONFIG_NET_POLL_CONTROLLER
 static void smsc911x_poll_controller(struct net_device *dev)
 {
@@ -2291,16 +2314,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
         pdata = netdev_priv(dev);
         BUG_ON(!pdata);
         BUG_ON(!pdata->ioaddr);
-        BUG_ON(!dev->phydev);
+        WARN_ON(dev->phydev);
 
         SMSC_TRACE(pdata, ifdown, "Stopping driver");
 
-        phy_disconnect(dev->phydev);
         mdiobus_unregister(pdata->mii_bus);
         mdiobus_free(pdata->mii_bus);
 
         unregister_netdev(dev);
-        free_irq(dev->irq, dev);
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
                                            "smsc911x-memory");
         if (!res)
@@ -2385,8 +2406,7 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         struct smsc911x_data *pdata;
         struct smsc911x_platform_config *config = dev_get_platdata(&pdev->dev);
         struct resource *res;
-        unsigned int intcfg = 0;
-        int res_size, irq, irq_flags;
+        int res_size, irq;
         int retval;
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -2425,7 +2445,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         pdata = netdev_priv(dev);
         dev->irq = irq;
-        irq_flags = irq_get_trigger_type(irq);
         pdata->ioaddr = ioremap_nocache(res->start, res_size);
 
         pdata->dev = dev;
@@ -2472,43 +2491,23 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
         if (retval < 0)
                 goto out_disable_resources;
 
-        /* configure irq polarity and type before connecting isr */
-        if (pdata->config.irq_polarity == SMSC911X_IRQ_POLARITY_ACTIVE_HIGH)
-                intcfg |= INT_CFG_IRQ_POL_;
-
-        if (pdata->config.irq_type == SMSC911X_IRQ_TYPE_PUSH_PULL)
-                intcfg |= INT_CFG_IRQ_TYPE_;
-
-        smsc911x_reg_write(pdata, INT_CFG, intcfg);
-
-        /* Ensure interrupts are globally disabled before connecting ISR */
-        smsc911x_disable_irq_chip(dev);
+        netif_carrier_off(dev);
 
-        retval = request_irq(dev->irq, smsc911x_irqhandler,
-                             irq_flags | IRQF_SHARED, dev->name, dev);
+        retval = smsc911x_mii_init(pdev, dev);
         if (retval) {
-                SMSC_WARN(pdata, probe,
-                          "Unable to claim requested irq: %d", dev->irq);
+                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
                 goto out_disable_resources;
         }
 
-        netif_carrier_off(dev);
-
         retval = register_netdev(dev);
         if (retval) {
                 SMSC_WARN(pdata, probe, "Error %i registering device", retval);
-                goto out_free_irq;
+                goto out_disable_resources;
         } else {
                 SMSC_TRACE(pdata, probe,
                            "Network interface: \"%s\"", dev->name);
         }
 
-        retval = smsc911x_mii_init(pdev, dev);
-        if (retval) {
-                SMSC_WARN(pdata, probe, "Error %i initialising mii", retval);
-                goto out_unregister_netdev_5;
-        }
-
         spin_lock_irq(&pdata->mac_lock);
 
         /* Check if mac address has been specified when bringing interface up */
@@ -2544,10 +2543,6 @@ static int smsc911x_drv_probe(struct platform_device *pdev)
 
         return 0;
 
-out_unregister_netdev_5:
-        unregister_netdev(dev);
-out_free_irq:
-        free_irq(dev->irq, dev);
 out_disable_resources:
         pm_runtime_put(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index cbefe9e2207c..885a5e64519d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -261,7 +261,7 @@ static void dwmac1000_pmt(struct mac_device_info *hw, unsigned long mode)
         }
         if (mode & WAKE_UCAST) {
                 pr_debug("GMAC: WOL on global unicast\n");
-                pmt |= global_unicast;
+                pmt |= power_down | global_unicast | wake_up_frame_en;
         }
 
         writel(pmt, ioaddr + GMAC_PMT);
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
index df5580dcdfed..51019b794be5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
@@ -102,7 +102,7 @@ static void dwmac4_pmt(struct mac_device_info *hw, unsigned long mode)
         }
         if (mode & WAKE_UCAST) {
                 pr_debug("GMAC: WOL on global unicast\n");
-                pmt |= global_unicast;
+                pmt |= power_down | global_unicast | wake_up_frame_en;
         }
 
         writel(pmt, ioaddr + GMAC_PMT);
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 9f159a775af3..4490ebaed127 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -1246,7 +1246,7 @@ static int dwceqos_mii_init(struct net_local *lp)
         lp->mii_bus->read  = &dwceqos_mdio_read;
         lp->mii_bus->write = &dwceqos_mdio_write;
         lp->mii_bus->priv = lp;
-        lp->mii_bus->parent = &lp->ndev->dev;
+        lp->mii_bus->parent = &lp->pdev->dev;
 
         of_address_to_resource(lp->pdev->dev.of_node, 0, &res);
         snprintf(lp->mii_bus->id, MII_BUS_ID_SIZE, "%.8llx",
@@ -1622,13 +1622,7 @@ static void dwceqos_init_hw(struct net_local *lp)
                 DWCEQOS_MMC_CTRL_RSTONRD);
         dwceqos_enable_mmc_interrupt(lp);
 
-        /* Enable Interrupts */
-        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
-                      DWCEQOS_DMA_CH0_IE_NIE |
-                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
-                      DWCEQOS_DMA_CH0_IE_AIE |
-                      DWCEQOS_DMA_CH0_IE_FBEE);
-
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE, 0);
         dwceqos_write(lp, REG_DWCEQOS_MAC_IE, 0);
 
         dwceqos_write(lp, REG_DWCEQOS_MAC_CFG, DWCEQOS_MAC_CFG_IPC |
@@ -1905,6 +1899,15 @@ static int dwceqos_open(struct net_device *ndev)
         netif_start_queue(ndev);
         tasklet_enable(&lp->tx_bdreclaim_tasklet);
 
+        /* Enable Interrupts -- do this only after we enable NAPI and the
+         * tasklet.
+         */
+        dwceqos_write(lp, REG_DWCEQOS_DMA_CH0_IE,
+                      DWCEQOS_DMA_CH0_IE_NIE |
+                      DWCEQOS_DMA_CH0_IE_RIE | DWCEQOS_DMA_CH0_IE_TIE |
+                      DWCEQOS_DMA_CH0_IE_AIE |
+                      DWCEQOS_DMA_CH0_IE_FBEE);
+
         return 0;
 }
 
@@ -2850,25 +2853,17 @@ static int dwceqos_probe(struct platform_device *pdev)
 
         ndev->features = ndev->hw_features;
 
-        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
-
-        ret = register_netdev(ndev);
-        if (ret) {
-                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
-                goto err_out_clk_dis_aper;
-        }
-
         lp->phy_ref_clk = devm_clk_get(&pdev->dev, "phy_ref_clk");
         if (IS_ERR(lp->phy_ref_clk)) {
                 dev_err(&pdev->dev, "phy_ref_clk clock not found.\n");
                 ret = PTR_ERR(lp->phy_ref_clk);
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         ret = clk_prepare_enable(lp->phy_ref_clk);
         if (ret) {
                 dev_err(&pdev->dev, "Unable to enable device clock.\n");
-                goto err_out_unregister_netdev;
+                goto err_out_clk_dis_aper;
         }
 
         lp->phy_node = of_parse_phandle(lp->pdev->dev.of_node,
@@ -2877,7 +2872,7 @@ static int dwceqos_probe(struct platform_device *pdev)
                 ret = of_phy_register_fixed_link(lp->pdev->dev.of_node);
                 if (ret < 0) {
                         dev_err(&pdev->dev, "invalid fixed-link");
-                        goto err_out_unregister_clk_notifier;
+                        goto err_out_clk_dis_phy;
                 }
 
                 lp->phy_node = of_node_get(lp->pdev->dev.of_node);
@@ -2886,7 +2881,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = of_get_phy_mode(lp->pdev->dev.of_node);
         if (ret < 0) {
                 dev_err(&lp->pdev->dev, "error in getting phy i/f\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         lp->phy_interface = ret;
@@ -2894,14 +2889,14 @@ static int dwceqos_probe(struct platform_device *pdev)
         ret = dwceqos_mii_init(lp);
         if (ret) {
                 dev_err(&lp->pdev->dev, "error in dwceqos_mii_init\n");
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         ret = dwceqos_mii_probe(ndev);
         if (ret != 0) {
                 netdev_err(ndev, "mii_probe fail.\n");
                 ret = -ENXIO;
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         dwceqos_set_umac_addr(lp, lp->ndev->dev_addr, 0);
@@ -2919,7 +2914,7 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to retrieve DT, error %d\n",
                         ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
         dev_info(&lp->pdev->dev, "pdev->id %d, baseaddr 0x%08lx, irq %d\n",
                  pdev->id, ndev->base_addr, ndev->irq);
@@ -2929,18 +2924,24 @@ static int dwceqos_probe(struct platform_device *pdev)
         if (ret) {
                 dev_err(&lp->pdev->dev, "Unable to request IRQ %d, error %d\n",
                         ndev->irq, ret);
-                goto err_out_unregister_clk_notifier;
+                goto err_out_clk_dis_phy;
         }
 
         if (netif_msg_probe(lp))
                 netdev_dbg(ndev, "net_local@%p\n", lp);
 
+        netif_napi_add(ndev, &lp->napi, dwceqos_rx_poll, NAPI_POLL_WEIGHT);
+
+        ret = register_netdev(ndev);
+        if (ret) {
+                dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
+                        goto err_out_clk_dis_phy;
+        }
+
         return 0;
 
-err_out_unregister_clk_notifier:
+err_out_clk_dis_phy:
         clk_disable_unprepare(lp->phy_ref_clk);
-err_out_unregister_netdev:
-        unregister_netdev(ndev);
 err_out_clk_dis_aper:
         clk_disable_unprepare(lp->apb_pclk);
 err_out_free_netdev:
diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c
index 7452b5f9d024..7108c68f16d3 100644
--- a/drivers/net/ethernet/tehuti/tehuti.c
+++ b/drivers/net/ethernet/tehuti/tehuti.c
@@ -1987,7 +1987,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if ((readl(nic->regs + FPGA_VER) & 0xFFF) >= 378) {
                 err = pci_enable_msi(pdev);
                 if (err)
-                        pr_err("Can't eneble msi. error is %d\n", err);
+                        pr_err("Can't enable msi. error is %d\n", err);
                 else
                         nic->irq_type = IRQ_MSI;
         } else
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index c51f34693eae..f85d605e4560 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -734,6 +734,7 @@ static void cpsw_rx_handler(void *token, int len, int status)
                 netif_receive_skb(skb);
                 ndev->stats.rx_bytes += len;
                 ndev->stats.rx_packets++;
+                kmemleak_not_leak(new_skb);
         } else {
                 ndev->stats.rx_dropped++;
                 new_skb = skb;
@@ -1325,6 +1326,7 @@ static int cpsw_ndo_open(struct net_device *ndev)
                                 kfree_skb(skb);
                                 goto err_cleanup;
                         }
+                        kmemleak_not_leak(skb);
                 }
                 /* continue even if we didn't manage to submit all
                  * receive descs
diff --git a/drivers/net/ethernet/tundra/tsi108_eth.c b/drivers/net/ethernet/tundra/tsi108_eth.c
index 01a77145a0fa..8fd131207ee1 100644
--- a/drivers/net/ethernet/tundra/tsi108_eth.c
+++ b/drivers/net/ethernet/tundra/tsi108_eth.c
@@ -166,6 +166,7 @@ static struct platform_driver tsi_eth_driver = {
 
 static void tsi108_timed_checker(unsigned long dev_ptr);
 
+#ifdef DEBUG
 static void dump_eth_one(struct net_device *dev)
 {
         struct tsi108_prv_data *data = netdev_priv(dev);
@@ -190,6 +191,7 @@ static void dump_eth_one(struct net_device *dev)
                TSI_READ(TSI108_EC_RXESTAT),
                TSI_READ(TSI108_EC_RXERR), data->rxpending);
 }
+#endif
 
 /* Synchronization is needed between the thread and up/down events.
  * Note that the PHY is accessed through the same registers for both
diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
index 3cee84a24815..93dc10b10c09 100644
--- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c
+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c
@@ -1131,11 +1131,13 @@ static int xemaclite_of_probe(struct platform_device *ofdev)
         lp->rx_ping_pong = get_bool(ofdev, "xlnx,rx-ping-pong");
         mac_address = of_get_mac_address(ofdev->dev.of_node);
 
-        if (mac_address)
+        if (mac_address) {
                 /* Set the MAC address. */
                 memcpy(ndev->dev_addr, mac_address, ETH_ALEN);
-        else
-                dev_warn(dev, "No MAC address found\n");
+        } else {
+                dev_warn(dev, "No MAC address found, using random\n");
+                eth_hw_addr_random(ndev);
+        }
 
         /* Clear the Tx CSR's in case this is a restart */
         __raw_writel(0, lp->base_addr + XEL_TSR_OFFSET);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 467fb8b4d083..591af71eae56 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -644,12 +644,6 @@ struct netvsc_reconfig {
         u32 event;
 };
 
-struct garp_wrk {
-        struct work_struct dwrk;
-        struct net_device *netdev;
-        struct netvsc_device *netvsc_dev;
-};
-
 /* The context of the netvsc device  */
 struct net_device_context {
         /* point back to our device context */
@@ -667,7 +661,6 @@ struct net_device_context {
 
         struct work_struct work;
         u32 msg_enable; /* debug level */
-        struct garp_wrk gwrk;
 
         struct netvsc_stats __percpu *tx_stats;
         struct netvsc_stats __percpu *rx_stats;
@@ -678,6 +671,15 @@ struct net_device_context {
 
         /* the device is going away */
         bool start_remove;
+
+        /* State to manage the associated VF interface. */
+        struct net_device *vf_netdev;
+        bool vf_inject;
+        atomic_t vf_use_cnt;
+        /* 1: allocated, serial number is valid. 0: not allocated */
+        u32 vf_alloc;
+        /* Serial number of the VF to team with */
+        u32 vf_serial;
 };
 
 /* Per netvsc device */
@@ -733,15 +735,7 @@ struct netvsc_device {
         u32 max_pkt; /* max number of pkt in one send, e.g. 8 */
         u32 pkt_align; /* alignment bytes, e.g. 8 */
 
-        /* 1: allocated, serial number is valid. 0: not allocated */
-        u32 vf_alloc;
-        /* Serial number of the VF to team with */
-        u32 vf_serial;
         atomic_t open_cnt;
-        /* State to manage the associated VF interface. */
-        bool vf_inject;
-        struct net_device *vf_netdev;
-        atomic_t vf_use_cnt;
 };
 
 static inline struct netvsc_device *
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 20e09174ff62..410fb8e81376 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -77,13 +77,9 @@ static struct netvsc_device *alloc_net_device(void)
         init_waitqueue_head(&net_device->wait_drain);
         net_device->destroy = false;
         atomic_set(&net_device->open_cnt, 0);
-        atomic_set(&net_device->vf_use_cnt, 0);
         net_device->max_pkt = RNDIS_MAX_PKT_DEFAULT;
         net_device->pkt_align = RNDIS_PKT_ALIGN_DEFAULT;
 
-        net_device->vf_netdev = NULL;
-        net_device->vf_inject = false;
-
         return net_device;
 }
 
@@ -1106,16 +1102,16 @@ static void netvsc_send_table(struct hv_device *hdev,
                 nvscdev->send_table[i] = tab[i];
 }
 
-static void netvsc_send_vf(struct netvsc_device *nvdev,
+static void netvsc_send_vf(struct net_device_context *net_device_ctx,
                            struct nvsp_message *nvmsg)
 {
-        nvdev->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
-        nvdev->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
+        net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated;
+        net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial;
 }
 
 static inline void netvsc_receive_inband(struct hv_device *hdev,
-                                         struct netvsc_device *nvdev,
-                                         struct nvsp_message *nvmsg)
+                                 struct net_device_context *net_device_ctx,
+                                 struct nvsp_message *nvmsg)
 {
         switch (nvmsg->hdr.msg_type) {
         case NVSP_MSG5_TYPE_SEND_INDIRECTION_TABLE:
@@ -1123,7 +1119,7 @@ static inline void netvsc_receive_inband(struct hv_device *hdev,
                 break;
 
         case NVSP_MSG4_TYPE_SEND_VF_ASSOCIATION:
-                netvsc_send_vf(nvdev, nvmsg);
+                netvsc_send_vf(net_device_ctx, nvmsg);
                 break;
         }
 }
@@ -1136,6 +1132,7 @@ static void netvsc_process_raw_pkt(struct hv_device *device,
                                    struct vmpacket_descriptor *desc)
 {
         struct nvsp_message *nvmsg;
+        struct net_device_context *net_device_ctx = netdev_priv(ndev);
 
         nvmsg = (struct nvsp_message *)((unsigned long)
                 desc + (desc->offset8 << 3));
@@ -1150,7 +1147,7 @@ static void netvsc_process_raw_pkt(struct hv_device *device,
                 break;
 
         case VM_PKT_DATA_INBAND:
-                netvsc_receive_inband(device, net_device, nvmsg);
+                netvsc_receive_inband(device, net_device_ctx, nvmsg);
                 break;
 
         default:
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 41bd952cc28d..3ba29fc80d05 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -658,20 +658,19 @@ int netvsc_recv_callback(struct hv_device *device_obj,
         struct sk_buff *skb;
         struct sk_buff *vf_skb;
         struct netvsc_stats *rx_stats;
-        struct netvsc_device *netvsc_dev = net_device_ctx->nvdev;
         u32 bytes_recvd = packet->total_data_buflen;
         int ret = 0;
 
         if (!net || net->reg_state != NETREG_REGISTERED)
                 return NVSP_STAT_FAIL;
 
-        if (READ_ONCE(netvsc_dev->vf_inject)) {
-                atomic_inc(&netvsc_dev->vf_use_cnt);
-                if (!READ_ONCE(netvsc_dev->vf_inject)) {
+        if (READ_ONCE(net_device_ctx->vf_inject)) {
+                atomic_inc(&net_device_ctx->vf_use_cnt);
+                if (!READ_ONCE(net_device_ctx->vf_inject)) {
                         /*
                          * We raced; just move on.
                          */
-                        atomic_dec(&netvsc_dev->vf_use_cnt);
+                        atomic_dec(&net_device_ctx->vf_use_cnt);
                         goto vf_injection_done;
                 }
 
@@ -683,17 +682,19 @@ int netvsc_recv_callback(struct hv_device *device_obj,
                  * the host). Deliver these via the VF interface
                  * in the guest.
                  */
-                vf_skb = netvsc_alloc_recv_skb(netvsc_dev->vf_netdev, packet,
-                                               csum_info, *data, vlan_tci);
+                vf_skb = netvsc_alloc_recv_skb(net_device_ctx->vf_netdev,
+                                               packet, csum_info, *data,
+                                               vlan_tci);
                 if (vf_skb != NULL) {
-                        ++netvsc_dev->vf_netdev->stats.rx_packets;
-                        netvsc_dev->vf_netdev->stats.rx_bytes += bytes_recvd;
+                        ++net_device_ctx->vf_netdev->stats.rx_packets;
+                        net_device_ctx->vf_netdev->stats.rx_bytes +=
+                                bytes_recvd;
                         netif_receive_skb(vf_skb);
                 } else {
                         ++net->stats.rx_dropped;
                         ret = NVSP_STAT_FAIL;
                 }
-                atomic_dec(&netvsc_dev->vf_use_cnt);
+                atomic_dec(&net_device_ctx->vf_use_cnt);
                 return ret;
         }
 
@@ -1150,17 +1151,6 @@ static void netvsc_free_netdev(struct net_device *netdev)
         free_netdev(netdev);
 }
 
-static void netvsc_notify_peers(struct work_struct *wrk)
-{
-        struct garp_wrk *gwrk;
-
-        gwrk = container_of(wrk, struct garp_wrk, dwrk);
-
-        netdev_notify_peers(gwrk->netdev);
-
-        atomic_dec(&gwrk->netvsc_dev->vf_use_cnt);
-}
-
 static struct net_device *get_netvsc_net_device(char *mac)
 {
         struct net_device *dev, *found = NULL;
@@ -1203,7 +1193,7 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
 
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
-        if (netvsc_dev == NULL)
+        if (!netvsc_dev || net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF registering: %s\n", vf_netdev->name);
@@ -1211,10 +1201,23 @@ static int netvsc_register_vf(struct net_device *vf_netdev)
          * Take a reference on the module.
          */
         try_module_get(THIS_MODULE);
-        netvsc_dev->vf_netdev = vf_netdev;
+        net_device_ctx->vf_netdev = vf_netdev;
         return NOTIFY_OK;
 }
 
+static void netvsc_inject_enable(struct net_device_context *net_device_ctx)
+{
+        net_device_ctx->vf_inject = true;
+}
+
+static void netvsc_inject_disable(struct net_device_context *net_device_ctx)
+{
+        net_device_ctx->vf_inject = false;
+
+        /* Wait for currently active users to drain out. */
+        while (atomic_read(&net_device_ctx->vf_use_cnt) != 0)
+                udelay(50);
+}
 
 static int netvsc_vf_up(struct net_device *vf_netdev)
 {
@@ -1233,11 +1236,11 @@ static int netvsc_vf_up(struct net_device *vf_netdev)
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
 
-        if ((netvsc_dev == NULL) || (netvsc_dev->vf_netdev == NULL))
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF up: %s\n", vf_netdev->name);
-        netvsc_dev->vf_inject = true;
+        netvsc_inject_enable(net_device_ctx);
 
         /*
          * Open the device before switching data path.
@@ -1252,15 +1255,8 @@ static int netvsc_vf_up(struct net_device *vf_netdev)
 
         netif_carrier_off(ndev);
 
-        /*
-         * Now notify peers. We are scheduling work to
-         * notify peers; take a reference to prevent
-         * the VF interface from vanishing.
-         */
-        atomic_inc(&netvsc_dev->vf_use_cnt);
-        net_device_ctx->gwrk.netdev = vf_netdev;
-        net_device_ctx->gwrk.netvsc_dev = netvsc_dev;
-        schedule_work(&net_device_ctx->gwrk.dwrk);
+        /* Now notify peers through VF device. */
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, vf_netdev);
 
         return NOTIFY_OK;
 }
@@ -1283,29 +1279,18 @@ static int netvsc_vf_down(struct net_device *vf_netdev)
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
 
-        if ((netvsc_dev == NULL) || (netvsc_dev->vf_netdev == NULL))
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
 
         netdev_info(ndev, "VF down: %s\n", vf_netdev->name);
-        netvsc_dev->vf_inject = false;
-        /*
-         * Wait for currently active users to
-         * drain out.
-         */
-
-        while (atomic_read(&netvsc_dev->vf_use_cnt) != 0)
-                udelay(50);
+        netvsc_inject_disable(net_device_ctx);
         netvsc_switch_datapath(ndev, false);
         netdev_info(ndev, "Data path switched from VF: %s\n", vf_netdev->name);
         rndis_filter_close(netvsc_dev);
         netif_carrier_on(ndev);
-        /*
-         * Notify peers.
-         */
-        atomic_inc(&netvsc_dev->vf_use_cnt);
-        net_device_ctx->gwrk.netdev = ndev;
-        net_device_ctx->gwrk.netvsc_dev = netvsc_dev;
-        schedule_work(&net_device_ctx->gwrk.dwrk);
+
+        /* Now notify peers through netvsc device. */
+        call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, ndev);
 
         return NOTIFY_OK;
 }
@@ -1327,11 +1312,11 @@ static int netvsc_unregister_vf(struct net_device *vf_netdev)
 
         net_device_ctx = netdev_priv(ndev);
         netvsc_dev = net_device_ctx->nvdev;
-        if (netvsc_dev == NULL)
+        if (!netvsc_dev || !net_device_ctx->vf_netdev)
                 return NOTIFY_DONE;
         netdev_info(ndev, "VF unregistering: %s\n", vf_netdev->name);
-
-        netvsc_dev->vf_netdev = NULL;
+        netvsc_inject_disable(net_device_ctx);
+        net_device_ctx->vf_netdev = NULL;
         module_put(THIS_MODULE);
         return NOTIFY_OK;
 }
@@ -1377,11 +1362,14 @@ static int netvsc_probe(struct hv_device *dev,
 
         INIT_DELAYED_WORK(&net_device_ctx->dwork, netvsc_link_change);
         INIT_WORK(&net_device_ctx->work, do_set_multicast);
-        INIT_WORK(&net_device_ctx->gwrk.dwrk, netvsc_notify_peers);
 
         spin_lock_init(&net_device_ctx->lock);
         INIT_LIST_HEAD(&net_device_ctx->reconfig_events);
 
+        atomic_set(&net_device_ctx->vf_use_cnt, 0);
+        net_device_ctx->vf_netdev = NULL;
+        net_device_ctx->vf_inject = false;
+
         net->netdev_ops = &device_ops;
 
         net->hw_features = NETVSC_HW_FEATURES;
@@ -1494,8 +1482,13 @@ static int netvsc_netdev_event(struct notifier_block *this,
 {
         struct net_device *event_dev = netdev_notifier_info_to_dev(ptr);
 
-        /* Avoid Vlan, Bonding dev with same MAC registering as VF */
-        if (event_dev->priv_flags & (IFF_802_1Q_VLAN | IFF_BONDING))
+        /* Avoid Vlan dev with same MAC registering as VF */
+        if (event_dev->priv_flags & IFF_802_1Q_VLAN)
+                return NOTIFY_DONE;
+
+        /* Avoid Bonding master dev with same MAC registering as VF */
+        if (event_dev->priv_flags & IFF_BONDING &&
+            event_dev->flags & IFF_MASTER)
                 return NOTIFY_DONE;
 
         switch (event) {
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index d13e6e15d7b5..351e701eb043 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -270,6 +270,7 @@ struct macsec_dev {
         struct pcpu_secy_stats __percpu *stats;
         struct list_head secys;
         struct gro_cells gro_cells;
+        unsigned int nest_level;
 };
 
 /**
@@ -2699,6 +2700,8 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,
 
 #define MACSEC_FEATURES \
         (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST)
+static struct lock_class_key macsec_netdev_addr_lock_key;
+
 static int macsec_dev_init(struct net_device *dev)
 {
         struct macsec_dev *macsec = macsec_priv(dev);
@@ -2910,6 +2913,13 @@ static int macsec_get_iflink(const struct net_device *dev)
         return macsec_priv(dev)->real_dev->ifindex;
 }
 
+
+static int macsec_get_nest_level(struct net_device *dev)
+{
+        return macsec_priv(dev)->nest_level;
+}
+
+
 static const struct net_device_ops macsec_netdev_ops = {
         .ndo_init               = macsec_dev_init,
         .ndo_uninit             = macsec_dev_uninit,
@@ -2923,6 +2933,7 @@ static const struct net_device_ops macsec_netdev_ops = {
         .ndo_start_xmit         = macsec_start_xmit,
         .ndo_get_stats64        = macsec_get_stats64,
         .ndo_get_iflink         = macsec_get_iflink,
+        .ndo_get_lock_subclass  = macsec_get_nest_level,
 };
 
 static const struct device_type macsec_type = {
@@ -3047,22 +3058,31 @@ static void macsec_del_dev(struct macsec_dev *macsec)
         }
 }
 
+static void macsec_common_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct macsec_dev *macsec = macsec_priv(dev);
+        struct net_device *real_dev = macsec->real_dev;
+
+        unregister_netdevice_queue(dev, head);
+        list_del_rcu(&macsec->secys);
+        macsec_del_dev(macsec);
+        netdev_upper_dev_unlink(real_dev, dev);
+
+        macsec_generation++;
+}
+
 static void macsec_dellink(struct net_device *dev, struct list_head *head)
 {
         struct macsec_dev *macsec = macsec_priv(dev);
         struct net_device *real_dev = macsec->real_dev;
         struct macsec_rxh_data *rxd = macsec_data_rtnl(real_dev);
 
-        macsec_generation++;
+        macsec_common_dellink(dev, head);
 
-        unregister_netdevice_queue(dev, head);
-        list_del_rcu(&macsec->secys);
         if (list_empty(&rxd->secys)) {
                 netdev_rx_handler_unregister(real_dev);
                 kfree(rxd);
         }
-
-        macsec_del_dev(macsec);
 }
 
 static int register_macsec_dev(struct net_device *real_dev,
@@ -3181,6 +3201,16 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
         dev_hold(real_dev);
 
+        macsec->nest_level = dev_get_nest_level(real_dev) + 1;
+        netdev_lockdep_set_classes(dev);
+        lockdep_set_class_and_subclass(&dev->addr_list_lock,
+                                       &macsec_netdev_addr_lock_key,
+                                       macsec_get_nest_level(dev));
+
+        err = netdev_upper_dev_link(real_dev, dev);
+        if (err < 0)
+                goto unregister;
+
         /* need to be already registered so that ->init has run and
          * the MAC addr is set
          */
@@ -3193,12 +3223,12 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
         if (rx_handler && sci_exists(real_dev, sci)) {
                 err = -EBUSY;
-                goto unregister;
+                goto unlink;
         }
 
         err = macsec_add_dev(dev, sci, icv_len);
         if (err)
-                goto unregister;
+                goto unlink;
 
         if (data)
                 macsec_changelink_common(dev, data);
@@ -3213,6 +3243,8 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
 
 del_dev:
         macsec_del_dev(macsec);
+unlink:
+        netdev_upper_dev_unlink(real_dev, dev);
 unregister:
         unregister_netdevice(dev);
         return err;
@@ -3382,8 +3414,12 @@ static int macsec_notify(struct notifier_block *this, unsigned long event,
 
                 rxd = macsec_data_rtnl(real_dev);
                 list_for_each_entry_safe(m, n, &rxd->secys, secys) {
-                        macsec_dellink(m->secy.netdev, &head);
+                        macsec_common_dellink(m->secy.netdev, &head);
                 }
+
+                netdev_rx_handler_unregister(real_dev);
+                kfree(rxd);
+
                 unregister_netdevice_many(&head);
                 break;
         }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index cd9b53834bf6..3234fcdea317 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1315,7 +1315,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
         vlan->dev      = dev;
         vlan->port     = port;
         vlan->set_features = MACVLAN_FEATURES;
-        vlan->nest_level = dev_get_nest_level(lowerdev, netif_is_macvlan) + 1;
+        vlan->nest_level = dev_get_nest_level(lowerdev) + 1;
 
         vlan->mode     = MACVLAN_MODE_VEPA;
         if (data && data[IFLA_MACVLAN_MODE])
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index a38c0dac514b..070e3290aa6e 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
         rtnl_unlock();
 
         synchronize_rcu();
-        skb_array_cleanup(&q->skb_array);
         sock_put(&q->sk);
 }
 
@@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
 static void macvtap_sock_destruct(struct sock *sk)
 {
         struct macvtap_queue *q = container_of(sk, struct macvtap_queue, sk);
-        struct sk_buff *skb;
 
-        while ((skb = skb_array_consume(&q->skb_array)) != NULL)
-                kfree_skb(skb);
+        skb_array_cleanup(&q->skb_array);
 }
 
 static int macvtap_open(struct inode *inode, struct file *file)
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 47a64342cc16..b4863e4e522b 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -303,6 +303,7 @@ config MDIO_HISI_FEMAC
 
 config MDIO_XGENE
         tristate "APM X-Gene SoC MDIO bus controller"
+        depends on ARCH_XGENE || COMPILE_TEST
         help
           This module provides a driver for the MDIO busses found in the
           APM X-Gene SoC's.
diff --git a/drivers/net/phy/mdio-xgene.c b/drivers/net/phy/mdio-xgene.c
index 775674808249..92af182951be 100644
--- a/drivers/net/phy/mdio-xgene.c
+++ b/drivers/net/phy/mdio-xgene.c
@@ -424,10 +424,8 @@ static int xgene_mdio_remove(struct platform_device *pdev)
         mdiobus_unregister(mdio_bus);
         mdiobus_free(mdio_bus);
 
-        if (dev->of_node) {
-                if (IS_ERR(pdata->clk))
-                        clk_disable_unprepare(pdata->clk);
-        }
+        if (dev->of_node)
+                clk_disable_unprepare(pdata->clk);
 
         return 0;
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 1882d9828c99..885ac9cbab5a 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -677,17 +677,28 @@ static void kszphy_get_stats(struct phy_device *phydev,
                 data[i] = kszphy_get_stat(phydev, i);
 }
 
-static int kszphy_resume(struct phy_device *phydev)
+static int kszphy_suspend(struct phy_device *phydev)
 {
-        int value;
+        /* Disable PHY Interrupts */
+        if (phy_interrupt_is_valid(phydev)) {
+                phydev->interrupts = PHY_INTERRUPT_DISABLED;
+                if (phydev->drv->config_intr)
+                        phydev->drv->config_intr(phydev);
+        }
 
-        mutex_lock(&phydev->lock);
+        return genphy_suspend(phydev);
+}
 
-        value = phy_read(phydev, MII_BMCR);
-        phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN);
+static int kszphy_resume(struct phy_device *phydev)
+{
+        genphy_resume(phydev);
 
-        kszphy_config_intr(phydev);
-        mutex_unlock(&phydev->lock);
+        /* Enable PHY Interrupts */
+        if (phy_interrupt_is_valid(phydev)) {
+                phydev->interrupts = PHY_INTERRUPT_ENABLED;
+                if (phydev->drv->config_intr)
+                        phydev->drv->config_intr(phydev);
+        }
 
         return 0;
 }
@@ -900,7 +911,7 @@ static struct phy_driver ksphy_driver[] = {
         .get_sset_count = kszphy_get_sset_count,
         .get_strings    = kszphy_get_strings,
         .get_stats      = kszphy_get_stats,
-        .suspend        = genphy_suspend,
+        .suspend        = kszphy_suspend,
         .resume         = kszphy_resume,
 }, {
         .phy_id         = PHY_ID_KSZ8061,
@@ -953,7 +964,7 @@ static struct phy_driver ksphy_driver[] = {
         .get_strings    = kszphy_get_strings,
         .get_stats      = kszphy_get_stats,
         .suspend        = genphy_suspend,
-        .resume         = genphy_resume,
+        .resume         = kszphy_resume,
 }, {
         .phy_id         = PHY_ID_KSZ8873MLL,
         .phy_id_mask    = MICREL_PHY_ID_MASK,
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index c5dc2c363f96..c6f66832a1a6 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -722,8 +722,10 @@ phy_err:
 int phy_start_interrupts(struct phy_device *phydev)
 {
         atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
-                        phydev) < 0) {
+        if (request_irq(phydev->irq, phy_interrupt,
+                                IRQF_SHARED,
+                                "phy_interrupt",
+                                phydev) < 0) {
                 pr_warn("%s: Can't get IRQ %d (PHY)\n",
                         phydev->mdio.bus->name, phydev->irq);
                 phydev->irq = PHY_POLL;
diff --git a/drivers/net/team/team_mode_loadbalance.c b/drivers/net/team/team_mode_loadbalance.c
index cdb19b385d42..b228bea7931f 100644
--- a/drivers/net/team/team_mode_loadbalance.c
+++ b/drivers/net/team/team_mode_loadbalance.c
@@ -14,9 +14,23 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/filter.h>
 #include <linux/if_team.h>
 
+static rx_handler_result_t lb_receive(struct team *team, struct team_port *port,
+                                      struct sk_buff *skb)
+{
+        if (unlikely(skb->protocol == htons(ETH_P_SLOW))) {
+                /* LACPDU packets should go to exact delivery */
+                const unsigned char *dest = eth_hdr(skb)->h_dest;
+
+                if (is_link_local_ether_addr(dest) && dest[5] == 0x02)
+                        return RX_HANDLER_EXACT;
+        }
+        return RX_HANDLER_ANOTHER;
+}
+
 struct lb_priv;
 
 typedef struct team_port *lb_select_tx_port_func_t(struct team *,
@@ -652,6 +666,7 @@ static const struct team_mode_ops lb_mode_ops = {
         .port_enter             = lb_port_enter,
         .port_leave             = lb_port_leave,
         .port_disabled          = lb_port_disabled,
+        .receive                = lb_receive,
         .transmit               = lb_transmit,
 };
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 9c8b5bc2b9d8..6f9df375c5d4 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -894,11 +894,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
         if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
                 goto drop;
 
-        if (skb->sk && sk_fullsock(skb->sk)) {
-                sock_tx_timestamp(skb->sk, skb->sk->sk_tsflags,
-                                  &skb_shinfo(skb)->tx_flags);
-                sw_tx_timestamp(skb);
-        }
+        skb_tx_timestamp(skb);
 
         /* Orphan the skb - required as we might hang on to it
          * for indefinite time.
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 770212baaf05..528b9c9c4e60 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -1009,6 +1009,7 @@ static int kaweth_probe(
         struct net_device *netdev;
         const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
         int result = 0;
+        int rv = -EIO;
 
         dev_dbg(dev,
                 "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -1029,6 +1030,7 @@ static int kaweth_probe(
         kaweth = netdev_priv(netdev);
         kaweth->dev = udev;
         kaweth->net = netdev;
+        kaweth->intf = intf;
 
         spin_lock_init(&kaweth->device_lock);
         init_waitqueue_head(&kaweth->term_wait);
@@ -1048,6 +1050,10 @@ static int kaweth_probe(
                 /* Download the firmware */
                 dev_info(dev, "Downloading firmware...\n");
                 kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL);
+                if (!kaweth->firmware_buf) {
+                        rv = -ENOMEM;
+                        goto err_free_netdev;
+                }
                 if ((result = kaweth_download_firmware(kaweth,
                                                       "kaweth/new_code.bin",
                                                       100,
@@ -1139,8 +1145,6 @@ err_fw:
 
         dev_dbg(dev, "Initializing net device.\n");
 
-        kaweth->intf = intf;
-
         kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!kaweth->tx_urb)
                 goto err_free_netdev;
@@ -1204,7 +1208,7 @@ err_only_tx:
 err_free_netdev:
         free_netdev(netdev);
 
-        return -EIO;
+        return rv;
 }
 
 /****************************************************************
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index f41a8ad4740e..c254248863d4 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -32,7 +32,7 @@
 #define NETNEXT_VERSION         "08"
 
 /* Information for net */
-#define NET_VERSION             "5"
+#define NET_VERSION             "6"
 
 #define DRIVER_VERSION          "v1." NETNEXT_VERSION "." NET_VERSION
 #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
@@ -2552,6 +2552,77 @@ static void r8152_aldps_en(struct r8152 *tp, bool enable)
         }
 }
 
+static inline void r8152_mmd_indirect(struct r8152 *tp, u16 dev, u16 reg)
+{
+        ocp_reg_write(tp, OCP_EEE_AR, FUN_ADDR | dev);
+        ocp_reg_write(tp, OCP_EEE_DATA, reg);
+        ocp_reg_write(tp, OCP_EEE_AR, FUN_DATA | dev);
+}
+
+static u16 r8152_mmd_read(struct r8152 *tp, u16 dev, u16 reg)
+{
+        u16 data;
+
+        r8152_mmd_indirect(tp, dev, reg);
+        data = ocp_reg_read(tp, OCP_EEE_DATA);
+        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
+
+        return data;
+}
+
+static void r8152_mmd_write(struct r8152 *tp, u16 dev, u16 reg, u16 data)
+{
+        r8152_mmd_indirect(tp, dev, reg);
+        ocp_reg_write(tp, OCP_EEE_DATA, data);
+        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
+}
+
+static void r8152_eee_en(struct r8152 *tp, bool enable)
+{
+        u16 config1, config2, config3;
+        u32 ocp_data;
+
+        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
+        config1 = ocp_reg_read(tp, OCP_EEE_CONFIG1) & ~sd_rise_time_mask;
+        config2 = ocp_reg_read(tp, OCP_EEE_CONFIG2);
+        config3 = ocp_reg_read(tp, OCP_EEE_CONFIG3) & ~fast_snr_mask;
+
+        if (enable) {
+                ocp_data |= EEE_RX_EN | EEE_TX_EN;
+                config1 |= EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN | RX_QUIET_EN;
+                config1 |= sd_rise_time(1);
+                config2 |= RG_DACQUIET_EN | RG_LDVQUIET_EN;
+                config3 |= fast_snr(42);
+        } else {
+                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
+                config1 &= ~(EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN |
+                             RX_QUIET_EN);
+                config1 |= sd_rise_time(7);
+                config2 &= ~(RG_DACQUIET_EN | RG_LDVQUIET_EN);
+                config3 |= fast_snr(511);
+        }
+
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
+        ocp_reg_write(tp, OCP_EEE_CONFIG1, config1);
+        ocp_reg_write(tp, OCP_EEE_CONFIG2, config2);
+        ocp_reg_write(tp, OCP_EEE_CONFIG3, config3);
+}
+
+static void r8152b_enable_eee(struct r8152 *tp)
+{
+        r8152_eee_en(tp, true);
+        r8152_mmd_write(tp, MDIO_MMD_AN, MDIO_AN_EEE_ADV, MDIO_EEE_100TX);
+}
+
+static void r8152b_enable_fc(struct r8152 *tp)
+{
+        u16 anar;
+
+        anar = r8152_mdio_read(tp, MII_ADVERTISE);
+        anar |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
+        r8152_mdio_write(tp, MII_ADVERTISE, anar);
+}
+
 static void rtl8152_disable(struct r8152 *tp)
 {
         r8152_aldps_en(tp, false);
@@ -2561,13 +2632,9 @@ static void rtl8152_disable(struct r8152 *tp)
 
 static void r8152b_hw_phy_cfg(struct r8152 *tp)
 {
-        u16 data;
-
-        data = r8152_mdio_read(tp, MII_BMCR);
-        if (data & BMCR_PDOWN) {
-                data &= ~BMCR_PDOWN;
-                r8152_mdio_write(tp, MII_BMCR, data);
-        }
+        r8152b_enable_eee(tp);
+        r8152_aldps_en(tp, true);
+        r8152b_enable_fc(tp);
 
         set_bit(PHY_RESET, &tp->flags);
 }
@@ -2701,20 +2768,52 @@ static void r8152b_enter_oob(struct r8152 *tp)
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
 }
 
+static void r8153_aldps_en(struct r8152 *tp, bool enable)
+{
+        u16 data;
+
+        data = ocp_reg_read(tp, OCP_POWER_CFG);
+        if (enable) {
+                data |= EN_ALDPS;
+                ocp_reg_write(tp, OCP_POWER_CFG, data);
+        } else {
+                data &= ~EN_ALDPS;
+                ocp_reg_write(tp, OCP_POWER_CFG, data);
+                msleep(20);
+        }
+}
+
+static void r8153_eee_en(struct r8152 *tp, bool enable)
+{
+        u32 ocp_data;
+        u16 config;
+
+        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
+        config = ocp_reg_read(tp, OCP_EEE_CFG);
+
+        if (enable) {
+                ocp_data |= EEE_RX_EN | EEE_TX_EN;
+                config |= EEE10_EN;
+        } else {
+                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
+                config &= ~EEE10_EN;
+        }
+
+        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
+        ocp_reg_write(tp, OCP_EEE_CFG, config);
+}
+
 static void r8153_hw_phy_cfg(struct r8152 *tp)
 {
         u32 ocp_data;
         u16 data;
 
-        if (tp->version == RTL_VER_03 || tp->version == RTL_VER_04 ||
-            tp->version == RTL_VER_05)
-                ocp_reg_write(tp, OCP_ADC_CFG, CKADSEL_L | ADC_EN | EN_EMI_L);
+        /* disable ALDPS before updating the PHY parameters */
+        r8153_aldps_en(tp, false);
 
-        data = r8152_mdio_read(tp, MII_BMCR);
-        if (data & BMCR_PDOWN) {
-                data &= ~BMCR_PDOWN;
-                r8152_mdio_write(tp, MII_BMCR, data);
-        }
+        /* disable EEE before updating the PHY parameters */
+        r8153_eee_en(tp, false);
+        ocp_reg_write(tp, OCP_EEE_ADV, 0);
 
         if (tp->version == RTL_VER_03) {
                 data = ocp_reg_read(tp, OCP_EEE_CFG);
@@ -2745,6 +2844,12 @@ static void r8153_hw_phy_cfg(struct r8152 *tp)
         sram_write(tp, SRAM_10M_AMP1, 0x00af);
         sram_write(tp, SRAM_10M_AMP2, 0x0208);
 
+        r8153_eee_en(tp, true);
+        ocp_reg_write(tp, OCP_EEE_ADV, MDIO_EEE_1000T | MDIO_EEE_100TX);
+
+        r8153_aldps_en(tp, true);
+        r8152b_enable_fc(tp);
+
         set_bit(PHY_RESET, &tp->flags);
 }
 
@@ -2866,21 +2971,6 @@ static void r8153_enter_oob(struct r8152 *tp)
         ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
 }
 
-static void r8153_aldps_en(struct r8152 *tp, bool enable)
-{
-        u16 data;
-
-        data = ocp_reg_read(tp, OCP_POWER_CFG);
-        if (enable) {
-                data |= EN_ALDPS;
-                ocp_reg_write(tp, OCP_POWER_CFG, data);
-        } else {
-                data &= ~EN_ALDPS;
-                ocp_reg_write(tp, OCP_POWER_CFG, data);
-                msleep(20);
-        }
-}
-
 static void rtl8153_disable(struct r8152 *tp)
 {
         r8153_aldps_en(tp, false);
@@ -3246,103 +3336,6 @@ static int rtl8152_close(struct net_device *netdev)
         return res;
 }
 
-static inline void r8152_mmd_indirect(struct r8152 *tp, u16 dev, u16 reg)
-{
-        ocp_reg_write(tp, OCP_EEE_AR, FUN_ADDR | dev);
-        ocp_reg_write(tp, OCP_EEE_DATA, reg);
-        ocp_reg_write(tp, OCP_EEE_AR, FUN_DATA | dev);
-}
-
-static u16 r8152_mmd_read(struct r8152 *tp, u16 dev, u16 reg)
-{
-        u16 data;
-
-        r8152_mmd_indirect(tp, dev, reg);
-        data = ocp_reg_read(tp, OCP_EEE_DATA);
-        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
-
-        return data;
-}
-
-static void r8152_mmd_write(struct r8152 *tp, u16 dev, u16 reg, u16 data)
-{
-        r8152_mmd_indirect(tp, dev, reg);
-        ocp_reg_write(tp, OCP_EEE_DATA, data);
-        ocp_reg_write(tp, OCP_EEE_AR, 0x0000);
-}
-
-static void r8152_eee_en(struct r8152 *tp, bool enable)
-{
-        u16 config1, config2, config3;
-        u32 ocp_data;
-
-        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
-        config1 = ocp_reg_read(tp, OCP_EEE_CONFIG1) & ~sd_rise_time_mask;
-        config2 = ocp_reg_read(tp, OCP_EEE_CONFIG2);
-        config3 = ocp_reg_read(tp, OCP_EEE_CONFIG3) & ~fast_snr_mask;
-
-        if (enable) {
-                ocp_data |= EEE_RX_EN | EEE_TX_EN;
-                config1 |= EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN | RX_QUIET_EN;
-                config1 |= sd_rise_time(1);
-                config2 |= RG_DACQUIET_EN | RG_LDVQUIET_EN;
-                config3 |= fast_snr(42);
-        } else {
-                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
-                config1 &= ~(EEE_10_CAP | EEE_NWAY_EN | TX_QUIET_EN |
-                             RX_QUIET_EN);
-                config1 |= sd_rise_time(7);
-                config2 &= ~(RG_DACQUIET_EN | RG_LDVQUIET_EN);
-                config3 |= fast_snr(511);
-        }
-
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
-        ocp_reg_write(tp, OCP_EEE_CONFIG1, config1);
-        ocp_reg_write(tp, OCP_EEE_CONFIG2, config2);
-        ocp_reg_write(tp, OCP_EEE_CONFIG3, config3);
-}
-
-static void r8152b_enable_eee(struct r8152 *tp)
-{
-        r8152_eee_en(tp, true);
-        r8152_mmd_write(tp, MDIO_MMD_AN, MDIO_AN_EEE_ADV, MDIO_EEE_100TX);
-}
-
-static void r8153_eee_en(struct r8152 *tp, bool enable)
-{
-        u32 ocp_data;
-        u16 config;
-
-        ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_EEE_CR);
-        config = ocp_reg_read(tp, OCP_EEE_CFG);
-
-        if (enable) {
-                ocp_data |= EEE_RX_EN | EEE_TX_EN;
-                config |= EEE10_EN;
-        } else {
-                ocp_data &= ~(EEE_RX_EN | EEE_TX_EN);
-                config &= ~EEE10_EN;
-        }
-
-        ocp_write_word(tp, MCU_TYPE_PLA, PLA_EEE_CR, ocp_data);
-        ocp_reg_write(tp, OCP_EEE_CFG, config);
-}
-
-static void r8153_enable_eee(struct r8152 *tp)
-{
-        r8153_eee_en(tp, true);
-        ocp_reg_write(tp, OCP_EEE_ADV, MDIO_EEE_1000T | MDIO_EEE_100TX);
-}
-
-static void r8152b_enable_fc(struct r8152 *tp)
-{
-        u16 anar;
-
-        anar = r8152_mdio_read(tp, MII_ADVERTISE);
-        anar |= ADVERTISE_PAUSE_CAP | ADVERTISE_PAUSE_ASYM;
-        r8152_mdio_write(tp, MII_ADVERTISE, anar);
-}
-
 static void rtl_tally_reset(struct r8152 *tp)
 {
         u32 ocp_data;
@@ -3355,10 +3348,17 @@ static void rtl_tally_reset(struct r8152 *tp)
 static void r8152b_init(struct r8152 *tp)
 {
         u32 ocp_data;
+        u16 data;
 
         if (test_bit(RTL8152_UNPLUG, &tp->flags))
                 return;
 
+        data = r8152_mdio_read(tp, MII_BMCR);
+        if (data & BMCR_PDOWN) {
+                data &= ~BMCR_PDOWN;
+                r8152_mdio_write(tp, MII_BMCR, data);
+        }
+
         r8152_aldps_en(tp, false);
 
         if (tp->version == RTL_VER_01) {
@@ -3380,9 +3380,6 @@ static void r8152b_init(struct r8152 *tp)
                    SPDWN_RXDV_MSK | SPDWN_LINKCHG_MSK;
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_GPHY_INTR_IMR, ocp_data);
 
-        r8152b_enable_eee(tp);
-        r8152_aldps_en(tp, true);
-        r8152b_enable_fc(tp);
         rtl_tally_reset(tp);
 
         /* enable rx aggregation */
@@ -3394,12 +3391,12 @@ static void r8152b_init(struct r8152 *tp)
 static void r8153_init(struct r8152 *tp)
 {
         u32 ocp_data;
+        u16 data;
         int i;
 
         if (test_bit(RTL8152_UNPLUG, &tp->flags))
                 return;
 
-        r8153_aldps_en(tp, false);
         r8153_u1u2en(tp, false);
 
         for (i = 0; i < 500; i++) {
@@ -3416,6 +3413,23 @@ static void r8153_init(struct r8152 *tp)
                 msleep(20);
         }
 
+        if (tp->version == RTL_VER_03 || tp->version == RTL_VER_04 ||
+            tp->version == RTL_VER_05)
+                ocp_reg_write(tp, OCP_ADC_CFG, CKADSEL_L | ADC_EN | EN_EMI_L);
+
+        data = r8152_mdio_read(tp, MII_BMCR);
+        if (data & BMCR_PDOWN) {
+                data &= ~BMCR_PDOWN;
+                r8152_mdio_write(tp, MII_BMCR, data);
+        }
+
+        for (i = 0; i < 500; i++) {
+                ocp_data = ocp_reg_read(tp, OCP_PHY_STATUS) & PHY_STAT_MASK;
+                if (ocp_data == PHY_STAT_LAN_ON)
+                        break;
+                msleep(20);
+        }
+
         usb_disable_lpm(tp->udev);
         r8153_u2p3en(tp, false);
 
@@ -3483,9 +3497,6 @@ static void r8153_init(struct r8152 *tp)
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0);
         ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0);
 
-        r8153_enable_eee(tp);
-        r8153_aldps_en(tp, true);
-        r8152b_enable_fc(tp);
         rtl_tally_reset(tp);
         r8153_u2p3en(tp, true);
 }
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index c68fe495d3f9..4244b9d4418e 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -914,7 +914,9 @@ vmxnet3_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
 {
         struct Vmxnet3_TxDataDesc *tdd;
 
-        tdd = tq->data_ring.base + tq->tx_ring.next2fill;
+        tdd = (struct Vmxnet3_TxDataDesc *)((u8 *)tq->data_ring.base +
+                                            tq->tx_ring.next2fill *
+                                            tq->txdata_desc_size);
 
         memcpy(tdd->data, skb->data, ctx->copy_size);
         netdev_dbg(adapter->netdev,
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index 74fc03072b87..7dc37a090549 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -69,10 +69,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.4.9.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.4.a.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01040900
+#define VMXNET3_DRIVER_VERSION_NUM      0x01040a00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index da4e3d6632f6..6e65832051d6 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1811,7 +1811,7 @@ static struct rtable *vxlan_get_route(struct vxlan_dev *vxlan,
         fl4.flowi4_mark = skb->mark;
         fl4.flowi4_proto = IPPROTO_UDP;
         fl4.daddr = daddr;
-        fl4.saddr = vxlan->cfg.saddr.sin.sin_addr.s_addr;
+        fl4.saddr = *saddr;
 
         rt = ip_route_output_key(vxlan->net, &fl4);
         if (!IS_ERR(rt)) {
@@ -1847,7 +1847,7 @@ static struct dst_entry *vxlan6_get_route(struct vxlan_dev *vxlan,
         memset(&fl6, 0, sizeof(fl6));
         fl6.flowi6_oif = oif;
         fl6.daddr = *daddr;
-        fl6.saddr = vxlan->cfg.saddr.sin6.sin6_addr;
+        fl6.saddr = *saddr;
         fl6.flowlabel = ip6_make_flowinfo(RT_TOS(tos), label);
         fl6.flowi6_mark = skb->mark;
         fl6.flowi6_proto = IPPROTO_UDP;
@@ -1920,7 +1920,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
         struct rtable *rt = NULL;
         const struct iphdr *old_iph;
         union vxlan_addr *dst;
-        union vxlan_addr remote_ip;
+        union vxlan_addr remote_ip, local_ip;
+        union vxlan_addr *src;
         struct vxlan_metadata _md;
         struct vxlan_metadata *md = &_md;
         __be16 src_port = 0, dst_port;
@@ -1938,6 +1939,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 dst_port = rdst->remote_port ? rdst->remote_port : vxlan->cfg.dst_port;
                 vni = rdst->remote_vni;
                 dst = &rdst->remote_ip;
+                src = &vxlan->cfg.saddr;
                 dst_cache = &rdst->dst_cache;
         } else {
                 if (!info) {
@@ -1948,11 +1950,15 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port;
                 vni = vxlan_tun_id_to_vni(info->key.tun_id);
                 remote_ip.sa.sa_family = ip_tunnel_info_af(info);
-                if (remote_ip.sa.sa_family == AF_INET)
+                if (remote_ip.sa.sa_family == AF_INET) {
                         remote_ip.sin.sin_addr.s_addr = info->key.u.ipv4.dst;
-                else
+                        local_ip.sin.sin_addr.s_addr = info->key.u.ipv4.src;
+                } else {
                         remote_ip.sin6.sin6_addr = info->key.u.ipv6.dst;
+                        local_ip.sin6.sin6_addr = info->key.u.ipv6.src;
+                }
                 dst = &remote_ip;
+                src = &local_ip;
                 dst_cache = &info->dst_cache;
         }
 
@@ -1992,15 +1998,14 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
         }
 
         if (dst->sa.sa_family == AF_INET) {
-                __be32 saddr;
-
                 if (!vxlan->vn4_sock)
                         goto drop;
                 sk = vxlan->vn4_sock->sock->sk;
 
                 rt = vxlan_get_route(vxlan, skb,
                                      rdst ? rdst->remote_ifindex : 0, tos,
-                                     dst->sin.sin_addr.s_addr, &saddr,
+                                     dst->sin.sin_addr.s_addr,
+                                     &src->sin.sin_addr.s_addr,
                                      dst_cache, info);
                 if (IS_ERR(rt)) {
                         netdev_dbg(dev, "no route to %pI4\n",
@@ -2017,7 +2022,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 }
 
                 /* Bypass encapsulation if the destination is local */
-                if (rt->rt_flags & RTCF_LOCAL &&
+                if (!info && rt->rt_flags & RTCF_LOCAL &&
                     !(rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
                         struct vxlan_dev *dst_vxlan;
 
@@ -2043,13 +2048,12 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                 if (err < 0)
                         goto xmit_tx_error;
 
-                udp_tunnel_xmit_skb(rt, sk, skb, saddr,
+                udp_tunnel_xmit_skb(rt, sk, skb, src->sin.sin_addr.s_addr,
                                     dst->sin.sin_addr.s_addr, tos, ttl, df,
                                     src_port, dst_port, xnet, !udp_sum);
 #if IS_ENABLED(CONFIG_IPV6)
         } else {
                 struct dst_entry *ndst;
-                struct in6_addr saddr;
                 u32 rt6i_flags;
 
                 if (!vxlan->vn6_sock)
@@ -2058,7 +2062,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 
                 ndst = vxlan6_get_route(vxlan, skb,
                                         rdst ? rdst->remote_ifindex : 0, tos,
-                                        label, &dst->sin6.sin6_addr, &saddr,
+                                        label, &dst->sin6.sin6_addr,
+                                        &src->sin6.sin6_addr,
                                         dst_cache, info);
                 if (IS_ERR(ndst)) {
                         netdev_dbg(dev, "no route to %pI6\n",
@@ -2077,7 +2082,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
 
                 /* Bypass encapsulation if the destination is local */
                 rt6i_flags = ((struct rt6_info *)ndst)->rt6i_flags;
-                if (rt6i_flags & RTF_LOCAL &&
+                if (!info && rt6i_flags & RTF_LOCAL &&
                     !(rt6i_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
                         struct vxlan_dev *dst_vxlan;
 
@@ -2104,7 +2109,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         return;
                 }
                 udp_tunnel6_xmit_skb(ndst, sk, skb, dev,
-                                     &saddr, &dst->sin6.sin6_addr, tos, ttl,
+                                     &src->sin6.sin6_addr,
+                                     &dst->sin6.sin6_addr, tos, ttl,
                                      label, src_port, dst_port, !udp_sum);
 #endif
         }
@@ -2776,14 +2782,15 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         struct net_device *lowerdev = NULL;
 
         if (conf->flags & VXLAN_F_GPE) {
-                if (conf->flags & ~VXLAN_F_ALLOWED_GPE)
-                        return -EINVAL;
                 /* For now, allow GPE only together with COLLECT_METADATA.
                  * This can be relaxed later; in such case, the other side
                  * of the PtP link will have to be provided.
                  */
-                if (!(conf->flags & VXLAN_F_COLLECT_METADATA))
+                if ((conf->flags & ~VXLAN_F_ALLOWED_GPE) ||
+                    !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
+                        pr_info("unsupported combination of extensions\n");
                         return -EINVAL;
+                }
 
                 vxlan_raw_setup(dev);
         } else {
@@ -2836,6 +2843,9 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                         dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
 
                 needed_headroom = lowerdev->hard_header_len;
+        } else if (vxlan_addr_multicast(&dst->remote_ip)) {
+                pr_info("multicast destination requires interface to be specified\n");
+                return -EINVAL;
         }
 
         if (conf->mtu) {
@@ -2868,8 +2878,10 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                      tmp->cfg.saddr.sa.sa_family == AF_INET6) == use_ipv6 &&
                     tmp->cfg.dst_port == vxlan->cfg.dst_port &&
                     (tmp->flags & VXLAN_F_RCV_FLAGS) ==
-                    (vxlan->flags & VXLAN_F_RCV_FLAGS))
-                return -EEXIST;
+                    (vxlan->flags & VXLAN_F_RCV_FLAGS)) {
+                        pr_info("duplicate VNI %u\n", be32_to_cpu(conf->vni));
+                        return -EEXIST;
+                }
         }
 
         dev->ethtool_ops = &vxlan_ethtool_ops;
@@ -2903,7 +2915,6 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
                          struct nlattr *tb[], struct nlattr *data[])
 {
         struct vxlan_config conf;
-        int err;
 
         memset(&conf, 0, sizeof(conf));
 
@@ -3012,26 +3023,7 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
         if (tb[IFLA_MTU])
                 conf.mtu = nla_get_u32(tb[IFLA_MTU]);
 
-        err = vxlan_dev_configure(src_net, dev, &conf);
-        switch (err) {
-        case -ENODEV:
-                pr_info("ifindex %d does not exist\n", conf.remote_ifindex);
-                break;
-
-        case -EPERM:
-                pr_info("IPv6 is disabled via sysctl\n");
-                break;
-
-        case -EEXIST:
-                pr_info("duplicate VNI %u\n", be32_to_cpu(conf.vni));
-                break;
-
-        case -EINVAL:
-                pr_info("unsupported combination of extensions\n");
-                break;
-        }
-
-        return err;
+        return vxlan_dev_configure(src_net, dev, &conf);
 }
 
 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 78db5d679f19..24c8d65bcf34 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1525,7 +1525,7 @@ static void ath10k_htt_rx_h_filter(struct ath10k *ar,
 static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 {
         struct ath10k *ar = htt->ar;
-        static struct ieee80211_rx_status rx_status;
+        struct ieee80211_rx_status *rx_status = &htt->rx_status;
         struct sk_buff_head amsdu;
         int ret;
 
@@ -1549,11 +1549,11 @@ static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
                 return ret;
         }
 
-        ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
+        ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
         ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
-        ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
-        ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
+        ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+        ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 9a22c478dd1b..07933c51a850 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3162,7 +3162,6 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
                 pci_hard_reset = ath10k_pci_qca988x_chip_reset;
                 break;
         case QCA9887_1_0_DEVICE_ID:
-                dev_warn(&pdev->dev, "QCA9887 support is still experimental, there are likely bugs. You have been warned.\n");
                 hw_rev = ATH10K_HW_QCA9887;
                 pci_ps = false;
                 pci_soft_reset = ath10k_pci_warm_reset;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index d1d0c06d627c..14b13f07cd1f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2482,6 +2482,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 return -EINVAL;
         }
 
+        ath9k_gpio_cap_init(ah);
+
         if (AR_SREV_9485(ah) ||
             AR_SREV_9285(ah) ||
             AR_SREV_9330(ah) ||
@@ -2531,8 +2533,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
         else
                 pCap->hw_caps &= ~ATH9K_HW_CAP_HT;
 
-        ath9k_gpio_cap_init(ah);
-
         if (AR_SREV_9160_10_OR_LATER(ah) || AR_SREV_9100(ah))
                 pCap->rts_aggr_limit = ATH_AMPDU_LIMIT_MAX;
         else
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index a394622c9022..7cb65c303f8d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -718,9 +718,12 @@ static int ath9k_start(struct ieee80211_hw *hw)
         if (!ath_complete_reset(sc, false))
                 ah->reset_power_on = false;
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 1 : 0);
+                ath9k_hw_gpio_request_out(ah, ah->led_pin, NULL,
+                                          AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        }
 
         /*
          * Reset key cache to sane defaults (all entries cleared) instead of
@@ -864,9 +867,11 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 
         spin_lock_bh(&sc->sc_pcu_lock);
 
-        if (ah->led_pin >= 0)
+        if (ah->led_pin >= 0) {
                 ath9k_hw_set_gpio(ah, ah->led_pin,
                                   (ah->config.led_active_high) ? 0 : 1);
+                ath9k_hw_gpio_request_in(ah, ah->led_pin, NULL);
+        }
 
         ath_prepare_reset(sc);
 
@@ -1154,6 +1159,7 @@ void ath9k_calculate_summary_state(struct ath_softc *sc,
                 bool changed = (iter_data.primary_sta != ctx->primary_sta);
 
                 if (iter_data.primary_sta) {
+                        iter_data.primary_beacon_vif = iter_data.primary_sta;
                         iter_data.beacons = true;
                         ath9k_set_assoc_state(sc, iter_data.primary_sta,
                                               changed);
@@ -1563,13 +1569,13 @@ static int ath9k_sta_state(struct ieee80211_hw *hw,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         int ret = 0;
 
-        if (old_state == IEEE80211_STA_AUTH &&
-            new_state == IEEE80211_STA_ASSOC) {
+        if (old_state == IEEE80211_STA_NOTEXIST &&
+            new_state == IEEE80211_STA_NONE) {
                 ret = ath9k_sta_add(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Add station: %pM\n", sta->addr);
-        } else if (old_state == IEEE80211_STA_ASSOC &&
-                   new_state == IEEE80211_STA_AUTH) {
+        } else if (old_state == IEEE80211_STA_NONE &&
+                   new_state == IEEE80211_STA_NOTEXIST) {
                 ret = ath9k_sta_remove(hw, vif, sta);
                 ath_dbg(common, CONFIG,
                         "Remove station: %pM\n", sta->addr);
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 2628d5e12c64..b8aec5e5ef93 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -4527,7 +4527,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                                 (u8 *)&settings->beacon.head[ie_offset],
                                 settings->beacon.head_len - ie_offset,
                                 WLAN_EID_SSID);
-                if (!ssid_ie)
+                if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
                         return -EINVAL;
 
                 memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);
@@ -5635,7 +5635,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                   ifevent->action, ifevent->flags, ifevent->ifidx,
                   ifevent->bsscfgidx);
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->action = ifevent->action;
         vif = event->vif;
 
@@ -5643,7 +5643,7 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
         case BRCMF_E_IF_ADD:
                 /* waiting process may have timed out */
                 if (!cfg->vif_event.vif) {
-                        mutex_unlock(&event->vif_event_lock);
+                        spin_unlock(&event->vif_event_lock);
                         return -EBADF;
                 }
 
@@ -5654,24 +5654,24 @@ static s32 brcmf_notify_vif_event(struct brcmf_if *ifp,
                         ifp->ndev->ieee80211_ptr = &vif->wdev;
                         SET_NETDEV_DEV(ifp->ndev, wiphy_dev(cfg->wiphy));
                 }
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_DEL:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 /* event may not be upon user request */
                 if (brcmf_cfg80211_vif_event_armed(cfg))
                         wake_up(&event->vif_wq);
                 return 0;
 
         case BRCMF_E_IF_CHANGE:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 wake_up(&event->vif_wq);
                 return 0;
 
         default:
-                mutex_unlock(&event->vif_event_lock);
+                spin_unlock(&event->vif_event_lock);
                 break;
         }
         return -EINVAL;
@@ -5792,7 +5792,7 @@ static void wl_deinit_priv(struct brcmf_cfg80211_info *cfg)
 static void init_vif_event(struct brcmf_cfg80211_vif_event *event)
 {
         init_waitqueue_head(&event->vif_wq);
-        mutex_init(&event->vif_event_lock);
+        spin_lock_init(&event->vif_event_lock);
 }
 
 static s32 brcmf_dongle_roam(struct brcmf_if *ifp)
@@ -6691,9 +6691,9 @@ static inline bool vif_event_equals(struct brcmf_cfg80211_vif_event *event,
 {
         u8 evt_action;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         evt_action = event->action;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
         return evt_action == action;
 }
 
@@ -6702,10 +6702,10 @@ void brcmf_cfg80211_arm_vif_event(struct brcmf_cfg80211_info *cfg,
 {
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         event->vif = vif;
         event->action = 0;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 }
 
 bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
@@ -6713,9 +6713,9 @@ bool brcmf_cfg80211_vif_event_armed(struct brcmf_cfg80211_info *cfg)
         struct brcmf_cfg80211_vif_event *event = &cfg->vif_event;
         bool armed;
 
-        mutex_lock(&event->vif_event_lock);
+        spin_lock(&event->vif_event_lock);
         armed = event->vif != NULL;
-        mutex_unlock(&event->vif_event_lock);
+        spin_unlock(&event->vif_event_lock);
 
         return armed;
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
index 7d77f869b7f1..8889832c17e0 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
@@ -227,7 +227,7 @@ struct escan_info {
  */
 struct brcmf_cfg80211_vif_event {
         wait_queue_head_t vif_wq;
-        struct mutex vif_event_lock;
+        spinlock_t vif_event_lock;
         u8 action;
         struct brcmf_cfg80211_vif *vif;
 };
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 8d16f0204985..65e8c8766441 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -743,7 +743,7 @@ static void brcmf_del_if(struct brcmf_pub *drvr, s32 bsscfgidx,
                  * serious troublesome side effects. The p2p module will clean
                  * up the ifp if needed.
                  */
-                brcmf_p2p_ifp_removed(ifp);
+                brcmf_p2p_ifp_removed(ifp, rtnl_locked);
                 kfree(ifp);
         }
 }
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 66f942f7448e..de19c7c92bc6 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2297,7 +2297,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
         return err;
 }
 
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked)
 {
         struct brcmf_cfg80211_info *cfg;
         struct brcmf_cfg80211_vif *vif;
@@ -2306,9 +2306,11 @@ void brcmf_p2p_ifp_removed(struct brcmf_if *ifp)
         vif = ifp->vif;
         cfg = wdev_to_cfg(&vif->wdev);
         cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-        rtnl_lock();
+        if (!rtnl_locked)
+                rtnl_lock();
         cfg80211_unregister_wdev(&vif->wdev);
-        rtnl_unlock();
+        if (!rtnl_locked)
+                rtnl_unlock();
         brcmf_free_vif(vif);
 }
 
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
index a3bd18c2360b..8ce9447533ef 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -155,7 +155,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
 int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_ifchange(struct brcmf_cfg80211_info *cfg,
                        enum brcmf_fil_p2p_if_types if_type);
-void brcmf_p2p_ifp_removed(struct brcmf_if *ifp);
+void brcmf_p2p_ifp_removed(struct brcmf_if *ifp, bool rtnl_locked);
 int brcmf_p2p_start_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 void brcmf_p2p_stop_device(struct wiphy *wiphy, struct wireless_dev *wdev);
 int brcmf_p2p_scan_prep(struct wiphy *wiphy,
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
index 1abcabb9b6cd..46b52bf705fb 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c
@@ -960,5 +960,6 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 conf_id)
         }
 
         mvm->fw_dbg_conf = conf_id;
-        return ret;
+
+        return 0;
 }
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
index f7dff7612c9c..e9f1be9da7d4 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.h
@@ -105,7 +105,8 @@ iwl_fw_dbg_trigger_vif_match(struct iwl_fw_dbg_trigger_tlv *trig,
 {
         u32 trig_vif = le32_to_cpu(trig->vif_type);
 
-        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY || vif->type == trig_vif;
+        return trig_vif == IWL_FW_DBG_CONF_VIF_ANY ||
+               ieee80211_vif_type_p2p(vif) == trig_vif;
 }
 
 static inline bool
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
index 6d6064534d59..5dd77e336617 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
@@ -624,6 +624,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
                                NL80211_FEATURE_LOW_PRIORITY_SCAN |
                                NL80211_FEATURE_P2P_GO_OPPPS |
+                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE |
                                NL80211_FEATURE_DYNAMIC_SMPS |
                                NL80211_FEATURE_STATIC_SMPS |
                                NL80211_FEATURE_SUPPORTS_WMM_ADMISSION;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index b4fc86d5d7ef..6a615bb73042 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -467,6 +467,8 @@ struct iwl_mvm_vif {
 static inline struct iwl_mvm_vif *
 iwl_mvm_vif_from_mac80211(struct ieee80211_vif *vif)
 {
+        if (!vif)
+                return NULL;
         return (void *)vif->drv_priv;
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index c6585ab48df3..b3a87a31de30 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -513,6 +513,15 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
         int hdrlen = ieee80211_hdrlen(hdr->frame_control);
         int queue;
 
+        /* IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets that can be used
+         * in 2 different types of vifs, P2P & STATION. P2P uses the offchannel
+         * queue. STATION (HS2.0) uses the auxiliary context of the FW,
+         * and hence needs to be sent on the aux queue
+         */
+        if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
+            skb_info->control.vif->type == NL80211_IFTYPE_STATION)
+                IEEE80211_SKB_CB(skb)->hw_queue = mvm->aux_queue;
+
         memcpy(&info, skb->cb, sizeof(info));
 
         if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
@@ -526,16 +535,6 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
         /* This holds the amsdu headers length */
         skb_info->driver_data[0] = (void *)(uintptr_t)0;
 
-        /*
-         * IWL_MVM_OFFCHANNEL_QUEUE is used for ROC packets that can be used
-         * in 2 different types of vifs, P2P & STATION. P2P uses the offchannel
-         * queue. STATION (HS2.0) uses the auxiliary context of the FW,
-         * and hence needs to be sent on the aux queue
-         */
-        if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
-            info.control.vif->type == NL80211_IFTYPE_STATION)
-                IEEE80211_SKB_CB(skb)->hw_queue = mvm->aux_queue;
-
         queue = info.hw_queue;
 
         /*
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
index dc49c3de1f25..c47d6366875d 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_aggr.c
@@ -205,7 +205,8 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv,
 
         do {
                 /* Check if AMSDU can accommodate this MSDU */
-                if (skb_tailroom(skb_aggr) < (skb_src->len + LLC_SNAP_LEN))
+                if ((skb_aggr->len + skb_src->len + LLC_SNAP_LEN) >
+                    adapter->tx_buf_size)
                         break;
 
                 skb_src = skb_dequeue(&pra_list->skb_head);
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 1d689169da76..9e1f2d9c9865 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -5700,10 +5700,11 @@ out:
         mutex_unlock(&wl->mutex);
 }
 
-static u32 wlcore_op_get_expected_throughput(struct ieee80211_sta *sta)
+static u32 wlcore_op_get_expected_throughput(struct ieee80211_hw *hw,
+                                             struct ieee80211_sta *sta)
 {
         struct wl1271_station *wl_sta = (struct wl1271_station *)sta->drv_priv;
-        struct wl1271 *wl = wl_sta->wl;
+        struct wl1271 *wl = hw->priv;
         u8 hlid = wl_sta->hlid;
 
         /* return in units of Kbps */
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 6a31f2610c23..daf4c7867102 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -271,6 +271,11 @@ static int netback_probe(struct xenbus_device *dev,
         be->dev = dev;
         dev_set_drvdata(&dev->dev, be);
 
+        be->state = XenbusStateInitialising;
+        err = xenbus_switch_state(dev, XenbusStateInitialising);
+        if (err)
+                goto fail;
+
         sg = 1;
 
         do {
@@ -383,11 +388,6 @@ static int netback_probe(struct xenbus_device *dev,
 
         be->hotplug_script = script;
 
-        err = xenbus_switch_state(dev, XenbusStateInitWait);
-        if (err)
-                goto fail;
-
-        be->state = XenbusStateInitWait;
 
         /* This kicks hotplug scripts, so do it immediately. */
         err = backend_create_xenvif(be);
@@ -492,20 +492,20 @@ static inline void backend_switch_state(struct backend_info *be,
 
 /* Handle backend state transitions:
  *
- * The backend state starts in InitWait and the following transitions are
+ * The backend state starts in Initialising and the following transitions are
  * allowed.
  *
- * InitWait -> Connected
- *
- *    ^    \         |
- *    |     \        |
- *    |      \       |
- *    |       \      |
- *    |        \     |
- *    |         \    |
- *    |          V   V
+ * Initialising -> InitWait -> Connected
+ *          \
+ *           \        ^    \         |
+ *            \       |     \        |
+ *             \      |      \       |
+ *              \     |       \      |
+ *               \    |        \     |
+ *                \   |         \    |
+ *                 V  |          V   V
  *
- *  Closed  <-> Closing
+ *                  Closed  <-> Closing
  *
  * The state argument specifies the eventual state of the backend and the
  * function transitions to that state via the shortest path.
@@ -515,6 +515,20 @@ static void set_backend_state(struct backend_info *be,
 {
         while (be->state != state) {
                 switch (be->state) {
+                case XenbusStateInitialising:
+                        switch (state) {
+                        case XenbusStateInitWait:
+                        case XenbusStateConnected:
+                        case XenbusStateClosing:
+                                backend_switch_state(be, XenbusStateInitWait);
+                                break;
+                        case XenbusStateClosed:
+                                backend_switch_state(be, XenbusStateClosed);
+                                break;
+                        default:
+                                BUG();
+                        }
+                        break;
                 case XenbusStateClosed:
                         switch (state) {
                         case XenbusStateInitWait:
diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
index 88e91666f145..368795aad5c9 100644
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -1269,6 +1269,7 @@ static int btt_blk_init(struct btt *btt)
                 }
         }
         set_capacity(btt->btt_disk, btt->nlba * btt->sector_size >> 9);
+        btt->nd_btt->size = btt->nlba * (u64)btt->sector_size;
         revalidate_disk(btt->btt_disk);
 
         return 0;
diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
index 3fa7919f94a8..97dd2925ed6e 100644
--- a/drivers/nvdimm/btt_devs.c
+++ b/drivers/nvdimm/btt_devs.c
@@ -140,10 +140,30 @@ static ssize_t namespace_store(struct device *dev,
 }
 static DEVICE_ATTR_RW(namespace);
 
+static ssize_t size_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct nd_btt *nd_btt = to_nd_btt(dev);
+        ssize_t rc;
+
+        device_lock(dev);
+        if (dev->driver)
+                rc = sprintf(buf, "%llu\n", nd_btt->size);
+        else {
+                /* no size to convey if the btt instance is disabled */
+                rc = -ENXIO;
+        }
+        device_unlock(dev);
+
+        return rc;
+}
+static DEVICE_ATTR_RO(size);
+
 static struct attribute *nd_btt_attributes[] = {
         &dev_attr_sector_size.attr,
         &dev_attr_namespace.attr,
         &dev_attr_uuid.attr,
+        &dev_attr_size.attr,
         NULL,
 };
 
diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index 458daf927336..935866fe5ec2 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -185,8 +185,12 @@ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
                 return -ENXIO;
 
         nd_desc = nvdimm_bus->nd_desc;
+        /*
+         * if ndctl does not exist, it's PMEM_LEGACY and
+         * we want to just pretend everything is handled.
+         */
         if (!nd_desc->ndctl)
-                return -ENXIO;
+                return len;
 
         memset(&ars_cap, 0, sizeof(ars_cap));
         ars_cap.address = phys;
diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h
index 40476399d227..8024a0ef86d3 100644
--- a/drivers/nvdimm/nd.h
+++ b/drivers/nvdimm/nd.h
@@ -143,6 +143,7 @@ struct nd_btt {
         struct nd_namespace_common *ndns;
         struct btt *btt;
         unsigned long lbasize;
+        u64 size;
         u8 *uuid;
         int id;
 };
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index db39d53cdfb9..f7d37a62f874 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -30,8 +30,8 @@ config NVME_FABRICS
 
 config NVME_RDMA
         tristate "NVM Express over Fabrics RDMA host driver"
-        depends on INFINIBAND
-        depends on BLK_DEV_NVME
+        depends on INFINIBAND && BLOCK
+        select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
         help
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 7ff2e820bbf4..2feacc70bf61 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -81,10 +81,12 @@ EXPORT_SYMBOL_GPL(nvme_cancel_request);
 bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
                 enum nvme_ctrl_state new_state)
 {
-        enum nvme_ctrl_state old_state = ctrl->state;
+        enum nvme_ctrl_state old_state;
         bool changed = false;
 
         spin_lock_irq(&ctrl->lock);
+
+        old_state = ctrl->state;
         switch (new_state) {
         case NVME_CTRL_LIVE:
                 switch (old_state) {
@@ -140,11 +142,12 @@ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
         default:
                 break;
         }
-        spin_unlock_irq(&ctrl->lock);
 
         if (changed)
                 ctrl->state = new_state;
 
+        spin_unlock_irq(&ctrl->lock);
+
         return changed;
 }
 EXPORT_SYMBOL_GPL(nvme_change_ctrl_state);
@@ -608,7 +611,7 @@ int nvme_get_features(struct nvme_ctrl *dev, unsigned fid, unsigned nsid,
 
         ret = __nvme_submit_sync_cmd(dev->admin_q, &c, &cqe, NULL, 0, 0,
                         NVME_QID_ANY, 0, 0);
-        if (ret >= 0)
+        if (ret >= 0 && result)
                 *result = le32_to_cpu(cqe.result);
         return ret;
 }
@@ -628,7 +631,7 @@ int nvme_set_features(struct nvme_ctrl *dev, unsigned fid, unsigned dword11,
 
         ret = __nvme_submit_sync_cmd(dev->admin_q, &c, &cqe, NULL, 0, 0,
                         NVME_QID_ANY, 0, 0);
-        if (ret >= 0)
+        if (ret >= 0 && result)
                 *result = le32_to_cpu(cqe.result);
         return ret;
 }
diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c
index dc996761042f..4eff49174466 100644
--- a/drivers/nvme/host/fabrics.c
+++ b/drivers/nvme/host/fabrics.c
@@ -47,8 +47,10 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
 
         mutex_lock(&nvmf_hosts_mutex);
         host = __nvmf_host_find(hostnqn);
-        if (host)
+        if (host) {
+                kref_get(&host->ref);
                 goto out_unlock;
+        }
 
         host = kmalloc(sizeof(*host), GFP_KERNEL);
         if (!host)
@@ -56,7 +58,7 @@ static struct nvmf_host *nvmf_host_add(const char *hostnqn)
 
         kref_init(&host->ref);
         memcpy(host->nqn, hostnqn, NVMF_NQN_SIZE);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
 
         list_add_tail(&host->list, &nvmf_hosts);
 out_unlock:
@@ -73,9 +75,9 @@ static struct nvmf_host *nvmf_host_default(void)
                 return NULL;
 
         kref_init(&host->ref);
-        uuid_le_gen(&host->id);
+        uuid_be_gen(&host->id);
         snprintf(host->nqn, NVMF_NQN_SIZE,
-                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUl", &host->id);
+                "nqn.2014-08.org.nvmexpress:NVMf:uuid:%pUb", &host->id);
 
         mutex_lock(&nvmf_hosts_mutex);
         list_add_tail(&host->list, &nvmf_hosts);
@@ -363,7 +365,14 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
         cmd.connect.opcode = nvme_fabrics_command;
         cmd.connect.fctype = nvme_fabrics_type_connect;
         cmd.connect.qid = 0;
-        cmd.connect.sqsize = cpu_to_le16(ctrl->sqsize);
+
+        /*
+         * fabrics spec sets a minimum of depth 32 for admin queue,
+         * so set the queue with this depth always until
+         * justification otherwise.
+         */
+        cmd.connect.sqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
+
         /*
          * Set keep-alive timeout in seconds granularity (ms * 1000)
          * and add a grace period for controller kato enforcement
@@ -375,7 +384,7 @@ int nvmf_connect_admin_queue(struct nvme_ctrl *ctrl)
         if (!data)
                 return -ENOMEM;
 
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
         data->cntlid = cpu_to_le16(0xffff);
         strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
         strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
@@ -434,7 +443,7 @@ int nvmf_connect_io_queue(struct nvme_ctrl *ctrl, u16 qid)
         if (!data)
                 return -ENOMEM;
 
-        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_le));
+        memcpy(&data->hostid, &ctrl->opts->host->id, sizeof(uuid_be));
         data->cntlid = cpu_to_le16(ctrl->cntlid);
         strncpy(data->subsysnqn, ctrl->opts->subsysnqn, NVMF_NQN_SIZE);
         strncpy(data->hostnqn, ctrl->opts->host->nqn, NVMF_NQN_SIZE);
diff --git a/drivers/nvme/host/fabrics.h b/drivers/nvme/host/fabrics.h
index 89df52c8be97..46e460aee52d 100644
--- a/drivers/nvme/host/fabrics.h
+++ b/drivers/nvme/host/fabrics.h
@@ -34,7 +34,7 @@ struct nvmf_host {
         struct kref             ref;
         struct list_head        list;
         char                    nqn[NVMF_NQN_SIZE];
-        uuid_le                 id;
+        uuid_be                 id;
 };
 
 /**
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index d7c33f9361aa..60f7eab11865 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1543,15 +1543,10 @@ static void nvme_disable_io_queues(struct nvme_dev *dev)
                 reinit_completion(&dev->ioq_wait);
  retry:
                 timeout = ADMIN_TIMEOUT;
-                for (; i > 0; i--) {
-                        struct nvme_queue *nvmeq = dev->queues[i];
-
-                        if (!pass)
-                                nvme_suspend_queue(nvmeq);
-                        if (nvme_delete_queue(nvmeq, opcode))
+                for (; i > 0; i--, sent++)
+                        if (nvme_delete_queue(dev->queues[i], opcode))
                                 break;
-                        ++sent;
-                }
+
                 while (sent--) {
                         timeout = wait_for_completion_io_timeout(&dev->ioq_wait, timeout);
                         if (timeout == 0)
@@ -1693,11 +1688,17 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown)
                 nvme_stop_queues(&dev->ctrl);
                 csts = readl(dev->bar + NVME_REG_CSTS);
         }
+
+        for (i = dev->queue_count - 1; i > 0; i--)
+                nvme_suspend_queue(dev->queues[i]);
+
         if (csts & NVME_CSTS_CFS || !(csts & NVME_CSTS_RDY)) {
-                for (i = dev->queue_count - 1; i >= 0; i--) {
-                        struct nvme_queue *nvmeq = dev->queues[i];
-                        nvme_suspend_queue(nvmeq);
-                }
+                /* A device might become IO incapable very soon during
+                 * probe, before the admin queue is configured. Thus,
+                 * queue_count can be 0 here.
+                 */
+                if (dev->queue_count)
+                        nvme_suspend_queue(dev->queues[0]);
         } else {
                 nvme_disable_io_queues(dev);
                 nvme_disable_admin_queue(dev, shutdown);
@@ -2116,6 +2117,8 @@ static const struct pci_device_id nvme_id_table[] = {
                 .driver_data = NVME_QUIRK_IDENTIFY_CNS, },
         { PCI_DEVICE(0x1c58, 0x0003),   /* HGST adapter */
                 .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
+        { PCI_DEVICE(0x1c5f, 0x0540),   /* Memblaze Pblaze4 adapter */
+                .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, },
         { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
         { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
         { 0, }
diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 3e3ce2b0424e..fbdb2267e460 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -12,13 +12,11 @@
  * more details.
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/string.h>
-#include <linux/jiffies.h>
 #include <linux/atomic.h>
 #include <linux/blk-mq.h>
 #include <linux/types.h>
@@ -26,7 +24,6 @@
 #include <linux/mutex.h>
 #include <linux/scatterlist.h>
 #include <linux/nvme.h>
-#include <linux/t10-pi.h>
 #include <asm/unaligned.h>
 
 #include <rdma/ib_verbs.h>
@@ -46,10 +43,6 @@
 
 #define NVME_RDMA_MAX_INLINE_SEGMENTS   1
 
-#define NVME_RDMA_MAX_PAGES_PER_MR      512
-
-#define NVME_RDMA_DEF_RECONNECT_DELAY   20
-
 /*
  * We handle AEN commands ourselves and don't even let the
  * block layer know about them.
@@ -80,7 +73,6 @@ struct nvme_rdma_request {
         u32                     num_sge;
         int                     nents;
         bool                    inline_data;
-        bool                    need_inval;
         struct ib_reg_wr        reg_wr;
         struct ib_cqe           reg_cqe;
         struct nvme_rdma_queue  *queue;
@@ -90,6 +82,8 @@ struct nvme_rdma_request {
 
 enum nvme_rdma_queue_flags {
         NVME_RDMA_Q_CONNECTED = (1 << 0),
+        NVME_RDMA_IB_QUEUE_ALLOCATED = (1 << 1),
+        NVME_RDMA_Q_DELETING = (1 << 2),
 };
 
 struct nvme_rdma_queue {
@@ -169,7 +163,6 @@ MODULE_PARM_DESC(register_always,
 static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 struct rdma_cm_event *event);
 static void nvme_rdma_recv_done(struct ib_cq *cq, struct ib_wc *wc);
-static int __nvme_rdma_del_ctrl(struct nvme_rdma_ctrl *ctrl);
 
 /* XXX: really should move to a generic header sooner or later.. */
 static inline void put_unaligned_le24(u32 val, u8 *p)
@@ -290,7 +283,7 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
         struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq);
         int ret = 0;
 
-        if (!req->need_inval)
+        if (!req->mr->need_inval)
                 goto out;
 
         ib_dereg_mr(req->mr);
@@ -300,9 +293,10 @@ static int nvme_rdma_reinit_request(void *data, struct request *rq)
         if (IS_ERR(req->mr)) {
                 ret = PTR_ERR(req->mr);
                 req->mr = NULL;
+                goto out;
         }
 
-        req->need_inval = false;
+        req->mr->need_inval = false;
 
 out:
         return ret;
@@ -489,9 +483,14 @@ out_err:
 
 static void nvme_rdma_destroy_queue_ib(struct nvme_rdma_queue *queue)
 {
-        struct nvme_rdma_device *dev = queue->device;
-        struct ib_device *ibdev = dev->dev;
+        struct nvme_rdma_device *dev;
+        struct ib_device *ibdev;
+
+        if (!test_and_clear_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags))
+                return;
 
+        dev = queue->device;
+        ibdev = dev->dev;
         rdma_destroy_qp(queue->cm_id);
         ib_free_cq(queue->ib_cq);
 
@@ -542,6 +541,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue,
                 ret = -ENOMEM;
                 goto out_destroy_qp;
         }
+        set_bit(NVME_RDMA_IB_QUEUE_ALLOCATED, &queue->flags);
 
         return 0;
 
@@ -594,11 +594,13 @@ static int nvme_rdma_init_queue(struct nvme_rdma_ctrl *ctrl,
                 goto out_destroy_cm_id;
         }
 
+        clear_bit(NVME_RDMA_Q_DELETING, &queue->flags);
         set_bit(NVME_RDMA_Q_CONNECTED, &queue->flags);
 
         return 0;
 
 out_destroy_cm_id:
+        nvme_rdma_destroy_queue_ib(queue);
         rdma_destroy_id(queue->cm_id);
         return ret;
 }
@@ -617,7 +619,7 @@ static void nvme_rdma_free_queue(struct nvme_rdma_queue *queue)
 
 static void nvme_rdma_stop_and_free_queue(struct nvme_rdma_queue *queue)
 {
-        if (!test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags))
+        if (test_and_set_bit(NVME_RDMA_Q_DELETING, &queue->flags))
                 return;
         nvme_rdma_stop_queue(queue);
         nvme_rdma_free_queue(queue);
@@ -649,7 +651,8 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
         int i, ret;
 
         for (i = 1; i < ctrl->queue_count; i++) {
-                ret = nvme_rdma_init_queue(ctrl, i, ctrl->ctrl.sqsize);
+                ret = nvme_rdma_init_queue(ctrl, i,
+                                           ctrl->ctrl.opts->queue_size);
                 if (ret) {
                         dev_info(ctrl->ctrl.device,
                                 "failed to initialize i/o queue: %d\n", ret);
@@ -660,7 +663,7 @@ static int nvme_rdma_init_io_queues(struct nvme_rdma_ctrl *ctrl)
         return 0;
 
 out_free_queues:
-        for (; i >= 1; i--)
+        for (i--; i >= 1; i--)
                 nvme_rdma_stop_and_free_queue(&ctrl->queues[i]);
 
         return ret;
@@ -687,11 +690,6 @@ static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl)
         list_del(&ctrl->list);
         mutex_unlock(&nvme_rdma_ctrl_mutex);
 
-        if (ctrl->ctrl.tagset) {
-                blk_cleanup_queue(ctrl->ctrl.connect_q);
-                blk_mq_free_tag_set(&ctrl->tag_set);
-                nvme_rdma_dev_put(ctrl->device);
-        }
         kfree(ctrl->queues);
         nvmf_free_options(nctrl->opts);
 free_ctrl:
@@ -748,8 +746,11 @@ static void nvme_rdma_reconnect_ctrl_work(struct work_struct *work)
         changed = nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_LIVE);
         WARN_ON_ONCE(!changed);
 
-        if (ctrl->queue_count > 1)
+        if (ctrl->queue_count > 1) {
                 nvme_start_queues(&ctrl->ctrl);
+                nvme_queue_scan(&ctrl->ctrl);
+                nvme_queue_async_events(&ctrl->ctrl);
+        }
 
         dev_info(ctrl->ctrl.device, "Successfully reconnected\n");
 
@@ -771,8 +772,13 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work)
 {
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                         struct nvme_rdma_ctrl, err_work);
+        int i;
 
         nvme_stop_keep_alive(&ctrl->ctrl);
+
+        for (i = 0; i < ctrl->queue_count; i++)
+                clear_bit(NVME_RDMA_Q_CONNECTED, &ctrl->queues[i].flags);
+
         if (ctrl->queue_count > 1)
                 nvme_stop_queues(&ctrl->ctrl);
         blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
@@ -855,7 +861,7 @@ static void nvme_rdma_unmap_data(struct nvme_rdma_queue *queue,
         if (!blk_rq_bytes(rq))
                 return;
 
-        if (req->need_inval) {
+        if (req->mr->need_inval) {
                 res = nvme_rdma_inv_rkey(queue, req);
                 if (res < 0) {
                         dev_err(ctrl->ctrl.device,
@@ -941,7 +947,7 @@ static int nvme_rdma_map_sg_fr(struct nvme_rdma_queue *queue,
                              IB_ACCESS_REMOTE_READ |
                              IB_ACCESS_REMOTE_WRITE;
 
-        req->need_inval = true;
+        req->mr->need_inval = true;
 
         sg->addr = cpu_to_le64(req->mr->iova);
         put_unaligned_le24(req->mr->length, sg->length);
@@ -964,7 +970,7 @@ static int nvme_rdma_map_data(struct nvme_rdma_queue *queue,
 
         req->num_sge = 1;
         req->inline_data = false;
-        req->need_inval = false;
+        req->mr->need_inval = false;
 
         c->common.flags |= NVME_CMD_SGL_METABUF;
 
@@ -1151,7 +1157,7 @@ static int nvme_rdma_process_nvme_rsp(struct nvme_rdma_queue *queue,
 
         if ((wc->wc_flags & IB_WC_WITH_INVALIDATE) &&
             wc->ex.invalidate_rkey == req->mr->rkey)
-                req->need_inval = false;
+                req->mr->need_inval = false;
 
         blk_mq_complete_request(rq, status);
 
@@ -1269,7 +1275,7 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
 {
         struct nvme_rdma_ctrl *ctrl = queue->ctrl;
         struct rdma_conn_param param = { };
-        struct nvme_rdma_cm_req priv;
+        struct nvme_rdma_cm_req priv = { };
         int ret;
 
         param.qp_num = queue->qp->qp_num;
@@ -1284,8 +1290,22 @@ static int nvme_rdma_route_resolved(struct nvme_rdma_queue *queue)
 
         priv.recfmt = cpu_to_le16(NVME_RDMA_CM_FMT_1_0);
         priv.qid = cpu_to_le16(nvme_rdma_queue_idx(queue));
-        priv.hrqsize = cpu_to_le16(queue->queue_size);
-        priv.hsqsize = cpu_to_le16(queue->queue_size);
+        /*
+         * set the admin queue depth to the minimum size
+         * specified by the Fabrics standard.
+         */
+        if (priv.qid == 0) {
+                priv.hrqsize = cpu_to_le16(NVMF_AQ_DEPTH);
+                priv.hsqsize = cpu_to_le16(NVMF_AQ_DEPTH - 1);
+        } else {
+                /*
+                 * current interpretation of the fabrics spec
+                 * is at minimum you make hrqsize sqsize+1, or a
+                 * 1's based representation of sqsize.
+                 */
+                priv.hrqsize = cpu_to_le16(queue->queue_size);
+                priv.hsqsize = cpu_to_le16(queue->ctrl->ctrl.sqsize);
+        }
 
         ret = rdma_connect(queue->cm_id, &param);
         if (ret) {
@@ -1301,56 +1321,6 @@ out_destroy_queue_ib:
         return ret;
 }
 
-/**
- * nvme_rdma_device_unplug() - Handle RDMA device unplug
- * @queue:      Queue that owns the cm_id that caught the event
- *
- * DEVICE_REMOVAL event notifies us that the RDMA device is about
- * to unplug so we should take care of destroying our RDMA resources.
- * This event will be generated for each allocated cm_id.
- *
- * In our case, the RDMA resources are managed per controller and not
- * only per queue. So the way we handle this is we trigger an implicit
- * controller deletion upon the first DEVICE_REMOVAL event we see, and
- * hold the event inflight until the controller deletion is completed.
- *
- * One exception that we need to handle is the destruction of the cm_id
- * that caught the event. Since we hold the callout until the controller
- * deletion is completed, we'll deadlock if the controller deletion will
- * call rdma_destroy_id on this queue's cm_id. Thus, we claim ownership
- * of destroying this queue before-hand, destroy the queue resources
- * after the controller deletion completed with the exception of destroying
- * the cm_id implicitely by returning a non-zero rc to the callout.
- */
-static int nvme_rdma_device_unplug(struct nvme_rdma_queue *queue)
-{
-        struct nvme_rdma_ctrl *ctrl = queue->ctrl;
-        int ret, ctrl_deleted = 0;
-
-        /* First disable the queue so ctrl delete won't free it */
-        if (!test_and_clear_bit(NVME_RDMA_Q_CONNECTED, &queue->flags))
-                goto out;
-
-        /* delete the controller */
-        ret = __nvme_rdma_del_ctrl(ctrl);
-        if (!ret) {
-                dev_warn(ctrl->ctrl.device,
-                        "Got rdma device removal event, deleting ctrl\n");
-                flush_work(&ctrl->delete_work);
-
-                /* Return non-zero so the cm_id will destroy implicitly */
-                ctrl_deleted = 1;
-
-                /* Free this queue ourselves */
-                rdma_disconnect(queue->cm_id);
-                ib_drain_qp(queue->qp);
-                nvme_rdma_destroy_queue_ib(queue);
-        }
-
-out:
-        return ctrl_deleted;
-}
-
 static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 struct rdma_cm_event *ev)
 {
@@ -1392,8 +1362,8 @@ static int nvme_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 nvme_rdma_error_recovery(queue->ctrl);
                 break;
         case RDMA_CM_EVENT_DEVICE_REMOVAL:
-                /* return 1 means impliciy CM ID destroy */
-                return nvme_rdma_device_unplug(queue);
+                /* device removal is handled via the ib_client API */
+                break;
         default:
                 dev_err(queue->ctrl->ctrl.device,
                         "Unexpected RDMA CM event (%d)\n", ev->event);
@@ -1465,7 +1435,7 @@ static int nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx,
         if (rq->cmd_type == REQ_TYPE_FS && req_op(rq) == REQ_OP_FLUSH)
                 flush = true;
         ret = nvme_rdma_post_send(queue, sqe, req->sge, req->num_sge,
-                        req->need_inval ? &req->reg_wr.wr : NULL, flush);
+                        req->mr->need_inval ? &req->reg_wr.wr : NULL, flush);
         if (ret) {
                 nvme_rdma_unmap_data(queue, rq);
                 goto err;
@@ -1648,7 +1618,7 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl)
                 nvme_rdma_free_io_queues(ctrl);
         }
 
-        if (ctrl->ctrl.state == NVME_CTRL_LIVE)
+        if (test_bit(NVME_RDMA_Q_CONNECTED, &ctrl->queues[0].flags))
                 nvme_shutdown_ctrl(&ctrl->ctrl);
 
         blk_mq_stop_hw_queues(ctrl->ctrl.admin_q);
@@ -1657,15 +1627,27 @@ static void nvme_rdma_shutdown_ctrl(struct nvme_rdma_ctrl *ctrl)
         nvme_rdma_destroy_admin_queue(ctrl);
 }
 
+static void __nvme_rdma_remove_ctrl(struct nvme_rdma_ctrl *ctrl, bool shutdown)
+{
+        nvme_uninit_ctrl(&ctrl->ctrl);
+        if (shutdown)
+                nvme_rdma_shutdown_ctrl(ctrl);
+
+        if (ctrl->ctrl.tagset) {
+                blk_cleanup_queue(ctrl->ctrl.connect_q);
+                blk_mq_free_tag_set(&ctrl->tag_set);
+                nvme_rdma_dev_put(ctrl->device);
+        }
+
+        nvme_put_ctrl(&ctrl->ctrl);
+}
+
 static void nvme_rdma_del_ctrl_work(struct work_struct *work)
 {
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                                 struct nvme_rdma_ctrl, delete_work);
 
-        nvme_remove_namespaces(&ctrl->ctrl);
-        nvme_rdma_shutdown_ctrl(ctrl);
-        nvme_uninit_ctrl(&ctrl->ctrl);
-        nvme_put_ctrl(&ctrl->ctrl);
+        __nvme_rdma_remove_ctrl(ctrl, true);
 }
 
 static int __nvme_rdma_del_ctrl(struct nvme_rdma_ctrl *ctrl)
@@ -1682,15 +1664,19 @@ static int __nvme_rdma_del_ctrl(struct nvme_rdma_ctrl *ctrl)
 static int nvme_rdma_del_ctrl(struct nvme_ctrl *nctrl)
 {
         struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl);
-        int ret;
+        int ret = 0;
 
+        /*
+         * Keep a reference until all work is flushed since
+         * __nvme_rdma_del_ctrl can free the ctrl mem
+         */
+        if (!kref_get_unless_zero(&ctrl->ctrl.kref))
+                return -EBUSY;
         ret = __nvme_rdma_del_ctrl(ctrl);
-        if (ret)
-                return ret;
-
-        flush_work(&ctrl->delete_work);
-
-        return 0;
+        if (!ret)
+                flush_work(&ctrl->delete_work);
+        nvme_put_ctrl(&ctrl->ctrl);
+        return ret;
 }
 
 static void nvme_rdma_remove_ctrl_work(struct work_struct *work)
@@ -1698,9 +1684,7 @@ static void nvme_rdma_remove_ctrl_work(struct work_struct *work)
         struct nvme_rdma_ctrl *ctrl = container_of(work,
                                 struct nvme_rdma_ctrl, delete_work);
 
-        nvme_remove_namespaces(&ctrl->ctrl);
-        nvme_uninit_ctrl(&ctrl->ctrl);
-        nvme_put_ctrl(&ctrl->ctrl);
+        __nvme_rdma_remove_ctrl(ctrl, false);
 }
 
 static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
@@ -1739,6 +1723,7 @@ static void nvme_rdma_reset_ctrl_work(struct work_struct *work)
         if (ctrl->queue_count > 1) {
                 nvme_start_queues(&ctrl->ctrl);
                 nvme_queue_scan(&ctrl->ctrl);
+                nvme_queue_async_events(&ctrl->ctrl);
         }
 
         return;
@@ -1809,7 +1794,7 @@ static int nvme_rdma_create_io_queues(struct nvme_rdma_ctrl *ctrl)
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_rdma_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
         ctrl->tag_set.reserved_tags = 1; /* fabric connect */
         ctrl->tag_set.numa_node = NUMA_NO_NODE;
         ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -1907,7 +1892,7 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev,
         spin_lock_init(&ctrl->lock);
 
         ctrl->queue_count = opts->nr_io_queues + 1; /* +1 for admin queue */
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
         ctrl->ctrl.kato = opts->kato;
 
         ret = -ENOMEM;
@@ -1988,27 +1973,57 @@ static struct nvmf_transport_ops nvme_rdma_transport = {
         .create_ctrl    = nvme_rdma_create_ctrl,
 };
 
+static void nvme_rdma_add_one(struct ib_device *ib_device)
+{
+}
+
+static void nvme_rdma_remove_one(struct ib_device *ib_device, void *client_data)
+{
+        struct nvme_rdma_ctrl *ctrl;
+
+        /* Delete all controllers using this device */
+        mutex_lock(&nvme_rdma_ctrl_mutex);
+        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list) {
+                if (ctrl->device->dev != ib_device)
+                        continue;
+                dev_info(ctrl->ctrl.device,
+                        "Removing ctrl: NQN \"%s\", addr %pISp\n",
+                        ctrl->ctrl.opts->subsysnqn, &ctrl->addr);
+                __nvme_rdma_del_ctrl(ctrl);
+        }
+        mutex_unlock(&nvme_rdma_ctrl_mutex);
+
+        flush_workqueue(nvme_rdma_wq);
+}
+
+static struct ib_client nvme_rdma_ib_client = {
+        .name   = "nvme_rdma",
+        .add = nvme_rdma_add_one,
+        .remove = nvme_rdma_remove_one
+};
+
 static int __init nvme_rdma_init_module(void)
 {
+        int ret;
+
         nvme_rdma_wq = create_workqueue("nvme_rdma_wq");
         if (!nvme_rdma_wq)
                 return -ENOMEM;
 
+        ret = ib_register_client(&nvme_rdma_ib_client);
+        if (ret) {
+                destroy_workqueue(nvme_rdma_wq);
+                return ret;
+        }
+
         nvmf_register_transport(&nvme_rdma_transport);
         return 0;
 }
 
 static void __exit nvme_rdma_cleanup_module(void)
 {
-        struct nvme_rdma_ctrl *ctrl;
-
         nvmf_unregister_transport(&nvme_rdma_transport);
-
-        mutex_lock(&nvme_rdma_ctrl_mutex);
-        list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list)
-                __nvme_rdma_del_ctrl(ctrl);
-        mutex_unlock(&nvme_rdma_ctrl_mutex);
-
+        ib_unregister_client(&nvme_rdma_ib_client);
         destroy_workqueue(nvme_rdma_wq);
 }
 
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index a5c31cbeb481..3a5b9d0576cb 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -15,8 +15,8 @@ config NVME_TARGET
 
 config NVME_TARGET_LOOP
         tristate "NVMe loopback device support"
-        depends on BLK_DEV_NVME
         depends on NVME_TARGET
+        select NVME_CORE
         select NVME_FABRICS
         select SG_POOL
         help
diff --git a/drivers/nvme/target/admin-cmd.c b/drivers/nvme/target/admin-cmd.c
index 2fac17a5ad53..47c564b5a289 100644
--- a/drivers/nvme/target/admin-cmd.c
+++ b/drivers/nvme/target/admin-cmd.c
@@ -13,7 +13,6 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
-#include <linux/random.h>
 #include <generated/utsrelease.h>
 #include "nvmet.h"
 
@@ -83,7 +82,6 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
 {
         struct nvmet_ctrl *ctrl = req->sq->ctrl;
         struct nvme_id_ctrl *id;
-        u64 serial;
         u16 status = 0;
 
         id = kzalloc(sizeof(*id), GFP_KERNEL);
@@ -96,10 +94,8 @@ static void nvmet_execute_identify_ctrl(struct nvmet_req *req)
         id->vid = 0;
         id->ssvid = 0;
 
-        /* generate a random serial number as our controllers are ephemeral: */
-        get_random_bytes(&serial, sizeof(serial));
         memset(id->sn, ' ', sizeof(id->sn));
-        snprintf(id->sn, sizeof(id->sn), "%llx", serial);
+        snprintf(id->sn, sizeof(id->sn), "%llx", ctrl->serial);
 
         memset(id->mn, ' ', sizeof(id->mn));
         strncpy((char *)id->mn, "Linux", sizeof(id->mn));
diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 8a891ca53367..6559d5afa7bf 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -13,6 +13,7 @@
  */
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
+#include <linux/random.h>
 #include "nvmet.h"
 
 static struct nvmet_fabrics_ops *nvmet_transports[NVMF_TRTYPE_MAX];
@@ -728,6 +729,9 @@ u16 nvmet_alloc_ctrl(const char *subsysnqn, const char *hostnqn,
         memcpy(ctrl->subsysnqn, subsysnqn, NVMF_NQN_SIZE);
         memcpy(ctrl->hostnqn, hostnqn, NVMF_NQN_SIZE);
 
+        /* generate a random serial number as our controllers are ephemeral: */
+        get_random_bytes(&ctrl->serial, sizeof(ctrl->serial));
+
         kref_init(&ctrl->ref);
         ctrl->subsys = subsys;
 
diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c
index 94e782987cc9..395e60dad835 100644
--- a/drivers/nvme/target/loop.c
+++ b/drivers/nvme/target/loop.c
@@ -414,9 +414,8 @@ static void nvme_loop_del_ctrl_work(struct work_struct *work)
         struct nvme_loop_ctrl *ctrl = container_of(work,
                                 struct nvme_loop_ctrl, delete_work);
 
-        nvme_remove_namespaces(&ctrl->ctrl);
-        nvme_loop_shutdown_ctrl(ctrl);
         nvme_uninit_ctrl(&ctrl->ctrl);
+        nvme_loop_shutdown_ctrl(ctrl);
         nvme_put_ctrl(&ctrl->ctrl);
 }
 
@@ -501,7 +500,6 @@ out_free_queues:
         nvme_loop_destroy_admin_queue(ctrl);
 out_disable:
         dev_warn(ctrl->ctrl.device, "Removing after reset failure\n");
-        nvme_remove_namespaces(&ctrl->ctrl);
         nvme_uninit_ctrl(&ctrl->ctrl);
         nvme_put_ctrl(&ctrl->ctrl);
 }
@@ -558,7 +556,7 @@ static int nvme_loop_create_io_queues(struct nvme_loop_ctrl *ctrl)
 
         memset(&ctrl->tag_set, 0, sizeof(ctrl->tag_set));
         ctrl->tag_set.ops = &nvme_loop_mq_ops;
-        ctrl->tag_set.queue_depth = ctrl->ctrl.sqsize;
+        ctrl->tag_set.queue_depth = ctrl->ctrl.opts->queue_size;
         ctrl->tag_set.reserved_tags = 1; /* fabric connect */
         ctrl->tag_set.numa_node = NUMA_NO_NODE;
         ctrl->tag_set.flags = BLK_MQ_F_SHOULD_MERGE;
@@ -622,7 +620,7 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
 
         ret = -ENOMEM;
 
-        ctrl->ctrl.sqsize = opts->queue_size;
+        ctrl->ctrl.sqsize = opts->queue_size - 1;
         ctrl->ctrl.kato = opts->kato;
 
         ctrl->queues = kcalloc(opts->nr_io_queues + 1, sizeof(*ctrl->queues),
diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h
index 57dd6d834c28..76b6eedccaf9 100644
--- a/drivers/nvme/target/nvmet.h
+++ b/drivers/nvme/target/nvmet.h
@@ -113,6 +113,7 @@ struct nvmet_ctrl {
 
         struct mutex            lock;
         u64                     cap;
+        u64                     serial;
         u32                     cc;
         u32                     csts;
 
diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c
index e06d504bdf0c..1cbe6e053b5b 100644
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -77,6 +77,7 @@ enum nvmet_rdma_queue_state {
         NVMET_RDMA_Q_CONNECTING,
         NVMET_RDMA_Q_LIVE,
         NVMET_RDMA_Q_DISCONNECTING,
+        NVMET_RDMA_IN_DEVICE_REMOVAL,
 };
 
 struct nvmet_rdma_queue {
@@ -615,15 +616,10 @@ static u16 nvmet_rdma_map_sgl_keyed(struct nvmet_rdma_rsp *rsp,
         if (!len)
                 return 0;
 
-        /* use the already allocated data buffer if possible */
-        if (len <= NVMET_RDMA_INLINE_DATA_SIZE && rsp->queue->host_qid) {
-                nvmet_rdma_use_inline_sg(rsp, len, 0);
-        } else {
-                status = nvmet_rdma_alloc_sgl(&rsp->req.sg, &rsp->req.sg_cnt,
-                                len);
-                if (status)
-                        return status;
-        }
+        status = nvmet_rdma_alloc_sgl(&rsp->req.sg, &rsp->req.sg_cnt,
+                        len);
+        if (status)
+                return status;
 
         ret = rdma_rw_ctx_init(&rsp->rw, cm_id->qp, cm_id->port_num,
                         rsp->req.sg, rsp->req.sg_cnt, 0, addr, key,
@@ -982,9 +978,13 @@ static void nvmet_rdma_release_queue_work(struct work_struct *w)
                 container_of(w, struct nvmet_rdma_queue, release_work);
         struct rdma_cm_id *cm_id = queue->cm_id;
         struct nvmet_rdma_device *dev = queue->dev;
+        enum nvmet_rdma_queue_state state = queue->state;
 
         nvmet_rdma_free_queue(queue);
-        rdma_destroy_id(cm_id);
+
+        if (state != NVMET_RDMA_IN_DEVICE_REMOVAL)
+                rdma_destroy_id(cm_id);
+
         kref_put(&dev->ref, nvmet_rdma_free_dev);
 }
 
@@ -1004,10 +1004,10 @@ nvmet_rdma_parse_cm_connect_req(struct rdma_conn_param *conn,
         queue->host_qid = le16_to_cpu(req->qid);
 
         /*
-         * req->hsqsize corresponds to our recv queue size
+         * req->hsqsize corresponds to our recv queue size plus 1
          * req->hrqsize corresponds to our send queue size
          */
-        queue->recv_queue_size = le16_to_cpu(req->hsqsize);
+        queue->recv_queue_size = le16_to_cpu(req->hsqsize) + 1;
         queue->send_queue_size = le16_to_cpu(req->hrqsize);
 
         if (!queue->host_qid && queue->recv_queue_size > NVMF_AQ_DEPTH)
@@ -1233,8 +1233,9 @@ static void __nvmet_rdma_queue_disconnect(struct nvmet_rdma_queue *queue)
         switch (queue->state) {
         case NVMET_RDMA_Q_CONNECTING:
         case NVMET_RDMA_Q_LIVE:
-                disconnect = true;
                 queue->state = NVMET_RDMA_Q_DISCONNECTING;
+        case NVMET_RDMA_IN_DEVICE_REMOVAL:
+                disconnect = true;
                 break;
         case NVMET_RDMA_Q_DISCONNECTING:
                 break;
@@ -1272,6 +1273,62 @@ static void nvmet_rdma_queue_connect_fail(struct rdma_cm_id *cm_id,
         schedule_work(&queue->release_work);
 }
 
+/**
+ * nvme_rdma_device_removal() - Handle RDMA device removal
+ * @queue:      nvmet rdma queue (cm id qp_context)
+ * @addr:       nvmet address (cm_id context)
+ *
+ * DEVICE_REMOVAL event notifies us that the RDMA device is about
+ * to unplug so we should take care of destroying our RDMA resources.
+ * This event will be generated for each allocated cm_id.
+ *
+ * Note that this event can be generated on a normal queue cm_id
+ * and/or a device bound listener cm_id (where in this case
+ * queue will be null).
+ *
+ * we claim ownership on destroying the cm_id. For queues we move
+ * the queue state to NVMET_RDMA_IN_DEVICE_REMOVAL and for port
+ * we nullify the priv to prevent double cm_id destruction and destroying
+ * the cm_id implicitely by returning a non-zero rc to the callout.
+ */
+static int nvmet_rdma_device_removal(struct rdma_cm_id *cm_id,
+                struct nvmet_rdma_queue *queue)
+{
+        unsigned long flags;
+
+        if (!queue) {
+                struct nvmet_port *port = cm_id->context;
+
+                /*
+                 * This is a listener cm_id. Make sure that
+                 * future remove_port won't invoke a double
+                 * cm_id destroy. use atomic xchg to make sure
+                 * we don't compete with remove_port.
+                 */
+                if (xchg(&port->priv, NULL) != cm_id)
+                        return 0;
+        } else {
+                /*
+                 * This is a queue cm_id. Make sure that
+                 * release queue will not destroy the cm_id
+                 * and schedule all ctrl queues removal (only
+                 * if the queue is not disconnecting already).
+                 */
+                spin_lock_irqsave(&queue->state_lock, flags);
+                if (queue->state != NVMET_RDMA_Q_DISCONNECTING)
+                        queue->state = NVMET_RDMA_IN_DEVICE_REMOVAL;
+                spin_unlock_irqrestore(&queue->state_lock, flags);
+                nvmet_rdma_queue_disconnect(queue);
+                flush_scheduled_work();
+        }
+
+        /*
+         * We need to return 1 so that the core will destroy
+         * it's own ID.  What a great API design..
+         */
+        return 1;
+}
+
 static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 struct rdma_cm_event *event)
 {
@@ -1294,20 +1351,11 @@ static int nvmet_rdma_cm_handler(struct rdma_cm_id *cm_id,
                 break;
         case RDMA_CM_EVENT_ADDR_CHANGE:
         case RDMA_CM_EVENT_DISCONNECTED:
-        case RDMA_CM_EVENT_DEVICE_REMOVAL:
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:
-                /*
-                 * We can get the device removal callback even for a
-                 * CM ID that we aren't actually using.  In that case
-                 * the context pointer is NULL, so we shouldn't try
-                 * to disconnect a non-existing queue.  But we also
-                 * need to return 1 so that the core will destroy
-                 * it's own ID.  What a great API design..
-                 */
-                if (queue)
-                        nvmet_rdma_queue_disconnect(queue);
-                else
-                        ret = 1;
+                nvmet_rdma_queue_disconnect(queue);
+                break;
+        case RDMA_CM_EVENT_DEVICE_REMOVAL:
+                ret = nvmet_rdma_device_removal(cm_id, queue);
                 break;
         case RDMA_CM_EVENT_REJECTED:
         case RDMA_CM_EVENT_UNREACHABLE:
@@ -1396,9 +1444,10 @@ out_destroy_id:
 
 static void nvmet_rdma_remove_port(struct nvmet_port *port)
 {
-        struct rdma_cm_id *cm_id = port->priv;
+        struct rdma_cm_id *cm_id = xchg(&port->priv, NULL);
 
-        rdma_destroy_id(cm_id);
+        if (cm_id)
+                rdma_destroy_id(cm_id);
 }
 
 static struct nvmet_fabrics_ops nvmet_rdma_ops = {
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 7792266db259..3ce69536a7b3 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1631,8 +1631,7 @@ static int __of_parse_phandle_with_args(const struct device_node *np,
          */
 
  err:
-        if (it.node)
-                of_node_put(it.node);
+        of_node_put(it.node);
         return rc;
 }
 
@@ -2343,20 +2342,13 @@ struct device_node *of_graph_get_endpoint_by_regs(
         const struct device_node *parent, int port_reg, int reg)
 {
         struct of_endpoint endpoint;
-        struct device_node *node, *prev_node = NULL;
-
-        while (1) {
-                node = of_graph_get_next_endpoint(parent, prev_node);
-                of_node_put(prev_node);
-                if (!node)
-                        break;
+        struct device_node *node = NULL;
 
+        for_each_endpoint_of_node(parent, node) {
                 of_graph_parse_endpoint(node, &endpoint);
                 if (((port_reg == -1) || (endpoint.port == port_reg)) &&
                         ((reg == -1) || (endpoint.id == reg)))
                         return node;
-
-                prev_node = node;
         }
 
         return NULL;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 55f1b8391149..085c6389afd1 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -517,7 +517,7 @@ static void *__unflatten_device_tree(const void *blob,
                 pr_warning("End of tree marker overwritten: %08x\n",
                            be32_to_cpup(mem + size));
 
-        if (detached) {
+        if (detached && mynodes) {
                 of_node_set_flag(*mynodes, OF_DETACHED);
                 pr_debug("unflattened tree is detached\n");
         }
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 89a71c6074fc..a2e68f740eda 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -544,12 +544,15 @@ void __init of_irq_init(const struct of_device_id *matches)
 
                         list_del(&desc->list);
 
+                        of_node_set_flag(desc->dev, OF_POPULATED);
+
                         pr_debug("of_irq_init: init %s (%p), parent %p\n",
                                  desc->dev->full_name,
                                  desc->dev, desc->interrupt_parent);
                         ret = desc->irq_init_cb(desc->dev,
                                                 desc->interrupt_parent);
                         if (ret) {
+                                of_node_clear_flag(desc->dev, OF_POPULATED);
                                 kfree(desc);
                                 continue;
                         }
@@ -559,8 +562,6 @@ void __init of_irq_init(const struct of_device_id *matches)
                          * its children can get processed in a subsequent pass.
                          */
                         list_add_tail(&desc->list, &intc_parent_list);
-
-                        of_node_set_flag(desc->dev, OF_POPULATED);
                 }
 
                 /* Get the next pending parent that might have children */
diff --git a/drivers/of/platform.c b/drivers/of/platform.c
index 8aa197691074..f39ccd5aa701 100644
--- a/drivers/of/platform.c
+++ b/drivers/of/platform.c
@@ -497,6 +497,7 @@ int of_platform_default_populate(struct device_node *root,
 }
 EXPORT_SYMBOL_GPL(of_platform_default_populate);
 
+#ifndef CONFIG_PPC
 static int __init of_platform_default_populate_init(void)
 {
         struct device_node *node;
@@ -521,6 +522,7 @@ static int __init of_platform_default_populate_init(void)
         return 0;
 }
 arch_initcall_sync(of_platform_default_populate_init);
+#endif
 
 static int of_platform_device_destroy(struct device *dev, void *data)
 {
diff --git a/drivers/pci/host-bridge.c b/drivers/pci/host-bridge.c
index 5f4a2e04c8d7..add66236215c 100644
--- a/drivers/pci/host-bridge.c
+++ b/drivers/pci/host-bridge.c
@@ -44,6 +44,7 @@ void pci_set_host_bridge_release(struct pci_host_bridge *bridge,
         bridge->release_fn = release_fn;
         bridge->release_data = release_data;
 }
+EXPORT_SYMBOL_GPL(pci_set_host_bridge_release);
 
 void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
                              struct resource *res)
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index a02981efdad5..98f12223c734 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -1069,7 +1069,7 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
                 nvec = maxvec;
 
         for (;;) {
-                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                if (flags & PCI_IRQ_AFFINITY) {
                         dev->irq_affinity = irq_create_affinity_mask(&nvec);
                         if (nvec < minvec)
                                 return -ENOSPC;
@@ -1105,7 +1105,7 @@ static int __pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec,
  **/
 int pci_enable_msi_range(struct pci_dev *dev, int minvec, int maxvec)
 {
-        return __pci_enable_msi_range(dev, minvec, maxvec, PCI_IRQ_NOAFFINITY);
+        return __pci_enable_msi_range(dev, minvec, maxvec, 0);
 }
 EXPORT_SYMBOL(pci_enable_msi_range);
 
@@ -1120,7 +1120,7 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
                 return -ERANGE;
 
         for (;;) {
-                if (!(flags & PCI_IRQ_NOAFFINITY)) {
+                if (flags & PCI_IRQ_AFFINITY) {
                         dev->irq_affinity = irq_create_affinity_mask(&nvec);
                         if (nvec < minvec)
                                 return -ENOSPC;
@@ -1160,8 +1160,7 @@ static int __pci_enable_msix_range(struct pci_dev *dev,
 int pci_enable_msix_range(struct pci_dev *dev, struct msix_entry *entries,
                 int minvec, int maxvec)
 {
-        return __pci_enable_msix_range(dev, entries, minvec, maxvec,
-                        PCI_IRQ_NOAFFINITY);
+        return __pci_enable_msix_range(dev, entries, minvec, maxvec, 0);
 }
 EXPORT_SYMBOL(pci_enable_msix_range);
 
@@ -1187,22 +1186,25 @@ int pci_alloc_irq_vectors(struct pci_dev *dev, unsigned int min_vecs,
 {
         int vecs = -ENOSPC;
 
-        if (!(flags & PCI_IRQ_NOMSIX)) {
+        if (flags & PCI_IRQ_MSIX) {
                 vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
                                 flags);
                 if (vecs > 0)
                         return vecs;
         }
 
-        if (!(flags & PCI_IRQ_NOMSI)) {
+        if (flags & PCI_IRQ_MSI) {
                 vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, flags);
                 if (vecs > 0)
                         return vecs;
         }
 
         /* use legacy irq if allowed */
-        if (!(flags & PCI_IRQ_NOLEGACY) && min_vecs == 1)
+        if ((flags & PCI_IRQ_LEGACY) && min_vecs == 1) {
+                pci_intx(dev, 1);
                 return 1;
+        }
+
         return vecs;
 }
 EXPORT_SYMBOL(pci_alloc_irq_vectors);
@@ -1411,6 +1413,8 @@ struct irq_domain *pci_msi_create_irq_domain(struct fwnode_handle *fwnode,
         if (info->flags & MSI_FLAG_USE_DEF_CHIP_OPS)
                 pci_msi_domain_update_chip_ops(info);
 
+        info->flags |= MSI_FLAG_ACTIVATE_EARLY;
+
         domain = msi_create_irq_domain(fwnode, info, parent);
         if (!domain)
                 return NULL;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 37ff0158e45f..44e0ff37480b 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3327,9 +3327,9 @@ static void quirk_apple_wait_for_thunderbolt(struct pci_dev *dev)
         if (nhi->vendor != PCI_VENDOR_ID_INTEL
                     || (nhi->device != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
                         nhi->device != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
+                        nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI &&
                         nhi->device != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI)
-                    || nhi->subsystem_vendor != 0x2222
-                    || nhi->subsystem_device != 0x1111)
+                    || nhi->class != PCI_CLASS_SYSTEM_OTHER << 8)
                 goto out;
         dev_info(&dev->dev, "quirk: waiting for thunderbolt to reestablish PCI tunnels...\n");
         device_pm_wait_for_dev(&dev->dev, &nhi->dev);
@@ -3344,6 +3344,9 @@ DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                                PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C,
                                quirk_apple_wait_for_thunderbolt);
 DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
+                               PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE,
+                               quirk_apple_wait_for_thunderbolt);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_INTEL,
                                PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE,
                                quirk_apple_wait_for_thunderbolt);
 #endif
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index d1ef7acf6930..f9357e09e9b3 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -40,6 +40,7 @@ static void pci_destroy_dev(struct pci_dev *dev)
         list_del(&dev->bus_list);
         up_write(&pci_bus_sem);
 
+        pci_bridge_d3_device_removed(dev);
         pci_free_resources(dev);
         put_device(&dev->dev);
 }
@@ -96,8 +97,6 @@ static void pci_remove_bus_device(struct pci_dev *dev)
                 dev->subordinate = NULL;
         }
 
-        pci_bridge_d3_device_removed(dev);
-
         pci_destroy_dev(dev);
 }
 
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index 489ea1098c96..69b5e811ea2b 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -977,7 +977,7 @@ static int pcmcia_bus_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 /************************ runtime PM support ***************************/
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state);
+static int pcmcia_dev_suspend(struct device *dev);
 static int pcmcia_dev_resume(struct device *dev);
 
 static int runtime_suspend(struct device *dev)
@@ -985,7 +985,7 @@ static int runtime_suspend(struct device *dev)
         int rc;
 
         device_lock(dev);
-        rc = pcmcia_dev_suspend(dev, PMSG_SUSPEND);
+        rc = pcmcia_dev_suspend(dev);
         device_unlock(dev);
         return rc;
 }
@@ -1135,7 +1135,7 @@ ATTRIBUTE_GROUPS(pcmcia_dev);
 
 /* PM support, also needed for reset */
 
-static int pcmcia_dev_suspend(struct device *dev, pm_message_t state)
+static int pcmcia_dev_suspend(struct device *dev)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
         struct pcmcia_driver *p_drv = NULL;
@@ -1410,6 +1410,9 @@ static struct class_interface pcmcia_bus_interface __refdata = {
         .remove_dev = &pcmcia_bus_remove_socket,
 };
 
+static const struct dev_pm_ops pcmcia_bus_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(pcmcia_dev_suspend, pcmcia_dev_resume)
+};
 
 struct bus_type pcmcia_bus_type = {
         .name = "pcmcia",
@@ -1418,8 +1421,7 @@ struct bus_type pcmcia_bus_type = {
         .dev_groups = pcmcia_dev_groups,
         .probe = pcmcia_device_probe,
         .remove = pcmcia_device_remove,
-        .suspend = pcmcia_dev_suspend,
-        .resume = pcmcia_dev_resume,
+        .pm = &pcmcia_bus_pm_ops,
 };
 
 
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index 483f919e0d2e..91b5f5724cba 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -214,9 +214,8 @@ pxa2xx_pcmcia_frequency_change(struct soc_pcmcia_socket *skt,
 }
 #endif
 
-void pxa2xx_configure_sockets(struct device *dev)
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops)
 {
-        struct pcmcia_low_level *ops = dev->platform_data;
         /*
          * We have at least one socket, so set MECR:CIT
          * (Card Is There)
@@ -322,7 +321,7 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                         goto err1;
         }
 
-        pxa2xx_configure_sockets(&dev->dev);
+        pxa2xx_configure_sockets(&dev->dev, ops);
         dev_set_drvdata(&dev->dev, sinfo);
 
         return 0;
@@ -348,7 +347,9 @@ static int pxa2xx_drv_pcmcia_remove(struct platform_device *dev)
 
 static int pxa2xx_drv_pcmcia_resume(struct device *dev)
 {
-        pxa2xx_configure_sockets(dev);
+        struct pcmcia_low_level *ops = (struct pcmcia_low_level *)dev->platform_data;
+
+        pxa2xx_configure_sockets(dev, ops);
         return 0;
 }
 
diff --git a/drivers/pcmcia/pxa2xx_base.h b/drivers/pcmcia/pxa2xx_base.h
index b609b45469ed..e58c7a415418 100644
--- a/drivers/pcmcia/pxa2xx_base.h
+++ b/drivers/pcmcia/pxa2xx_base.h
@@ -1,4 +1,4 @@
 int pxa2xx_drv_pcmcia_add_one(struct soc_pcmcia_socket *skt);
 void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops);
-void pxa2xx_configure_sockets(struct device *dev);
+void pxa2xx_configure_sockets(struct device *dev, struct pcmcia_low_level *ops);
 
diff --git a/drivers/pcmcia/sa1111_badge4.c b/drivers/pcmcia/sa1111_badge4.c
index 12f0dd091477..2f490930430d 100644
--- a/drivers/pcmcia/sa1111_badge4.c
+++ b/drivers/pcmcia/sa1111_badge4.c
@@ -134,20 +134,14 @@ static struct pcmcia_low_level badge4_pcmcia_ops = {
 
 int pcmcia_badge4_init(struct sa1111_dev *dev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_badge4()) {
-                printk(KERN_INFO
-                       "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
-                       __func__,
-                       badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
-
-                sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
-                ret = sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        printk(KERN_INFO
+               "%s: badge4_pcmvcc=%d, badge4_pcmvpp=%d, badge4_cfvcc=%d\n",
+               __func__,
+               badge4_pcmvcc, badge4_pcmvpp, badge4_cfvcc);
+
+        sa11xx_drv_pcmcia_ops(&badge4_pcmcia_ops);
+        return sa1111_pcmcia_add(dev, &badge4_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
 
 static int __init pcmv_setup(char *s)
diff --git a/drivers/pcmcia/sa1111_generic.c b/drivers/pcmcia/sa1111_generic.c
index a1531feb8460..3d95dffcff7a 100644
--- a/drivers/pcmcia/sa1111_generic.c
+++ b/drivers/pcmcia/sa1111_generic.c
@@ -18,6 +18,7 @@
 
 #include <mach/hardware.h>
 #include <asm/hardware/sa1111.h>
+#include <asm/mach-types.h>
 #include <asm/irq.h>
 
 #include "sa1111_generic.h"
@@ -203,19 +204,30 @@ static int pcmcia_probe(struct sa1111_dev *dev)
         sa1111_writel(PCSSR_S0_SLEEP | PCSSR_S1_SLEEP, base + PCSSR);
         sa1111_writel(PCCR_S0_FLT | PCCR_S1_FLT, base + PCCR);
 
+        ret = -ENODEV;
 #ifdef CONFIG_SA1100_BADGE4
-        pcmcia_badge4_init(dev);
+        if (machine_is_badge4())
+                ret = pcmcia_badge4_init(dev);
 #endif
 #ifdef CONFIG_SA1100_JORNADA720
-        pcmcia_jornada720_init(dev);
+        if (machine_is_jornada720())
+                ret = pcmcia_jornada720_init(dev);
 #endif
 #ifdef CONFIG_ARCH_LUBBOCK
-        pcmcia_lubbock_init(dev);
+        if (machine_is_lubbock())
+                ret = pcmcia_lubbock_init(dev);
 #endif
 #ifdef CONFIG_ASSABET_NEPONSET
-        pcmcia_neponset_init(dev);
+        if (machine_is_assabet())
+                ret = pcmcia_neponset_init(dev);
 #endif
-        return 0;
+
+        if (ret) {
+                release_mem_region(dev->res.start, 512);
+                sa1111_disable_device(dev);
+        }
+
+        return ret;
 }
 
 static int pcmcia_remove(struct sa1111_dev *dev)
diff --git a/drivers/pcmcia/sa1111_jornada720.c b/drivers/pcmcia/sa1111_jornada720.c
index c2c30580c83f..480a3ede27c8 100644
--- a/drivers/pcmcia/sa1111_jornada720.c
+++ b/drivers/pcmcia/sa1111_jornada720.c
@@ -94,22 +94,17 @@ static struct pcmcia_low_level jornada720_pcmcia_ops = {
 
 int pcmcia_jornada720_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
+        unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
 
-        if (machine_is_jornada720()) {
-                unsigned int pin = GPIO_A0 | GPIO_A1 | GPIO_A2 | GPIO_A3;
+        /* Fixme: why messing around with SA11x0's GPIO1? */
+        GRER |= 0x00000002;
 
-                GRER |= 0x00000002;
+        /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
+        sa1111_set_io_dir(sadev, pin, 0, 0);
+        sa1111_set_io(sadev, pin, 0);
+        sa1111_set_sleep_io(sadev, pin, 0);
 
-                /* Set GPIO_A<3:1> to be outputs for PCMCIA/CF power controller: */
-                sa1111_set_io_dir(sadev, pin, 0, 0);
-                sa1111_set_io(sadev, pin, 0);
-                sa1111_set_sleep_io(sadev, pin, 0);
-
-                sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        sa11xx_drv_pcmcia_ops(&jornada720_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &jornada720_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
diff --git a/drivers/pcmcia/sa1111_lubbock.c b/drivers/pcmcia/sa1111_lubbock.c
index c5caf5790451..e741f499c875 100644
--- a/drivers/pcmcia/sa1111_lubbock.c
+++ b/drivers/pcmcia/sa1111_lubbock.c
@@ -210,27 +210,21 @@ static struct pcmcia_low_level lubbock_pcmcia_ops = {
 
 int pcmcia_lubbock_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_lubbock()) {
-                /*
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
-                 * and switch to standby mode.
-                 */
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-
-                /* Set CF Socket 1 power to standby mode. */
-                lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
+         * and switch to standby mode.
+         */
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
 
-                pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
-                pxa2xx_configure_sockets(&sadev->dev);
-                ret = sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
-                                pxa2xx_drv_pcmcia_add_one);
-        }
+        /* Set CF Socket 1 power to standby mode. */
+        lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
 
-        return ret;
+        pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
+        pxa2xx_configure_sockets(&sadev->dev, &lubbock_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
+                                 pxa2xx_drv_pcmcia_add_one);
 }
 
 MODULE_LICENSE("GPL");
diff --git a/drivers/pcmcia/sa1111_neponset.c b/drivers/pcmcia/sa1111_neponset.c
index 1d78739c4c07..019c395eb4bf 100644
--- a/drivers/pcmcia/sa1111_neponset.c
+++ b/drivers/pcmcia/sa1111_neponset.c
@@ -110,20 +110,14 @@ static struct pcmcia_low_level neponset_pcmcia_ops = {
 
 int pcmcia_neponset_init(struct sa1111_dev *sadev)
 {
-        int ret = -ENODEV;
-
-        if (machine_is_assabet()) {
-                /*
-                 * Set GPIO_A<3:0> to be outputs for the MAX1600,
-                 * and switch to standby mode.
-                 */
-                sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
-                sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
-                sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
-                ret = sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
-                                sa11xx_drv_pcmcia_add_one);
-        }
-
-        return ret;
+        /*
+         * Set GPIO_A<3:0> to be outputs for the MAX1600,
+         * and switch to standby mode.
+         */
+        sa1111_set_io_dir(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0, 0);
+        sa1111_set_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa1111_set_sleep_io(sadev, GPIO_A0|GPIO_A1|GPIO_A2|GPIO_A3, 0);
+        sa11xx_drv_pcmcia_ops(&neponset_pcmcia_ops);
+        return sa1111_pcmcia_add(sadev, &neponset_pcmcia_ops,
+                                 sa11xx_drv_pcmcia_add_one);
 }
diff --git a/drivers/pcmcia/sa11xx_base.c b/drivers/pcmcia/sa11xx_base.c
index 9f6ec87b9f9e..48140ac73ed6 100644
--- a/drivers/pcmcia/sa11xx_base.c
+++ b/drivers/pcmcia/sa11xx_base.c
@@ -144,19 +144,19 @@ static int
 sa1100_pcmcia_show_timing(struct soc_pcmcia_socket *skt, char *buf)
 {
         struct soc_pcmcia_timing timing;
-        unsigned int clock = clk_get_rate(skt->clk);
+        unsigned int clock = clk_get_rate(skt->clk) / 1000;
         unsigned long mecr = MECR;
         char *p = buf;
 
         soc_common_pcmcia_get_timing(skt, &timing);
 
-        p+=sprintf(p, "I/O      : %u (%u)\n", timing.io,
+        p+=sprintf(p, "I/O      : %uns (%uns)\n", timing.io,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSIO_GET(mecr, skt->nr)));
 
-        p+=sprintf(p, "attribute: %u (%u)\n", timing.attr,
+        p+=sprintf(p, "attribute: %uns (%uns)\n", timing.attr,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSA_GET(mecr, skt->nr)));
 
-        p+=sprintf(p, "common   : %u (%u)\n", timing.mem,
+        p+=sprintf(p, "common   : %uns (%uns)\n", timing.mem,
                    sa1100_pcmcia_cmd_time(clock, MECR_BSM_GET(mecr, skt->nr)));
 
         return p - buf;
diff --git a/drivers/pcmcia/soc_common.c b/drivers/pcmcia/soc_common.c
index eed5e9c05353..d5ca760c4eb2 100644
--- a/drivers/pcmcia/soc_common.c
+++ b/drivers/pcmcia/soc_common.c
@@ -235,7 +235,7 @@ static unsigned int soc_common_pcmcia_skt_state(struct soc_pcmcia_socket *skt)
         stat |= skt->cs_state.Vcc ? SS_POWERON : 0;
 
         if (skt->cs_state.flags & SS_IOCARD)
-                stat |= state.bvd1 ? SS_STSCHG : 0;
+                stat |= state.bvd1 ? 0 : SS_STSCHG;
         else {
                 if (state.bvd1 == 0)
                         stat |= SS_BATDEAD;
diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
index 6ccb994bdfcb..f5e1008a223d 100644
--- a/drivers/perf/arm_pmu.c
+++ b/drivers/perf/arm_pmu.c
@@ -688,7 +688,7 @@ static int cpu_pmu_request_irq(struct arm_pmu *cpu_pmu, irq_handler_t handler)
         return 0;
 }
 
-static DEFINE_MUTEX(arm_pmu_mutex);
+static DEFINE_SPINLOCK(arm_pmu_lock);
 static LIST_HEAD(arm_pmu_list);
 
 /*
@@ -701,7 +701,7 @@ static int arm_perf_starting_cpu(unsigned int cpu)
 {
         struct arm_pmu *pmu;
 
-        mutex_lock(&arm_pmu_mutex);
+        spin_lock(&arm_pmu_lock);
         list_for_each_entry(pmu, &arm_pmu_list, entry) {
 
                 if (!cpumask_test_cpu(cpu, &pmu->supported_cpus))
@@ -709,7 +709,7 @@ static int arm_perf_starting_cpu(unsigned int cpu)
                 if (pmu->reset)
                         pmu->reset(pmu);
         }
-        mutex_unlock(&arm_pmu_mutex);
+        spin_unlock(&arm_pmu_lock);
         return 0;
 }
 
@@ -821,9 +821,9 @@ static int cpu_pmu_init(struct arm_pmu *cpu_pmu)
         if (!cpu_hw_events)
                 return -ENOMEM;
 
-        mutex_lock(&arm_pmu_mutex);
+        spin_lock(&arm_pmu_lock);
         list_add_tail(&cpu_pmu->entry, &arm_pmu_list);
-        mutex_unlock(&arm_pmu_mutex);
+        spin_unlock(&arm_pmu_lock);
 
         err = cpu_pm_pmu_register(cpu_pmu);
         if (err)
@@ -859,9 +859,9 @@ static int cpu_pmu_init(struct arm_pmu *cpu_pmu)
         return 0;
 
 out_unregister:
-        mutex_lock(&arm_pmu_mutex);
+        spin_lock(&arm_pmu_lock);
         list_del(&cpu_pmu->entry);
-        mutex_unlock(&arm_pmu_mutex);
+        spin_unlock(&arm_pmu_lock);
         free_percpu(cpu_hw_events);
         return err;
 }
@@ -869,9 +869,9 @@ out_unregister:
 static void cpu_pmu_destroy(struct arm_pmu *cpu_pmu)
 {
         cpu_pm_pmu_unregister(cpu_pmu);
-        mutex_lock(&arm_pmu_mutex);
+        spin_lock(&arm_pmu_lock);
         list_del(&cpu_pmu->entry);
-        mutex_unlock(&arm_pmu_mutex);
+        spin_unlock(&arm_pmu_lock);
         free_percpu(cpu_pmu->hw_events);
 }
 
@@ -925,6 +925,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
                         if (i > 0 && spi != using_spi) {
                                 pr_err("PPI/SPI IRQ type mismatch for %s!\n",
                                         dn->name);
+                                of_node_put(dn);
                                 kfree(irqs);
                                 return -EINVAL;
                         }
@@ -967,11 +968,12 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
 
         /* If we didn't manage to parse anything, try the interrupt affinity */
         if (cpumask_weight(&pmu->supported_cpus) == 0) {
-                if (!using_spi) {
+                int irq = platform_get_irq(pdev, 0);
+
+                if (irq >= 0 && irq_is_percpu(irq)) {
                         /* If using PPIs, check the affinity of the partition */
-                        int ret, irq;
+                        int ret;
 
-                        irq = platform_get_irq(pdev, 0);
                         ret = irq_get_percpu_devid_partition(irq, &pmu->supported_cpus);
                         if (ret) {
                                 kfree(irqs);
diff --git a/drivers/phy/phy-brcm-sata.c b/drivers/phy/phy-brcm-sata.c
index 18d662610075..8ffc44afdb75 100644
--- a/drivers/phy/phy-brcm-sata.c
+++ b/drivers/phy/phy-brcm-sata.c
@@ -367,7 +367,7 @@ static int brcm_sata_phy_init(struct phy *phy)
                 rc = -ENODEV;
         };
 
-        return 0;
+        return rc;
 }
 
 static const struct phy_ops phy_ops = {
diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c
index 0a45bc6088ae..8c7eb335622e 100644
--- a/drivers/phy/phy-sun4i-usb.c
+++ b/drivers/phy/phy-sun4i-usb.c
@@ -40,6 +40,7 @@
 #include <linux/power_supply.h>
 #include <linux/regulator/consumer.h>
 #include <linux/reset.h>
+#include <linux/usb/of.h>
 #include <linux/workqueue.h>
 
 #define REG_ISCR                        0x00
@@ -110,6 +111,7 @@ struct sun4i_usb_phy_cfg {
 struct sun4i_usb_phy_data {
         void __iomem *base;
         const struct sun4i_usb_phy_cfg *cfg;
+        enum usb_dr_mode dr_mode;
         struct mutex mutex;
         struct sun4i_usb_phy {
                 struct phy *phy;
@@ -120,6 +122,7 @@ struct sun4i_usb_phy_data {
                 bool regulator_on;
                 int index;
         } phys[MAX_PHYS];
+        int first_phy;
         /* phy0 / otg related variables */
         struct extcon_dev *extcon;
         bool phy0_init;
@@ -285,16 +288,10 @@ static int sun4i_usb_phy_init(struct phy *_phy)
                 sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_DPDM_PULLUP_EN);
                 sun4i_usb_phy0_update_iscr(_phy, 0, ISCR_ID_PULLUP_EN);
 
-                if (data->id_det_gpio) {
-                        /* OTG mode, force ISCR and cable state updates */
-                        data->id_det = -1;
-                        data->vbus_det = -1;
-                        queue_delayed_work(system_wq, &data->detect, 0);
-                } else {
-                        /* Host only mode */
-                        sun4i_usb_phy0_set_id_detect(_phy, 0);
-                        sun4i_usb_phy0_set_vbus_detect(_phy, 1);
-                }
+                /* Force ISCR and cable state updates */
+                data->id_det = -1;
+                data->vbus_det = -1;
+                queue_delayed_work(system_wq, &data->detect, 0);
         }
 
         return 0;
@@ -319,6 +316,19 @@ static int sun4i_usb_phy_exit(struct phy *_phy)
         return 0;
 }
 
+static int sun4i_usb_phy0_get_id_det(struct sun4i_usb_phy_data *data)
+{
+        switch (data->dr_mode) {
+        case USB_DR_MODE_OTG:
+                return gpiod_get_value_cansleep(data->id_det_gpio);
+        case USB_DR_MODE_HOST:
+                return 0;
+        case USB_DR_MODE_PERIPHERAL:
+        default:
+                return 1;
+        }
+}
+
 static int sun4i_usb_phy0_get_vbus_det(struct sun4i_usb_phy_data *data)
 {
         if (data->vbus_det_gpio)
@@ -432,7 +442,10 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
         struct phy *phy0 = data->phys[0].phy;
         int id_det, vbus_det, id_notify = 0, vbus_notify = 0;
 
-        id_det = gpiod_get_value_cansleep(data->id_det_gpio);
+        if (phy0 == NULL)
+                return;
+
+        id_det = sun4i_usb_phy0_get_id_det(data);
         vbus_det = sun4i_usb_phy0_get_vbus_det(data);
 
         mutex_lock(&phy0->mutex);
@@ -448,7 +461,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                  * without vbus detection report vbus low for long enough for
                  * the musb-ip to end the current device session.
                  */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 0) {
                         sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                         msleep(200);
                         sun4i_usb_phy0_set_vbus_detect(phy0, 1);
@@ -474,7 +488,8 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
                  * without vbus detection report vbus low for long enough to
                  * the musb-ip to end the current host session.
                  */
-                if (!sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
+                if (data->dr_mode == USB_DR_MODE_OTG &&
+                    !sun4i_usb_phy0_have_vbus_det(data) && id_det == 1) {
                         mutex_lock(&phy0->mutex);
                         sun4i_usb_phy0_set_vbus_detect(phy0, 0);
                         msleep(1000);
@@ -519,7 +534,8 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
 {
         struct sun4i_usb_phy_data *data = dev_get_drvdata(dev);
 
-        if (args->args[0] >= data->cfg->num_phys)
+        if (args->args[0] < data->first_phy ||
+            args->args[0] >= data->cfg->num_phys)
                 return ERR_PTR(-ENODEV);
 
         return data->phys[args->args[0]].phy;
@@ -593,13 +609,17 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                         return -EPROBE_DEFER;
         }
 
-        /* vbus_det without id_det makes no sense, and is not supported */
-        if (sun4i_usb_phy0_have_vbus_det(data) && !data->id_det_gpio) {
-                dev_err(dev, "usb0_id_det missing or invalid\n");
-                return -ENODEV;
-        }
-
-        if (data->id_det_gpio) {
+        data->dr_mode = of_usb_get_dr_mode_by_phy(np, 0);
+        switch (data->dr_mode) {
+        case USB_DR_MODE_OTG:
+                /* otg without id_det makes no sense, and is not supported */
+                if (!data->id_det_gpio) {
+                        dev_err(dev, "usb0_id_det missing or invalid\n");
+                        return -ENODEV;
+                }
+                /* fall through */
+        case USB_DR_MODE_HOST:
+        case USB_DR_MODE_PERIPHERAL:
                 data->extcon = devm_extcon_dev_allocate(dev,
                                                         sun4i_usb_phy0_cable);
                 if (IS_ERR(data->extcon))
@@ -610,9 +630,13 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
                         dev_err(dev, "failed to register extcon: %d\n", ret);
                         return ret;
                 }
+                break;
+        default:
+                dev_info(dev, "dr_mode unknown, not registering usb phy0\n");
+                data->first_phy = 1;
         }
 
-        for (i = 0; i < data->cfg->num_phys; i++) {
+        for (i = data->first_phy; i < data->cfg->num_phys; i++) {
                 struct sun4i_usb_phy *phy = data->phys + i;
                 char name[16];
 
diff --git a/drivers/phy/phy-sun9i-usb.c b/drivers/phy/phy-sun9i-usb.c
index ac4f31abefe3..28fce4bce638 100644
--- a/drivers/phy/phy-sun9i-usb.c
+++ b/drivers/phy/phy-sun9i-usb.c
@@ -141,9 +141,9 @@ static int sun9i_usb_phy_probe(struct platform_device *pdev)
                 }
 
                 phy->hsic_clk = devm_clk_get(dev, "hsic_12M");
-                if (IS_ERR(phy->clk)) {
+                if (IS_ERR(phy->hsic_clk)) {
                         dev_err(dev, "failed to get hsic_12M clock\n");
-                        return PTR_ERR(phy->clk);
+                        return PTR_ERR(phy->hsic_clk);
                 }
 
                 phy->reset = devm_reset_control_get(dev, "hsic");
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 5749a4eee746..0fe8fad25e4d 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1539,12 +1539,11 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
                 offset += range->npins;
         }
 
-        /* Mask and clear all interrupts */
-        chv_writel(0, pctrl->regs + CHV_INTMASK);
+        /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
         ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
-                                   handle_simple_irq, IRQ_TYPE_NONE);
+                                   handle_bad_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(pctrl->dev, "failed to add IRQ chip\n");
                 goto fail;
diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c
index eb4990ff26ca..7fb765642ee7 100644
--- a/drivers/pinctrl/intel/pinctrl-merrifield.c
+++ b/drivers/pinctrl/intel/pinctrl-merrifield.c
@@ -11,6 +11,7 @@
 
 #include <linux/bitops.h>
 #include <linux/err.h>
+#include <linux/io.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pinctrl/pinconf.h>
diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c
index 11623c6b0cb3..44e69c963f5d 100644
--- a/drivers/pinctrl/meson/pinctrl-meson.c
+++ b/drivers/pinctrl/meson/pinctrl-meson.c
@@ -727,13 +727,7 @@ static int meson_pinctrl_probe(struct platform_device *pdev)
                 return PTR_ERR(pc->pcdev);
         }
 
-        ret = meson_gpiolib_register(pc);
-        if (ret) {
-                pinctrl_unregister(pc->pcdev);
-                return ret;
-        }
-
-        return 0;
+        return meson_gpiolib_register(pc);
 }
 
 static struct platform_driver meson_pinctrl_driver = {
diff --git a/drivers/pinctrl/pinctrl-amd.c b/drivers/pinctrl/pinctrl-amd.c
index 634b4d30eefb..b3e772390ab6 100644
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -43,17 +43,6 @@ static int amd_gpio_direction_input(struct gpio_chip *gc, unsigned offset)
 
         spin_lock_irqsave(&gpio_dev->lock, flags);
         pin_reg = readl(gpio_dev->base + offset * 4);
-        /*
-         * Suppose BIOS or Bootloader sets specific debounce for the
-         * GPIO. if not, set debounce to be  2.75ms and remove glitch.
-        */
-        if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-                pin_reg |= 0xf;
-                pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-                pin_reg |= DB_TYPE_REMOVE_GLITCH << DB_CNTRL_OFF;
-                pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-        }
-
         pin_reg &= ~BIT(OUTPUT_ENABLE_OFF);
         writel(pin_reg, gpio_dev->base + offset * 4);
         spin_unlock_irqrestore(&gpio_dev->lock, flags);
@@ -326,15 +315,6 @@ static void amd_gpio_irq_enable(struct irq_data *d)
 
         spin_lock_irqsave(&gpio_dev->lock, flags);
         pin_reg = readl(gpio_dev->base + (d->hwirq)*4);
-        /*
-                Suppose BIOS or Bootloader sets specific debounce for the
-                GPIO. if not, set debounce to be  2.75ms.
-        */
-        if ((pin_reg & DB_TMR_OUT_MASK) == 0) {
-                pin_reg |= 0xf;
-                pin_reg |= BIT(DB_TMR_OUT_UNIT_OFF);
-                pin_reg &= ~BIT(DB_TMR_LARGE_OFF);
-        }
         pin_reg |= BIT(INTERRUPT_ENABLE_OFF);
         pin_reg |= BIT(INTERRUPT_MASK_OFF);
         writel(pin_reg, gpio_dev->base + (d->hwirq)*4);
diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
index c6d410ef8de0..55375b1b3cc8 100644
--- a/drivers/pinctrl/pinctrl-pistachio.c
+++ b/drivers/pinctrl/pinctrl-pistachio.c
@@ -809,17 +809,17 @@ static const struct pistachio_pin_group pistachio_groups[] = {
                            PADS_FUNCTION_SELECT2, 12, 0x3),
         MFIO_MUX_PIN_GROUP(83, MIPS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 14, 0x3),
-        MFIO_MUX_PIN_GROUP(84, SYS_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
+        MFIO_MUX_PIN_GROUP(84, AUDIO_PLL_LOCK, MIPS_TRACE_DATA, USB_DEBUG,
                            PADS_FUNCTION_SELECT2, 16, 0x3),
-        MFIO_MUX_PIN_GROUP(85, WIFI_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(85, RPU_V_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 18, 0x3),
-        MFIO_MUX_PIN_GROUP(86, BT_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
+        MFIO_MUX_PIN_GROUP(86, RPU_L_PLL_LOCK, MIPS_TRACE_DATA, SDHOST_DEBUG,
                            PADS_FUNCTION_SELECT2, 20, 0x3),
-        MFIO_MUX_PIN_GROUP(87, RPU_V_PLL_LOCK, DREQ2, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(87, SYS_PLL_LOCK, DREQ2, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 22, 0x3),
-        MFIO_MUX_PIN_GROUP(88, RPU_L_PLL_LOCK, DREQ3, SOCIF_DEBUG,
+        MFIO_MUX_PIN_GROUP(88, WIFI_PLL_LOCK, DREQ3, SOCIF_DEBUG,
                            PADS_FUNCTION_SELECT2, 24, 0x3),
-        MFIO_MUX_PIN_GROUP(89, AUDIO_PLL_LOCK, DREQ4, DREQ5,
+        MFIO_MUX_PIN_GROUP(89, BT_PLL_LOCK, DREQ4, DREQ5,
                            PADS_FUNCTION_SELECT2, 26, 0x3),
         PIN_GROUP(TCK, "tck"),
         PIN_GROUP(TRSTN, "trstn"),
@@ -1432,7 +1432,6 @@ static int pistachio_pinctrl_probe(struct platform_device *pdev)
 {
         struct pistachio_pinctrl *pctl;
         struct resource *res;
-        int ret;
 
         pctl = devm_kzalloc(&pdev->dev, sizeof(*pctl), GFP_KERNEL);
         if (!pctl)
@@ -1464,13 +1463,7 @@ static int pistachio_pinctrl_probe(struct platform_device *pdev)
                 return PTR_ERR(pctl->pctldev);
         }
 
-        ret = pistachio_gpio_register(pctl);
-        if (ret < 0) {
-                pinctrl_unregister(pctl->pctldev);
-                return ret;
-        }
-
-        return 0;
+        return pistachio_gpio_register(pctl);
 }
 
 static struct platform_driver pistachio_pinctrl_driver = {
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
index ce483b03a263..f9d661e5c14a 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a23.c
@@ -485,12 +485,12 @@ static const struct sunxi_desc_pin sun8i_a23_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 2, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
index 3040abe6f73a..3131cac2b76f 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
@@ -407,12 +407,12 @@ static const struct sunxi_desc_pin sun8i_a33_pins[] = {
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 8),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* RTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* RTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 8)),  /* PG_EINT8 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 9),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
                   SUNXI_FUNCTION(0x1, "gpio_out"),
-                  SUNXI_FUNCTION(0x2, "uart2"),         /* CTS */
+                  SUNXI_FUNCTION(0x2, "uart1"),         /* CTS */
                   SUNXI_FUNCTION_IRQ_BANK(0x4, 1, 9)),  /* PG_EINT9 */
         SUNXI_PIN(SUNXI_PINCTRL_PIN(G, 10),
                   SUNXI_FUNCTION(0x0, "gpio_in"),
diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c
index f99b183d5296..374a8028fec7 100644
--- a/drivers/platform/olpc/olpc-ec.c
+++ b/drivers/platform/olpc/olpc-ec.c
@@ -1,6 +1,8 @@
 /*
  * Generic driver for the OLPC Embedded Controller.
  *
+ * Author: Andres Salomon <dilinger@queued.net>
+ *
  * Copyright (C) 2011-2012 One Laptop per Child Foundation.
  *
  * Licensed under the GPL v2 or later.
@@ -12,7 +14,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 #include <linux/workqueue.h>
-#include <linux/module.h>
+#include <linux/init.h>
 #include <linux/list.h>
 #include <linux/olpc-ec.h>
 #include <asm/olpc.h>
@@ -326,8 +328,4 @@ static int __init olpc_ec_init_module(void)
 {
         return platform_driver_register(&olpc_ec_plat_driver);
 }
-
 arch_initcall(olpc_ec_init_module);
-
-MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
-MODULE_LICENSE("GPL");
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index d2bc092defd7..da2fe18162e1 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -110,8 +110,8 @@ static const struct key_entry dell_wmi_keymap_type_0000[] __initconst = {
         /* BIOS error detected */
         { KE_IGNORE, 0xe00d, { KEY_RESERVED } },
 
-        /* Unknown, defined in ACPI DSDT */
-        /* { KE_IGNORE, 0xe00e, { KEY_RESERVED } }, */
+        /* Battery was removed or inserted */
+        { KE_IGNORE, 0xe00e, { KEY_RESERVED } },
 
         /* Wifi Catcher */
         { KE_KEY,    0xe011, { KEY_PROG2 } },
diff --git a/drivers/platform/x86/intel_pmic_gpio.c b/drivers/platform/x86/intel_pmic_gpio.c
index 63b371d6ee55..91ae58510d92 100644
--- a/drivers/platform/x86/intel_pmic_gpio.c
+++ b/drivers/platform/x86/intel_pmic_gpio.c
@@ -1,6 +1,8 @@
 /* Moorestown PMIC GPIO (access through IPC) driver
  * Copyright (c) 2008 - 2009, Intel Corporation.
  *
+ * Author: Alek Du <alek.du@intel.com>
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -21,7 +23,6 @@
 
 #define pr_fmt(fmt) "%s: " fmt, __func__
 
-#include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
@@ -322,9 +323,4 @@ static int __init platform_pmic_gpio_init(void)
 {
         return platform_driver_register(&platform_pmic_gpio_driver);
 }
-
 subsys_initcall(platform_pmic_gpio_init);
-
-MODULE_AUTHOR("Alek Du <alek.du@intel.com>");
-MODULE_DESCRIPTION("Intel Moorestown PMIC GPIO driver");
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/power/max17042_battery.c b/drivers/power/max17042_battery.c
index 9c65f134d447..da7a75f82489 100644
--- a/drivers/power/max17042_battery.c
+++ b/drivers/power/max17042_battery.c
@@ -457,13 +457,16 @@ static inline void max17042_write_model_data(struct max17042_chip *chip,
 }
 
 static inline void max17042_read_model_data(struct max17042_chip *chip,
-                                        u8 addr, u32 *data, int size)
+                                        u8 addr, u16 *data, int size)
 {
         struct regmap *map = chip->regmap;
         int i;
+        u32 tmp;
 
-        for (i = 0; i < size; i++)
-                regmap_read(map, addr + i, &data[i]);
+        for (i = 0; i < size; i++) {
+                regmap_read(map, addr + i, &tmp);
+                data[i] = (u16)tmp;
+        }
 }
 
 static inline int max17042_model_data_compare(struct max17042_chip *chip,
@@ -486,7 +489,7 @@ static int max17042_init_model(struct max17042_chip *chip)
 {
         int ret;
         int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
-        u32 *temp_data;
+        u16 *temp_data;
 
         temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
         if (!temp_data)
@@ -501,7 +504,7 @@ static int max17042_init_model(struct max17042_chip *chip)
         ret = max17042_model_data_compare(
                 chip,
                 chip->pdata->config_data->cell_char_tbl,
-                (u16 *)temp_data,
+                temp_data,
                 table_size);
 
         max10742_lock_model(chip);
@@ -514,7 +517,7 @@ static int max17042_verify_model_lock(struct max17042_chip *chip)
 {
         int i;
         int table_size = ARRAY_SIZE(chip->pdata->config_data->cell_char_tbl);
-        u32 *temp_data;
+        u16 *temp_data;
         int ret = 0;
 
         temp_data = kcalloc(table_size, sizeof(*temp_data), GFP_KERNEL);
diff --git a/drivers/power/reset/Kconfig b/drivers/power/reset/Kconfig
index 3bfac539334b..c74c3f67b8da 100644
--- a/drivers/power/reset/Kconfig
+++ b/drivers/power/reset/Kconfig
@@ -200,8 +200,8 @@ config REBOOT_MODE
 config SYSCON_REBOOT_MODE
         tristate "Generic SYSCON regmap reboot mode driver"
         depends on OF
+        depends on MFD_SYSCON
         select REBOOT_MODE
-        select MFD_SYSCON
         help
           Say y here will enable reboot mode driver. This will
           get reboot mode arguments and store it in SYSCON mapped
diff --git a/drivers/power/reset/hisi-reboot.c b/drivers/power/reset/hisi-reboot.c
index 9ab7f562a83b..f69387e12c1e 100644
--- a/drivers/power/reset/hisi-reboot.c
+++ b/drivers/power/reset/hisi-reboot.c
@@ -53,13 +53,16 @@ static int hisi_reboot_probe(struct platform_device *pdev)
 
         if (of_property_read_u32(np, "reboot-offset", &reboot_offset) < 0) {
                 pr_err("failed to find reboot-offset property\n");
+                iounmap(base);
                 return -EINVAL;
         }
 
         err = register_restart_handler(&hisi_restart_nb);
-        if (err)
+        if (err) {
                 dev_err(&pdev->dev, "cannot register restart handler (err=%d)\n",
                         err);
+                iounmap(base);
+        }
 
         return err;
 }
diff --git a/drivers/power/tps65217_charger.c b/drivers/power/tps65217_charger.c
index 73dfae41def8..4c56e54af6ac 100644
--- a/drivers/power/tps65217_charger.c
+++ b/drivers/power/tps65217_charger.c
@@ -206,6 +206,7 @@ static int tps65217_charger_probe(struct platform_device *pdev)
         if (!charger)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, charger);
         charger->tps = tps;
         charger->dev = &pdev->dev;
 
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 32f0f014a067..9d19b9a62011 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -1161,7 +1161,7 @@ static int tsi721_rio_map_inb_mem(struct rio_mport *mport, dma_addr_t lstart,
                 } else if (ibw_start < (ib_win->rstart + ib_win->size) &&
                            (ibw_start + ibw_size) > ib_win->rstart) {
                         /* Return error if address translation involved */
-                        if (direct && ib_win->xlat) {
+                        if (!direct || ib_win->xlat) {
                                 ret = -EFAULT;
                                 break;
                         }
diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
index cecc15a880de..cebc296463ad 100644
--- a/drivers/rapidio/rio_cm.c
+++ b/drivers/rapidio/rio_cm.c
@@ -1080,8 +1080,8 @@ static int riocm_send_ack(struct rio_channel *ch)
 static struct rio_channel *riocm_ch_accept(u16 ch_id, u16 *new_ch_id,
                                            long timeout)
 {
-        struct rio_channel *ch = NULL;
-        struct rio_channel *new_ch = NULL;
+        struct rio_channel *ch;
+        struct rio_channel *new_ch;
         struct conn_req *req;
         struct cm_peer *peer;
         int found = 0;
@@ -1155,6 +1155,7 @@ static struct rio_channel *riocm_ch_accept(u16 ch_id, u16 *new_ch_id,
 
         spin_unlock_bh(&ch->lock);
         riocm_put_channel(ch);
+        ch = NULL;
         kfree(req);
 
         down_read(&rdev_sem);
@@ -1172,7 +1173,7 @@ static struct rio_channel *riocm_ch_accept(u16 ch_id, u16 *new_ch_id,
         if (!found) {
                 /* If peer device object not found, simply ignore the request */
                 err = -ENODEV;
-                goto err_nodev;
+                goto err_put_new_ch;
         }
 
         new_ch->rdev = peer->rdev;
@@ -1184,15 +1185,16 @@ static struct rio_channel *riocm_ch_accept(u16 ch_id, u16 *new_ch_id,
 
         *new_ch_id = new_ch->id;
         return new_ch;
+
+err_put_new_ch:
+        spin_lock_bh(&idr_lock);
+        idr_remove(&ch_idr, new_ch->id);
+        spin_unlock_bh(&idr_lock);
+        riocm_put_channel(new_ch);
+
 err_put:
-        riocm_put_channel(ch);
-err_nodev:
-        if (new_ch) {
-                spin_lock_bh(&idr_lock);
-                idr_remove(&ch_idr, new_ch->id);
-                spin_unlock_bh(&idr_lock);
-                riocm_put_channel(new_ch);
-        }
+        if (ch)
+                riocm_put_channel(ch);
         *new_ch_id = 0;
         return ERR_PTR(err);
 }
@@ -2245,17 +2247,30 @@ static int rio_cm_shutdown(struct notifier_block *nb, unsigned long code,
 {
         struct rio_channel *ch;
         unsigned int i;
+        LIST_HEAD(list);
 
         riocm_debug(EXIT, ".");
 
+        /*
+         * If there are any channels left in connected state send
+         * close notification to the connection partner.
+         * First build a list of channels that require a closing
+         * notification because function riocm_send_close() should
+         * be called outside of spinlock protected code.
+         */
         spin_lock_bh(&idr_lock);
         idr_for_each_entry(&ch_idr, ch, i) {
-                riocm_debug(EXIT, "close ch %d", ch->id);
-                if (ch->state == RIO_CM_CONNECTED)
-                        riocm_send_close(ch);
+                if (ch->state == RIO_CM_CONNECTED) {
+                        riocm_debug(EXIT, "close ch %d", ch->id);
+                        idr_remove(&ch_idr, ch->id);
+                        list_add(&ch->ch_node, &list);
+                }
         }
         spin_unlock_bh(&idr_lock);
 
+        list_for_each_entry(ch, &list, ch_node)
+                riocm_send_close(ch);
+
         return NOTIFY_DONE;
 }
 
diff --git a/drivers/regulator/max14577-regulator.c b/drivers/regulator/max14577-regulator.c
index b2daa6641417..c9ff26199711 100644
--- a/drivers/regulator/max14577-regulator.c
+++ b/drivers/regulator/max14577-regulator.c
@@ -2,7 +2,7 @@
  * max14577.c - Regulator driver for the Maxim 14577/77836
  *
  * Copyright (C) 2013,2014 Samsung Electronics
- * Krzysztof Kozlowski <k.kozlowski@samsung.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -331,7 +331,7 @@ static void __exit max14577_regulator_exit(void)
 }
 module_exit(max14577_regulator_exit);
 
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski@samsung.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_DESCRIPTION("Maxim 14577/77836 regulator driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:max14577-regulator");
diff --git a/drivers/regulator/max77693-regulator.c b/drivers/regulator/max77693-regulator.c
index de730fd3f8a5..cfbb9512e486 100644
--- a/drivers/regulator/max77693-regulator.c
+++ b/drivers/regulator/max77693-regulator.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2013-2015 Samsung Electronics
  * Jonghwa Lee <jonghwa3.lee@samsung.com>
- * Krzysztof Kozlowski <k.kozlowski.k@gmail.com>
+ * Krzysztof Kozlowski <krzk@kernel.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -314,5 +314,5 @@ module_exit(max77693_pmic_cleanup);
 
 MODULE_DESCRIPTION("MAXIM 77693/77843 regulator driver");
 MODULE_AUTHOR("Jonghwa Lee <jonghwa3.lee@samsung.com>");
-MODULE_AUTHOR("Krzysztof Kozlowski <k.kozlowski.k@gmail.com>");
+MODULE_AUTHOR("Krzysztof Kozlowski <krzk@kernel.org>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c
index 5022fa8d10c6..8ed46a9a55c8 100644
--- a/drivers/regulator/qcom_smd-regulator.c
+++ b/drivers/regulator/qcom_smd-regulator.c
@@ -178,20 +178,21 @@ static const struct regulator_desc pma8084_hfsmps = {
 static const struct regulator_desc pma8084_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pma8084_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
@@ -221,29 +222,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
 static const struct regulator_desc pm8841_ftsmps = {
         .linear_ranges = (struct regulator_linear_range[]) {
                 REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
-                REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
+                REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
         },
         .n_linear_ranges = 2,
-        .n_voltages = 340,
+        .n_voltages = 262,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_boost = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
+                REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
         },
         .n_linear_ranges = 1,
-        .n_voltages = 16,
+        .n_voltages = 31,
         .ops = &rpm_smps_ldo_ops,
 };
 
 static const struct regulator_desc pm8941_pldo = {
         .linear_ranges = (struct regulator_linear_range[]) {
-                REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
-                REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
+                REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
+                REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
+                REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
         },
-        .n_linear_ranges = 2,
-        .n_voltages = 100,
+        .n_linear_ranges = 3,
+        .n_voltages = 164,
         .ops = &rpm_smps_ldo_ops,
 };
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 8973d34ce5ba..fb1b56a71475 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1643,9 +1643,18 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         u8 *sense = NULL;
         int expires;
 
+        cqr = (struct dasd_ccw_req *) intparm;
         if (IS_ERR(irb)) {
                 switch (PTR_ERR(irb)) {
                 case -EIO:
+                        if (cqr && cqr->status == DASD_CQR_CLEAR_PENDING) {
+                                device = (struct dasd_device *) cqr->startdev;
+                                cqr->status = DASD_CQR_CLEARED;
+                                dasd_device_clear_timer(device);
+                                wake_up(&dasd_flush_wq);
+                                dasd_schedule_device_bh(device);
+                                return;
+                        }
                         break;
                 case -ETIMEDOUT:
                         DBF_EVENT_DEVID(DBF_WARNING, cdev, "%s: "
@@ -1661,7 +1670,6 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         }
 
         now = get_tod_clock();
-        cqr = (struct dasd_ccw_req *) intparm;
         /* check for conditions that should be handled immediately */
         if (!cqr ||
             !(scsw_dstat(&irb->scsw) == (DEV_STAT_CHN_END | DEV_STAT_DEV_END) &&
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index fd2eff440098..98bbec44bcd0 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -5078,6 +5078,8 @@ static int dasd_eckd_read_message_buffer(struct dasd_device *device,
                 return PTR_ERR(cqr);
         }
 
+        cqr->lpm = lpum;
+retry:
         cqr->startdev = device;
         cqr->memdev = device;
         cqr->block = NULL;
@@ -5122,6 +5124,14 @@ static int dasd_eckd_read_message_buffer(struct dasd_device *device,
                         (prssdp + 1);
                 memcpy(messages, message_buf,
                        sizeof(struct dasd_rssd_messages));
+        } else if (cqr->lpm) {
+                /*
+                 * on z/VM we might not be able to do I/O on the requested path
+                 * but instead we get the required information on any path
+                 * so retry with open path mask
+                 */
+                cqr->lpm = 0;
+                goto retry;
         } else
                 DBF_EVENT_DEVID(DBF_WARNING, device->cdev,
                                 "Reading messages failed with rc=%d\n"
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 7ada078ffdd0..6a58bc8f46e2 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -762,7 +762,6 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
         priv->state = DEV_STATE_NOT_OPER;
         priv->dev_id.devno = sch->schib.pmcw.dev;
         priv->dev_id.ssid = sch->schid.ssid;
-        priv->schid = sch->schid;
 
         INIT_WORK(&priv->todo_work, ccw_device_todo);
         INIT_LIST_HEAD(&priv->cmb_list);
@@ -1000,7 +999,6 @@ static int ccw_device_move_to_sch(struct ccw_device *cdev,
         put_device(&old_sch->dev);
         /* Initialize new subchannel. */
         spin_lock_irq(sch->lock);
-        cdev->private->schid = sch->schid;
         cdev->ccwlock = sch->lock;
         if (!sch_is_pseudo_sch(sch))
                 sch_set_cdev(sch, cdev);
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 15b56a15db15..9bc3512374c9 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -26,6 +26,7 @@
 static void
 ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
 {
+        struct subchannel *sch = to_subchannel(cdev->dev.parent);
         char dbf_text[15];
 
         if (!scsw_is_valid_cstat(&irb->scsw) ||
@@ -36,10 +37,10 @@ ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
                       "received"
                       " ... device %04x on subchannel 0.%x.%04x, dev_stat "
                       ": %02X sch_stat : %02X\n",
-                      cdev->private->dev_id.devno, cdev->private->schid.ssid,
-                      cdev->private->schid.sch_no,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
+                      sch->schid.sch_no,
                       scsw_dstat(&irb->scsw), scsw_cstat(&irb->scsw));
-        sprintf(dbf_text, "chk%x", cdev->private->schid.sch_no);
+        sprintf(dbf_text, "chk%x", sch->schid.sch_no);
         CIO_TRACE_EVENT(0, dbf_text);
         CIO_HEX_EVENT(0, irb, sizeof(struct irb));
 }
diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h
index 8975060af96c..220f49145b2f 100644
--- a/drivers/s390/cio/io_sch.h
+++ b/drivers/s390/cio/io_sch.h
@@ -120,7 +120,6 @@ struct ccw_device_private {
         int state;              /* device state */
         atomic_t onoff;
         struct ccw_dev_id dev_id;       /* device id */
-        struct subchannel_id schid;     /* subchannel number */
         struct ccw_request req;         /* internal I/O request */
         int iretry;
         u8 pgid_valid_mask;     /* mask of valid PGIDs */
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 4bb5262f7aee..71bf9bded485 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -686,6 +686,15 @@ static void qdio_kick_handler(struct qdio_q *q)
         q->qdio_error = 0;
 }
 
+static inline int qdio_tasklet_schedule(struct qdio_q *q)
+{
+        if (likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE)) {
+                tasklet_schedule(&q->tasklet);
+                return 0;
+        }
+        return -EPERM;
+}
+
 static void __qdio_inbound_processing(struct qdio_q *q)
 {
         qperf_inc(q, tasklet_inbound);
@@ -698,10 +707,8 @@ static void __qdio_inbound_processing(struct qdio_q *q)
         if (!qdio_inbound_q_done(q)) {
                 /* means poll time is not yet over */
                 qperf_inc(q, tasklet_inbound_resched);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
-                        tasklet_schedule(&q->tasklet);
+                if (!qdio_tasklet_schedule(q))
                         return;
-                }
         }
 
         qdio_stop_polling(q);
@@ -711,8 +718,7 @@ static void __qdio_inbound_processing(struct qdio_q *q)
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
-                        tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -869,16 +875,15 @@ static void __qdio_outbound_processing(struct qdio_q *q)
          * is noticed and outbound_handler is called after some time.
          */
         if (qdio_outbound_q_done(q))
-                del_timer(&q->u.out.timer);
+                del_timer_sync(&q->u.out.timer);
         else
-                if (!timer_pending(&q->u.out.timer))
+                if (!timer_pending(&q->u.out.timer) &&
+                    likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE))
                         mod_timer(&q->u.out.timer, jiffies + 10 * HZ);
         return;
 
 sched:
-        if (unlikely(q->irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
-                return;
-        tasklet_schedule(&q->tasklet);
+        qdio_tasklet_schedule(q);
 }
 
 /* outbound tasklet */
@@ -892,9 +897,7 @@ void qdio_outbound_timer(unsigned long data)
 {
         struct qdio_q *q = (struct qdio_q *)data;
 
-        if (unlikely(q->irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
-                return;
-        tasklet_schedule(&q->tasklet);
+        qdio_tasklet_schedule(q);
 }
 
 static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
@@ -907,7 +910,7 @@ static inline void qdio_check_outbound_after_thinint(struct qdio_q *q)
 
         for_each_output_queue(q->irq_ptr, out, i)
                 if (!qdio_outbound_q_done(out))
-                        tasklet_schedule(&out->tasklet);
+                        qdio_tasklet_schedule(out);
 }
 
 static void __tiqdio_inbound_processing(struct qdio_q *q)
@@ -929,10 +932,8 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
 
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED)) {
-                        tasklet_schedule(&q->tasklet);
+                if (!qdio_tasklet_schedule(q))
                         return;
-                }
         }
 
         qdio_stop_polling(q);
@@ -942,8 +943,7 @@ static void __tiqdio_inbound_processing(struct qdio_q *q)
          */
         if (!qdio_inbound_q_done(q)) {
                 qperf_inc(q, tasklet_inbound_resched2);
-                if (likely(q->irq_ptr->state != QDIO_IRQ_STATE_STOPPED))
-                        tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -977,7 +977,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
         int i;
         struct qdio_q *q;
 
-        if (unlikely(irq_ptr->state == QDIO_IRQ_STATE_STOPPED))
+        if (unlikely(irq_ptr->state != QDIO_IRQ_STATE_ACTIVE))
                 return;
 
         for_each_input_queue(irq_ptr, q, i) {
@@ -1003,7 +1003,7 @@ static void qdio_int_handler_pci(struct qdio_irq *irq_ptr)
                         continue;
                 if (need_siga_sync(q) && need_siga_sync_out_after_pci(q))
                         qdio_siga_sync_q(q);
-                tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         }
 }
 
@@ -1066,10 +1066,12 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                       struct irb *irb)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
         int cstat, dstat;
 
         if (!intparm || !irq_ptr) {
-                DBF_ERROR("qint:%4x", cdev->private->schid.sch_no);
+                ccw_device_get_schid(cdev, &schid);
+                DBF_ERROR("qint:%4x", schid.sch_no);
                 return;
         }
 
@@ -1122,12 +1124,14 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
 int qdio_get_ssqd_desc(struct ccw_device *cdev,
                        struct qdio_ssqd_desc *data)
 {
+        struct subchannel_id schid;
 
         if (!cdev || !cdev->private)
                 return -EINVAL;
 
-        DBF_EVENT("get ssqd:%4x", cdev->private->schid.sch_no);
-        return qdio_setup_get_ssqd(NULL, &cdev->private->schid, data);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("get ssqd:%4x", schid.sch_no);
+        return qdio_setup_get_ssqd(NULL, &schid, data);
 }
 EXPORT_SYMBOL_GPL(qdio_get_ssqd_desc);
 
@@ -1141,7 +1145,7 @@ static void qdio_shutdown_queues(struct ccw_device *cdev)
                 tasklet_kill(&q->tasklet);
 
         for_each_output_queue(irq_ptr, q, i) {
-                del_timer(&q->u.out.timer);
+                del_timer_sync(&q->u.out.timer);
                 tasklet_kill(&q->tasklet);
         }
 }
@@ -1154,14 +1158,15 @@ static void qdio_shutdown_queues(struct ccw_device *cdev)
 int qdio_shutdown(struct ccw_device *cdev, int how)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
         int rc;
-        unsigned long flags;
 
         if (!irq_ptr)
                 return -ENODEV;
 
         WARN_ON_ONCE(irqs_disabled());
-        DBF_EVENT("qshutdown:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qshutdown:%4x", schid.sch_no);
 
         mutex_lock(&irq_ptr->setup_mutex);
         /*
@@ -1184,7 +1189,7 @@ int qdio_shutdown(struct ccw_device *cdev, int how)
         qdio_shutdown_debug_entries(irq_ptr);
 
         /* cleanup subchannel */
-        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
 
         if (how & QDIO_FLAG_CLEANUP_USING_CLEAR)
                 rc = ccw_device_clear(cdev, QDIO_DOING_CLEANUP);
@@ -1198,12 +1203,12 @@ int qdio_shutdown(struct ccw_device *cdev, int how)
         }
 
         qdio_set_state(irq_ptr, QDIO_IRQ_STATE_CLEANUP);
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         wait_event_interruptible_timeout(cdev->private->wait_q,
                 irq_ptr->state == QDIO_IRQ_STATE_INACTIVE ||
                 irq_ptr->state == QDIO_IRQ_STATE_ERR,
                 10 * HZ);
-        spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
 
 no_cleanup:
         qdio_shutdown_thinint(irq_ptr);
@@ -1211,7 +1216,7 @@ no_cleanup:
         /* restore interrupt handler */
         if ((void *)cdev->handler == (void *)qdio_int_handler)
                 cdev->handler = irq_ptr->orig_handler;
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), flags);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
 
         qdio_set_state(irq_ptr, QDIO_IRQ_STATE_INACTIVE);
         mutex_unlock(&irq_ptr->setup_mutex);
@@ -1228,11 +1233,13 @@ EXPORT_SYMBOL_GPL(qdio_shutdown);
 int qdio_free(struct ccw_device *cdev)
 {
         struct qdio_irq *irq_ptr = cdev->private->qdio_data;
+        struct subchannel_id schid;
 
         if (!irq_ptr)
                 return -ENODEV;
 
-        DBF_EVENT("qfree:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qfree:%4x", schid.sch_no);
         DBF_DEV_EVENT(DBF_ERR, irq_ptr, "dbf abandoned");
         mutex_lock(&irq_ptr->setup_mutex);
 
@@ -1251,9 +1258,11 @@ EXPORT_SYMBOL_GPL(qdio_free);
  */
 int qdio_allocate(struct qdio_initialize *init_data)
 {
+        struct subchannel_id schid;
         struct qdio_irq *irq_ptr;
 
-        DBF_EVENT("qallocate:%4x", init_data->cdev->private->schid.sch_no);
+        ccw_device_get_schid(init_data->cdev, &schid);
+        DBF_EVENT("qallocate:%4x", schid.sch_no);
 
         if ((init_data->no_input_qs && !init_data->input_handler) ||
             (init_data->no_output_qs && !init_data->output_handler))
@@ -1331,20 +1340,18 @@ static void qdio_detect_hsicq(struct qdio_irq *irq_ptr)
  */
 int qdio_establish(struct qdio_initialize *init_data)
 {
-        struct qdio_irq *irq_ptr;
         struct ccw_device *cdev = init_data->cdev;
-        unsigned long saveflags;
+        struct subchannel_id schid;
+        struct qdio_irq *irq_ptr;
         int rc;
 
-        DBF_EVENT("qestablish:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qestablish:%4x", schid.sch_no);
 
         irq_ptr = cdev->private->qdio_data;
         if (!irq_ptr)
                 return -ENODEV;
 
-        if (cdev->private->state != DEV_STATE_ONLINE)
-                return -EINVAL;
-
         mutex_lock(&irq_ptr->setup_mutex);
         qdio_setup_irq(init_data);
 
@@ -1361,17 +1368,14 @@ int qdio_establish(struct qdio_initialize *init_data)
         irq_ptr->ccw.count = irq_ptr->equeue.count;
         irq_ptr->ccw.cda = (u32)((addr_t)irq_ptr->qdr);
 
-        spin_lock_irqsave(get_ccwdev_lock(cdev), saveflags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
         ccw_device_set_options_mask(cdev, 0);
 
         rc = ccw_device_start(cdev, &irq_ptr->ccw, QDIO_DOING_ESTABLISH, 0, 0);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         if (rc) {
                 DBF_ERROR("%4x est IO ERR", irq_ptr->schid.sch_no);
                 DBF_ERROR("rc:%4x", rc);
-        }
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), saveflags);
-
-        if (rc) {
                 mutex_unlock(&irq_ptr->setup_mutex);
                 qdio_shutdown(cdev, QDIO_FLAG_CLEANUP_USING_CLEAR);
                 return rc;
@@ -1407,19 +1411,17 @@ EXPORT_SYMBOL_GPL(qdio_establish);
  */
 int qdio_activate(struct ccw_device *cdev)
 {
+        struct subchannel_id schid;
         struct qdio_irq *irq_ptr;
         int rc;
-        unsigned long saveflags;
 
-        DBF_EVENT("qactivate:%4x", cdev->private->schid.sch_no);
+        ccw_device_get_schid(cdev, &schid);
+        DBF_EVENT("qactivate:%4x", schid.sch_no);
 
         irq_ptr = cdev->private->qdio_data;
         if (!irq_ptr)
                 return -ENODEV;
 
-        if (cdev->private->state != DEV_STATE_ONLINE)
-                return -EINVAL;
-
         mutex_lock(&irq_ptr->setup_mutex);
         if (irq_ptr->state == QDIO_IRQ_STATE_INACTIVE) {
                 rc = -EBUSY;
@@ -1431,19 +1433,17 @@ int qdio_activate(struct ccw_device *cdev)
         irq_ptr->ccw.count = irq_ptr->aqueue.count;
         irq_ptr->ccw.cda = 0;
 
-        spin_lock_irqsave(get_ccwdev_lock(cdev), saveflags);
+        spin_lock_irq(get_ccwdev_lock(cdev));
         ccw_device_set_options(cdev, CCWDEV_REPORT_ALL);
 
         rc = ccw_device_start(cdev, &irq_ptr->ccw, QDIO_DOING_ACTIVATE,
                               0, DOIO_DENY_PREFETCH);
+        spin_unlock_irq(get_ccwdev_lock(cdev));
         if (rc) {
                 DBF_ERROR("%4x act IO ERR", irq_ptr->schid.sch_no);
                 DBF_ERROR("rc:%4x", rc);
-        }
-        spin_unlock_irqrestore(get_ccwdev_lock(cdev), saveflags);
-
-        if (rc)
                 goto out;
+        }
 
         if (is_thinint_irq(irq_ptr))
                 tiqdio_add_input_queues(irq_ptr);
@@ -1585,10 +1585,11 @@ static int handle_outbound(struct qdio_q *q, unsigned int callflags,
 
         /* in case of SIGA errors we must process the error immediately */
         if (used >= q->u.out.scan_threshold || rc)
-                tasklet_schedule(&q->tasklet);
+                qdio_tasklet_schedule(q);
         else
                 /* free the SBALs in case of no further traffic */
-                if (!timer_pending(&q->u.out.timer))
+                if (!timer_pending(&q->u.out.timer) &&
+                    likely(q->irq_ptr->state == QDIO_IRQ_STATE_ACTIVE))
                         mod_timer(&q->u.out.timer, jiffies + HZ);
         return rc;
 }
diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
index bf40063de202..6d4b68c483f3 100644
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -999,6 +999,7 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *,
                                                  __u16, __u16,
                                                  enum qeth_prot_versions);
 int qeth_set_features(struct net_device *, netdev_features_t);
+int qeth_recover_features(struct net_device *);
 netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t);
 
 /* exports for OSN */
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 7dba6c8537a1..20cf29613043 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -3619,7 +3619,8 @@ static void qeth_qdio_cq_handler(struct qeth_card *card,
                 int e;
 
                 e = 0;
-                while (buffer->element[e].addr) {
+                while ((e < QDIO_MAX_ELEMENTS_PER_BUFFER) &&
+                       buffer->element[e].addr) {
                         unsigned long phys_aob_addr;
 
                         phys_aob_addr = (unsigned long) buffer->element[e].addr;
@@ -6131,6 +6132,35 @@ static int qeth_set_ipa_tso(struct qeth_card *card, int on)
         return rc;
 }
 
+/* try to restore device features on a device after recovery */
+int qeth_recover_features(struct net_device *dev)
+{
+        struct qeth_card *card = dev->ml_priv;
+        netdev_features_t recover = dev->features;
+
+        if (recover & NETIF_F_IP_CSUM) {
+                if (qeth_set_ipa_csum(card, 1, IPA_OUTBOUND_CHECKSUM))
+                        recover ^= NETIF_F_IP_CSUM;
+        }
+        if (recover & NETIF_F_RXCSUM) {
+                if (qeth_set_ipa_csum(card, 1, IPA_INBOUND_CHECKSUM))
+                        recover ^= NETIF_F_RXCSUM;
+        }
+        if (recover & NETIF_F_TSO) {
+                if (qeth_set_ipa_tso(card, 1))
+                        recover ^= NETIF_F_TSO;
+        }
+
+        if (recover == dev->features)
+                return 0;
+
+        dev_warn(&card->gdev->dev,
+                 "Device recovery failed to restore all offload features\n");
+        dev->features = recover;
+        return -EIO;
+}
+EXPORT_SYMBOL_GPL(qeth_recover_features);
+
 int qeth_set_features(struct net_device *dev, netdev_features_t features)
 {
         struct qeth_card *card = dev->ml_priv;
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index 7bc20c5188bc..bb27058fa9f0 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1124,14 +1124,11 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
                         card->dev->hw_features |= NETIF_F_RXCSUM;
                         card->dev->vlan_features |= NETIF_F_RXCSUM;
                 }
-                /* Turn on SG per default */
-                card->dev->features |= NETIF_F_SG;
         }
         card->info.broadcast_capable = 1;
         qeth_l2_request_initial_mac(card);
         card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
                                   PAGE_SIZE;
-        card->dev->gso_max_segs = (QETH_MAX_BUFFER_ELEMENTS(card) - 1);
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
         netif_napi_add(card->dev, &card->napi, qeth_l2_poll, QETH_NAPI_WEIGHT);
         netif_carrier_off(card->dev);
@@ -1246,6 +1243,9 @@ contin:
                 }
                 /* this also sets saved unicast addresses */
                 qeth_l2_set_rx_mode(card->dev);
+                rtnl_lock();
+                qeth_recover_features(card->dev);
+                rtnl_unlock();
         }
         /* let user_space know that device is online */
         kobject_uevent(&gdev->dev.kobj, KOBJ_CHANGE);
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index 72934666fedf..272d9e7419be 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -257,6 +257,11 @@ int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
         if (addr->in_progress)
                 return -EINPROGRESS;
 
+        if (!qeth_card_hw_is_reachable(card)) {
+                addr->disp_flag = QETH_DISP_ADDR_DELETE;
+                return 0;
+        }
+
         rc = qeth_l3_deregister_addr_entry(card, addr);
 
         hash_del(&addr->hnode);
@@ -296,6 +301,11 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr)
                 hash_add(card->ip_htable, &addr->hnode,
                                 qeth_l3_ipaddr_hash(addr));
 
+                if (!qeth_card_hw_is_reachable(card)) {
+                        addr->disp_flag = QETH_DISP_ADDR_ADD;
+                        return 0;
+                }
+
                 /* qeth_l3_register_addr_entry can go to sleep
                  * if we add a IPV4 addr. It is caused by the reason
                  * that SETIP ipa cmd starts ARP staff for IPV4 addr.
@@ -390,12 +400,16 @@ static void qeth_l3_recover_ip(struct qeth_card *card)
         int i;
         int rc;
 
-        QETH_CARD_TEXT(card, 4, "recoverip");
+        QETH_CARD_TEXT(card, 4, "recovrip");
 
         spin_lock_bh(&card->ip_lock);
 
         hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) {
-                if (addr->disp_flag == QETH_DISP_ADDR_ADD) {
+                if (addr->disp_flag == QETH_DISP_ADDR_DELETE) {
+                        qeth_l3_deregister_addr_entry(card, addr);
+                        hash_del(&addr->hnode);
+                        kfree(addr);
+                } else if (addr->disp_flag == QETH_DISP_ADDR_ADD) {
                         if (addr->proto == QETH_PROT_IPV4) {
                                 addr->in_progress = 1;
                                 spin_unlock_bh(&card->ip_lock);
@@ -407,10 +421,8 @@ static void qeth_l3_recover_ip(struct qeth_card *card)
 
                         if (!rc) {
                                 addr->disp_flag = QETH_DISP_ADDR_DO_NOTHING;
-                                if (addr->ref_counter < 1) {
+                                if (addr->ref_counter < 1)
                                         qeth_l3_delete_ip(card, addr);
-                                        kfree(addr);
-                                }
                         } else {
                                 hash_del(&addr->hnode);
                                 kfree(addr);
@@ -689,7 +701,7 @@ int qeth_l3_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto,
 
         spin_lock_bh(&card->ip_lock);
 
-        if (!qeth_l3_ip_from_hash(card, ipaddr))
+        if (qeth_l3_ip_from_hash(card, ipaddr))
                 rc = -EEXIST;
         else
                 qeth_l3_add_ip(card, ipaddr);
@@ -757,7 +769,7 @@ int qeth_l3_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto,
 
         spin_lock_bh(&card->ip_lock);
 
-        if (!qeth_l3_ip_from_hash(card, ipaddr))
+        if (qeth_l3_ip_from_hash(card, ipaddr))
                 rc = -EEXIST;
         else
                 qeth_l3_add_ip(card, ipaddr);
@@ -3108,7 +3120,6 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
                                 card->dev->vlan_features = NETIF_F_SG |
                                         NETIF_F_RXCSUM | NETIF_F_IP_CSUM |
                                         NETIF_F_TSO;
-                                card->dev->features = NETIF_F_SG;
                         }
                 }
         } else if (card->info.type == QETH_CARD_TYPE_IQD) {
@@ -3136,7 +3147,6 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
         netif_keep_dst(card->dev);
         card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
                                   PAGE_SIZE;
-        card->dev->gso_max_segs = (QETH_MAX_BUFFER_ELEMENTS(card) - 1);
 
         SET_NETDEV_DEV(card->dev, &card->gdev->dev);
         netif_napi_add(card->dev, &card->napi, qeth_l3_poll, QETH_NAPI_WEIGHT);
@@ -3269,6 +3279,7 @@ contin:
                 else
                         dev_open(card->dev);
                 qeth_l3_set_multicast_list(card->dev);
+                qeth_recover_features(card->dev);
                 rtnl_unlock();
         }
         qeth_trace_features(card);
diff --git a/drivers/s390/net/qeth_l3_sys.c b/drivers/s390/net/qeth_l3_sys.c
index 65645b11fc19..0e00a5ce0f00 100644
--- a/drivers/s390/net/qeth_l3_sys.c
+++ b/drivers/s390/net/qeth_l3_sys.c
@@ -297,7 +297,9 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev,
                 addr->u.a6.pfxlen = 0;
                 addr->type = QETH_IP_TYPE_NORMAL;
 
+                spin_lock_bh(&card->ip_lock);
                 qeth_l3_delete_ip(card, addr);
+                spin_unlock_bh(&card->ip_lock);
                 kfree(addr);
         }
 
@@ -329,7 +331,10 @@ static ssize_t qeth_l3_dev_hsuid_store(struct device *dev,
                 addr->type = QETH_IP_TYPE_NORMAL;
         } else
                 return -ENOMEM;
+
+        spin_lock_bh(&card->ip_lock);
         qeth_l3_add_ip(card, addr);
+        spin_unlock_bh(&card->ip_lock);
         kfree(addr);
 
         return count;
diff --git a/drivers/s390/virtio/Makefile b/drivers/s390/virtio/Makefile
index 241891a57caf..df40692a9011 100644
--- a/drivers/s390/virtio/Makefile
+++ b/drivers/s390/virtio/Makefile
@@ -6,4 +6,8 @@
 # it under the terms of the GNU General Public License (version 2 only)
 # as published by the Free Software Foundation.
 
-obj-$(CONFIG_S390_GUEST) += kvm_virtio.o virtio_ccw.o
+s390-virtio-objs := virtio_ccw.o
+ifdef CONFIG_S390_GUEST_OLD_TRANSPORT
+s390-virtio-objs += kvm_virtio.o
+endif
+obj-$(CONFIG_S390_GUEST) += $(s390-virtio-objs)
diff --git a/drivers/s390/virtio/kvm_virtio.c b/drivers/s390/virtio/kvm_virtio.c
index 1d060fd293a3..5e5c11f37b24 100644
--- a/drivers/s390/virtio/kvm_virtio.c
+++ b/drivers/s390/virtio/kvm_virtio.c
@@ -458,6 +458,8 @@ static int __init kvm_devices_init(void)
         if (test_devices_support(total_memory_size) < 0)
                 return -ENODEV;
 
+        pr_warn("The s390-virtio transport is deprecated. Please switch to a modern host providing virtio-ccw.\n");
+
         rc = vmem_add_mapping(total_memory_size, PAGE_SIZE);
         if (rc)
                 return rc;
@@ -482,7 +484,7 @@ static int __init kvm_devices_init(void)
 }
 
 /* code for early console output with virtio_console */
-static __init int early_put_chars(u32 vtermno, const char *buf, int count)
+static int early_put_chars(u32 vtermno, const char *buf, int count)
 {
         char scratch[17];
         unsigned int len = count;
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index b381b3718a98..5648b715fed9 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -63,7 +63,7 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
         struct fib *fibptr;
         struct hw_fib * hw_fib = (struct hw_fib *)0;
         dma_addr_t hw_fib_pa = (dma_addr_t)0LL;
-        unsigned size;
+        unsigned int size, osize;
         int retval;
 
         if (dev->in_reset) {
@@ -87,7 +87,8 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
          *      will not overrun the buffer when we copy the memory. Return
          *      an error if we would.
          */
-        size = le16_to_cpu(kfib->header.Size) + sizeof(struct aac_fibhdr);
+        osize = size = le16_to_cpu(kfib->header.Size) +
+                sizeof(struct aac_fibhdr);
         if (size < le16_to_cpu(kfib->header.SenderSize))
                 size = le16_to_cpu(kfib->header.SenderSize);
         if (size > dev->max_fib_size) {
@@ -118,6 +119,14 @@ static int ioctl_send_fib(struct aac_dev * dev, void __user *arg)
                 goto cleanup;
         }
 
+        /* Sanity check the second copy */
+        if ((osize != le16_to_cpu(kfib->header.Size) +
+                sizeof(struct aac_fibhdr))
+                || (size < le16_to_cpu(kfib->header.SenderSize))) {
+                retval = -EINVAL;
+                goto cleanup;
+        }
+
         if (kfib->header.Command == cpu_to_le16(TakeABreakPt)) {
                 aac_adapter_interrupt(dev);
                 /*
diff --git a/drivers/scsi/constants.c b/drivers/scsi/constants.c
index 83458f7a2824..6dc96c8dfe75 100644
--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -361,8 +361,9 @@ static const char * const snstext[] = {
 
 /* Get sense key string or NULL if not available */
 const char *
-scsi_sense_key_string(unsigned char key) {
-        if (key <= 0xE)
+scsi_sense_key_string(unsigned char key)
+{
+        if (key < ARRAY_SIZE(snstext))
                 return snstext[key];
         return NULL;
 }
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index a569c65f22b1..dcf36537a767 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -2923,7 +2923,7 @@ static int fcoe_ctlr_vlan_recv(struct fcoe_ctlr *fip, struct sk_buff *skb)
         mutex_unlock(&fip->ctlr_mutex);
 
 drop:
-        kfree(skb);
+        kfree_skb(skb);
         return rc;
 }
 
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index bf85974be862..17d04c702e1b 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -10410,8 +10410,11 @@ static int ipr_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
                 __ipr_remove(pdev);
                 return rc;
         }
+        spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
+        ioa_cfg->scan_enabled = 1;
+        schedule_work(&ioa_cfg->work_q);
+        spin_unlock_irqrestore(ioa_cfg->host->host_lock, flags);
 
-        scsi_scan_host(ioa_cfg->host);
         ioa_cfg->iopoll_weight = ioa_cfg->chip_cfg->iopoll_weight;
 
         if (ioa_cfg->iopoll_weight && ioa_cfg->sis64 && ioa_cfg->nvectors > 1) {
@@ -10421,10 +10424,8 @@ static int ipr_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
                 }
         }
 
-        spin_lock_irqsave(ioa_cfg->host->host_lock, flags);
-        ioa_cfg->scan_enabled = 1;
-        schedule_work(&ioa_cfg->work_q);
-        spin_unlock_irqrestore(ioa_cfg->host->host_lock, flags);
+        scsi_scan_host(ioa_cfg->host);
+
         return 0;
 }
 
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index 2dab3dc2aa69..c1ed25adb17e 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -5037,7 +5037,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
         /* Find first memory bar */
         bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
         instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
-        if (pci_request_selected_regions(instance->pdev, instance->bar,
+        if (pci_request_selected_regions(instance->pdev, 1<<instance->bar,
                                          "megasas: LSI")) {
                 dev_printk(KERN_DEBUG, &instance->pdev->dev, "IO memory region busy!\n");
                 return -EBUSY;
@@ -5339,7 +5339,7 @@ fail_ready_state:
         iounmap(instance->reg_set);
 
       fail_ioremap:
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 
         return -EINVAL;
 }
@@ -5360,7 +5360,7 @@ static void megasas_release_mfi(struct megasas_instance *instance)
 
         iounmap(instance->reg_set);
 
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 }
 
 /**
diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
index ec837544f784..52d8bbf7feb5 100644
--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
+++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
@@ -2603,7 +2603,7 @@ megasas_release_fusion(struct megasas_instance *instance)
 
         iounmap(instance->reg_set);
 
-        pci_release_selected_regions(instance->pdev, instance->bar);
+        pci_release_selected_regions(instance->pdev, 1<<instance->bar);
 }
 
 /**
diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c
index 751f13edece0..750f82c339d4 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2188,6 +2188,17 @@ mpt3sas_base_map_resources(struct MPT3SAS_ADAPTER *ioc)
         } else
                 ioc->msix96_vector = 0;
 
+        if (ioc->is_warpdrive) {
+                ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
+                    &ioc->chip->ReplyPostHostIndex;
+
+                for (i = 1; i < ioc->cpu_msix_table_sz; i++)
+                        ioc->reply_post_host_index[i] =
+                        (resource_size_t __iomem *)
+                        ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
+                        * 4)));
+        }
+
         list_for_each_entry(reply_q, &ioc->reply_queue_list, list)
                 pr_info(MPT3SAS_FMT "%s: IRQ %d\n",
                     reply_q->name,  ((ioc->msix_enable) ? "PCI-MSI-X enabled" :
@@ -5280,17 +5291,6 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc)
         if (r)
                 goto out_free_resources;
 
-        if (ioc->is_warpdrive) {
-                ioc->reply_post_host_index[0] = (resource_size_t __iomem *)
-                    &ioc->chip->ReplyPostHostIndex;
-
-                for (i = 1; i < ioc->cpu_msix_table_sz; i++)
-                        ioc->reply_post_host_index[i] =
-                        (resource_size_t __iomem *)
-                        ((u8 __iomem *)&ioc->chip->Doorbell + (0x4000 + ((i - 1)
-                        * 4)));
-        }
-
         pci_set_drvdata(ioc->pdev, ioc->shost);
         r = _base_get_ioc_facts(ioc, CAN_SLEEP);
         if (r)
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index eaccd651ccda..246456925335 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -246,6 +246,10 @@ static struct {
         {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"DELL", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"STK", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"NETAPP", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"LSI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
+        {"ENGENIO", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
         {"SMSC", "USB 2 HS-CF", NULL, BLIST_SPARSELUN | BLIST_INQUIRY_36},
         {"SONY", "CD-ROM CDU-8001", NULL, BLIST_BORKEN},
         {"SONY", "TSL", NULL, BLIST_FORCELUN},          /* DDS3 & DDS4 autoloaders */
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 3f0ff072184b..60b651bfaa01 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -341,22 +341,6 @@ static int do_sas_phy_delete(struct device *dev, void *data)
 }
 
 /**
- * is_sas_attached - check if device is SAS attached
- * @sdev: scsi device to check
- *
- * returns true if the device is SAS attached
- */
-int is_sas_attached(struct scsi_device *sdev)
-{
-        struct Scsi_Host *shost = sdev->host;
-
-        return shost->transportt->host_attrs.ac.class ==
-                &sas_host_class.class;
-}
-EXPORT_SYMBOL(is_sas_attached);
-
-
-/**
  * sas_remove_children  -  tear down a devices SAS data structures
  * @dev:        device belonging to the sas object
  *
diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index 53ef1cb6418e..8c9a35c91705 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -587,7 +587,7 @@ static void ses_match_to_enclosure(struct enclosure_device *edev,
 
         ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0);
 
-        if (is_sas_attached(sdev))
+        if (scsi_is_sas_rphy(&sdev->sdev_gendev))
                 efd.addr = sas_get_address(sdev);
 
         if (efd.addr) {
@@ -778,6 +778,8 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
         if (!edev)
                 return;
 
+        enclosure_unregister(edev);
+
         ses_dev = edev->scratch;
         edev->scratch = NULL;
 
@@ -789,7 +791,6 @@ static void ses_intf_remove_enclosure(struct scsi_device *sdev)
         kfree(edev->component[0].scratch);
 
         put_device(&edev->edev);
-        enclosure_unregister(edev);
 }
 
 static void ses_intf_remove(struct device *cdev,
diff --git a/drivers/scsi/wd719x.c b/drivers/scsi/wd719x.c
index e3da1a2fdb66..2a9da2e0ea6b 100644
--- a/drivers/scsi/wd719x.c
+++ b/drivers/scsi/wd719x.c
@@ -962,7 +962,7 @@ static void wd719x_pci_remove(struct pci_dev *pdev)
         scsi_host_put(sh);
 }
 
-static DEFINE_PCI_DEVICE_TABLE(wd719x_pci_table) = {
+static const struct pci_device_id wd719x_pci_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_WD, 0x3296) },
         {}
 };
diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
index 823cbc92d1e7..7a37090dabbe 100644
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -720,8 +720,6 @@ static int img_spfi_remove(struct platform_device *pdev)
                 clk_disable_unprepare(spfi->sys_clk);
         }
 
-        spi_master_put(master);
-
         return 0;
 }
 
diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
index 0be89e052428..899d7a8f0889 100644
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -685,7 +685,6 @@ static int mtk_spi_remove(struct platform_device *pdev)
         pm_runtime_disable(&pdev->dev);
 
         mtk_spi_reset(mdata);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c
index f3df522db93b..58d2d48e16a5 100644
--- a/drivers/spi/spi-pxa2xx-pci.c
+++ b/drivers/spi/spi-pxa2xx-pci.c
@@ -214,6 +214,7 @@ static int pxa2xx_spi_pci_probe(struct pci_dev *dev,
                 return PTR_ERR(ssp->clk);
 
         memset(&pi, 0, sizeof(pi));
+        pi.fwnode = dev->dev.fwnode;
         pi.parent = &dev->dev;
         pi.name = "pxa2xx-spi";
         pi.id = ssp->port_id;
diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
index c338ef1136f6..7f1555621f8e 100644
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -1030,7 +1030,6 @@ static int spi_qup_remove(struct platform_device *pdev)
 
         pm_runtime_put_noidle(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
-        spi_master_put(master);
 
         return 0;
 }
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index 0f83ad1d5a58..1de3a772eb7d 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -262,6 +262,9 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p,
 
         for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
                 brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
+                /* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
+                if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
+                        continue;
                 if (brps <= 32) /* max of brdv is 32 */
                         break;
         }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 51ad42fad567..200ca228d885 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -960,7 +960,7 @@ static int spi_transfer_one_message(struct spi_master *master,
         struct spi_transfer *xfer;
         bool keep_cs = false;
         int ret = 0;
-        unsigned long ms = 1;
+        unsigned long long ms = 1;
         struct spi_statistics *statm = &master->statistics;
         struct spi_statistics *stats = &msg->spi->statistics;
 
@@ -991,9 +991,13 @@ static int spi_transfer_one_message(struct spi_master *master,
 
                         if (ret > 0) {
                                 ret = 0;
-                                ms = xfer->len * 8 * 1000 / xfer->speed_hz;
+                                ms = 8LL * 1000LL * xfer->len;
+                                do_div(ms, xfer->speed_hz);
                                 ms += ms + 100; /* some tolerance */
 
+                                if (ms > UINT_MAX)
+                                        ms = UINT_MAX;
+
                                 ms = wait_for_completion_timeout(&master->xfer_completion,
                                                                  msecs_to_jiffies(ms));
                         }
@@ -1159,6 +1163,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
                 if (ret < 0) {
                         dev_err(&master->dev, "Failed to power device: %d\n",
                                 ret);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
@@ -1174,6 +1179,7 @@ static void __spi_pump_messages(struct spi_master *master, bool in_kthread)
 
                         if (master->auto_runtime_pm)
                                 pm_runtime_put(master->dev.parent);
+                        mutex_unlock(&master->io_mutex);
                         return;
                 }
         }
diff --git a/drivers/staging/comedi/drivers/adv_pci1760.c b/drivers/staging/comedi/drivers/adv_pci1760.c
index d7dd1e55e347..9f525ff7290c 100644
--- a/drivers/staging/comedi/drivers/adv_pci1760.c
+++ b/drivers/staging/comedi/drivers/adv_pci1760.c
@@ -196,6 +196,7 @@ static int pci1760_pwm_ns_to_div(unsigned int flags, unsigned int ns)
                 break;
         case CMDF_ROUND_DOWN:
                 divisor = ns / PCI1760_PWM_TIMEBASE;
+                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index 4ab186669f0c..ec5b9a23494d 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -56,11 +56,6 @@
 
 #define N_CHANS 8
 
-enum waveform_state_bits {
-        WAVEFORM_AI_RUNNING,
-        WAVEFORM_AO_RUNNING
-};
-
 /* Data unique to this driver */
 struct waveform_private {
         struct timer_list ai_timer;     /* timer for AI commands */
@@ -68,7 +63,6 @@ struct waveform_private {
         unsigned int wf_amplitude;      /* waveform amplitude in microvolts */
         unsigned int wf_period;         /* waveform period in microseconds */
         unsigned int wf_current;        /* current time in waveform period */
-        unsigned long state_bits;
         unsigned int ai_scan_period;    /* AI scan period in usec */
         unsigned int ai_convert_period; /* AI conversion period in usec */
         struct timer_list ao_timer;     /* timer for AO commands */
@@ -191,10 +185,6 @@ static void waveform_ai_timer(unsigned long arg)
         unsigned int nsamples;
         unsigned int time_increment;
 
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits))
-                return;
-
         now = ktime_to_us(ktime_get());
         nsamples = comedi_nsamples_left(s, UINT_MAX);
 
@@ -386,11 +376,6 @@ static int waveform_ai_cmd(struct comedi_device *dev,
          */
         devpriv->ai_timer.expires =
                 jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
-
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
         add_timer(&devpriv->ai_timer);
         return 0;
 }
@@ -400,11 +385,12 @@ static int waveform_ai_cancel(struct comedi_device *dev,
 {
         struct waveform_private *devpriv = dev->private;
 
-        /* mark command as no longer active */
-        clear_bit(WAVEFORM_AI_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
-        /* cannot call del_timer_sync() as may be called from timer routine */
-        del_timer(&devpriv->ai_timer);
+        if (in_softirq()) {
+                /* Assume we were called from the timer routine itself. */
+                del_timer(&devpriv->ai_timer);
+        } else {
+                del_timer_sync(&devpriv->ai_timer);
+        }
         return 0;
 }
 
@@ -436,10 +422,6 @@ static void waveform_ao_timer(unsigned long arg)
         u64 scans_since;
         unsigned int scans_avail = 0;
 
-        /* check command is still active */
-        if (!test_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits))
-                return;
-
         /* determine number of scan periods since last time */
         now = ktime_to_us(ktime_get());
         scans_since = now - devpriv->ao_last_scan_time;
@@ -518,11 +500,6 @@ static int waveform_ao_inttrig_start(struct comedi_device *dev,
         devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
         devpriv->ao_timer.expires =
                 jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
-
-        /* mark command as active */
-        smp_mb__before_atomic();
-        set_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
         add_timer(&devpriv->ao_timer);
 
         return 1;
@@ -608,11 +585,12 @@ static int waveform_ao_cancel(struct comedi_device *dev,
         struct waveform_private *devpriv = dev->private;
 
         s->async->inttrig = NULL;
-        /* mark command as no longer active */
-        clear_bit(WAVEFORM_AO_RUNNING, &devpriv->state_bits);
-        smp_mb__after_atomic();
-        /* cannot call del_timer_sync() as may be called from timer routine */
-        del_timer(&devpriv->ao_timer);
+        if (in_softirq()) {
+                /* Assume we were called from the timer routine itself. */
+                del_timer(&devpriv->ao_timer);
+        } else {
+                del_timer_sync(&devpriv->ao_timer);
+        }
         return 0;
 }
 
diff --git a/drivers/staging/comedi/drivers/daqboard2000.c b/drivers/staging/comedi/drivers/daqboard2000.c
index 65daef0c00d5..0f4eb954aa80 100644
--- a/drivers/staging/comedi/drivers/daqboard2000.c
+++ b/drivers/staging/comedi/drivers/daqboard2000.c
@@ -634,7 +634,7 @@ static const void *daqboard2000_find_boardinfo(struct comedi_device *dev,
         const struct daq200_boardtype *board;
         int i;
 
-        if (pcidev->subsystem_device != PCI_VENDOR_ID_IOTECH)
+        if (pcidev->subsystem_vendor != PCI_VENDOR_ID_IOTECH)
                 return NULL;
 
         for (i = 0; i < ARRAY_SIZE(boardtypes); i++) {
diff --git a/drivers/staging/comedi/drivers/dt2811.c b/drivers/staging/comedi/drivers/dt2811.c
index 904f637797b6..8bbd93814340 100644
--- a/drivers/staging/comedi/drivers/dt2811.c
+++ b/drivers/staging/comedi/drivers/dt2811.c
@@ -588,8 +588,8 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it)
         s = &dev->subdevices[0];
         s->type         = COMEDI_SUBD_AI;
         s->subdev_flags = SDF_READABLE |
-                          (it->options[2] == 1) ? SDF_DIFF :
-                          (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND;
+                          ((it->options[2] == 1) ? SDF_DIFF :
+                           (it->options[2] == 2) ? SDF_COMMON : SDF_GROUND);
         s->n_chan       = (it->options[2] == 1) ? 8 : 16;
         s->maxdata      = 0x0fff;
         s->range_table  = board->is_pgh ? &dt2811_pgh_ai_ranges
diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
index 8dabb19519a5..0f97d7b611d7 100644
--- a/drivers/staging/comedi/drivers/ni_mio_common.c
+++ b/drivers/staging/comedi/drivers/ni_mio_common.c
@@ -2772,7 +2772,15 @@ static int ni_ao_inttrig(struct comedi_device *dev,
         int i;
         static const int timeout = 1000;
 
-        if (trig_num != cmd->start_arg)
+        /*
+         * Require trig_num == cmd->start_arg when cmd->start_src == TRIG_INT.
+         * For backwards compatibility, also allow trig_num == 0 when
+         * cmd->start_src != TRIG_INT (i.e. when cmd->start_src == TRIG_EXT);
+         * in that case, the internal trigger is being used as a pre-trigger
+         * before the external trigger.
+         */
+        if (!(trig_num == cmd->start_arg ||
+              (trig_num == 0 && cmd->start_src != TRIG_INT)))
                 return -EINVAL;
 
         /*
@@ -5480,7 +5488,7 @@ static int ni_E_init(struct comedi_device *dev,
                 s->maxdata      = (devpriv->is_m_series) ? 0xffffffff
                                                          : 0x00ffffff;
                 s->insn_read    = ni_tio_insn_read;
-                s->insn_write   = ni_tio_insn_read;
+                s->insn_write   = ni_tio_insn_write;
                 s->insn_config  = ni_tio_insn_config;
 #ifdef PCIDMA
                 if (dev->irq && devpriv->mite) {
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index 170ac980abcb..24c348d2f5bb 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -419,6 +419,7 @@ static ssize_t ad5933_store(struct device *dev,
         mutex_lock(&indio_dev->mlock);
         switch ((u32)this_attr->address) {
         case AD5933_OUT_RANGE:
+                ret = -EINVAL;
                 for (i = 0; i < 4; i++)
                         if (val == st->range_avail[i]) {
                                 st->ctrl_hb &= ~AD5933_CTRL_RANGE(0x3);
@@ -426,7 +427,6 @@ static ssize_t ad5933_store(struct device *dev,
                                 ret = ad5933_cmd(st, 0);
                                 break;
                         }
-                ret = -EINVAL;
                 break;
         case AD5933_IN_PGA_GAIN:
                 if (sysfs_streq(buf, "1")) {
diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
index 3664bfd0178b..2c4dc69731e8 100644
--- a/drivers/staging/lustre/lustre/llite/namei.c
+++ b/drivers/staging/lustre/lustre/llite/namei.c
@@ -388,6 +388,7 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
         struct inode *inode = NULL;
         __u64 bits = 0;
         int rc = 0;
+        struct dentry *alias;
 
         /* NB 1 request reference will be taken away by ll_intent_lock()
          * when I return
@@ -412,26 +413,12 @@ static int ll_lookup_it_finish(struct ptlrpc_request *request,
                  */
         }
 
-        /* Only hash *de if it is unhashed (new dentry).
-         * Atoimc_open may passing hashed dentries for open.
-         */
-        if (d_unhashed(*de)) {
-                struct dentry *alias;
-
-                alias = ll_splice_alias(inode, *de);
-                if (IS_ERR(alias)) {
-                        rc = PTR_ERR(alias);
-                        goto out;
-                }
-                *de = alias;
-        } else if (!it_disposition(it, DISP_LOOKUP_NEG)  &&
-                   !it_disposition(it, DISP_OPEN_CREATE)) {
-                /* With DISP_OPEN_CREATE dentry will be
-                 * instantiated in ll_create_it.
-                 */
-                LASSERT(!d_inode(*de));
-                d_instantiate(*de, inode);
+        alias = ll_splice_alias(inode, *de);
+        if (IS_ERR(alias)) {
+                rc = PTR_ERR(alias);
+                goto out;
         }
+        *de = alias;
 
         if (!it_disposition(it, DISP_LOOKUP_NEG)) {
                 /* we have lookup look - unhide dentry */
@@ -587,6 +574,24 @@ static int ll_atomic_open(struct inode *dir, struct dentry *dentry,
                dentry, PFID(ll_inode2fid(dir)), dir, file, open_flags, mode,
                *opened);
 
+        /* Only negative dentries enter here */
+        LASSERT(!d_inode(dentry));
+
+        if (!d_in_lookup(dentry)) {
+                /* A valid negative dentry that just passed revalidation,
+                 * there's little point to try and open it server-side,
+                 * even though there's a minuscle chance it might succeed.
+                 * Either way it's a valid race to just return -ENOENT here.
+                 */
+                if (!(open_flags & O_CREAT))
+                        return -ENOENT;
+
+                /* Otherwise we just unhash it to be rehashed afresh via
+                 * lookup if necessary
+                 */
+                d_drop(dentry);
+        }
+
         it = kzalloc(sizeof(*it), GFP_NOFS);
         if (!it)
                 return -ENOMEM;
diff --git a/drivers/staging/media/cec/TODO b/drivers/staging/media/cec/TODO
index a10d4f82b954..13224694a8ae 100644
--- a/drivers/staging/media/cec/TODO
+++ b/drivers/staging/media/cec/TODO
@@ -12,6 +12,7 @@ Hopefully this will happen later in 2016.
 
 Other TODOs:
 
+- There are two possible replies to CEC_MSG_INITIATE_ARC. How to handle that?
 - Add a flag to inhibit passing CEC RC messages to the rc subsystem.
   Applications should be able to choose this when calling S_LOG_ADDRS.
 - If the reply field of cec_msg is set then when the reply arrives it
diff --git a/drivers/staging/media/cec/cec-adap.c b/drivers/staging/media/cec/cec-adap.c
index b2393bbacb26..946986f3ac0d 100644
--- a/drivers/staging/media/cec/cec-adap.c
+++ b/drivers/staging/media/cec/cec-adap.c
@@ -124,10 +124,10 @@ static void cec_queue_event(struct cec_adapter *adap,
         u64 ts = ktime_get_ns();
         struct cec_fh *fh;
 
-        mutex_lock(&adap->devnode.fhs_lock);
+        mutex_lock(&adap->devnode.lock);
         list_for_each_entry(fh, &adap->devnode.fhs, list)
                 cec_queue_event_fh(fh, ev, ts);
-        mutex_unlock(&adap->devnode.fhs_lock);
+        mutex_unlock(&adap->devnode.lock);
 }
 
 /*
@@ -191,12 +191,12 @@ static void cec_queue_msg_monitor(struct cec_adapter *adap,
         u32 monitor_mode = valid_la ? CEC_MODE_MONITOR :
                                       CEC_MODE_MONITOR_ALL;
 
-        mutex_lock(&adap->devnode.fhs_lock);
+        mutex_lock(&adap->devnode.lock);
         list_for_each_entry(fh, &adap->devnode.fhs, list) {
                 if (fh->mode_follower >= monitor_mode)
                         cec_queue_msg_fh(fh, msg);
         }
-        mutex_unlock(&adap->devnode.fhs_lock);
+        mutex_unlock(&adap->devnode.lock);
 }
 
 /*
@@ -207,12 +207,12 @@ static void cec_queue_msg_followers(struct cec_adapter *adap,
 {
         struct cec_fh *fh;
 
-        mutex_lock(&adap->devnode.fhs_lock);
+        mutex_lock(&adap->devnode.lock);
         list_for_each_entry(fh, &adap->devnode.fhs, list) {
                 if (fh->mode_follower == CEC_MODE_FOLLOWER)
                         cec_queue_msg_fh(fh, msg);
         }
-        mutex_unlock(&adap->devnode.fhs_lock);
+        mutex_unlock(&adap->devnode.lock);
 }
 
 /* Notify userspace of an adapter state change. */
@@ -851,6 +851,9 @@ void cec_received_msg(struct cec_adapter *adap, struct cec_msg *msg)
         if (!valid_la || msg->len <= 1)
                 return;
 
+        if (adap->log_addrs.log_addr_mask == 0)
+                return;
+
         /*
          * Process the message on the protocol level. If is_reply is true,
          * then cec_receive_notify() won't pass on the reply to the listener(s)
@@ -1047,11 +1050,17 @@ static int cec_config_thread_func(void *arg)
                         dprintk(1, "could not claim LA %d\n", i);
         }
 
+        if (adap->log_addrs.log_addr_mask == 0 &&
+            !(las->flags & CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK))
+                goto unconfigure;
+
 configured:
         if (adap->log_addrs.log_addr_mask == 0) {
                 /* Fall back to unregistered */
                 las->log_addr[0] = CEC_LOG_ADDR_UNREGISTERED;
                 las->log_addr_mask = 1 << las->log_addr[0];
+                for (i = 1; i < las->num_log_addrs; i++)
+                        las->log_addr[i] = CEC_LOG_ADDR_INVALID;
         }
         adap->is_configured = true;
         adap->is_configuring = false;
@@ -1070,6 +1079,8 @@ configured:
                         cec_report_features(adap, i);
                 cec_report_phys_addr(adap, i);
         }
+        for (i = las->num_log_addrs; i < CEC_MAX_LOG_ADDRS; i++)
+                las->log_addr[i] = CEC_LOG_ADDR_INVALID;
         mutex_lock(&adap->lock);
         adap->kthread_config = NULL;
         mutex_unlock(&adap->lock);
@@ -1398,7 +1409,6 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
         u8 init_laddr = cec_msg_initiator(msg);
         u8 devtype = cec_log_addr2dev(adap, dest_laddr);
         int la_idx = cec_log_addr2idx(adap, dest_laddr);
-        bool is_directed = la_idx >= 0;
         bool from_unregistered = init_laddr == 0xf;
         struct cec_msg tx_cec_msg = { };
 
@@ -1560,7 +1570,7 @@ static int cec_receive_notify(struct cec_adapter *adap, struct cec_msg *msg,
                  * Unprocessed messages are aborted if userspace isn't doing
                  * any processing either.
                  */
-                if (is_directed && !is_reply && !adap->follower_cnt &&
+                if (!is_broadcast && !is_reply && !adap->follower_cnt &&
                     !adap->cec_follower && msg->msg[1] != CEC_MSG_FEATURE_ABORT)
                         return cec_feature_abort(adap, msg);
                 break;
diff --git a/drivers/staging/media/cec/cec-api.c b/drivers/staging/media/cec/cec-api.c
index 7be7615a0fdf..e274e2f22398 100644
--- a/drivers/staging/media/cec/cec-api.c
+++ b/drivers/staging/media/cec/cec-api.c
@@ -162,7 +162,7 @@ static long cec_adap_s_log_addrs(struct cec_adapter *adap, struct cec_fh *fh,
                 return -ENOTTY;
         if (copy_from_user(&log_addrs, parg, sizeof(log_addrs)))
                 return -EFAULT;
-        log_addrs.flags = 0;
+        log_addrs.flags &= CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK;
         mutex_lock(&adap->lock);
         if (!adap->is_configuring &&
             (!log_addrs.num_log_addrs || !adap->is_configured) &&
@@ -435,7 +435,7 @@ static long cec_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
         void __user *parg = (void __user *)arg;
 
         if (!devnode->registered)
-                return -EIO;
+                return -ENODEV;
 
         switch (cmd) {
         case CEC_ADAP_G_CAPS:
@@ -508,14 +508,14 @@ static int cec_open(struct inode *inode, struct file *filp)
 
         filp->private_data = fh;
 
-        mutex_lock(&devnode->fhs_lock);
+        mutex_lock(&devnode->lock);
         /* Queue up initial state events */
         ev_state.state_change.phys_addr = adap->phys_addr;
         ev_state.state_change.log_addr_mask = adap->log_addrs.log_addr_mask;
         cec_queue_event_fh(fh, &ev_state, 0);
 
         list_add(&fh->list, &devnode->fhs);
-        mutex_unlock(&devnode->fhs_lock);
+        mutex_unlock(&devnode->lock);
 
         return 0;
 }
@@ -540,9 +540,9 @@ static int cec_release(struct inode *inode, struct file *filp)
                 cec_monitor_all_cnt_dec(adap);
         mutex_unlock(&adap->lock);
 
-        mutex_lock(&devnode->fhs_lock);
+        mutex_lock(&devnode->lock);
         list_del(&fh->list);
-        mutex_unlock(&devnode->fhs_lock);
+        mutex_unlock(&devnode->lock);
 
         /* Unhook pending transmits from this filehandle. */
         mutex_lock(&adap->lock);
diff --git a/drivers/staging/media/cec/cec-core.c b/drivers/staging/media/cec/cec-core.c
index 112a5fae12f5..3b1e4d2b190d 100644
--- a/drivers/staging/media/cec/cec-core.c
+++ b/drivers/staging/media/cec/cec-core.c
@@ -51,31 +51,29 @@ int cec_get_device(struct cec_devnode *devnode)
 {
         /*
          * Check if the cec device is available. This needs to be done with
-         * the cec_devnode_lock held to prevent an open/unregister race:
+         * the devnode->lock held to prevent an open/unregister race:
          * without the lock, the device could be unregistered and freed between
          * the devnode->registered check and get_device() calls, leading to
          * a crash.
          */
-        mutex_lock(&cec_devnode_lock);
+        mutex_lock(&devnode->lock);
         /*
          * return ENXIO if the cec device has been removed
          * already or if it is not registered anymore.
          */
         if (!devnode->registered) {
-                mutex_unlock(&cec_devnode_lock);
+                mutex_unlock(&devnode->lock);
                 return -ENXIO;
         }
         /* and increase the device refcount */
         get_device(&devnode->dev);
-        mutex_unlock(&cec_devnode_lock);
+        mutex_unlock(&devnode->lock);
         return 0;
 }
 
 void cec_put_device(struct cec_devnode *devnode)
 {
-        mutex_lock(&cec_devnode_lock);
         put_device(&devnode->dev);
-        mutex_unlock(&cec_devnode_lock);
 }
 
 /* Called when the last user of the cec device exits. */
@@ -84,11 +82,10 @@ static void cec_devnode_release(struct device *cd)
         struct cec_devnode *devnode = to_cec_devnode(cd);
 
         mutex_lock(&cec_devnode_lock);
-
         /* Mark device node number as free */
         clear_bit(devnode->minor, cec_devnode_nums);
-
         mutex_unlock(&cec_devnode_lock);
+
         cec_delete_adapter(to_cec_adapter(devnode));
 }
 
@@ -117,7 +114,7 @@ static int __must_check cec_devnode_register(struct cec_devnode *devnode,
 
         /* Initialization */
         INIT_LIST_HEAD(&devnode->fhs);
-        mutex_init(&devnode->fhs_lock);
+        mutex_init(&devnode->lock);
 
         /* Part 1: Find a free minor number */
         mutex_lock(&cec_devnode_lock);
@@ -160,7 +157,9 @@ static int __must_check cec_devnode_register(struct cec_devnode *devnode,
 cdev_del:
         cdev_del(&devnode->cdev);
 clr_bit:
+        mutex_lock(&cec_devnode_lock);
         clear_bit(devnode->minor, cec_devnode_nums);
+        mutex_unlock(&cec_devnode_lock);
         return ret;
 }
 
@@ -177,17 +176,21 @@ static void cec_devnode_unregister(struct cec_devnode *devnode)
 {
         struct cec_fh *fh;
 
+        mutex_lock(&devnode->lock);
+
         /* Check if devnode was never registered or already unregistered */
-        if (!devnode->registered || devnode->unregistered)
+        if (!devnode->registered || devnode->unregistered) {
+                mutex_unlock(&devnode->lock);
                 return;
+        }
 
-        mutex_lock(&devnode->fhs_lock);
         list_for_each_entry(fh, &devnode->fhs, list)
                 wake_up_interruptible(&fh->wait);
-        mutex_unlock(&devnode->fhs_lock);
 
         devnode->registered = false;
         devnode->unregistered = true;
+        mutex_unlock(&devnode->lock);
+
         device_del(&devnode->dev);
         cdev_del(&devnode->cdev);
         put_device(&devnode->dev);
diff --git a/drivers/staging/media/pulse8-cec/pulse8-cec.c b/drivers/staging/media/pulse8-cec/pulse8-cec.c
index 94f8590492dc..ed8bd95ad6d0 100644
--- a/drivers/staging/media/pulse8-cec/pulse8-cec.c
+++ b/drivers/staging/media/pulse8-cec/pulse8-cec.c
@@ -114,14 +114,11 @@ static void pulse8_irq_work_handler(struct work_struct *work)
                 cec_transmit_done(pulse8->adap, CEC_TX_STATUS_OK,
                                   0, 0, 0, 0);
                 break;
-        case MSGCODE_TRANSMIT_FAILED_LINE:
-                cec_transmit_done(pulse8->adap, CEC_TX_STATUS_ARB_LOST,
-                                  1, 0, 0, 0);
-                break;
         case MSGCODE_TRANSMIT_FAILED_ACK:
                 cec_transmit_done(pulse8->adap, CEC_TX_STATUS_NACK,
                                   0, 1, 0, 0);
                 break;
+        case MSGCODE_TRANSMIT_FAILED_LINE:
         case MSGCODE_TRANSMIT_FAILED_TIMEOUT_DATA:
         case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE:
                 cec_transmit_done(pulse8->adap, CEC_TX_STATUS_ERROR,
@@ -170,6 +167,9 @@ static irqreturn_t pulse8_interrupt(struct serio *serio, unsigned char data,
                 case MSGCODE_TRANSMIT_FAILED_TIMEOUT_LINE:
                         schedule_work(&pulse8->work);
                         break;
+                case MSGCODE_HIGH_ERROR:
+                case MSGCODE_LOW_ERROR:
+                case MSGCODE_RECEIVE_FAILED:
                 case MSGCODE_TIMEOUT_ERROR:
                         break;
                 case MSGCODE_COMMAND_ACCEPTED:
@@ -388,7 +388,7 @@ static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
         int err;
 
         cmd[0] = MSGCODE_TRANSMIT_IDLETIME;
-        cmd[1] = 3;
+        cmd[1] = signal_free_time;
         err = pulse8_send_and_wait(pulse8, cmd, 2,
                                    MSGCODE_COMMAND_ACCEPTED, 1);
         cmd[0] = MSGCODE_TRANSMIT_ACK_POLARITY;
diff --git a/drivers/staging/wilc1000/host_interface.c b/drivers/staging/wilc1000/host_interface.c
index 0b1760cba6e3..78f524fcd214 100644
--- a/drivers/staging/wilc1000/host_interface.c
+++ b/drivers/staging/wilc1000/host_interface.c
@@ -3363,7 +3363,7 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
                 if (!hif_workqueue) {
                         netdev_err(vif->ndev, "Failed to create workqueue\n");
                         result = -ENOMEM;
-                        goto _fail_mq_;
+                        goto _fail_;
                 }
 
                 setup_timer(&periodic_rssi, GetPeriodicRSSI,
@@ -3391,7 +3391,6 @@ int wilc_init(struct net_device *dev, struct host_if_drv **hif_drv_handler)
 
         clients_count++;
 
-_fail_mq_:
         destroy_workqueue(hif_workqueue);
 _fail_:
         return result;
diff --git a/drivers/staging/wilc1000/linux_wlan.c b/drivers/staging/wilc1000/linux_wlan.c
index 3a66255f14fc..32215110d597 100644
--- a/drivers/staging/wilc1000/linux_wlan.c
+++ b/drivers/staging/wilc1000/linux_wlan.c
@@ -648,7 +648,7 @@ void wilc1000_wlan_deinit(struct net_device *dev)
                         mutex_unlock(&wl->hif_cs);
                 }
                 if (&wl->txq_event)
-                        wait_for_completion(&wl->txq_event);
+                        complete(&wl->txq_event);
 
                 wlan_deinitialize_threads(dev);
                 deinit_irq(dev);
diff --git a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
index 9092600a1794..2c2e8aca8305 100644
--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
+++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c
@@ -1191,7 +1191,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
         struct wilc_priv *priv;
         struct wilc_vif *vif;
         u32 i = 0;
-        u32 associatedsta = 0;
+        u32 associatedsta = ~0;
         u32 inactive_time = 0;
         priv = wiphy_priv(wiphy);
         vif = netdev_priv(dev);
@@ -1204,7 +1204,7 @@ static int get_station(struct wiphy *wiphy, struct net_device *dev,
                         }
                 }
 
-                if (associatedsta == -1) {
+                if (associatedsta == ~0) {
                         netdev_err(dev, "sta required is not associated\n");
                         return -ENOENT;
                 }
diff --git a/drivers/thermal/clock_cooling.c b/drivers/thermal/clock_cooling.c
index 1b4ff0f4c716..ed5dd0e88657 100644
--- a/drivers/thermal/clock_cooling.c
+++ b/drivers/thermal/clock_cooling.c
@@ -426,6 +426,7 @@ clock_cooling_register(struct device *dev, const char *clock_name)
         if (!ccdev)
                 return ERR_PTR(-ENOMEM);
 
+        mutex_init(&ccdev->lock);
         ccdev->dev = dev;
         ccdev->clk = devm_clk_get(dev, clock_name);
         if (IS_ERR(ccdev->clk))
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index 3788ed74c9ab..a32b41783b77 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -740,12 +740,22 @@ static int cpufreq_power2state(struct thermal_cooling_device *cdev,
 }
 
 /* Bind cpufreq callbacks to thermal cooling device ops */
+
 static struct thermal_cooling_device_ops cpufreq_cooling_ops = {
         .get_max_state = cpufreq_get_max_state,
         .get_cur_state = cpufreq_get_cur_state,
         .set_cur_state = cpufreq_set_cur_state,
 };
 
+static struct thermal_cooling_device_ops cpufreq_power_cooling_ops = {
+        .get_max_state          = cpufreq_get_max_state,
+        .get_cur_state          = cpufreq_get_cur_state,
+        .set_cur_state          = cpufreq_set_cur_state,
+        .get_requested_power    = cpufreq_get_requested_power,
+        .state2power            = cpufreq_state2power,
+        .power2state            = cpufreq_power2state,
+};
+
 /* Notifier for cpufreq policy change */
 static struct notifier_block thermal_cpufreq_notifier_block = {
         .notifier_call = cpufreq_thermal_notifier,
@@ -795,6 +805,7 @@ __cpufreq_cooling_register(struct device_node *np,
         struct cpumask temp_mask;
         unsigned int freq, i, num_cpus;
         int ret;
+        struct thermal_cooling_device_ops *cooling_ops;
 
         cpumask_and(&temp_mask, clip_cpus, cpu_online_mask);
         policy = cpufreq_cpu_get(cpumask_first(&temp_mask));
@@ -850,10 +861,6 @@ __cpufreq_cooling_register(struct device_node *np,
         cpumask_copy(&cpufreq_dev->allowed_cpus, clip_cpus);
 
         if (capacitance) {
-                cpufreq_cooling_ops.get_requested_power =
-                        cpufreq_get_requested_power;
-                cpufreq_cooling_ops.state2power = cpufreq_state2power;
-                cpufreq_cooling_ops.power2state = cpufreq_power2state;
                 cpufreq_dev->plat_get_static_power = plat_static_func;
 
                 ret = build_dyn_power_table(cpufreq_dev, capacitance);
@@ -861,6 +868,10 @@ __cpufreq_cooling_register(struct device_node *np,
                         cool_dev = ERR_PTR(ret);
                         goto free_table;
                 }
+
+                cooling_ops = &cpufreq_power_cooling_ops;
+        } else {
+                cooling_ops = &cpufreq_cooling_ops;
         }
 
         ret = get_idr(&cpufreq_idr, &cpufreq_dev->id);
@@ -885,7 +896,7 @@ __cpufreq_cooling_register(struct device_node *np,
                  cpufreq_dev->id);
 
         cool_dev = thermal_of_cooling_device_register(np, dev_name, cpufreq_dev,
-                                                      &cpufreq_cooling_ops);
+                                                      cooling_ops);
         if (IS_ERR(cool_dev))
                 goto remove_idr;
 
diff --git a/drivers/thermal/fair_share.c b/drivers/thermal/fair_share.c
index 34fe36504a55..68bd1b569118 100644
--- a/drivers/thermal/fair_share.c
+++ b/drivers/thermal/fair_share.c
@@ -116,7 +116,9 @@ static int fair_share_throttle(struct thermal_zone_device *tz, int trip)
                 instance->target = get_target_state(tz, cdev, percentage,
                                                     cur_trip_level);
 
+                mutex_lock(&instance->cdev->lock);
                 instance->cdev->updated = false;
+                mutex_unlock(&instance->cdev->lock);
                 thermal_cdev_update(cdev);
         }
         return 0;
diff --git a/drivers/thermal/gov_bang_bang.c b/drivers/thermal/gov_bang_bang.c
index fc52016d4e85..bb118a152cbb 100644
--- a/drivers/thermal/gov_bang_bang.c
+++ b/drivers/thermal/gov_bang_bang.c
@@ -71,7 +71,9 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
                 dev_dbg(&instance->cdev->device, "target=%d\n",
                                         (int)instance->target);
 
+                mutex_lock(&instance->cdev->lock);
                 instance->cdev->updated = false; /* cdev needs update */
+                mutex_unlock(&instance->cdev->lock);
         }
 
         mutex_unlock(&tz->lock);
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index c5547bd711db..e473548b5d28 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -471,8 +471,6 @@ MODULE_DEVICE_TABLE(of, of_imx_thermal_match);
 
 static int imx_thermal_probe(struct platform_device *pdev)
 {
-        const struct of_device_id *of_id =
-                of_match_device(of_imx_thermal_match, &pdev->dev);
         struct imx_thermal_data *data;
         struct regmap *map;
         int measure_freq;
@@ -490,7 +488,7 @@ static int imx_thermal_probe(struct platform_device *pdev)
         }
         data->tempmon = map;
 
-        data->socdata = of_id->data;
+        data->socdata = of_device_get_match_data(&pdev->dev);
 
         /* make sure the IRQ flag is clear before enabling irq on i.MX6SX */
         if (data->socdata->version == TEMPMON_IMX6SX) {
diff --git a/drivers/thermal/int340x_thermal/int3406_thermal.c b/drivers/thermal/int340x_thermal/int3406_thermal.c
index a578cd257db4..1891f34ab7fc 100644
--- a/drivers/thermal/int340x_thermal/int3406_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3406_thermal.c
@@ -225,7 +225,6 @@ static struct platform_driver int3406_thermal_driver = {
         .remove = int3406_thermal_remove,
         .driver = {
                    .name = "int3406 thermal",
-                   .owner = THIS_MODULE,
                    .acpi_match_table = int3406_thermal_match,
                    },
 };
diff --git a/drivers/thermal/intel_pch_thermal.c b/drivers/thermal/intel_pch_thermal.c
index 6a6ec1c95a7a..9b4815e81b0d 100644
--- a/drivers/thermal/intel_pch_thermal.c
+++ b/drivers/thermal/intel_pch_thermal.c
@@ -21,6 +21,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/thermal.h>
+#include <linux/pm.h>
 
 /* Intel PCH thermal Device IDs */
 #define PCH_THERMAL_DID_WPT     0x9CA4 /* Wildcat Point */
@@ -65,6 +66,7 @@ struct pch_thermal_device {
         unsigned long crt_temp;
         int hot_trip_id;
         unsigned long hot_temp;
+        bool bios_enabled;
 };
 
 static int pch_wpt_init(struct pch_thermal_device *ptd, int *nr_trips)
@@ -75,8 +77,10 @@ static int pch_wpt_init(struct pch_thermal_device *ptd, int *nr_trips)
         *nr_trips = 0;
 
         /* Check if BIOS has already enabled thermal sensor */
-        if (WPT_TSS_TSDSS & readb(ptd->hw_base + WPT_TSS))
+        if (WPT_TSS_TSDSS & readb(ptd->hw_base + WPT_TSS)) {
+                ptd->bios_enabled = true;
                 goto read_trips;
+        }
 
         tsel = readb(ptd->hw_base + WPT_TSEL);
         /*
@@ -130,9 +134,39 @@ static int pch_wpt_get_temp(struct pch_thermal_device *ptd, int *temp)
         return 0;
 }
 
+static int pch_wpt_suspend(struct pch_thermal_device *ptd)
+{
+        u8 tsel;
+
+        if (ptd->bios_enabled)
+                return 0;
+
+        tsel = readb(ptd->hw_base + WPT_TSEL);
+
+        writeb(tsel & 0xFE, ptd->hw_base + WPT_TSEL);
+
+        return 0;
+}
+
+static int pch_wpt_resume(struct pch_thermal_device *ptd)
+{
+        u8 tsel;
+
+        if (ptd->bios_enabled)
+                return 0;
+
+        tsel = readb(ptd->hw_base + WPT_TSEL);
+
+        writeb(tsel | WPT_TSEL_ETS, ptd->hw_base + WPT_TSEL);
+
+        return 0;
+}
+
 struct pch_dev_ops {
         int (*hw_init)(struct pch_thermal_device *ptd, int *nr_trips);
         int (*get_temp)(struct pch_thermal_device *ptd, int *temp);
+        int (*suspend)(struct pch_thermal_device *ptd);
+        int (*resume)(struct pch_thermal_device *ptd);
 };
 
 
@@ -140,6 +174,8 @@ struct pch_dev_ops {
 static const struct pch_dev_ops pch_dev_ops_wpt = {
         .hw_init = pch_wpt_init,
         .get_temp = pch_wpt_get_temp,
+        .suspend = pch_wpt_suspend,
+        .resume = pch_wpt_resume,
 };
 
 static int pch_thermal_get_temp(struct thermal_zone_device *tzd, int *temp)
@@ -269,6 +305,22 @@ static void intel_pch_thermal_remove(struct pci_dev *pdev)
         pci_disable_device(pdev);
 }
 
+static int intel_pch_thermal_suspend(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+        struct pch_thermal_device *ptd = pci_get_drvdata(pdev);
+
+        return ptd->ops->suspend(ptd);
+}
+
+static int intel_pch_thermal_resume(struct device *device)
+{
+        struct pci_dev *pdev = to_pci_dev(device);
+        struct pch_thermal_device *ptd = pci_get_drvdata(pdev);
+
+        return ptd->ops->resume(ptd);
+}
+
 static struct pci_device_id intel_pch_thermal_id[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_WPT) },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCH_THERMAL_DID_SKL) },
@@ -276,11 +328,17 @@ static struct pci_device_id intel_pch_thermal_id[] = {
 };
 MODULE_DEVICE_TABLE(pci, intel_pch_thermal_id);
 
+static const struct dev_pm_ops intel_pch_pm_ops = {
+        .suspend = intel_pch_thermal_suspend,
+        .resume = intel_pch_thermal_resume,
+};
+
 static struct pci_driver intel_pch_thermal_driver = {
         .name           = "intel_pch_thermal",
         .id_table       = intel_pch_thermal_id,
         .probe          = intel_pch_thermal_probe,
         .remove         = intel_pch_thermal_remove,
+        .driver.pm      = &intel_pch_pm_ops,
 };
 
 module_pci_driver(intel_pch_thermal_driver);
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index 015ce2eb6eb7..0e4dc0afcfd2 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -388,7 +388,7 @@ static int clamp_thread(void *arg)
                 int sleeptime;
                 unsigned long target_jiffies;
                 unsigned int guard;
-                unsigned int compensation = 0;
+                unsigned int compensated_ratio;
                 int interval; /* jiffies to sleep for each attempt */
                 unsigned int duration_jiffies = msecs_to_jiffies(duration);
                 unsigned int window_size_now;
@@ -409,8 +409,11 @@ static int clamp_thread(void *arg)
                  * c-states, thus we need to compensate the injected idle ratio
                  * to achieve the actual target reported by the HW.
                  */
-                compensation = get_compensation(target_ratio);
-                interval = duration_jiffies*100/(target_ratio+compensation);
+                compensated_ratio = target_ratio +
+                        get_compensation(target_ratio);
+                if (compensated_ratio <= 0)
+                        compensated_ratio = 1;
+                interval = duration_jiffies * 100 / compensated_ratio;
 
                 /* align idle time */
                 target_jiffies = roundup(jiffies, interval);
@@ -647,8 +650,8 @@ static int powerclamp_set_cur_state(struct thermal_cooling_device *cdev,
                 goto exit_set;
         } else  if (set_target_ratio > 0 && new_target_ratio == 0) {
                 pr_info("Stop forced idle injection\n");
-                set_target_ratio = 0;
                 end_power_clamp();
+                set_target_ratio = 0;
         } else  /* adjust currently running */ {
                 set_target_ratio = new_target_ratio;
                 /* make new set_target_ratio visible to other cpus */
diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c
index 2f1a863a8e15..b4d3116cfdaf 100644
--- a/drivers/thermal/power_allocator.c
+++ b/drivers/thermal/power_allocator.c
@@ -529,7 +529,9 @@ static void allow_maximum_power(struct thermal_zone_device *tz)
                         continue;
 
                 instance->target = 0;
+                mutex_lock(&instance->cdev->lock);
                 instance->cdev->updated = false;
+                mutex_unlock(&instance->cdev->lock);
                 thermal_cdev_update(instance->cdev);
         }
 }
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 71a339271fa5..5f817923f374 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -504,6 +504,7 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 if (IS_ERR(priv->zone)) {
                         dev_err(dev, "can't register thermal zone\n");
                         ret = PTR_ERR(priv->zone);
+                        priv->zone = NULL;
                         goto error_unregister;
                 }
 
diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
index ea9366ad3e6b..bcef2e7c4ec9 100644
--- a/drivers/thermal/step_wise.c
+++ b/drivers/thermal/step_wise.c
@@ -175,7 +175,9 @@ static void thermal_zone_trip_update(struct thermal_zone_device *tz, int trip)
                         update_passive_instance(tz, trip_type, -1);
 
                 instance->initialized = true;
+                mutex_lock(&instance->cdev->lock);
                 instance->cdev->updated = false; /* cdev needs update */
+                mutex_unlock(&instance->cdev->lock);
         }
 
         mutex_unlock(&tz->lock);
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 5133cd1e10b7..e2fc6161dded 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1093,7 +1093,9 @@ int power_actor_set_power(struct thermal_cooling_device *cdev,
                 return ret;
 
         instance->target = state;
+        mutex_lock(&cdev->lock);
         cdev->updated = false;
+        mutex_unlock(&cdev->lock);
         thermal_cdev_update(cdev);
 
         return 0;
@@ -1623,11 +1625,13 @@ void thermal_cdev_update(struct thermal_cooling_device *cdev)
         struct thermal_instance *instance;
         unsigned long target = 0;
 
+        mutex_lock(&cdev->lock);
         /* cooling device is updated*/
-        if (cdev->updated)
+        if (cdev->updated) {
+                mutex_unlock(&cdev->lock);
                 return;
+        }
 
-        mutex_lock(&cdev->lock);
         /* Make sure cdev enters the deepest cooling state */
         list_for_each_entry(instance, &cdev->thermal_instances, cdev_node) {
                 dev_dbg(&cdev->device, "zone%d->target=%lu\n",
@@ -1637,9 +1641,9 @@ void thermal_cdev_update(struct thermal_cooling_device *cdev)
                 if (instance->target > target)
                         target = instance->target;
         }
-        mutex_unlock(&cdev->lock);
         cdev->ops->set_cur_state(cdev, target);
         cdev->updated = true;
+        mutex_unlock(&cdev->lock);
         trace_cdev_update(cdev, target);
         dev_dbg(&cdev->device, "set to state %lu\n", target);
 }
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index 06fd2ed9ef9d..c41c7742903a 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -232,6 +232,7 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
 
         return result;
 }
+EXPORT_SYMBOL_GPL(thermal_add_hwmon_sysfs);
 
 void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
 {
@@ -270,3 +271,4 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
         hwmon_device_unregister(hwmon->device);
         kfree(hwmon);
 }
+EXPORT_SYMBOL_GPL(thermal_remove_hwmon_sysfs);
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 9c15344b657a..a8c20413dbda 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -651,6 +651,12 @@ static struct pci_device_id nhi_ids[] = {
         {
                 .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
                 .vendor = PCI_VENDOR_ID_INTEL,
+                .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_NHI,
+                .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
+        },
+        {
+                .class = PCI_CLASS_SYSTEM_OTHER << 8, .class_mask = ~0,
+                .vendor = PCI_VENDOR_ID_INTEL,
                 .device = PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_NHI,
                 .subvendor = PCI_ANY_ID, .subdevice = PCI_ANY_ID,
         },
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 1e116f53d6dd..9840fdecb73b 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -372,7 +372,9 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, u64 route)
 
         if (sw->config.device_id != PCI_DEVICE_ID_INTEL_LIGHT_RIDGE &&
             sw->config.device_id != PCI_DEVICE_ID_INTEL_CACTUS_RIDGE_4C &&
-            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE)
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_PORT_RIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_2C_BRIDGE &&
+            sw->config.device_id != PCI_DEVICE_ID_INTEL_FALCON_RIDGE_4C_BRIDGE)
                 tb_sw_warn(sw, "unsupported switch device id %#x\n",
                            sw->config.device_id);
 
diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
index 122e0e4029fe..1a16feac9a36 100644
--- a/drivers/tty/serial/8250/8250.h
+++ b/drivers/tty/serial/8250/8250.h
@@ -15,8 +15,6 @@
 #include <linux/serial_reg.h>
 #include <linux/dmaengine.h>
 
-#include "../serial_mctrl_gpio.h"
-
 struct uart_8250_dma {
         int (*tx_dma)(struct uart_8250_port *p);
         int (*rx_dma)(struct uart_8250_port *p);
@@ -133,43 +131,12 @@ void serial8250_em485_destroy(struct uart_8250_port *p);
 
 static inline void serial8250_out_MCR(struct uart_8250_port *up, int value)
 {
-        int mctrl_gpio = 0;
-
         serial_out(up, UART_MCR, value);
-
-        if (value & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (value & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-
-        mctrl_gpio_set(up->gpios, mctrl_gpio);
 }
 
 static inline int serial8250_in_MCR(struct uart_8250_port *up)
 {
-        int mctrl, mctrl_gpio = 0;
-
-        mctrl = serial_in(up, UART_MCR);
-
-        /* save current MCR values */
-        if (mctrl & UART_MCR_RTS)
-                mctrl_gpio |= TIOCM_RTS;
-        if (mctrl & UART_MCR_DTR)
-                mctrl_gpio |= TIOCM_DTR;
-
-        mctrl_gpio = mctrl_gpio_get_outputs(up->gpios, &mctrl_gpio);
-
-        if (mctrl_gpio & TIOCM_RTS)
-                mctrl |= UART_MCR_RTS;
-        else
-                mctrl &= ~UART_MCR_RTS;
-
-        if (mctrl_gpio & TIOCM_DTR)
-                mctrl |= UART_MCR_DTR;
-        else
-                mctrl &= ~UART_MCR_DTR;
-
-        return mctrl;
+        return serial_in(up, UART_MCR);
 }
 
 #if defined(__alpha__) && !defined(CONFIG_PCI)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index 13ad5c3d2e68..dcf43f66404f 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -974,8 +974,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
 
         uart = serial8250_find_match_or_unused(&up->port);
         if (uart && uart->port.type != PORT_8250_CIR) {
-                struct mctrl_gpios *gpios;
-
                 if (uart->port.dev)
                         uart_remove_one_port(&serial8250_reg, &uart->port);
 
@@ -1013,13 +1011,6 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
                 if (up->port.flags & UPF_FIXED_TYPE)
                         uart->port.type = up->port.type;
 
-                gpios = mctrl_gpio_init(&uart->port, 0);
-                if (IS_ERR(gpios)) {
-                        if (PTR_ERR(gpios) != -ENOSYS)
-                                return PTR_ERR(gpios);
-                } else
-                        uart->gpios = gpios;
-
                 serial8250_set_defaults(uart);
 
                 /* Possibly override default I/O functions.  */
diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
index 737b4b3957b0..0facc789fe7d 100644
--- a/drivers/tty/serial/8250/8250_fintek.c
+++ b/drivers/tty/serial/8250/8250_fintek.c
@@ -31,7 +31,7 @@
 #define IO_ADDR2 0x60
 #define LDN 0x7
 
-#define IRQ_MODE        0x70
+#define FINTEK_IRQ_MODE 0x70
 #define IRQ_SHARE       BIT(4)
 #define IRQ_MODE_MASK   (BIT(6) | BIT(5))
 #define IRQ_LEVEL_LOW   0
@@ -195,7 +195,7 @@ static int fintek_8250_set_irq_mode(struct fintek_8250 *pdata, bool level_mode)
         outb(LDN, pdata->base_port + ADDR_PORT);
         outb(pdata->index, pdata->base_port + DATA_PORT);
 
-        outb(IRQ_MODE, pdata->base_port + ADDR_PORT);
+        outb(FINTEK_IRQ_MODE, pdata->base_port + ADDR_PORT);
         tmp = inb(pdata->base_port + DATA_PORT);
 
         tmp &= ~IRQ_MODE_MASK;
diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
index 339de9cd0866..20c5db2f4264 100644
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -168,6 +168,9 @@ static void mid8250_set_termios(struct uart_port *p,
         unsigned long w = BIT(24) - 1;
         unsigned long mul, div;
 
+        /* Gracefully handle the B0 case: fall back to B9600 */
+        fuart = fuart ? fuart : 9600 * 16;
+
         if (mid->board->freq < fuart) {
                 /* Find prescaler value that satisfies Fuart < Fref */
                 if (mid->board->freq > baud)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e14982f36a04..61ad6c3b20a0 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -134,21 +134,18 @@ static void omap8250_set_mctrl(struct uart_port *port, unsigned int mctrl)
 
         serial8250_do_set_mctrl(port, mctrl);
 
-        if (IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
-                                                UART_GPIO_RTS))) {
-                /*
-                 * Turn off autoRTS if RTS is lowered and restore autoRTS
-                 * setting if RTS is raised
-                 */
-                lcr = serial_in(up, UART_LCR);
-                serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
-                if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
-                        priv->efr |= UART_EFR_RTS;
-                else
-                        priv->efr &= ~UART_EFR_RTS;
-                serial_out(up, UART_EFR, priv->efr);
-                serial_out(up, UART_LCR, lcr);
-        }
+        /*
+         * Turn off autoRTS if RTS is lowered and restore autoRTS setting
+         * if RTS is raised
+         */
+        lcr = serial_in(up, UART_LCR);
+        serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
+        if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS))
+                priv->efr |= UART_EFR_RTS;
+        else
+                priv->efr &= ~UART_EFR_RTS;
+        serial_out(up, UART_EFR, priv->efr);
+        serial_out(up, UART_LCR, lcr);
 }
 
 /*
@@ -449,9 +446,7 @@ static void omap_8250_set_termios(struct uart_port *port,
         priv->efr = 0;
         up->port.status &= ~(UPSTAT_AUTOCTS | UPSTAT_AUTORTS | UPSTAT_AUTOXOFF);
 
-        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW
-                && IS_ERR_OR_NULL(mctrl_gpio_to_gpiod(up->gpios,
-                                                        UART_GPIO_RTS))) {
+        if (termios->c_cflag & CRTSCTS && up->port.flags & UPF_HARD_FLOW) {
                 /* Enable AUTOCTS (autoRTS is enabled when RTS is raised) */
                 up->port.status |= UPSTAT_AUTOCTS | UPSTAT_AUTORTS;
                 priv->efr |= UART_EFR_CTS;
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 20ebaea5c414..bc51b32b2774 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1950,6 +1950,43 @@ pci_wch_ch38x_setup(struct serial_private *priv,
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7954        0x7954
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7958        0x7958
 
+#define PCI_VENDOR_ID_ACCESIO                   0x494f
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB     0x1051
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S      0x1053
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB     0x105C
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S      0x105E
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB   0x1091
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2    0x1093
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB   0x1099
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4    0x109B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB    0x10D1
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM     0x10D3
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB    0x10DA
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM     0x10DC
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1    0x1108
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2    0x1110
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2    0x1111
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4    0x1118
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4    0x1119
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S       0x1152
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S       0x115A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2     0x1190
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2    0x1191
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4     0x1198
+#define PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4    0x1199
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM      0x11D0
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4     0x105A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4     0x105B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8     0x106A
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8     0x106B
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4     0x1098
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8     0x10A9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM      0x10D9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM      0x10E9
+#define PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM      0x11D8
+
+
+
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588 0x1588
@@ -5113,6 +5150,108 @@ static struct pci_device_id serial_pci_tbl[] = {
                 0,
                 0, pbn_pericom_PI7C9X7958 },
         /*
+         * ACCES I/O Products quad
+         */
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7954 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        {       PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_pericom_PI7C9X7958 },
+        /*
          * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
          */
         {       PCI_VENDOR_ID_TOPIC, PCI_DEVICE_ID_TOPIC_TP560,
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 7481b95c6d84..bdfa659b9606 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1618,8 +1618,6 @@ static void serial8250_disable_ms(struct uart_port *port)
         if (up->bugs & UART_BUG_NOMSR)
                 return;
 
-        mctrl_gpio_disable_ms(up->gpios);
-
         up->ier &= ~UART_IER_MSI;
         serial_port_out(port, UART_IER, up->ier);
 }
@@ -1632,8 +1630,6 @@ static void serial8250_enable_ms(struct uart_port *port)
         if (up->bugs & UART_BUG_NOMSR)
                 return;
 
-        mctrl_gpio_enable_ms(up->gpios);
-
         up->ier |= UART_IER_MSI;
 
         serial8250_rpm_get(up);
@@ -1917,8 +1913,7 @@ unsigned int serial8250_do_get_mctrl(struct uart_port *port)
                 ret |= TIOCM_DSR;
         if (status & UART_MSR_CTS)
                 ret |= TIOCM_CTS;
-
-        return mctrl_gpio_get(up->gpios, &ret);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(serial8250_do_get_mctrl);
 
diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig
index c9ec839a5ddf..7c6f7afca5dd 100644
--- a/drivers/tty/serial/8250/Kconfig
+++ b/drivers/tty/serial/8250/Kconfig
@@ -6,7 +6,6 @@
 config SERIAL_8250
         tristate "8250/16550 and compatible serial support"
         select SERIAL_CORE
-        select SERIAL_MCTRL_GPIO if GPIOLIB
         ---help---
           This selects whether you want to include the driver for the standard
           serial ports.  The standard answer is Y.  People who might say N
diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
index 065f5d97aa67..b93356834bb5 100644
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -949,6 +949,15 @@ static int isr_setup_status_phase(struct ci_hdrc *ci)
         int retval;
         struct ci_hw_ep *hwep;
 
+        /*
+         * Unexpected USB controller behavior, caused by bad signal integrity
+         * or ground reference problems, can lead to isr_setup_status_phase
+         * being called with ci->status equal to NULL.
+         * If this situation occurs, you should review your USB hardware design.
+         */
+        if (WARN_ON_ONCE(!ci->status))
+                return -EPIPE;
+
         hwep = (ci->ep0_dir == TX) ? ci->ep0out : ci->ep0in;
         ci->status->context = ci;
         ci->status->complete = isr_setup_status_complete;
@@ -1596,8 +1605,11 @@ static int ci_udc_pullup(struct usb_gadget *_gadget, int is_on)
 {
         struct ci_hdrc *ci = container_of(_gadget, struct ci_hdrc, gadget);
 
-        /* Data+ pullup controlled by OTG state machine in OTG fsm mode */
-        if (ci_otg_is_fsm_mode(ci))
+        /*
+         * Data+ pullup controlled by OTG state machine in OTG fsm mode;
+         * and don't touch Data+ in host mode for dual role config.
+         */
+        if (ci_otg_is_fsm_mode(ci) || ci->role == CI_ROLE_HOST)
                 return 0;
 
         pm_runtime_get_sync(&ci->gadget.dev);
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 71912301ef7f..0f3f62e81e5b 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1354,7 +1354,6 @@ made_compressed_probe:
         spin_lock_init(&acm->write_lock);
         spin_lock_init(&acm->read_lock);
         mutex_init(&acm->mutex);
-        acm->rx_endpoint = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
         acm->is_int_ep = usb_endpoint_xfer_int(epread);
         if (acm->is_int_ep)
                 acm->bInterval = epread->bInterval;
@@ -1394,14 +1393,14 @@ made_compressed_probe:
                 urb->transfer_dma = rb->dma;
                 if (acm->is_int_ep) {
                         usb_fill_int_urb(urb, acm->dev,
-                                         acm->rx_endpoint,
+                                         usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
                                          rb->base,
                                          acm->readsize,
                                          acm_read_bulk_callback, rb,
                                          acm->bInterval);
                 } else {
                         usb_fill_bulk_urb(urb, acm->dev,
-                                          acm->rx_endpoint,
+                                          usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
                                           rb->base,
                                           acm->readsize,
                                           acm_read_bulk_callback, rb);
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index 05ce308d5d2a..1f1eabfd8462 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -96,7 +96,6 @@ struct acm {
         struct acm_rb read_buffers[ACM_NR];
         struct acm_wb *putbuffer;                       /* for acm_tty_put_char() */
         int rx_buflimit;
-        int rx_endpoint;
         spinlock_t read_lock;
         int write_used;                                 /* number of non-empty write buffers */
         int transmitting;
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index 31ccdccd7a04..a2d90aca779f 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -171,6 +171,31 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
                                                         ep, buffer, size);
 }
 
+static const unsigned short low_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 8,
+        [USB_ENDPOINT_XFER_ISOC] = 0,
+        [USB_ENDPOINT_XFER_BULK] = 0,
+        [USB_ENDPOINT_XFER_INT] = 8,
+};
+static const unsigned short full_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1023,
+        [USB_ENDPOINT_XFER_BULK] = 64,
+        [USB_ENDPOINT_XFER_INT] = 64,
+};
+static const unsigned short high_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 64,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 512,
+        [USB_ENDPOINT_XFER_INT] = 1024,
+};
+static const unsigned short super_speed_maxpacket_maxes[4] = {
+        [USB_ENDPOINT_XFER_CONTROL] = 512,
+        [USB_ENDPOINT_XFER_ISOC] = 1024,
+        [USB_ENDPOINT_XFER_BULK] = 1024,
+        [USB_ENDPOINT_XFER_INT] = 1024,
+};
+
 static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
     int asnum, struct usb_host_interface *ifp, int num_ep,
     unsigned char *buffer, int size)
@@ -179,6 +204,8 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
         struct usb_endpoint_descriptor *d;
         struct usb_host_endpoint *endpoint;
         int n, i, j, retval;
+        unsigned int maxp;
+        const unsigned short *maxpacket_maxes;
 
         d = (struct usb_endpoint_descriptor *) buffer;
         buffer += d->bLength;
@@ -213,8 +240,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
         memcpy(&endpoint->desc, d, n);
         INIT_LIST_HEAD(&endpoint->urb_list);
 
-        /* Fix up bInterval values outside the legal range. Use 32 ms if no
-         * proper value can be guessed. */
+        /*
+         * Fix up bInterval values outside the legal range.
+         * Use 10 or 8 ms if no proper value can be guessed.
+         */
         i = 0;          /* i = min, j = max, n = default */
         j = 255;
         if (usb_endpoint_xfer_int(d)) {
@@ -223,13 +252,15 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 case USB_SPEED_SUPER_PLUS:
                 case USB_SPEED_SUPER:
                 case USB_SPEED_HIGH:
-                        /* Many device manufacturers are using full-speed
+                        /*
+                         * Many device manufacturers are using full-speed
                          * bInterval values in high-speed interrupt endpoint
-                         * descriptors. Try to fix those and fall back to a
-                         * 32 ms default value otherwise. */
+                         * descriptors. Try to fix those and fall back to an
+                         * 8-ms default value otherwise.
+                         */
                         n = fls(d->bInterval*8);
                         if (n == 0)
-                                n = 9;  /* 32 ms = 2^(9-1) uframes */
+                                n = 7;  /* 8 ms = 2^(7-1) uframes */
                         j = 16;
 
                         /*
@@ -244,10 +275,12 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                         }
                         break;
                 default:                /* USB_SPEED_FULL or _LOW */
-                        /* For low-speed, 10 ms is the official minimum.
+                        /*
+                         * For low-speed, 10 ms is the official minimum.
                          * But some "overclocked" devices might want faster
-                         * polling so we'll allow it. */
-                        n = 32;
+                         * polling so we'll allow it.
+                         */
+                        n = 10;
                         break;
                 }
         } else if (usb_endpoint_xfer_isoc(d)) {
@@ -255,10 +288,10 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                 j = 16;
                 switch (to_usb_device(ddev)->speed) {
                 case USB_SPEED_HIGH:
-                        n = 9;          /* 32 ms = 2^(9-1) uframes */
+                        n = 7;          /* 8 ms = 2^(7-1) uframes */
                         break;
                 default:                /* USB_SPEED_FULL */
-                        n = 6;          /* 32 ms = 2^(6-1) frames */
+                        n = 4;          /* 8 ms = 2^(4-1) frames */
                         break;
                 }
         }
@@ -286,6 +319,42 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
                         endpoint->desc.wMaxPacketSize = cpu_to_le16(8);
         }
 
+        /* Validate the wMaxPacketSize field */
+        maxp = usb_endpoint_maxp(&endpoint->desc);
+
+        /* Find the highest legal maxpacket size for this endpoint */
+        i = 0;          /* additional transactions per microframe */
+        switch (to_usb_device(ddev)->speed) {
+        case USB_SPEED_LOW:
+                maxpacket_maxes = low_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_FULL:
+                maxpacket_maxes = full_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_HIGH:
+                /* Bits 12..11 are allowed only for HS periodic endpoints */
+                if (usb_endpoint_xfer_int(d) || usb_endpoint_xfer_isoc(d)) {
+                        i = maxp & (BIT(12) | BIT(11));
+                        maxp &= ~i;
+                }
+                /* fallthrough */
+        default:
+                maxpacket_maxes = high_speed_maxpacket_maxes;
+                break;
+        case USB_SPEED_SUPER:
+        case USB_SPEED_SUPER_PLUS:
+                maxpacket_maxes = super_speed_maxpacket_maxes;
+                break;
+        }
+        j = maxpacket_maxes[usb_endpoint_type(&endpoint->desc)];
+
+        if (maxp > j) {
+                dev_warn(ddev, "config %d interface %d altsetting %d endpoint 0x%X has invalid maxpacket %d, setting to %d\n",
+                    cfgno, inum, asnum, d->bEndpointAddress, maxp, j);
+                maxp = j;
+                endpoint->desc.wMaxPacketSize = cpu_to_le16(i | maxp);
+        }
+
         /*
          * Some buggy high speed devices have bulk endpoints using
          * maxpacket sizes other than 512.  High speed HCDs may not
@@ -293,9 +362,6 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
          */
         if (to_usb_device(ddev)->speed == USB_SPEED_HIGH
                         && usb_endpoint_xfer_bulk(d)) {
-                unsigned maxp;
-
-                maxp = usb_endpoint_maxp(&endpoint->desc) & 0x07ff;
                 if (maxp != 512)
                         dev_warn(ddev, "config %d interface %d altsetting %d "
                                 "bulk endpoint 0x%X has invalid maxpacket %d\n",
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index e9f5043a2167..09c8d9ca61ae 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -241,7 +241,8 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma)
                 goto error_decrease_mem;
         }
 
-        mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
+        mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN,
+                        &dma_handle);
         if (!mem) {
                 ret = -ENOMEM;
                 goto error_free_usbm;
@@ -1708,11 +1709,17 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
         as->urb->start_frame = uurb->start_frame;
         as->urb->number_of_packets = number_of_packets;
         as->urb->stream_id = stream_id;
-        if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
-                        ps->dev->speed == USB_SPEED_HIGH)
-                as->urb->interval = 1 << min(15, ep->desc.bInterval - 1);
-        else
-                as->urb->interval = ep->desc.bInterval;
+
+        if (ep->desc.bInterval) {
+                if (uurb->type == USBDEVFS_URB_TYPE_ISO ||
+                                ps->dev->speed == USB_SPEED_HIGH ||
+                                ps->dev->speed >= USB_SPEED_SUPER)
+                        as->urb->interval = 1 <<
+                                        min(15, ep->desc.bInterval - 1);
+                else
+                        as->urb->interval = ep->desc.bInterval;
+        }
+
         as->urb->context = as;
         as->urb->complete = async_completed;
         for (totlen = u = 0; u < number_of_packets; u++) {
@@ -2582,7 +2589,9 @@ static unsigned int usbdev_poll(struct file *file,
         if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
                 mask |= POLLOUT | POLLWRNORM;
         if (!connected(ps))
-                mask |= POLLERR | POLLHUP;
+                mask |= POLLHUP;
+        if (list_empty(&ps->list))
+                mask |= POLLERR;
         return mask;
 }
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index bee13517676f..1d5fc32d06d0 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1052,14 +1052,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
         /* Continue a partial initialization */
         if (type == HUB_INIT2 || type == HUB_INIT3) {
-                device_lock(hub->intfdev);
+                device_lock(&hdev->dev);
 
                 /* Was the hub disconnected while we were waiting? */
-                if (hub->disconnected) {
-                        device_unlock(hub->intfdev);
-                        kref_put(&hub->kref, hub_release);
-                        return;
-                }
+                if (hub->disconnected)
+                        goto disconnected;
                 if (type == HUB_INIT2)
                         goto init2;
                 goto init3;
@@ -1262,7 +1259,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
                         queue_delayed_work(system_power_efficient_wq,
                                         &hub->init_work,
                                         msecs_to_jiffies(delay));
-                        device_unlock(hub->intfdev);
+                        device_unlock(&hdev->dev);
                         return;         /* Continues at init3: below */
                 } else {
                         msleep(delay);
@@ -1281,12 +1278,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         /* Scan all ports that need attention */
         kick_hub_wq(hub);
 
-        /* Allow autosuspend if it was suppressed */
-        if (type <= HUB_INIT3)
+        if (type == HUB_INIT2 || type == HUB_INIT3) {
+                /* Allow autosuspend if it was suppressed */
+ disconnected:
                 usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
-
-        if (type == HUB_INIT2 || type == HUB_INIT3)
-                device_unlock(hub->intfdev);
+                device_unlock(&hdev->dev);
+        }
 
         kref_put(&hub->kref, hub_release);
 }
@@ -1315,8 +1312,6 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type)
         struct usb_device *hdev = hub->hdev;
         int i;
 
-        cancel_delayed_work_sync(&hub->init_work);
-
         /* hub_wq and related activity won't re-trigger */
         hub->quiescing = 1;
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index 9fae0291cd69..d64551243789 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -868,6 +868,7 @@ struct dwc2_hsotg {
         void *priv;
         int     irq;
         struct clk *clk;
+        struct reset_control *reset;
 
         unsigned int queuing_high_bandwidth:1;
         unsigned int srp_success:1;
diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c
index fc6f5251de5d..530959a8a6d1 100644
--- a/drivers/usb/dwc2/platform.c
+++ b/drivers/usb/dwc2/platform.c
@@ -45,6 +45,7 @@
 #include <linux/platform_device.h>
 #include <linux/phy/phy.h>
 #include <linux/platform_data/s3c-hsotg.h>
+#include <linux/reset.h>
 
 #include <linux/usb/of.h>
 
@@ -337,6 +338,24 @@ static int dwc2_lowlevel_hw_init(struct dwc2_hsotg *hsotg)
 {
         int i, ret;
 
+        hsotg->reset = devm_reset_control_get_optional(hsotg->dev, "dwc2");
+        if (IS_ERR(hsotg->reset)) {
+                ret = PTR_ERR(hsotg->reset);
+                switch (ret) {
+                case -ENOENT:
+                case -ENOTSUPP:
+                        hsotg->reset = NULL;
+                        break;
+                default:
+                        dev_err(hsotg->dev, "error getting reset control %d\n",
+                                ret);
+                        return ret;
+                }
+        }
+
+        if (hsotg->reset)
+                reset_control_deassert(hsotg->reset);
+
         /* Set default UTMI width */
         hsotg->phyif = GUSBCFG_PHYIF16;
 
@@ -434,6 +453,9 @@ static int dwc2_driver_remove(struct platform_device *dev)
         if (hsotg->ll_hw_enabled)
                 dwc2_lowlevel_hw_disable(hsotg);
 
+        if (hsotg->reset)
+                reset_control_assert(hsotg->reset);
+
         return 0;
 }
 
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 946643157b78..35d092456bec 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1192,6 +1192,7 @@ static int dwc3_runtime_resume(struct device *dev)
         }
 
         pm_runtime_mark_last_busy(dev);
+        pm_runtime_put(dev);
 
         return 0;
 }
diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
index 22dfc3dd6a13..33ab2a203c1b 100644
--- a/drivers/usb/dwc3/debug.h
+++ b/drivers/usb/dwc3/debug.h
@@ -192,7 +192,7 @@ dwc3_ep_event_string(const struct dwc3_event_depevt *event)
         int ret;
 
         ret = sprintf(str, "ep%d%s: ", epnum >> 1,
-                        (epnum & 1) ? "in" : "in");
+                        (epnum & 1) ? "in" : "out");
         if (ret < 0)
                 return "UNKNOWN";
 
diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index 974335377d9f..e56d59b19a0e 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -61,6 +61,7 @@ static int dwc3_of_simple_probe(struct platform_device *pdev)
         if (!simple->clks)
                 return -ENOMEM;
 
+        platform_set_drvdata(pdev, simple);
         simple->dev = dev;
 
         for (i = 0; i < simple->num_clocks; i++) {
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 45f5a232d9fb..6df0f5dad9a4 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -37,6 +37,7 @@
 #define PCI_DEVICE_ID_INTEL_BXT                 0x0aaa
 #define PCI_DEVICE_ID_INTEL_BXT_M               0x1aaa
 #define PCI_DEVICE_ID_INTEL_APL                 0x5aaa
+#define PCI_DEVICE_ID_INTEL_KBP                 0xa2b0
 
 static const struct acpi_gpio_params reset_gpios = { 0, 0, false };
 static const struct acpi_gpio_params cs_gpios = { 1, 0, false };
@@ -227,6 +228,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BXT_M), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_APL), },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBP), },
         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_NL_USB), },
         {  }    /* Terminating Entry */
 };
@@ -241,6 +243,15 @@ static int dwc3_pci_runtime_suspend(struct device *dev)
         return -EBUSY;
 }
 
+static int dwc3_pci_runtime_resume(struct device *dev)
+{
+        struct platform_device *dwc3 = dev_get_drvdata(dev);
+
+        return pm_runtime_get(&dwc3->dev);
+}
+#endif /* CONFIG_PM */
+
+#ifdef CONFIG_PM_SLEEP
 static int dwc3_pci_pm_dummy(struct device *dev)
 {
         /*
@@ -253,11 +264,11 @@ static int dwc3_pci_pm_dummy(struct device *dev)
          */
         return 0;
 }
-#endif /* CONFIG_PM */
+#endif /* CONFIG_PM_SLEEP */
 
 static struct dev_pm_ops dwc3_pci_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(dwc3_pci_pm_dummy, dwc3_pci_pm_dummy)
-        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_pm_dummy,
+        SET_RUNTIME_PM_OPS(dwc3_pci_runtime_suspend, dwc3_pci_runtime_resume,
                 NULL)
 };
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 8f8c2157910e..122e64df2f4d 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -829,7 +829,7 @@ static void dwc3_prepare_one_trb(struct dwc3_ep *dep,
         if (!req->request.no_interrupt && !chain)
                 trb->ctrl |= DWC3_TRB_CTRL_IOC | DWC3_TRB_CTRL_ISP_IMI;
 
-        if (last)
+        if (last && !usb_endpoint_xfer_isoc(dep->endpoint.desc))
                 trb->ctrl |= DWC3_TRB_CTRL_LST;
 
         if (chain)
@@ -1433,7 +1433,7 @@ static int dwc3_gadget_get_frame(struct usb_gadget *g)
 
 static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
 {
-        unsigned long           timeout;
+        int                     retries;
 
         int                     ret;
         u32                     reg;
@@ -1484,9 +1484,9 @@ static int __dwc3_gadget_wakeup(struct dwc3 *dwc)
         }
 
         /* poll until Link State changes to ON */
-        timeout = jiffies + msecs_to_jiffies(100);
+        retries = 20000;
 
-        while (!time_after(jiffies, timeout)) {
+        while (retries--) {
                 reg = dwc3_readl(dwc->regs, DWC3_DSTS);
 
                 /* in HS, means ON */
@@ -1955,7 +1955,8 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
 
 static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                 struct dwc3_request *req, struct dwc3_trb *trb,
-                const struct dwc3_event_depevt *event, int status)
+                const struct dwc3_event_depevt *event, int status,
+                int chain)
 {
         unsigned int            count;
         unsigned int            s_pkt = 0;
@@ -1964,17 +1965,22 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
         dep->queued_requests--;
         trace_dwc3_complete_trb(dep, trb);
 
+        /*
+         * If we're in the middle of series of chained TRBs and we
+         * receive a short transfer along the way, DWC3 will skip
+         * through all TRBs including the last TRB in the chain (the
+         * where CHN bit is zero. DWC3 will also avoid clearing HWO
+         * bit and SW has to do it manually.
+         *
+         * We're going to do that here to avoid problems of HW trying
+         * to use bogus TRBs for transfers.
+         */
+        if (chain && (trb->ctrl & DWC3_TRB_CTRL_HWO))
+                trb->ctrl &= ~DWC3_TRB_CTRL_HWO;
+
         if ((trb->ctrl & DWC3_TRB_CTRL_HWO) && status != -ESHUTDOWN)
-                /*
-                 * We continue despite the error. There is not much we
-                 * can do. If we don't clean it up we loop forever. If
-                 * we skip the TRB then it gets overwritten after a
-                 * while since we use them in a ring buffer. A BUG()
-                 * would help. Lets hope that if this occurs, someone
-                 * fixes the root cause instead of looking away :)
-                 */
-                dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n",
-                                dep->name, trb);
+                return 1;
+
         count = trb->size & DWC3_TRB_SIZE_MASK;
 
         if (dep->direction) {
@@ -2013,15 +2019,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep,
                         s_pkt = 1;
         }
 
-        /*
-         * We assume here we will always receive the entire data block
-         * which we should receive. Meaning, if we program RX to
-         * receive 4K but we receive only 2K, we assume that's all we
-         * should receive and we simply bounce the request back to the
-         * gadget driver for further processing.
-         */
-        req->request.actual += req->request.length - count;
-        if (s_pkt)
+        if (s_pkt && !chain)
                 return 1;
         if ((event->status & DEPEVT_STATUS_LST) &&
                         (trb->ctrl & (DWC3_TRB_CTRL_LST |
@@ -2040,13 +2038,17 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
         struct dwc3_trb         *trb;
         unsigned int            slot;
         unsigned int            i;
+        int                     count = 0;
         int                     ret;
 
         do {
+                int chain;
+
                 req = next_request(&dep->started_list);
                 if (WARN_ON_ONCE(!req))
                         return 1;
 
+                chain = req->request.num_mapped_sgs > 0;
                 i = 0;
                 do {
                         slot = req->first_trb_index + i;
@@ -2054,13 +2056,22 @@ static int dwc3_cleanup_done_reqs(struct dwc3 *dwc, struct dwc3_ep *dep,
                                 slot++;
                         slot %= DWC3_TRB_NUM;
                         trb = &dep->trb_pool[slot];
+                        count += trb->size & DWC3_TRB_SIZE_MASK;
 
                         ret = __dwc3_cleanup_done_trbs(dwc, dep, req, trb,
-                                        event, status);
+                                        event, status, chain);
                         if (ret)
                                 break;
                 } while (++i < req->request.num_mapped_sgs);
 
+                /*
+                 * We assume here we will always receive the entire data block
+                 * which we should receive. Meaning, if we program RX to
+                 * receive 4K but we receive only 2K, we assume that's all we
+                 * should receive and we simply bounce the request back to the
+                 * gadget driver for further processing.
+                 */
+                req->request.actual += req->request.length - count;
                 dwc3_gadget_giveback(dep, req, status);
 
                 if (ret)
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index eb648485a58c..5ebe6af7976e 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1913,6 +1913,8 @@ unknown:
                         break;
 
                 case USB_RECIP_ENDPOINT:
+                        if (!cdev->config)
+                                break;
                         endp = ((w_index & 0x80) >> 3) | (w_index & 0x0f);
                         list_for_each_entry(f, &cdev->config->functions, list) {
                                 if (test_bit(endp, f->endpoints))
@@ -2124,14 +2126,14 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev,
 
         cdev->os_desc_req = usb_ep_alloc_request(ep0, GFP_KERNEL);
         if (!cdev->os_desc_req) {
-                ret = PTR_ERR(cdev->os_desc_req);
+                ret = -ENOMEM;
                 goto end;
         }
 
         /* OS feature descriptor length <= 4kB */
         cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL);
         if (!cdev->os_desc_req->buf) {
-                ret = PTR_ERR(cdev->os_desc_req->buf);
+                ret = -ENOMEM;
                 kfree(cdev->os_desc_req);
                 goto end;
         }
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 70cf3477f951..f9237fe2be05 100644
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1490,7 +1490,9 @@ void unregister_gadget_item(struct config_item *item)
 {
         struct gadget_info *gi = to_gadget_info(item);
 
+        mutex_lock(&gi->lock);
         unregister_gadget(gi);
+        mutex_unlock(&gi->lock);
 }
 EXPORT_SYMBOL_GPL(unregister_gadget_item);
 
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index d58bfc32be9e..007ec6e4a5d4 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -341,11 +341,15 @@ static struct sk_buff *eem_wrap(struct gether *port, struct sk_buff *skb)
 {
         struct sk_buff  *skb2 = NULL;
         struct usb_ep   *in = port->in_ep;
-        int             padlen = 0;
-        u16             len = skb->len;
+        int             headroom, tailroom, padlen = 0;
+        u16             len;
 
-        int headroom = skb_headroom(skb);
-        int tailroom = skb_tailroom(skb);
+        if (!skb)
+                return NULL;
+
+        len = skb->len;
+        headroom = skb_headroom(skb);
+        tailroom = skb_tailroom(skb);
 
         /* When (len + EEM_HLEN + ETH_FCS_LEN) % in->maxpacket) is 0,
          * stick two bytes of zero-length EEM packet on the end.
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index c8005823b190..16562e461121 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -374,6 +374,9 @@ static struct sk_buff *rndis_add_header(struct gether *port,
 {
         struct sk_buff *skb2;
 
+        if (!skb)
+                return NULL;
+
         skb2 = skb_realloc_headroom(skb, sizeof(struct rndis_packet_msg_type));
         rndis_add_hdr(skb2);
 
diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c
index 943c21aafd3b..ab6ac1b74ac0 100644
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -680,6 +680,12 @@ static int rndis_reset_response(struct rndis_params *params,
 {
         rndis_reset_cmplt_type *resp;
         rndis_resp_t *r;
+        u8 *xbuf;
+        u32 length;
+
+        /* drain the response queue */
+        while ((xbuf = rndis_get_next_response(params, &length)))
+                rndis_free_response(params, xbuf);
 
         r = rndis_add_response(params, sizeof(rndis_reset_cmplt_type));
         if (!r)
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index a3f7e7c55ebb..5f562c1ec795 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -556,7 +556,8 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
                         /* Multi frame CDC protocols may store the frame for
                          * later which is not a dropped frame.
                          */
-                        if (dev->port_usb->supports_multi_frame)
+                        if (dev->port_usb &&
+                                        dev->port_usb->supports_multi_frame)
                                 goto multiframe;
                         goto drop;
                 }
diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
index 6ded6345cd09..e0cd1e4c8892 100644
--- a/drivers/usb/gadget/function/u_serial.c
+++ b/drivers/usb/gadget/function/u_serial.c
@@ -375,10 +375,15 @@ __acquires(&port->port_lock)
 */
 {
         struct list_head        *pool = &port->write_pool;
-        struct usb_ep           *in = port->port_usb->in;
+        struct usb_ep           *in;
         int                     status = 0;
         bool                    do_tty_wake = false;
 
+        if (!port->port_usb)
+                return status;
+
+        in = port->port_usb->in;
+
         while (!port->write_busy && !list_empty(pool)) {
                 struct usb_request      *req;
                 int                     len;
diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index 66753ba7a42e..31125a4a2658 100644
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -2023,7 +2023,7 @@ static int uvcg_streaming_class_allow_link(struct config_item *src,
         if (!data) {
                 kfree(*class_array);
                 *class_array = NULL;
-                ret = PTR_ERR(data);
+                ret = -ENOMEM;
                 goto unlock;
         }
         cl_arr = *class_array;
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index aa3707bdebb4..16104b5ebdcb 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -542,7 +542,7 @@ static ssize_t ep_aio(struct kiocb *iocb,
          */
         spin_lock_irq(&epdata->dev->lock);
         value = -ENODEV;
-        if (unlikely(epdata->ep))
+        if (unlikely(epdata->ep == NULL))
                 goto fail;
 
         req = usb_ep_alloc_request(epdata->ep, GFP_ATOMIC);
@@ -606,7 +606,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
         }
         if (is_sync_kiocb(iocb)) {
                 value = ep_io(epdata, buf, len);
-                if (value >= 0 && copy_to_iter(buf, value, to))
+                if (value >= 0 && (copy_to_iter(buf, value, to) != value))
                         value = -EFAULT;
         } else {
                 struct kiocb_priv *priv = kzalloc(sizeof *priv, GFP_KERNEL);
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index ff8685ea7219..40c04bb25f2f 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -827,7 +827,7 @@ void usb_gadget_unmap_request_by_dev(struct device *dev,
                 return;
 
         if (req->num_mapped_sgs) {
-                dma_unmap_sg(dev, req->sg, req->num_mapped_sgs,
+                dma_unmap_sg(dev, req->sg, req->num_sgs,
                                 is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
                 req->num_mapped_sgs = 0;
@@ -1145,7 +1145,7 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
                         if (ret != -EPROBE_DEFER)
                                 list_del(&driver->pending);
                         if (ret)
-                                goto err4;
+                                goto err5;
                         break;
                 }
         }
@@ -1154,6 +1154,9 @@ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
 
         return 0;
 
+err5:
+        device_del(&udc->dev);
+
 err4:
         list_del(&udc->list);
         mutex_unlock(&udc_lock);
diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c b/drivers/usb/gadget/udc/fsl_qe_udc.c
index 93d28cb00b76..8bb011ea78f7 100644
--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
+++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget)
 
         tmp = in_be16(&udc->usb_param->frame_n);
         if (tmp & 0x8000)
-                tmp = tmp & 0x07ff;
-        else
-                tmp = -EINVAL;
-
-        return (int)tmp;
+                return tmp & 0x07ff;
+        return -EINVAL;
 }
 
 static int fsl_qe_start(struct usb_gadget *gadget,
@@ -2053,7 +2050,7 @@ static void setup_received_handle(struct qe_udc *udc,
                         struct qe_ep *ep;
 
                         if (wValue != 0 || wLength != 0
-                                || pipe > USB_MAX_ENDPOINTS)
+                                || pipe >= USB_MAX_ENDPOINTS)
                                 break;
                         ep = &udc->eps[pipe];
 
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 93a3bec81df7..fb8fc34827ab 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -106,6 +106,7 @@
 
 /* DRD_CON */
 #define DRD_CON_PERI_CON        BIT(24)
+#define DRD_CON_VBOUT           BIT(0)
 
 /* USB_INT_ENA_1 and USB_INT_STA_1 */
 #define USB_INT_1_B3_PLLWKUP    BIT(31)
@@ -363,6 +364,7 @@ static void usb3_init_epc_registers(struct renesas_usb3 *usb3)
 {
         /* FIXME: How to change host / peripheral mode as well? */
         usb3_set_bit(usb3, DRD_CON_PERI_CON, USB3_DRD_CON);
+        usb3_clear_bit(usb3, DRD_CON_VBOUT, USB3_DRD_CON);
 
         usb3_write(usb3, ~0, USB3_USB_INT_STA_1);
         usb3_enable_irq_1(usb3, USB_INT_1_VBUS_CNG);
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index a962b89b65a6..1e5f529d51a2 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -332,11 +332,11 @@ static void ehci_turn_off_all_ports(struct ehci_hcd *ehci)
         int     port = HCS_N_PORTS(ehci->hcs_params);
 
         while (port--) {
-                ehci_writel(ehci, PORT_RWC_BITS,
-                                &ehci->regs->port_status[port]);
                 spin_unlock_irq(&ehci->lock);
                 ehci_port_power(ehci, port, false);
                 spin_lock_irq(&ehci->lock);
+                ehci_writel(ehci, PORT_RWC_BITS,
+                                &ehci->regs->port_status[port]);
         }
 }
 
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index c369c29e496d..2f7690092a7f 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1675,7 +1675,7 @@ max3421_gpout_set_value(struct usb_hcd *hcd, u8 pin_number, u8 value)
         if (pin_number > 7)
                 return;
 
-        mask = 1u << pin_number;
+        mask = 1u << (pin_number % 4);
         idx = pin_number / 4;
 
         if (value)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index d61fcc48099e..730b9fd26685 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -386,6 +386,9 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend)
 
         ret = 0;
         virt_dev = xhci->devs[slot_id];
+        if (!virt_dev)
+                return -ENODEV;
+
         cmd = xhci_alloc_command(xhci, false, true, GFP_NOIO);
         if (!cmd) {
                 xhci_dbg(xhci, "Couldn't allocate command structure.\n");
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 4fd041bec332..d7b0f97abbad 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -314,11 +314,12 @@ static void xhci_pci_remove(struct pci_dev *dev)
                 usb_remove_hcd(xhci->shared_hcd);
                 usb_put_hcd(xhci->shared_hcd);
         }
-        usb_hcd_pci_remove(dev);
 
         /* Workaround for spurious wakeups at shutdown with HSW */
         if (xhci->quirks & XHCI_SPURIOUS_WAKEUP)
                 pci_set_power_state(dev, PCI_D3hot);
+
+        usb_hcd_pci_remove(dev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 918e0c739b79..797137e26549 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -850,6 +850,10 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
 
         ep->stop_cmds_pending--;
+        if (xhci->xhc_state & XHCI_STATE_REMOVING) {
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                return;
+        }
         if (xhci->xhc_state & XHCI_STATE_DYING) {
                 xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                                 "Stop EP timer ran, but another timer marked "
@@ -903,7 +907,7 @@ void xhci_stop_endpoint_command_watchdog(unsigned long arg)
         spin_unlock_irqrestore(&xhci->lock, flags);
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "Calling usb_hc_died()");
-        usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
+        usb_hc_died(xhci_to_hcd(xhci));
         xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
                         "xHCI host controller is dead.");
 }
@@ -1334,12 +1338,6 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
 
         cmd = list_entry(xhci->cmd_list.next, struct xhci_command, cmd_list);
 
-        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
-                xhci_err(xhci,
-                         "Command completion event does not match command\n");
-                return;
-        }
-
         del_timer(&xhci->cmd_timer);
 
         trace_xhci_cmd_completion(cmd_trb, (struct xhci_generic_trb *) event);
@@ -1351,6 +1349,13 @@ static void handle_cmd_completion(struct xhci_hcd *xhci,
                 xhci_handle_stopped_cmd_ring(xhci, cmd);
                 return;
         }
+
+        if (cmd->command_trb != xhci->cmd_ring->dequeue) {
+                xhci_err(xhci,
+                         "Command completion event does not match command\n");
+                return;
+        }
+
         /*
          * Host aborted the command ring, check if the current command was
          * supposed to be aborted, otherwise continue normally.
@@ -3243,7 +3248,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
         send_addr = addr;
 
         /* Queue the TRBs, even if they are zero-length */
-        for (enqd_len = 0; enqd_len < full_len; enqd_len += trb_buff_len) {
+        for (enqd_len = 0; first_trb || enqd_len < full_len;
+                        enqd_len += trb_buff_len) {
                 field = TRB_TYPE(TRB_NORMAL);
 
                 /* TRB buffer should not cross 64KB boundaries */
diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c
index 52c27cab78c3..9b5b3b2281ca 100644
--- a/drivers/usb/misc/ftdi-elan.c
+++ b/drivers/usb/misc/ftdi-elan.c
@@ -665,7 +665,7 @@ static ssize_t ftdi_elan_read(struct file *file, char __user *buffer,
 {
         char data[30 *3 + 4];
         char *d = data;
-        int m = (sizeof(data) - 1) / 3;
+        int m = (sizeof(data) - 1) / 3 - 1;
         int bytes_read = 0;
         int retry_on_empty = 10;
         int retry_on_timeout = 5;
@@ -1684,7 +1684,7 @@ wait:if (ftdi->disconnected > 0) {
                         int i = 0;
                         char data[30 *3 + 4];
                         char *d = data;
-                        int m = (sizeof(data) - 1) / 3;
+                        int m = (sizeof(data) - 1) / 3 - 1;
                         int l = 0;
                         struct u132_target *target = &ftdi->target[ed];
                         struct u132_command *command = &ftdi->command[
@@ -1876,7 +1876,7 @@ more:{
                 if (packet_bytes > 2) {
                         char diag[30 *3 + 4];
                         char *d = diag;
-                        int m = (sizeof(diag) - 1) / 3;
+                        int m = (sizeof(diag) - 1) / 3 - 1;
                         char *b = ftdi->bulk_in_buffer;
                         int bytes_read = 0;
                         diag[0] = 0;
@@ -2053,7 +2053,7 @@ static int ftdi_elan_synchronize(struct usb_ftdi *ftdi)
                         if (packet_bytes > 2) {
                                 char diag[30 *3 + 4];
                                 char *d = diag;
-                                int m = (sizeof(diag) - 1) / 3;
+                                int m = (sizeof(diag) - 1) / 3 - 1;
                                 char *b = ftdi->bulk_in_buffer;
                                 int bytes_read = 0;
                                 unsigned char c = 0;
@@ -2155,7 +2155,7 @@ more:{
                 if (packet_bytes > 2) {
                         char diag[30 *3 + 4];
                         char *d = diag;
-                        int m = (sizeof(diag) - 1) / 3;
+                        int m = (sizeof(diag) - 1) / 3 - 1;
                         char *b = ftdi->bulk_in_buffer;
                         int bytes_read = 0;
                         diag[0] = 0;
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 6b978f04b8d7..5c8210dc6fd9 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -585,7 +585,6 @@ static void sg_timeout(unsigned long _req)
 {
         struct usb_sg_request   *req = (struct usb_sg_request *) _req;
 
-        req->status = -ETIMEDOUT;
         usb_sg_cancel(req);
 }
 
@@ -616,8 +615,10 @@ static int perform_sglist(
                 mod_timer(&sg_timer, jiffies +
                                 msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
                 usb_sg_wait(req);
-                del_timer_sync(&sg_timer);
-                retval = req->status;
+                if (!del_timer_sync(&sg_timer))
+                        retval = -ETIMEDOUT;
+                else
+                        retval = req->status;
 
                 /* FIXME check resulting data pattern */
 
@@ -2602,7 +2603,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
         ktime_get_ts64(&start);
 
         retval = usbtest_do_ioctl(intf, param_32);
-        if (retval)
+        if (retval < 0)
                 goto free_mutex;
 
         ktime_get_ts64(&end);
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index 886526b5fcdd..73cfa13fc0dc 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -87,7 +87,7 @@ config USB_MUSB_DA8XX
 config USB_MUSB_TUSB6010
         tristate "TUSB6010"
         depends on HAS_IOMEM
-        depends on ARCH_OMAP2PLUS || COMPILE_TEST
+        depends on (ARCH_OMAP2PLUS || COMPILE_TEST) && !BLACKFIN
         depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules
 
 config USB_MUSB_OMAP2PLUS
diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
index 192248f974ec..fe08e776fec3 100644
--- a/drivers/usb/musb/musb_virthub.c
+++ b/drivers/usb/musb/musb_virthub.c
@@ -290,6 +290,7 @@ int musb_hub_control(
         u32             temp;
         int             retval = 0;
         unsigned long   flags;
+        bool            start_musb = false;
 
         spin_lock_irqsave(&musb->lock, flags);
 
@@ -390,7 +391,7 @@ int musb_hub_control(
                          * logic relating to VBUS power-up.
                          */
                         if (!hcd->self.is_b_host && musb_has_gadget(musb))
-                                musb_start(musb);
+                                start_musb = true;
                         break;
                 case USB_PORT_FEAT_RESET:
                         musb_port_reset(musb, true);
@@ -451,5 +452,9 @@ error:
                 retval = -EPIPE;
         }
         spin_unlock_irqrestore(&musb->lock, flags);
+
+        if (start_musb)
+                musb_start(musb);
+
         return retval;
 }
diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
index 980c9dee09eb..427efb5eebae 100644
--- a/drivers/usb/phy/phy-generic.c
+++ b/drivers/usb/phy/phy-generic.c
@@ -144,14 +144,18 @@ static irqreturn_t nop_gpio_vbus_thread(int irq, void *data)
 int usb_gen_phy_init(struct usb_phy *phy)
 {
         struct usb_phy_generic *nop = dev_get_drvdata(phy->dev);
+        int ret;
 
         if (!IS_ERR(nop->vcc)) {
                 if (regulator_enable(nop->vcc))
                         dev_err(phy->dev, "Failed to enable power\n");
         }
 
-        if (!IS_ERR(nop->clk))
-                clk_prepare_enable(nop->clk);
+        if (!IS_ERR(nop->clk)) {
+                ret = clk_prepare_enable(nop->clk);
+                if (ret)
+                        return ret;
+        }
 
         nop_reset(nop);
 
diff --git a/drivers/usb/phy/phy-omap-otg.c b/drivers/usb/phy/phy-omap-otg.c
index 6f6d2a7fd5a0..6523af4f8f93 100644
--- a/drivers/usb/phy/phy-omap-otg.c
+++ b/drivers/usb/phy/phy-omap-otg.c
@@ -140,6 +140,8 @@ static int omap_otg_probe(struct platform_device *pdev)
                  (rev >> 4) & 0xf, rev & 0xf, config->extcon, otg_dev->id,
                  otg_dev->vbus);
 
+        platform_set_drvdata(pdev, otg_dev);
+
         return 0;
 }
 
diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c
index 8fbbc2d32371..ac67bab9124c 100644
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -514,7 +514,8 @@ static struct renesas_usbhs_platform_info *usbhs_parse_dt(struct device *dev)
         if (gpio > 0)
                 dparam->enable_gpio = gpio;
 
-        if (dparam->type == USBHS_TYPE_RCAR_GEN2)
+        if (dparam->type == USBHS_TYPE_RCAR_GEN2 ||
+            dparam->type == USBHS_TYPE_RCAR_GEN3)
                 dparam->has_usb_dmac = 1;
 
         return info;
diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
index 280ed5ff021b..857e78337324 100644
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -871,7 +871,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
 
         /* use PIO if packet is less than pio_dma_border or pipe is DCP */
         if ((len < usbhs_get_dparam(priv, pio_dma_border)) ||
-            usbhs_pipe_is_dcp(pipe))
+            usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
                 goto usbhsf_pio_prepare_push;
 
         /* check data length if this driver don't use USB-DMAC */
@@ -976,7 +976,7 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt,
 
         /* use PIO if packet is less than pio_dma_border or pipe is DCP */
         if ((pkt->length < usbhs_get_dparam(priv, pio_dma_border)) ||
-            usbhs_pipe_is_dcp(pipe))
+            usbhs_pipe_type_is(pipe, USB_ENDPOINT_XFER_ISOC))
                 goto usbhsf_pio_prepare_pop;
 
         fifo = usbhsf_get_dma_fifo(priv, pkt);
diff --git a/drivers/usb/renesas_usbhs/mod.c b/drivers/usb/renesas_usbhs/mod.c
index d4be5d594896..28965ef4f824 100644
--- a/drivers/usb/renesas_usbhs/mod.c
+++ b/drivers/usb/renesas_usbhs/mod.c
@@ -282,9 +282,16 @@ static irqreturn_t usbhs_interrupt(int irq, void *data)
         if (usbhs_mod_is_host(priv))
                 usbhs_write(priv, INTSTS1, ~irq_state.intsts1 & INTSTS1_MAGIC);
 
-        usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
+        /*
+         * The driver should not clear the xxxSTS after the line of
+         * "call irq callback functions" because each "if" statement is
+         * possible to call the callback function for avoiding any side effects.
+         */
+        if (irq_state.intsts0 & BRDY)
+                usbhs_write(priv, BRDYSTS, ~irq_state.brdysts);
         usbhs_write(priv, NRDYSTS, ~irq_state.nrdysts);
-        usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
+        if (irq_state.intsts0 & BEMP)
+                usbhs_write(priv, BEMPSTS, ~irq_state.bempsts);
 
         /*
          * call irq callback functions
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index 50f3363cc382..c4c64740a3e7 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -617,10 +617,13 @@ static int usbhsg_ep_enable(struct usb_ep *ep,
                  * use dmaengine if possible.
                  * It will use pio handler if impossible.
                  */
-                if (usb_endpoint_dir_in(desc))
+                if (usb_endpoint_dir_in(desc)) {
                         pipe->handler = &usbhs_fifo_dma_push_handler;
-                else
+                } else {
                         pipe->handler = &usbhs_fifo_dma_pop_handler;
+                        usbhs_xxxsts_clear(priv, BRDYSTS,
+                                           usbhs_pipe_number(pipe));
+                }
 
                 ret = 0;
         }
@@ -1073,7 +1076,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
 
         gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
         dev_info(dev, "%stransceiver found\n",
-                 gpriv->transceiver ? "" : "no ");
+                 !IS_ERR(gpriv->transceiver) ? "" : "no ");
 
         /*
          * CAUTION
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 00820809139a..b2d767e743fc 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -648,6 +648,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_PALMSENS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_IVIUM_XSTAT_PID) },
         { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
         { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
         { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
@@ -1008,6 +1010,7 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7560U_PID) },
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
         { USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
+        { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
         { }                                     /* Terminating entry */
 };
 
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index c5d6c1e73e8e..f87a938cf005 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -406,6 +406,12 @@
 #define FTDI_4N_GALAXY_DE_3_PID 0xF3C2
 
 /*
+ * Ivium Technologies product IDs
+ */
+#define FTDI_PALMSENS_PID       0xf440
+#define FTDI_IVIUM_XSTAT_PID    0xf441
+
+/*
  * Linx Technologies product ids
  */
 #define LINX_SDMUSBQSS_PID      0xF448  /* Linx SDM-USB-QS-S */
@@ -673,6 +679,12 @@
 #define INTREPID_NEOVI_PID      0x0701
 
 /*
+ * WICED USB UART
+ */
+#define WICED_VID               0x0A5C
+#define WICED_USB20706V2_PID    0x6422
+
+/*
  * Definitions for ID TECH (www.idt-net.com) devices
  */
 #define IDTECH_VID              0x0ACD  /* ID TECH Vendor ID */
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 5608af4a369d..de9992b492b0 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -1252,7 +1252,7 @@ static int mos7720_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         if (urb->transfer_buffer == NULL) {
                 urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
-                                               GFP_KERNEL);
+                                               GFP_ATOMIC);
                 if (!urb->transfer_buffer)
                         goto exit;
         }
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index ed378fb232e7..57426d703a09 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -1340,8 +1340,8 @@ static int mos7840_write(struct tty_struct *tty, struct usb_serial_port *port,
         }
 
         if (urb->transfer_buffer == NULL) {
-                urb->transfer_buffer =
-                    kmalloc(URB_TRANSFER_BUFFER_SIZE, GFP_KERNEL);
+                urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE,
+                                               GFP_ATOMIC);
                 if (!urb->transfer_buffer)
                         goto exit;
         }
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 8e07536c233a..9894e341c6ac 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -274,6 +274,12 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_LE920                     0x1200
 #define TELIT_PRODUCT_LE910                     0x1201
 #define TELIT_PRODUCT_LE910_USBCFG4             0x1206
+#define TELIT_PRODUCT_LE920A4_1207              0x1207
+#define TELIT_PRODUCT_LE920A4_1208              0x1208
+#define TELIT_PRODUCT_LE920A4_1211              0x1211
+#define TELIT_PRODUCT_LE920A4_1212              0x1212
+#define TELIT_PRODUCT_LE920A4_1213              0x1213
+#define TELIT_PRODUCT_LE920A4_1214              0x1214
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -519,6 +525,12 @@ static void option_instat_callback(struct urb *urb);
 #define VIATELECOM_VENDOR_ID                    0x15eb
 #define VIATELECOM_PRODUCT_CDS7                 0x0001
 
+/* WeTelecom products */
+#define WETELECOM_VENDOR_ID                     0x22de
+#define WETELECOM_PRODUCT_WMD200                0x6801
+#define WETELECOM_PRODUCT_6802                  0x6802
+#define WETELECOM_PRODUCT_WMD300                0x6803
+
 struct option_blacklist_info {
         /* bitmask of interface numbers blacklisted for send_setup */
         const unsigned long sendsetup;
@@ -628,6 +640,11 @@ static const struct option_blacklist_info telit_le920_blacklist = {
         .reserved = BIT(1) | BIT(5),
 };
 
+static const struct option_blacklist_info telit_le920a4_blacklist_1 = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1),
+};
+
 static const struct option_blacklist_info telit_le922_blacklist_usbcfg0 = {
         .sendsetup = BIT(2),
         .reserved = BIT(0) | BIT(1) | BIT(3),
@@ -1203,6 +1220,16 @@ static const struct usb_device_id option_ids[] = {
                 .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
                 .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1207) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1208),
+                .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1211),
+                .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1212),
+                .driver_info = (kernel_ulong_t)&telit_le920a4_blacklist_1 },
+        { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+                .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -1966,9 +1993,13 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
         { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */
         { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
         { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
         { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
index a204782ae530..e98b6e57b703 100644
--- a/drivers/usb/serial/usb-serial-simple.c
+++ b/drivers/usb/serial/usb-serial-simple.c
@@ -54,7 +54,8 @@ DEVICE(funsoft, FUNSOFT_IDS);
 /* Infineon Flashloader driver */
 #define FLASHLOADER_IDS()               \
         { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
-        { USB_DEVICE(0x8087, 0x0716) }
+        { USB_DEVICE(0x8087, 0x0716) }, \
+        { USB_DEVICE(0x8087, 0x0801) }
 DEVICE(flashloader, FLASHLOADER_IDS);
 
 /* Google Serial USB SubClass */
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index b1b9bac44016..d213cf44a7e4 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1433,7 +1433,7 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
 
         rc = usb_register(udriver);
         if (rc)
-                return rc;
+                goto failed_usb_register;
 
         for (sd = serial_drivers; *sd; ++sd) {
                 (*sd)->usb_driver = udriver;
@@ -1451,6 +1451,8 @@ int usb_serial_register_drivers(struct usb_serial_driver *const serial_drivers[]
         while (sd-- > serial_drivers)
                 usb_serial_deregister(*sd);
         usb_deregister(udriver);
+failed_usb_register:
+        kfree(udriver);
         return rc;
 }
 EXPORT_SYMBOL_GPL(usb_serial_register_drivers);
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 15ecfc9c5f6c..152b43822ef1 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -564,67 +564,80 @@ static int vfio_pci_set_msi_trigger(struct vfio_pci_device *vdev,
 }
 
 static int vfio_pci_set_ctx_trigger_single(struct eventfd_ctx **ctx,
-                                           uint32_t flags, void *data)
+                                           unsigned int count, uint32_t flags,
+                                           void *data)
 {
-        int32_t fd = *(int32_t *)data;
-
-        if (!(flags & VFIO_IRQ_SET_DATA_TYPE_MASK))
-                return -EINVAL;
-
         /* DATA_NONE/DATA_BOOL enables loopback testing */
         if (flags & VFIO_IRQ_SET_DATA_NONE) {
-                if (*ctx)
-                        eventfd_signal(*ctx, 1);
-                return 0;
+                if (*ctx) {
+                        if (count) {
+                                eventfd_signal(*ctx, 1);
+                        } else {
+                                eventfd_ctx_put(*ctx);
+                                *ctx = NULL;
+                        }
+                        return 0;
+                }
         } else if (flags & VFIO_IRQ_SET_DATA_BOOL) {
-                uint8_t trigger = *(uint8_t *)data;
+                uint8_t trigger;
+
+                if (!count)
+                        return -EINVAL;
+
+                trigger = *(uint8_t *)data;
                 if (trigger && *ctx)
                         eventfd_signal(*ctx, 1);
-                return 0;
-        }
 
-        /* Handle SET_DATA_EVENTFD */
-        if (fd == -1) {
-                if (*ctx)
-                        eventfd_ctx_put(*ctx);
-                *ctx = NULL;
                 return 0;
-        } else if (fd >= 0) {
-                struct eventfd_ctx *efdctx;
-                efdctx = eventfd_ctx_fdget(fd);
-                if (IS_ERR(efdctx))
-                        return PTR_ERR(efdctx);
-                if (*ctx)
-                        eventfd_ctx_put(*ctx);
-                *ctx = efdctx;
+        } else if (flags & VFIO_IRQ_SET_DATA_EVENTFD) {
+                int32_t fd;
+
+                if (!count)
+                        return -EINVAL;
+
+                fd = *(int32_t *)data;
+                if (fd == -1) {
+                        if (*ctx)
+                                eventfd_ctx_put(*ctx);
+                        *ctx = NULL;
+                } else if (fd >= 0) {
+                        struct eventfd_ctx *efdctx;
+
+                        efdctx = eventfd_ctx_fdget(fd);
+                        if (IS_ERR(efdctx))
+                                return PTR_ERR(efdctx);
+
+                        if (*ctx)
+                                eventfd_ctx_put(*ctx);
+
+                        *ctx = efdctx;
+                }
                 return 0;
-        } else
-                return -EINVAL;
+        }
+
+        return -EINVAL;
 }
 
 static int vfio_pci_set_err_trigger(struct vfio_pci_device *vdev,
                                     unsigned index, unsigned start,
                                     unsigned count, uint32_t flags, void *data)
 {
-        if (index != VFIO_PCI_ERR_IRQ_INDEX)
+        if (index != VFIO_PCI_ERR_IRQ_INDEX || start != 0 || count > 1)
                 return -EINVAL;
 
-        /*
-         * We should sanitize start & count, but that wasn't caught
-         * originally, so this IRQ index must forever ignore them :-(
-         */
-
-        return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger, flags, data);
+        return vfio_pci_set_ctx_trigger_single(&vdev->err_trigger,
+                                               count, flags, data);
 }
 
 static int vfio_pci_set_req_trigger(struct vfio_pci_device *vdev,
                                     unsigned index, unsigned start,
                                     unsigned count, uint32_t flags, void *data)
 {
-        if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count != 1)
+        if (index != VFIO_PCI_REQ_IRQ_INDEX || start != 0 || count > 1)
                 return -EINVAL;
 
-        return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger, flags, data);
+        return vfio_pci_set_ctx_trigger_single(&vdev->req_trigger,
+                                               count, flags, data);
 }
 
 int vfio_pci_set_irqs_ioctl(struct vfio_pci_device *vdev, uint32_t flags,
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9d6320e8ff3e..6e29d053843d 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
         struct scatterlist *tvc_prot_sgl;
         struct page **tvc_upages;
         /* Pointer to response header iovec */
-        struct iovec *tvc_resp_iov;
+        struct iovec tvc_resp_iov;
         /* Pointer to vhost_scsi for our device */
         struct vhost_scsi *tvc_vhost;
         /* Pointer to vhost_virtqueue for the cmd */
@@ -547,7 +547,7 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
                 memcpy(v_rsp.sense, cmd->tvc_sense_buf,
                        se_cmd->scsi_sense_length);
 
-                iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
+                iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
                               cmd->tvc_in_iovs, sizeof(v_rsp));
                 ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
                 if (likely(ret == sizeof(v_rsp))) {
@@ -1044,7 +1044,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq)
                 }
                 cmd->tvc_vhost = vs;
                 cmd->tvc_vq = vq;
-                cmd->tvc_resp_iov = &vq->iov[out];
+                cmd->tvc_resp_iov = vq->iov[out];
                 cmd->tvc_in_iovs = in;
 
                 pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",
diff --git a/drivers/vhost/test.c b/drivers/vhost/test.c
index 388eec4e1a90..97fb2f8fa930 100644
--- a/drivers/vhost/test.c
+++ b/drivers/vhost/test.c
@@ -220,20 +220,20 @@ static long vhost_test_reset_owner(struct vhost_test *n)
 {
         void *priv = NULL;
         long err;
-        struct vhost_memory *memory;
+        struct vhost_umem *umem;
 
         mutex_lock(&n->dev.mutex);
         err = vhost_dev_check_owner(&n->dev);
         if (err)
                 goto done;
-        memory = vhost_dev_reset_owner_prepare();
-        if (!memory) {
+        umem = vhost_dev_reset_owner_prepare();
+        if (!umem) {
                 err = -ENOMEM;
                 goto done;
         }
         vhost_test_stop(n, &priv);
         vhost_test_flush(n);
-        vhost_dev_reset_owner(&n->dev, memory);
+        vhost_dev_reset_owner(&n->dev, umem);
 done:
         mutex_unlock(&n->dev.mutex);
         return err;
diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
index 0ddf3a2dbfc4..e3b30ea9ece5 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
@@ -307,6 +307,8 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
 
         vhost_disable_notify(&vsock->dev, vq);
         for (;;) {
+                u32 len;
+
                 if (!vhost_vsock_more_replies(vsock)) {
                         /* Stop tx until the device processes already
                          * pending replies.  Leave tx virtqueue
@@ -334,13 +336,15 @@ static void vhost_vsock_handle_tx_kick(struct vhost_work *work)
                         continue;
                 }
 
+                len = pkt->len;
+
                 /* Only accept correctly addressed packets */
                 if (le64_to_cpu(pkt->hdr.src_cid) == vsock->guest_cid)
                         virtio_transport_recv_pkt(pkt);
                 else
                         virtio_transport_free_pkt(pkt);
 
-                vhost_add_used(vq, head, sizeof(pkt->hdr) + pkt->len);
+                vhost_add_used(vq, head, sizeof(pkt->hdr) + len);
                 added = true;
         }
 
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 114a0c88afb8..ed9c9eeedfe5 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -167,7 +167,7 @@ static bool vring_use_dma_api(struct virtio_device *vdev)
  * making all of the arch DMA ops work on the vring device itself
  * is a mess.  For now, we use the parent device for DMA ops.
  */
-struct device *vring_dma_dev(const struct vring_virtqueue *vq)
+static struct device *vring_dma_dev(const struct vring_virtqueue *vq)
 {
         return vq->vq.vdev->dev.parent;
 }
@@ -327,6 +327,8 @@ static inline int virtqueue_add(struct virtqueue *_vq,
                  * host should service the ring ASAP. */
                 if (out_sgs)
                         vq->notify(&vq->vq);
+                if (indirect)
+                        kfree(desc);
                 END_USE(vq);
                 return -ENOSPC;
         }
@@ -426,6 +428,7 @@ unmap_release:
         if (indirect)
                 kfree(desc);
 
+        END_USE(vq);
         return -EIO;
 }
 
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 7487971f9f78..c1010f018bd8 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type,
                         rc = -ENOMEM;
                         goto out;
                 }
-        } else {
+        } else if (msg_type == XS_TRANSACTION_END) {
                 list_for_each_entry(trans, &u->transactions, list)
                         if (trans->handle.id == u->u.msg.tx_id)
                                 break;
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 4b0eff6da674..85737e96ab8b 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -189,11 +189,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
         case 1:
                 _debug("extract FID count");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("FID count: %u", call->count);
@@ -210,11 +207,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 _debug("extract FID array");
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count * 3 * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 _debug("unmarshall FID array");
                 call->request = kcalloc(call->count,
@@ -239,11 +233,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
         case 3:
                 _debug("extract CB count");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 tmp = ntohl(call->tmp);
                 _debug("CB count: %u", tmp);
@@ -258,11 +249,8 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 _debug("extract CB array");
                 ret = afs_extract_data(call, skb, last, call->request,
                                        call->count * 3 * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 _debug("unmarshall CB array");
                 cb = call->request;
@@ -278,9 +266,9 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 call->unmarshall++;
 
         case 5:
-                _debug("trailer");
-                if (skb->len != 0)
-                        return -EBADMSG;
+                ret = afs_data_complete(call, skb, last);
+                if (ret < 0)
+                        return ret;
 
                 /* Record that the message was unmarshalled successfully so
                  * that the call destructor can know do the callback breaking
@@ -294,8 +282,6 @@ static int afs_deliver_cb_callback(struct afs_call *call, struct sk_buff *skb,
                 break;
         }
 
-        if (!last)
-                return 0;
 
         call->state = AFS_CALL_REPLYING;
 
@@ -335,13 +321,13 @@ static int afs_deliver_cb_init_call_back_state(struct afs_call *call,
 {
         struct afs_server *server;
         struct in_addr addr;
+        int ret;
 
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
@@ -371,8 +357,10 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call,
 
         _enter(",{%u},%d", skb->len, last);
 
+        /* There are some arguments that we ignore */
+        afs_data_consumed(call, skb);
         if (!last)
-                return 0;
+                return -EAGAIN;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
@@ -408,12 +396,13 @@ static void SRXAFSCB_Probe(struct work_struct *work)
 static int afs_deliver_cb_probe(struct afs_call *call, struct sk_buff *skb,
                                 bool last)
 {
+        int ret;
+
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
@@ -460,10 +449,9 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call, struct sk_buff *skb,
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         switch (call->unmarshall) {
         case 0:
@@ -509,8 +497,9 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call, struct sk_buff *skb,
                 break;
         }
 
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         call->state = AFS_CALL_REPLYING;
 
@@ -588,12 +577,13 @@ static void SRXAFSCB_TellMeAboutYourself(struct work_struct *work)
 static int afs_deliver_cb_tell_me_about_yourself(struct afs_call *call,
                                                  struct sk_buff *skb, bool last)
 {
+        int ret;
+
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG;
-        if (!last)
-                return 0;
+        ret = afs_data_complete(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* no unmarshalling required */
         call->state = AFS_CALL_REPLYING;
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index c2e930ec2888..9312b92e54be 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -240,15 +240,13 @@ static int afs_deliver_fs_fetch_status(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -335,11 +333,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
         case 1:
                 _debug("extract data length (MSW)");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("DATA length MSW: %u", call->count);
@@ -353,11 +348,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
         case 2:
                 _debug("extract data length");
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("DATA length: %u", call->count);
@@ -375,11 +367,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
                         ret = afs_extract_data(call, skb, last, buffer,
                                                call->count);
                         kunmap_atomic(buffer);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 call->offset = 0;
@@ -389,11 +378,8 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
         case 4:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        (21 + 3 + 6) * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 bp = call->buffer;
                 xdr_decode_AFSFetchStatus(&bp, &vnode->status, vnode, NULL);
@@ -405,15 +391,12 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call,
                 call->unmarshall++;
 
         case 5:
-                _debug("trailer");
-                if (skb->len != 0)
-                        return -EBADMSG;
+                ret = afs_data_complete(call, skb, last);
+                if (ret < 0)
+                        return ret;
                 break;
         }
 
-        if (!last)
-                return 0;
-
         if (call->count < PAGE_SIZE) {
                 _debug("clear");
                 page = call->reply3;
@@ -537,9 +520,8 @@ static int afs_deliver_fs_give_up_callbacks(struct afs_call *call,
 {
         _enter(",{%u},%d", skb->len, last);
 
-        if (skb->len > 0)
-                return -EBADMSG; /* shouldn't be any reply data */
-        return 0;
+        /* shouldn't be any reply data */
+        return afs_data_complete(call, skb, last);
 }
 
 /*
@@ -622,15 +604,13 @@ static int afs_deliver_fs_create_vnode(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -721,15 +701,13 @@ static int afs_deliver_fs_remove(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -804,15 +782,13 @@ static int afs_deliver_fs_link(struct afs_call *call,
 {
         struct afs_vnode *dvnode = call->reply, *vnode = call->reply2;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -892,15 +868,13 @@ static int afs_deliver_fs_symlink(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -999,15 +973,13 @@ static int afs_deliver_fs_rename(struct afs_call *call,
 {
         struct afs_vnode *orig_dvnode = call->reply, *new_dvnode = call->reply2;
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -1105,20 +1077,13 @@ static int afs_deliver_fs_store_data(struct afs_call *call,
 {
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last) {
-                _leave(" = 0 [more]");
-                return 0;
-        }
-
-        if (call->reply_size != call->reply_max) {
-                _leave(" = -EBADMSG [%u != %u]",
-                       call->reply_size, call->reply_max);
-                return -EBADMSG;
-        }
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
@@ -1292,20 +1257,13 @@ static int afs_deliver_fs_store_status(struct afs_call *call,
         afs_dataversion_t *store_version;
         struct afs_vnode *vnode = call->reply;
         const __be32 *bp;
+        int ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last) {
-                _leave(" = 0 [more]");
-                return 0;
-        }
-
-        if (call->reply_size != call->reply_max) {
-                _leave(" = -EBADMSG [%u != %u]",
-                       call->reply_size, call->reply_max);
-                return -EBADMSG;
-        }
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         store_version = NULL;
@@ -1504,11 +1462,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 _debug("extract status");
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        12 * 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 bp = call->buffer;
                 xdr_decode_AFSFetchVolumeStatus(&bp, call->reply2);
@@ -1518,11 +1473,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 /* extract the volume name length */
         case 2:
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("volname length: %u", call->count);
@@ -1537,11 +1489,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 if (call->count > 0) {
                         ret = afs_extract_data(call, skb, last, call->reply3,
                                                call->count);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 p = call->reply3;
@@ -1561,11 +1510,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
         case 4:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->offset = 0;
                 call->unmarshall++;
@@ -1574,11 +1520,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 /* extract the offline message length */
         case 5:
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("offline msg length: %u", call->count);
@@ -1593,11 +1536,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 if (call->count > 0) {
                         ret = afs_extract_data(call, skb, last, call->reply3,
                                                call->count);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 p = call->reply3;
@@ -1617,11 +1557,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
         case 7:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->offset = 0;
                 call->unmarshall++;
@@ -1630,11 +1567,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 /* extract the message of the day length */
         case 8:
                 ret = afs_extract_data(call, skb, last, &call->tmp, 4);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->count = ntohl(call->tmp);
                 _debug("motd length: %u", call->count);
@@ -1649,11 +1583,8 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
                 if (call->count > 0) {
                         ret = afs_extract_data(call, skb, last, call->reply3,
                                                call->count);
-                        switch (ret) {
-                        case 0:         break;
-                        case -EAGAIN:   return 0;
-                        default:        return ret;
-                        }
+                        if (ret < 0)
+                                return ret;
                 }
 
                 p = call->reply3;
@@ -1673,26 +1604,20 @@ static int afs_deliver_fs_get_volume_status(struct afs_call *call,
         case 10:
                 ret = afs_extract_data(call, skb, last, call->buffer,
                                        call->count);
-                switch (ret) {
-                case 0:         break;
-                case -EAGAIN:   return 0;
-                default:        return ret;
-                }
+                if (ret < 0)
+                        return ret;
 
                 call->offset = 0;
                 call->unmarshall++;
         no_motd_padding:
 
         case 11:
-                _debug("trailer %d", skb->len);
-                if (skb->len != 0)
-                        return -EBADMSG;
+                ret = afs_data_complete(call, skb, last);
+                if (ret < 0)
+                        return ret;
                 break;
         }
 
-        if (!last)
-                return 0;
-
         _leave(" = 0 [done]");
         return 0;
 }
@@ -1764,15 +1689,13 @@ static int afs_deliver_fs_xxxx_lock(struct afs_call *call,
                                     struct sk_buff *skb, bool last)
 {
         const __be32 *bp;
+        int ret;
 
         _enter("{%u},{%u},%d", call->unmarshall, skb->len, last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         bp = call->buffer;
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 71d5982312f3..df976b2a7f40 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -609,17 +609,29 @@ extern void afs_proc_cell_remove(struct afs_cell *);
  */
 extern int afs_open_socket(void);
 extern void afs_close_socket(void);
+extern void afs_data_consumed(struct afs_call *, struct sk_buff *);
 extern int afs_make_call(struct in_addr *, struct afs_call *, gfp_t,
                          const struct afs_wait_mode *);
 extern struct afs_call *afs_alloc_flat_call(const struct afs_call_type *,
                                             size_t, size_t);
 extern void afs_flat_call_destructor(struct afs_call *);
-extern void afs_transfer_reply(struct afs_call *, struct sk_buff *);
+extern int afs_transfer_reply(struct afs_call *, struct sk_buff *, bool);
 extern void afs_send_empty_reply(struct afs_call *);
 extern void afs_send_simple_reply(struct afs_call *, const void *, size_t);
 extern int afs_extract_data(struct afs_call *, struct sk_buff *, bool, void *,
                             size_t);
 
+static inline int afs_data_complete(struct afs_call *call, struct sk_buff *skb,
+                                    bool last)
+{
+        if (skb->len > 0)
+                return -EBADMSG;
+        afs_data_consumed(call, skb);
+        if (!last)
+                return -EAGAIN;
+        return 0;
+}
+
 /*
  * security.c
  */
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 4832de84d52c..14d04c848465 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -150,10 +150,9 @@ void afs_close_socket(void)
 }
 
 /*
- * note that the data in a socket buffer is now delivered and that the buffer
- * should be freed
+ * Note that the data in a socket buffer is now consumed.
  */
-static void afs_data_delivered(struct sk_buff *skb)
+void afs_data_consumed(struct afs_call *call, struct sk_buff *skb)
 {
         if (!skb) {
                 _debug("DLVR NULL [%d]", atomic_read(&afs_outstanding_skbs));
@@ -161,9 +160,7 @@ static void afs_data_delivered(struct sk_buff *skb)
         } else {
                 _debug("DLVR %p{%u} [%d]",
                        skb, skb->mark, atomic_read(&afs_outstanding_skbs));
-                if (atomic_dec_return(&afs_outstanding_skbs) == -1)
-                        BUG();
-                rxrpc_kernel_data_delivered(skb);
+                rxrpc_kernel_data_consumed(call->rxcall, skb);
         }
 }
 
@@ -489,9 +486,15 @@ static void afs_deliver_to_call(struct afs_call *call)
                         last = rxrpc_kernel_is_data_last(skb);
                         ret = call->type->deliver(call, skb, last);
                         switch (ret) {
+                        case -EAGAIN:
+                                if (last) {
+                                        _debug("short data");
+                                        goto unmarshal_error;
+                                }
+                                break;
                         case 0:
-                                if (last &&
-                                    call->state == AFS_CALL_AWAIT_REPLY)
+                                ASSERT(last);
+                                if (call->state == AFS_CALL_AWAIT_REPLY)
                                         call->state = AFS_CALL_COMPLETE;
                                 break;
                         case -ENOTCONN:
@@ -501,6 +504,7 @@ static void afs_deliver_to_call(struct afs_call *call)
                                 abort_code = RX_INVALID_OPERATION;
                                 goto do_abort;
                         default:
+                        unmarshal_error:
                                 abort_code = RXGEN_CC_UNMARSHAL;
                                 if (call->state != AFS_CALL_AWAIT_REPLY)
                                         abort_code = RXGEN_SS_UNMARSHAL;
@@ -511,9 +515,7 @@ static void afs_deliver_to_call(struct afs_call *call)
                                 call->state = AFS_CALL_ERROR;
                                 break;
                         }
-                        afs_data_delivered(skb);
-                        skb = NULL;
-                        continue;
+                        break;
                 case RXRPC_SKB_MARK_FINAL_ACK:
                         _debug("Rcv ACK");
                         call->state = AFS_CALL_COMPLETE;
@@ -685,15 +687,35 @@ static void afs_process_async_call(struct afs_call *call)
 }
 
 /*
- * empty a socket buffer into a flat reply buffer
+ * Empty a socket buffer into a flat reply buffer.
  */
-void afs_transfer_reply(struct afs_call *call, struct sk_buff *skb)
+int afs_transfer_reply(struct afs_call *call, struct sk_buff *skb, bool last)
 {
         size_t len = skb->len;
 
-        if (skb_copy_bits(skb, 0, call->buffer + call->reply_size, len) < 0)
-                BUG();
-        call->reply_size += len;
+        if (len > call->reply_max - call->reply_size) {
+                _leave(" = -EBADMSG [%zu > %u]",
+                       len, call->reply_max - call->reply_size);
+                return -EBADMSG;
+        }
+
+        if (len > 0) {
+                if (skb_copy_bits(skb, 0, call->buffer + call->reply_size,
+                                  len) < 0)
+                        BUG();
+                call->reply_size += len;
+        }
+
+        afs_data_consumed(call, skb);
+        if (!last)
+                return -EAGAIN;
+
+        if (call->reply_size != call->reply_max) {
+                _leave(" = -EBADMSG [%u != %u]",
+                       call->reply_size, call->reply_max);
+                return -EBADMSG;
+        }
+        return 0;
 }
 
 /*
@@ -745,7 +767,8 @@ static void afs_collect_incoming_call(struct work_struct *work)
 }
 
 /*
- * grab the operation ID from an incoming cache manager call
+ * Grab the operation ID from an incoming cache manager call.  The socket
+ * buffer is discarded on error or if we don't yet have sufficient data.
  */
 static int afs_deliver_cm_op_id(struct afs_call *call, struct sk_buff *skb,
                                 bool last)
@@ -766,12 +789,9 @@ static int afs_deliver_cm_op_id(struct afs_call *call, struct sk_buff *skb,
         call->offset += len;
 
         if (call->offset < 4) {
-                if (last) {
-                        _leave(" = -EBADMSG [op ID short]");
-                        return -EBADMSG;
-                }
-                _leave(" = 0 [incomplete]");
-                return 0;
+                afs_data_consumed(call, skb);
+                _leave(" = -EAGAIN");
+                return -EAGAIN;
         }
 
         call->state = AFS_CALL_AWAIT_REQUEST;
@@ -855,7 +875,7 @@ void afs_send_simple_reply(struct afs_call *call, const void *buf, size_t len)
 }
 
 /*
- * extract a piece of data from the received data socket buffers
+ * Extract a piece of data from the received data socket buffers.
  */
 int afs_extract_data(struct afs_call *call, struct sk_buff *skb,
                      bool last, void *buf, size_t count)
@@ -873,10 +893,7 @@ int afs_extract_data(struct afs_call *call, struct sk_buff *skb,
         call->offset += len;
 
         if (call->offset < count) {
-                if (last) {
-                        _leave(" = -EBADMSG [%d < %zu]", call->offset, count);
-                        return -EBADMSG;
-                }
+                afs_data_consumed(call, skb);
                 _leave(" = -EAGAIN");
                 return -EAGAIN;
         }
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index 340afd0cd182..f94d1abdc3eb 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -64,16 +64,13 @@ static int afs_deliver_vl_get_entry_by_xxx(struct afs_call *call,
         struct afs_cache_vlocation *entry;
         __be32 *bp;
         u32 tmp;
-        int loop;
+        int loop, ret;
 
         _enter(",,%u", last);
 
-        afs_transfer_reply(call, skb);
-        if (!last)
-                return 0;
-
-        if (call->reply_size != call->reply_max)
-                return -EBADMSG;
+        ret = afs_transfer_reply(call, skb, last);
+        if (ret < 0)
+                return ret;
 
         /* unmarshall the reply once we've received all of it */
         entry = call->reply;
diff --git a/fs/aio.c b/fs/aio.c
index fb8e45b88cd4..4fe81d1c60f9 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type *fs_type,
         static const struct dentry_operations ops = {
                 .d_dname        = simple_dname,
         };
-        return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
+        struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
+                                           AIO_RING_MAGIC);
+
+        if (!IS_ERR(root))
+                root->d_sb->s_iflags |= SB_I_NOEXEC;
+        return root;
 }
 
 /* aio_setup
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index b493909e7492..d8e6d421c27f 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -417,6 +417,7 @@ static struct dentry *should_expire(struct dentry *dentry,
         }
         return NULL;
 }
+
 /*
  * Find an eligible tree to time-out
  * A tree is eligible if :-
@@ -432,6 +433,7 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
         struct dentry *root = sb->s_root;
         struct dentry *dentry;
         struct dentry *expired;
+        struct dentry *found;
         struct autofs_info *ino;
 
         if (!root)
@@ -442,31 +444,46 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
 
         dentry = NULL;
         while ((dentry = get_next_positive_subdir(dentry, root))) {
+                int flags = how;
+
                 spin_lock(&sbi->fs_lock);
                 ino = autofs4_dentry_ino(dentry);
-                if (ino->flags & AUTOFS_INF_WANT_EXPIRE)
-                        expired = NULL;
-                else
-                        expired = should_expire(dentry, mnt, timeout, how);
-                if (!expired) {
+                if (ino->flags & AUTOFS_INF_WANT_EXPIRE) {
                         spin_unlock(&sbi->fs_lock);
                         continue;
                 }
+                spin_unlock(&sbi->fs_lock);
+
+                expired = should_expire(dentry, mnt, timeout, flags);
+                if (!expired)
+                        continue;
+
+                spin_lock(&sbi->fs_lock);
                 ino = autofs4_dentry_ino(expired);
                 ino->flags |= AUTOFS_INF_WANT_EXPIRE;
                 spin_unlock(&sbi->fs_lock);
                 synchronize_rcu();
-                spin_lock(&sbi->fs_lock);
-                if (should_expire(expired, mnt, timeout, how)) {
-                        if (expired != dentry)
-                                dput(dentry);
-                        goto found;
-                }
 
+                /* Make sure a reference is not taken on found if
+                 * things have changed.
+                 */
+                flags &= ~AUTOFS_EXP_LEAVES;
+                found = should_expire(expired, mnt, timeout, how);
+                if (!found || found != expired)
+                        /* Something has changed, continue */
+                        goto next;
+
+                if (expired != dentry)
+                        dput(dentry);
+
+                spin_lock(&sbi->fs_lock);
+                goto found;
+next:
+                spin_lock(&sbi->fs_lock);
                 ino->flags &= ~AUTOFS_INF_WANT_EXPIRE;
+                spin_unlock(&sbi->fs_lock);
                 if (expired != dentry)
                         dput(expired);
-                spin_unlock(&sbi->fs_lock);
         }
         return NULL;
 
@@ -483,6 +500,7 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
         struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
         struct autofs_info *ino = autofs4_dentry_ino(dentry);
         int status;
+        int state;
 
         /* Block on any pending expire */
         if (!(ino->flags & AUTOFS_INF_WANT_EXPIRE))
@@ -490,8 +508,19 @@ int autofs4_expire_wait(struct dentry *dentry, int rcu_walk)
         if (rcu_walk)
                 return -ECHILD;
 
+retry:
         spin_lock(&sbi->fs_lock);
-        if (ino->flags & AUTOFS_INF_EXPIRING) {
+        state = ino->flags & (AUTOFS_INF_WANT_EXPIRE | AUTOFS_INF_EXPIRING);
+        if (state == AUTOFS_INF_WANT_EXPIRE) {
+                spin_unlock(&sbi->fs_lock);
+                /*
+                 * Possibly being selected for expire, wait until
+                 * it's selected or not.
+                 */
+                schedule_timeout_uninterruptible(HZ/10);
+                goto retry;
+        }
+        if (state & AUTOFS_INF_EXPIRING) {
                 spin_unlock(&sbi->fs_lock);
 
                 pr_debug("waiting for expire %p name=%pd\n", dentry, dentry);
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 7f6aff3f72eb..e5495f37c6ed 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -853,6 +853,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 current->flags |= PF_RANDOMIZE;
 
         setup_new_exec(bprm);
+        install_exec_creds(bprm);
 
         /* Do this so that we can load the interpreter, if need be.  We will
            change some of these later */
@@ -1044,7 +1045,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
                 goto out;
 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 
-        install_exec_creds(bprm);
         retval = create_elf_tables(bprm, &loc->elf_ex,
                           load_addr, interp_load_addr);
         if (retval < 0)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index c3cdde87cc8c..08ae99343d92 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -249,7 +249,8 @@ struct super_block *freeze_bdev(struct block_device *bdev)
                  * thaw_bdev drops it.
                  */
                 sb = get_super(bdev);
-                drop_super(sb);
+                if (sb)
+                        drop_super(sb);
                 mutex_unlock(&bdev->bd_fsfreeze_mutex);
                 return sb;
         }
@@ -646,7 +647,7 @@ static struct dentry *bd_mount(struct file_system_type *fs_type,
 {
         struct dentry *dent;
         dent = mount_pseudo(fs_type, "bdev:", &bdev_sops, NULL, BDEVFS_MAGIC);
-        if (dent)
+        if (!IS_ERR(dent))
                 dent->d_sb->s_iflags |= SB_I_CGROUPWB;
         return dent;
 }
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 2b88439c2ee8..455a6b2fd539 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -589,6 +589,7 @@ static void __merge_refs(struct list_head *head, int mode)
 
                         list_del(&ref2->list);
                         kmem_cache_free(btrfs_prelim_ref_cache, ref2);
+                        cond_resched();
                 }
 
         }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 2fe8f89091a3..33fe03551105 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -427,6 +427,7 @@ struct btrfs_space_info {
         struct list_head ro_bgs;
         struct list_head priority_tickets;
         struct list_head tickets;
+        u64 tickets_id;
 
         struct rw_semaphore groups_sem;
         /* for block groups in our same type */
@@ -1028,6 +1029,7 @@ struct btrfs_fs_info {
         struct btrfs_workqueue *qgroup_rescan_workers;
         struct completion qgroup_rescan_completion;
         struct btrfs_work qgroup_rescan_work;
+        bool qgroup_rescan_running;     /* protected by qgroup_rescan_lock */
 
         /* filesystem state */
         unsigned long fs_state;
@@ -1079,6 +1081,8 @@ struct btrfs_fs_info {
         struct list_head pinned_chunks;
 
         int creating_free_space_tree;
+        /* Used to record internally whether fs has been frozen */
+        int fs_frozen;
 };
 
 struct btrfs_subvolume_writers {
@@ -2578,7 +2582,7 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
                                    struct btrfs_root *root,
                                    u64 root_objectid, u64 owner, u64 offset,
                                    struct btrfs_key *ins);
-int btrfs_reserve_extent(struct btrfs_root *root, u64 num_bytes,
+int btrfs_reserve_extent(struct btrfs_root *root, u64 ram_bytes, u64 num_bytes,
                          u64 min_alloc_size, u64 empty_size, u64 hint_byte,
                          struct btrfs_key *ins, int is_data, int delalloc);
 int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index b6d210e7a993..ac02e041464b 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -541,7 +541,6 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
         struct btrfs_delayed_ref_head *existing;
         struct btrfs_delayed_ref_head *head_ref = NULL;
         struct btrfs_delayed_ref_root *delayed_refs;
-        struct btrfs_qgroup_extent_record *qexisting;
         int count_mod = 1;
         int must_insert_reserved = 0;
 
@@ -606,10 +605,8 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
                 qrecord->num_bytes = num_bytes;
                 qrecord->old_roots = NULL;
 
-                qexisting = btrfs_qgroup_insert_dirty_extent(fs_info,
-                                                             delayed_refs,
-                                                             qrecord);
-                if (qexisting)
+                if(btrfs_qgroup_insert_dirty_extent_nolock(fs_info,
+                                        delayed_refs, qrecord))
                         kfree(qrecord);
         }
 
@@ -862,33 +859,6 @@ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
         return 0;
 }
 
-int btrfs_add_delayed_qgroup_reserve(struct btrfs_fs_info *fs_info,
-                                     struct btrfs_trans_handle *trans,
-                                     u64 ref_root, u64 bytenr, u64 num_bytes)
-{
-        struct btrfs_delayed_ref_root *delayed_refs;
-        struct btrfs_delayed_ref_head *ref_head;
-        int ret = 0;
-
-        if (!fs_info->quota_enabled || !is_fstree(ref_root))
-                return 0;
-
-        delayed_refs = &trans->transaction->delayed_refs;
-
-        spin_lock(&delayed_refs->lock);
-        ref_head = find_ref_head(&delayed_refs->href_root, bytenr, 0);
-        if (!ref_head) {
-                ret = -ENOENT;
-                goto out;
-        }
-        WARN_ON(ref_head->qgroup_reserved || ref_head->qgroup_ref_root);
-        ref_head->qgroup_ref_root = ref_root;
-        ref_head->qgroup_reserved = num_bytes;
-out:
-        spin_unlock(&delayed_refs->lock);
-        return ret;
-}
-
 int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
                                 struct btrfs_trans_handle *trans,
                                 u64 bytenr, u64 num_bytes,
diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
index 5fca9534a271..43f3629760e9 100644
--- a/fs/btrfs/delayed-ref.h
+++ b/fs/btrfs/delayed-ref.h
@@ -250,9 +250,6 @@ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
                                u64 parent, u64 ref_root,
                                u64 owner, u64 offset, u64 reserved, int action,
                                struct btrfs_delayed_extent_op *extent_op);
-int btrfs_add_delayed_qgroup_reserve(struct btrfs_fs_info *fs_info,
-                                     struct btrfs_trans_handle *trans,
-                                     u64 ref_root, u64 bytenr, u64 num_bytes);
 int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
                                 struct btrfs_trans_handle *trans,
                                 u64 bytenr, u64 num_bytes,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 59febfb8d04a..54bc8c7c6bcd 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -559,8 +559,29 @@ static noinline int check_leaf(struct btrfs_root *root,
         u32 nritems = btrfs_header_nritems(leaf);
         int slot;
 
-        if (nritems == 0)
+        if (nritems == 0) {
+                struct btrfs_root *check_root;
+
+                key.objectid = btrfs_header_owner(leaf);
+                key.type = BTRFS_ROOT_ITEM_KEY;
+                key.offset = (u64)-1;
+
+                check_root = btrfs_get_fs_root(root->fs_info, &key, false);
+                /*
+                 * The only reason we also check NULL here is that during
+                 * open_ctree() some roots has not yet been set up.
+                 */
+                if (!IS_ERR_OR_NULL(check_root)) {
+                        /* if leaf is the root, then it's fine */
+                        if (leaf->start !=
+                            btrfs_root_bytenr(&check_root->root_item)) {
+                                CORRUPT("non-root leaf's nritems is 0",
+                                        leaf, root, 0);
+                                return -EIO;
+                        }
+                }
                 return 0;
+        }
 
         /* Check the 0 item */
         if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) !=
@@ -612,6 +633,19 @@ static noinline int check_leaf(struct btrfs_root *root,
         return 0;
 }
 
+static int check_node(struct btrfs_root *root, struct extent_buffer *node)
+{
+        unsigned long nr = btrfs_header_nritems(node);
+
+        if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(root)) {
+                btrfs_crit(root->fs_info,
+                           "corrupt node: block %llu root %llu nritems %lu",
+                           node->start, root->objectid, nr);
+                return -EIO;
+        }
+        return 0;
+}
+
 static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
                                       u64 phy_offset, struct page *page,
                                       u64 start, u64 end, int mirror)
@@ -682,6 +716,9 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
                 ret = -EIO;
         }
 
+        if (found_level > 0 && check_node(root, eb))
+                ret = -EIO;
+
         if (!ret)
                 set_extent_buffer_uptodate(eb);
 err:
@@ -1618,8 +1655,8 @@ fail:
         return ret;
 }
 
-static struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
-                                               u64 root_id)
+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
+                                        u64 root_id)
 {
         struct btrfs_root *root;
 
@@ -2298,6 +2335,7 @@ static void btrfs_init_qgroup(struct btrfs_fs_info *fs_info)
         fs_info->quota_enabled = 0;
         fs_info->pending_quota_state = 0;
         fs_info->qgroup_ulist = NULL;
+        fs_info->qgroup_rescan_running = false;
         mutex_init(&fs_info->qgroup_rescan_lock);
 }
 
@@ -2624,6 +2662,7 @@ int open_ctree(struct super_block *sb,
         atomic_set(&fs_info->qgroup_op_seq, 0);
         atomic_set(&fs_info->reada_works_cnt, 0);
         atomic64_set(&fs_info->tree_mod_seq, 0);
+        fs_info->fs_frozen = 0;
         fs_info->sb = sb;
         fs_info->max_inline = BTRFS_DEFAULT_MAX_INLINE;
         fs_info->metadata_ratio = 0;
@@ -3739,8 +3778,15 @@ void btrfs_drop_and_free_fs_root(struct btrfs_fs_info *fs_info,
         if (btrfs_root_refs(&root->root_item) == 0)
                 synchronize_srcu(&fs_info->subvol_srcu);
 
-        if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state))
+        if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) {
                 btrfs_free_log(NULL, root);
+                if (root->reloc_root) {
+                        free_extent_buffer(root->reloc_root->node);
+                        free_extent_buffer(root->reloc_root->commit_root);
+                        btrfs_put_fs_root(root->reloc_root);
+                        root->reloc_root = NULL;
+                }
+        }
 
         if (root->free_ino_pinned)
                 __btrfs_remove_free_space_cache(root->free_ino_pinned);
@@ -3851,7 +3897,7 @@ void close_ctree(struct btrfs_root *root)
         smp_mb();
 
         /* wait for the qgroup rescan worker to stop */
-        btrfs_qgroup_wait_for_completion(fs_info);
+        btrfs_qgroup_wait_for_completion(fs_info, false);
 
         /* wait for the uuid_scan task to finish */
         down(&fs_info->uuid_tree_rescan_sem);
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index b3207a0e09f7..f19a982f5a4f 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -68,6 +68,8 @@ struct extent_buffer *btrfs_find_tree_block(struct btrfs_fs_info *fs_info,
 struct btrfs_root *btrfs_read_fs_root(struct btrfs_root *tree_root,
                                       struct btrfs_key *location);
 int btrfs_init_fs_root(struct btrfs_root *root);
+struct btrfs_root *btrfs_lookup_fs_root(struct btrfs_fs_info *fs_info,
+                                        u64 root_id);
 int btrfs_insert_fs_root(struct btrfs_fs_info *fs_info,
                          struct btrfs_root *root);
 void btrfs_free_fs_roots(struct btrfs_fs_info *fs_info);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 61b494e8e604..665da8f66ff1 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -60,21 +60,6 @@ enum {
         CHUNK_ALLOC_FORCE = 2,
 };
 
-/*
- * Control how reservations are dealt with.
- *
- * RESERVE_FREE - freeing a reservation.
- * RESERVE_ALLOC - allocating space and we need to update bytes_may_use for
- *   ENOSPC accounting
- * RESERVE_ALLOC_NO_ACCOUNT - allocating space and we should not update
- *   bytes_may_use as the ENOSPC accounting is done elsewhere
- */
-enum {
-        RESERVE_FREE = 0,
-        RESERVE_ALLOC = 1,
-        RESERVE_ALLOC_NO_ACCOUNT = 2,
-};
-
 static int update_block_group(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root, u64 bytenr,
                               u64 num_bytes, int alloc);
@@ -104,9 +89,10 @@ static int find_next_key(struct btrfs_path *path, int level,
                          struct btrfs_key *key);
 static void dump_space_info(struct btrfs_space_info *info, u64 bytes,
                             int dump_block_groups);
-static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
-                                       u64 num_bytes, int reserve,
-                                       int delalloc);
+static int btrfs_add_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                    u64 ram_bytes, u64 num_bytes, int delalloc);
+static int btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                     u64 num_bytes, int delalloc);
 static int block_rsv_use_bytes(struct btrfs_block_rsv *block_rsv,
                                u64 num_bytes);
 int btrfs_pin_extent(struct btrfs_root *root,
@@ -3501,7 +3487,6 @@ again:
                 dcs = BTRFS_DC_SETUP;
         else if (ret == -ENOSPC)
                 set_bit(BTRFS_TRANS_CACHE_ENOSPC, &trans->transaction->flags);
-        btrfs_free_reserved_data_space(inode, 0, num_pages);
 
 out_put:
         iput(inode);
@@ -4286,13 +4271,10 @@ int btrfs_check_data_free_space(struct inode *inode, u64 start, u64 len)
         if (ret < 0)
                 return ret;
 
-        /*
-         * Use new btrfs_qgroup_reserve_data to reserve precious data space
-         *
-         * TODO: Find a good method to avoid reserve data space for NOCOW
-         * range, but don't impact performance on quota disable case.
-         */
+        /* Use new btrfs_qgroup_reserve_data to reserve precious data space. */
         ret = btrfs_qgroup_reserve_data(inode, start, len);
+        if (ret)
+                btrfs_free_reserved_data_space_noquota(inode, start, len);
         return ret;
 }
 
@@ -4472,6 +4454,15 @@ void check_system_chunk(struct btrfs_trans_handle *trans,
         }
 }
 
+/*
+ * If force is CHUNK_ALLOC_FORCE:
+ *    - return 1 if it successfully allocates a chunk,
+ *    - return errors including -ENOSPC otherwise.
+ * If force is NOT CHUNK_ALLOC_FORCE:
+ *    - return 0 if it doesn't need to allocate a new chunk,
+ *    - return 1 if it successfully allocates a chunk,
+ *    - return errors including -ENOSPC otherwise.
+ */
 static int do_chunk_alloc(struct btrfs_trans_handle *trans,
                           struct btrfs_root *extent_root, u64 flags, int force)
 {
@@ -4882,7 +4873,7 @@ static int flush_space(struct btrfs_root *root,
                                      btrfs_get_alloc_profile(root, 0),
                                      CHUNK_ALLOC_NO_FORCE);
                 btrfs_end_transaction(trans, root);
-                if (ret == -ENOSPC)
+                if (ret > 0 || ret == -ENOSPC)
                         ret = 0;
                 break;
         case COMMIT_TRANS:
@@ -4907,11 +4898,6 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_root *root,
         u64 expected;
         u64 to_reclaim = 0;
 
-        to_reclaim = min_t(u64, num_online_cpus() * SZ_1M, SZ_16M);
-        if (can_overcommit(root, space_info, to_reclaim,
-                           BTRFS_RESERVE_FLUSH_ALL))
-                return 0;
-
         list_for_each_entry(ticket, &space_info->tickets, list)
                 to_reclaim += ticket->bytes;
         list_for_each_entry(ticket, &space_info->priority_tickets, list)
@@ -4919,6 +4905,11 @@ btrfs_calc_reclaim_metadata_size(struct btrfs_root *root,
         if (to_reclaim)
                 return to_reclaim;
 
+        to_reclaim = min_t(u64, num_online_cpus() * SZ_1M, SZ_16M);
+        if (can_overcommit(root, space_info, to_reclaim,
+                           BTRFS_RESERVE_FLUSH_ALL))
+                return 0;
+
         used = space_info->bytes_used + space_info->bytes_reserved +
                space_info->bytes_pinned + space_info->bytes_readonly +
                space_info->bytes_may_use;
@@ -4972,12 +4963,12 @@ static void wake_all_tickets(struct list_head *head)
  */
 static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
 {
-        struct reserve_ticket *last_ticket = NULL;
         struct btrfs_fs_info *fs_info;
         struct btrfs_space_info *space_info;
         u64 to_reclaim;
         int flush_state;
         int commit_cycles = 0;
+        u64 last_tickets_id;
 
         fs_info = container_of(work, struct btrfs_fs_info, async_reclaim_work);
         space_info = __find_space_info(fs_info, BTRFS_BLOCK_GROUP_METADATA);
@@ -4990,8 +4981,7 @@ static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
                 spin_unlock(&space_info->lock);
                 return;
         }
-        last_ticket = list_first_entry(&space_info->tickets,
-                                       struct reserve_ticket, list);
+        last_tickets_id = space_info->tickets_id;
         spin_unlock(&space_info->lock);
 
         flush_state = FLUSH_DELAYED_ITEMS_NR;
@@ -5011,10 +5001,10 @@ static void btrfs_async_reclaim_metadata_space(struct work_struct *work)
                                                               space_info);
                 ticket = list_first_entry(&space_info->tickets,
                                           struct reserve_ticket, list);
-                if (last_ticket == ticket) {
+                if (last_tickets_id == space_info->tickets_id) {
                         flush_state++;
                 } else {
-                        last_ticket = ticket;
+                        last_tickets_id = space_info->tickets_id;
                         flush_state = FLUSH_DELAYED_ITEMS_NR;
                         if (commit_cycles)
                                 commit_cycles--;
@@ -5390,6 +5380,7 @@ again:
                         list_del_init(&ticket->list);
                         num_bytes -= ticket->bytes;
                         ticket->bytes = 0;
+                        space_info->tickets_id++;
                         wake_up(&ticket->wait);
                 } else {
                         ticket->bytes -= num_bytes;
@@ -5432,6 +5423,7 @@ again:
                         num_bytes -= ticket->bytes;
                         space_info->bytes_may_use += ticket->bytes;
                         ticket->bytes = 0;
+                        space_info->tickets_id++;
                         wake_up(&ticket->wait);
                 } else {
                         trace_btrfs_space_reservation(fs_info, "space_info",
@@ -6497,19 +6489,15 @@ void btrfs_wait_block_group_reservations(struct btrfs_block_group_cache *bg)
 }
 
 /**
- * btrfs_update_reserved_bytes - update the block_group and space info counters
+ * btrfs_add_reserved_bytes - update the block_group and space info counters
  * @cache:      The cache we are manipulating
+ * @ram_bytes:  The number of bytes of file content, and will be same to
+ *              @num_bytes except for the compress path.
  * @num_bytes:  The number of bytes in question
- * @reserve:    One of the reservation enums
  * @delalloc:   The blocks are allocated for the delalloc write
  *
- * This is called by the allocator when it reserves space, or by somebody who is
- * freeing space that was never actually used on disk.  For example if you
- * reserve some space for a new leaf in transaction A and before transaction A
- * commits you free that leaf, you call this with reserve set to 0 in order to
- * clear the reservation.
- *
- * Metadata reservations should be called with RESERVE_ALLOC so we do the proper
+ * This is called by the allocator when it reserves space. Metadata
+ * reservations should be called with RESERVE_ALLOC so we do the proper
  * ENOSPC accounting.  For data we handle the reservation through clearing the
  * delalloc bits in the io_tree.  We have to do this since we could end up
  * allocating less disk space for the amount of data we have reserved in the
@@ -6519,44 +6507,63 @@ void btrfs_wait_block_group_reservations(struct btrfs_block_group_cache *bg)
  * make the reservation and return -EAGAIN, otherwise this function always
  * succeeds.
  */
-static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
-                                       u64 num_bytes, int reserve, int delalloc)
+static int btrfs_add_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                    u64 ram_bytes, u64 num_bytes, int delalloc)
 {
         struct btrfs_space_info *space_info = cache->space_info;
         int ret = 0;
 
         spin_lock(&space_info->lock);
         spin_lock(&cache->lock);
-        if (reserve != RESERVE_FREE) {
-                if (cache->ro) {
-                        ret = -EAGAIN;
-                } else {
-                        cache->reserved += num_bytes;
-                        space_info->bytes_reserved += num_bytes;
-                        if (reserve == RESERVE_ALLOC) {
-                                trace_btrfs_space_reservation(cache->fs_info,
-                                                "space_info", space_info->flags,
-                                                num_bytes, 0);
-                                space_info->bytes_may_use -= num_bytes;
-                        }
-
-                        if (delalloc)
-                                cache->delalloc_bytes += num_bytes;
-                }
+        if (cache->ro) {
+                ret = -EAGAIN;
         } else {
-                if (cache->ro)
-                        space_info->bytes_readonly += num_bytes;
-                cache->reserved -= num_bytes;
-                space_info->bytes_reserved -= num_bytes;
+                cache->reserved += num_bytes;
+                space_info->bytes_reserved += num_bytes;
 
+                trace_btrfs_space_reservation(cache->fs_info,
+                                "space_info", space_info->flags,
+                                ram_bytes, 0);
+                space_info->bytes_may_use -= ram_bytes;
                 if (delalloc)
-                        cache->delalloc_bytes -= num_bytes;
+                        cache->delalloc_bytes += num_bytes;
         }
         spin_unlock(&cache->lock);
         spin_unlock(&space_info->lock);
         return ret;
 }
 
+/**
+ * btrfs_free_reserved_bytes - update the block_group and space info counters
+ * @cache:      The cache we are manipulating
+ * @num_bytes:  The number of bytes in question
+ * @delalloc:   The blocks are allocated for the delalloc write
+ *
+ * This is called by somebody who is freeing space that was never actually used
+ * on disk.  For example if you reserve some space for a new leaf in transaction
+ * A and before transaction A commits you free that leaf, you call this with
+ * reserve set to 0 in order to clear the reservation.
+ */
+
+static int btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache,
+                                     u64 num_bytes, int delalloc)
+{
+        struct btrfs_space_info *space_info = cache->space_info;
+        int ret = 0;
+
+        spin_lock(&space_info->lock);
+        spin_lock(&cache->lock);
+        if (cache->ro)
+                space_info->bytes_readonly += num_bytes;
+        cache->reserved -= num_bytes;
+        space_info->bytes_reserved -= num_bytes;
+
+        if (delalloc)
+                cache->delalloc_bytes -= num_bytes;
+        spin_unlock(&cache->lock);
+        spin_unlock(&space_info->lock);
+        return ret;
+}
 void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root)
 {
@@ -7191,7 +7198,7 @@ void btrfs_free_tree_block(struct btrfs_trans_handle *trans,
                 WARN_ON(test_bit(EXTENT_BUFFER_DIRTY, &buf->bflags));
 
                 btrfs_add_free_space(cache, buf->start, buf->len);
-                btrfs_update_reserved_bytes(cache, buf->len, RESERVE_FREE, 0);
+                btrfs_free_reserved_bytes(cache, buf->len, 0);
                 btrfs_put_block_group(cache);
                 trace_btrfs_reserved_extent_free(root, buf->start, buf->len);
                 pin = 0;
@@ -7416,9 +7423,9 @@ btrfs_release_block_group(struct btrfs_block_group_cache *cache,
  * the free space extent currently.
  */
 static noinline int find_free_extent(struct btrfs_root *orig_root,
-                                     u64 num_bytes, u64 empty_size,
-                                     u64 hint_byte, struct btrfs_key *ins,
-                                     u64 flags, int delalloc)
+                                u64 ram_bytes, u64 num_bytes, u64 empty_size,
+                                u64 hint_byte, struct btrfs_key *ins,
+                                u64 flags, int delalloc)
 {
         int ret = 0;
         struct btrfs_root *root = orig_root->fs_info->extent_root;
@@ -7430,8 +7437,6 @@ static noinline int find_free_extent(struct btrfs_root *orig_root,
         struct btrfs_space_info *space_info;
         int loop = 0;
         int index = __get_raid_index(flags);
-        int alloc_type = (flags & BTRFS_BLOCK_GROUP_DATA) ?
-                RESERVE_ALLOC_NO_ACCOUNT : RESERVE_ALLOC;
         bool failed_cluster_refill = false;
         bool failed_alloc = false;
         bool use_cluster = true;
@@ -7763,8 +7768,8 @@ checks:
                                              search_start - offset);
                 BUG_ON(offset > search_start);
 
-                ret = btrfs_update_reserved_bytes(block_group, num_bytes,
-                                                  alloc_type, delalloc);
+                ret = btrfs_add_reserved_bytes(block_group, ram_bytes,
+                                num_bytes, delalloc);
                 if (ret == -EAGAIN) {
                         btrfs_add_free_space(block_group, offset, num_bytes);
                         goto loop;
@@ -7936,7 +7941,7 @@ again:
         up_read(&info->groups_sem);
 }
 
-int btrfs_reserve_extent(struct btrfs_root *root,
+int btrfs_reserve_extent(struct btrfs_root *root, u64 ram_bytes,
                          u64 num_bytes, u64 min_alloc_size,
                          u64 empty_size, u64 hint_byte,
                          struct btrfs_key *ins, int is_data, int delalloc)
@@ -7948,8 +7953,8 @@ int btrfs_reserve_extent(struct btrfs_root *root,
         flags = btrfs_get_alloc_profile(root, is_data);
 again:
         WARN_ON(num_bytes < root->sectorsize);
-        ret = find_free_extent(root, num_bytes, empty_size, hint_byte, ins,
-                               flags, delalloc);
+        ret = find_free_extent(root, ram_bytes, num_bytes, empty_size,
+                               hint_byte, ins, flags, delalloc);
         if (!ret && !is_data) {
                 btrfs_dec_block_group_reservations(root->fs_info,
                                                    ins->objectid);
@@ -7958,6 +7963,7 @@ again:
                         num_bytes = min(num_bytes >> 1, ins->offset);
                         num_bytes = round_down(num_bytes, root->sectorsize);
                         num_bytes = max(num_bytes, min_alloc_size);
+                        ram_bytes = num_bytes;
                         if (num_bytes == min_alloc_size)
                                 final_tried = true;
                         goto again;
@@ -7995,7 +8001,7 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
                 if (btrfs_test_opt(root->fs_info, DISCARD))
                         ret = btrfs_discard_extent(root, start, len, NULL);
                 btrfs_add_free_space(cache, start, len);
-                btrfs_update_reserved_bytes(cache, len, RESERVE_FREE, delalloc);
+                btrfs_free_reserved_bytes(cache, len, delalloc);
                 trace_btrfs_reserved_extent_free(root, start, len);
         }
 
@@ -8208,6 +8214,7 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
 {
         int ret;
         struct btrfs_block_group_cache *block_group;
+        struct btrfs_space_info *space_info;
 
         /*
          * Mixed block groups will exclude before processing the log so we only
@@ -8223,9 +8230,14 @@ int btrfs_alloc_logged_file_extent(struct btrfs_trans_handle *trans,
         if (!block_group)
                 return -EINVAL;
 
-        ret = btrfs_update_reserved_bytes(block_group, ins->offset,
-                                          RESERVE_ALLOC_NO_ACCOUNT, 0);
-        BUG_ON(ret); /* logic error */
+        space_info = block_group->space_info;
+        spin_lock(&space_info->lock);
+        spin_lock(&block_group->lock);
+        space_info->bytes_reserved += ins->offset;
+        block_group->reserved += ins->offset;
+        spin_unlock(&block_group->lock);
+        spin_unlock(&space_info->lock);
+
         ret = alloc_reserved_file_extent(trans, root, 0, root_objectid,
                                          0, owner, offset, ins, 1);
         btrfs_put_block_group(block_group);
@@ -8368,7 +8380,7 @@ struct extent_buffer *btrfs_alloc_tree_block(struct btrfs_trans_handle *trans,
         if (IS_ERR(block_rsv))
                 return ERR_CAST(block_rsv);
 
-        ret = btrfs_reserve_extent(root, blocksize, blocksize,
+        ret = btrfs_reserve_extent(root, blocksize, blocksize, blocksize,
                                    empty_size, hint, &ins, 0, 0);
         if (ret)
                 goto out_unuse;
@@ -8521,35 +8533,6 @@ reada:
         wc->reada_slot = slot;
 }
 
-/*
- * These may not be seen by the usual inc/dec ref code so we have to
- * add them here.
- */
-static int record_one_subtree_extent(struct btrfs_trans_handle *trans,
-                                     struct btrfs_root *root, u64 bytenr,
-                                     u64 num_bytes)
-{
-        struct btrfs_qgroup_extent_record *qrecord;
-        struct btrfs_delayed_ref_root *delayed_refs;
-
-        qrecord = kmalloc(sizeof(*qrecord), GFP_NOFS);
-        if (!qrecord)
-                return -ENOMEM;
-
-        qrecord->bytenr = bytenr;
-        qrecord->num_bytes = num_bytes;
-        qrecord->old_roots = NULL;
-
-        delayed_refs = &trans->transaction->delayed_refs;
-        spin_lock(&delayed_refs->lock);
-        if (btrfs_qgroup_insert_dirty_extent(trans->fs_info,
-                                             delayed_refs, qrecord))
-                kfree(qrecord);
-        spin_unlock(&delayed_refs->lock);
-
-        return 0;
-}
-
 static int account_leaf_items(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root,
                               struct extent_buffer *eb)
@@ -8583,7 +8566,8 @@ static int account_leaf_items(struct btrfs_trans_handle *trans,
 
                 num_bytes = btrfs_file_extent_disk_num_bytes(eb, fi);
 
-                ret = record_one_subtree_extent(trans, root, bytenr, num_bytes);
+                ret = btrfs_qgroup_insert_dirty_extent(trans, root->fs_info,
+                                bytenr, num_bytes, GFP_NOFS);
                 if (ret)
                         return ret;
         }
@@ -8732,8 +8716,9 @@ walk_down:
                         btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
                         path->locks[level] = BTRFS_READ_LOCK_BLOCKING;
 
-                        ret = record_one_subtree_extent(trans, root, child_bytenr,
-                                                        root->nodesize);
+                        ret = btrfs_qgroup_insert_dirty_extent(trans,
+                                        root->fs_info, child_bytenr,
+                                        root->nodesize, GFP_NOFS);
                         if (ret)
                                 goto out;
                 }
@@ -9906,6 +9891,7 @@ static int find_first_block_group(struct btrfs_root *root,
                         } else {
                                 ret = 0;
                         }
+                        free_extent_map(em);
                         goto out;
                 }
                 path->slots[0]++;
@@ -9942,6 +9928,7 @@ void btrfs_put_block_group_cache(struct btrfs_fs_info *info)
                 block_group->iref = 0;
                 block_group->inode = NULL;
                 spin_unlock(&block_group->lock);
+                ASSERT(block_group->io_ctl.inode == NULL);
                 iput(inode);
                 last = block_group->key.objectid + block_group->key.offset;
                 btrfs_put_block_group(block_group);
@@ -9999,6 +9986,10 @@ int btrfs_free_block_groups(struct btrfs_fs_info *info)
                         free_excluded_extents(info->extent_root, block_group);
 
                 btrfs_remove_free_space_cache(block_group);
+                ASSERT(list_empty(&block_group->dirty_list));
+                ASSERT(list_empty(&block_group->io_list));
+                ASSERT(list_empty(&block_group->bg_list));
+                ASSERT(atomic_read(&block_group->count) == 1);
                 btrfs_put_block_group(block_group);
 
                 spin_lock(&info->block_group_cache_lock);
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index bc2729a7612d..28cd88fccc7e 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -20,6 +20,7 @@
 #define EXTENT_DAMAGED          (1U << 14)
 #define EXTENT_NORESERVE        (1U << 15)
 #define EXTENT_QGROUP_RESERVED  (1U << 16)
+#define EXTENT_CLEAR_DATA_RESV  (1U << 17)
 #define EXTENT_IOBITS           (EXTENT_LOCKED | EXTENT_WRITEBACK)
 #define EXTENT_CTLBITS          (EXTENT_DO_ACCOUNTING | EXTENT_FIRST_DELALLOC)
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 9404121fd5f7..fea31a4a6e36 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2033,6 +2033,14 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
                  */
                 clear_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
                           &BTRFS_I(inode)->runtime_flags);
+                /*
+                 * An ordered extent might have started before and completed
+                 * already with io errors, in which case the inode was not
+                 * updated and we end up here. So check the inode's mapping
+                 * flags for any errors that might have happened while doing
+                 * writeback of file data.
+                 */
+                ret = btrfs_inode_check_errors(inode);
                 inode_unlock(inode);
                 goto out;
         }
@@ -2062,7 +2070,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
         }
         trans->sync = true;
 
-        btrfs_init_log_ctx(&ctx);
+        btrfs_init_log_ctx(&ctx, inode);
 
         ret = btrfs_log_dentry_safe(trans, root, dentry, start, end, &ctx);
         if (ret < 0) {
@@ -2667,6 +2675,7 @@ static long btrfs_fallocate(struct file *file, int mode,
 
         alloc_start = round_down(offset, blocksize);
         alloc_end = round_up(offset + len, blocksize);
+        cur_offset = alloc_start;
 
         /* Make sure we aren't being give some crap mode */
         if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
@@ -2759,7 +2768,6 @@ static long btrfs_fallocate(struct file *file, int mode,
 
         /* First, check if we exceed the qgroup limit */
         INIT_LIST_HEAD(&reserve_list);
-        cur_offset = alloc_start;
         while (1) {
                 em = btrfs_get_extent(inode, NULL, 0, cur_offset,
                                       alloc_end - cur_offset, 0);
@@ -2786,6 +2794,14 @@ static long btrfs_fallocate(struct file *file, int mode,
                                         last_byte - cur_offset);
                         if (ret < 0)
                                 break;
+                } else {
+                        /*
+                         * Do not need to reserve unwritten extent for this
+                         * range, free reserved data space first, otherwise
+                         * it'll result in false ENOSPC error.
+                         */
+                        btrfs_free_reserved_data_space(inode, cur_offset,
+                                last_byte - cur_offset);
                 }
                 free_extent_map(em);
                 cur_offset = last_byte;
@@ -2803,6 +2819,9 @@ static long btrfs_fallocate(struct file *file, int mode,
                                         range->start,
                                         range->len, 1 << inode->i_blkbits,
                                         offset + len, &alloc_hint);
+                else
+                        btrfs_free_reserved_data_space(inode, range->start,
+                                                       range->len);
                 list_del(&range->list);
                 kfree(range);
         }
@@ -2837,18 +2856,11 @@ out_unlock:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, alloc_start, locked_end,
                              &cached_state, GFP_KERNEL);
 out:
-        /*
-         * As we waited the extent range, the data_rsv_map must be empty
-         * in the range, as written data range will be released from it.
-         * And for prealloacted extent, it will also be released when
-         * its metadata is written.
-         * So this is completely used as cleanup.
-         */
-        btrfs_qgroup_free_data(inode, alloc_start, alloc_end - alloc_start);
         inode_unlock(inode);
         /* Let go of our reservation. */
-        btrfs_free_reserved_data_space(inode, alloc_start,
-                                       alloc_end - alloc_start);
+        if (ret != 0)
+                btrfs_free_reserved_data_space(inode, alloc_start,
+                                       alloc_end - cur_offset);
         return ret;
 }
 
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index aa6fabaee72e..359ee861b5a4 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -495,10 +495,9 @@ again:
         ret = btrfs_prealloc_file_range_trans(inode, trans, 0, 0, prealloc,
                                               prealloc, prealloc, &alloc_hint);
         if (ret) {
-                btrfs_delalloc_release_space(inode, 0, prealloc);
+                btrfs_delalloc_release_metadata(inode, prealloc);
                 goto out_put;
         }
-        btrfs_free_reserved_data_space(inode, 0, prealloc);
 
         ret = btrfs_write_out_ino_cache(root, trans, path, inode);
 out_put:
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 2f5975954ccf..e6811c42e41e 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -566,6 +566,8 @@ cont:
                                                      PAGE_SET_WRITEBACK |
                                                      page_error_op |
                                                      PAGE_END_WRITEBACK);
+                        btrfs_free_reserved_data_space_noquota(inode, start,
+                                                end - start + 1);
                         goto free_pages_out;
                 }
         }
@@ -742,7 +744,7 @@ retry:
                 lock_extent(io_tree, async_extent->start,
                             async_extent->start + async_extent->ram_size - 1);
 
-                ret = btrfs_reserve_extent(root,
+                ret = btrfs_reserve_extent(root, async_extent->ram_size,
                                            async_extent->compressed_size,
                                            async_extent->compressed_size,
                                            0, alloc_hint, &ins, 1, 1);
@@ -969,7 +971,8 @@ static noinline int cow_file_range(struct inode *inode,
                                      EXTENT_DEFRAG, PAGE_UNLOCK |
                                      PAGE_CLEAR_DIRTY | PAGE_SET_WRITEBACK |
                                      PAGE_END_WRITEBACK);
-
+                        btrfs_free_reserved_data_space_noquota(inode, start,
+                                                end - start + 1);
                         *nr_written = *nr_written +
                              (end - start + PAGE_SIZE) / PAGE_SIZE;
                         *page_started = 1;
@@ -989,7 +992,7 @@ static noinline int cow_file_range(struct inode *inode,
                 unsigned long op;
 
                 cur_alloc_size = disk_num_bytes;
-                ret = btrfs_reserve_extent(root, cur_alloc_size,
+                ret = btrfs_reserve_extent(root, cur_alloc_size, cur_alloc_size,
                                            root->sectorsize, 0, alloc_hint,
                                            &ins, 1, 1);
                 if (ret < 0)
@@ -1489,8 +1492,10 @@ out_check:
                 extent_clear_unlock_delalloc(inode, cur_offset,
                                              cur_offset + num_bytes - 1,
                                              locked_page, EXTENT_LOCKED |
-                                             EXTENT_DELALLOC, PAGE_UNLOCK |
-                                             PAGE_SET_PRIVATE2);
+                                             EXTENT_DELALLOC |
+                                             EXTENT_CLEAR_DATA_RESV,
+                                             PAGE_UNLOCK | PAGE_SET_PRIVATE2);
+
                 if (!nolock && nocow)
                         btrfs_end_write_no_snapshoting(root);
                 cur_offset = extent_end;
@@ -1807,7 +1812,9 @@ static void btrfs_clear_bit_hook(struct inode *inode,
                         return;
 
                 if (root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID
-                    && do_list && !(state->state & EXTENT_NORESERVE))
+                    && do_list && !(state->state & EXTENT_NORESERVE)
+                    && (*bits & (EXTENT_DO_ACCOUNTING |
+                    EXTENT_CLEAR_DATA_RESV)))
                         btrfs_free_reserved_data_space_noquota(inode,
                                         state->start, len);
 
@@ -3435,10 +3442,10 @@ int btrfs_orphan_cleanup(struct btrfs_root *root)
                 found_key.offset = 0;
                 inode = btrfs_iget(root->fs_info->sb, &found_key, root, NULL);
                 ret = PTR_ERR_OR_ZERO(inode);
-                if (ret && ret != -ESTALE)
+                if (ret && ret != -ENOENT)
                         goto out;
 
-                if (ret == -ESTALE && root == root->fs_info->tree_root) {
+                if (ret == -ENOENT && root == root->fs_info->tree_root) {
                         struct btrfs_root *dead_root;
                         struct btrfs_fs_info *fs_info = root->fs_info;
                         int is_dead_root = 0;
@@ -3474,7 +3481,7 @@ int btrfs_orphan_cleanup(struct btrfs_root *root)
                  * Inode is already gone but the orphan item is still there,
                  * kill the orphan item.
                  */
-                if (ret == -ESTALE) {
+                if (ret == -ENOENT) {
                         trans = btrfs_start_transaction(root, 1);
                         if (IS_ERR(trans)) {
                                 ret = PTR_ERR(trans);
@@ -3633,7 +3640,7 @@ static noinline int acls_after_inode_item(struct extent_buffer *leaf,
 /*
  * read an inode from the btree into the in-memory inode
  */
-static void btrfs_read_locked_inode(struct inode *inode)
+static int btrfs_read_locked_inode(struct inode *inode)
 {
         struct btrfs_path *path;
         struct extent_buffer *leaf;
@@ -3652,14 +3659,19 @@ static void btrfs_read_locked_inode(struct inode *inode)
                 filled = true;
 
         path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
+                ret = -ENOMEM;
                 goto make_bad;
+        }
 
         memcpy(&location, &BTRFS_I(inode)->location, sizeof(location));
 
         ret = btrfs_lookup_inode(NULL, root, path, &location, 0);
-        if (ret)
+        if (ret) {
+                if (ret > 0)
+                        ret = -ENOENT;
                 goto make_bad;
+        }
 
         leaf = path->nodes[0];
 
@@ -3812,11 +3824,12 @@ cache_acl:
         }
 
         btrfs_update_iflags(inode);
-        return;
+        return 0;
 
 make_bad:
         btrfs_free_path(path);
         make_bad_inode(inode);
+        return ret;
 }
 
 /*
@@ -4204,6 +4217,7 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
         int err = 0;
         struct btrfs_root *root = BTRFS_I(dir)->root;
         struct btrfs_trans_handle *trans;
+        u64 last_unlink_trans;
 
         if (inode->i_size > BTRFS_EMPTY_DIR_SIZE)
                 return -ENOTEMPTY;
@@ -4226,11 +4240,27 @@ static int btrfs_rmdir(struct inode *dir, struct dentry *dentry)
         if (err)
                 goto out;
 
+        last_unlink_trans = BTRFS_I(inode)->last_unlink_trans;
+
         /* now the directory is empty */
         err = btrfs_unlink_inode(trans, root, dir, d_inode(dentry),
                                  dentry->d_name.name, dentry->d_name.len);
-        if (!err)
+        if (!err) {
                 btrfs_i_size_write(inode, 0);
+                /*
+                 * Propagate the last_unlink_trans value of the deleted dir to
+                 * its parent directory. This is to prevent an unrecoverable
+                 * log tree in the case we do something like this:
+                 * 1) create dir foo
+                 * 2) create snapshot under dir foo
+                 * 3) delete the snapshot
+                 * 4) rmdir foo
+                 * 5) mkdir foo
+                 * 6) fsync foo or some file inside foo
+                 */
+                if (last_unlink_trans >= trans->transid)
+                        BTRFS_I(dir)->last_unlink_trans = last_unlink_trans;
+        }
 out:
         btrfs_end_transaction(trans, root);
         btrfs_btree_balance_dirty(root);
@@ -5606,7 +5636,9 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
                 return ERR_PTR(-ENOMEM);
 
         if (inode->i_state & I_NEW) {
-                btrfs_read_locked_inode(inode);
+                int ret;
+
+                ret = btrfs_read_locked_inode(inode);
                 if (!is_bad_inode(inode)) {
                         inode_tree_add(inode);
                         unlock_new_inode(inode);
@@ -5615,7 +5647,8 @@ struct inode *btrfs_iget(struct super_block *s, struct btrfs_key *location,
                 } else {
                         unlock_new_inode(inode);
                         iput(inode);
-                        inode = ERR_PTR(-ESTALE);
+                        ASSERT(ret < 0);
+                        inode = ERR_PTR(ret < 0 ? ret : -ESTALE);
                 }
         }
 
@@ -7225,7 +7258,7 @@ static struct extent_map *btrfs_new_extent_direct(struct inode *inode,
         int ret;
 
         alloc_hint = get_extent_allocation_hint(inode, start, len);
-        ret = btrfs_reserve_extent(root, len, root->sectorsize, 0,
+        ret = btrfs_reserve_extent(root, len, len, root->sectorsize, 0,
                                    alloc_hint, &ins, 1, 1);
         if (ret)
                 return ERR_PTR(ret);
@@ -7725,6 +7758,13 @@ static int btrfs_get_blocks_direct(struct inode *inode, sector_t iblock,
                                 ret = PTR_ERR(em2);
                                 goto unlock_err;
                         }
+                        /*
+                         * For inode marked NODATACOW or extent marked PREALLOC,
+                         * use the existing or preallocated extent, so does not
+                         * need to adjust btrfs_space_info's bytes_may_use.
+                         */
+                        btrfs_free_reserved_data_space_noquota(inode,
+                                        start, len);
                         goto unlock;
                 }
         }
@@ -7759,7 +7799,6 @@ unlock:
                         i_size_write(inode, start + len);
 
                 adjust_dio_outstanding_extents(inode, dio_data, len);
-                btrfs_free_reserved_data_space(inode, start, len);
                 WARN_ON(dio_data->reserve < len);
                 dio_data->reserve -= len;
                 dio_data->unsubmitted_oe_range_end = start + len;
@@ -10280,6 +10319,7 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
         u64 last_alloc = (u64)-1;
         int ret = 0;
         bool own_trans = true;
+        u64 end = start + num_bytes - 1;
 
         if (trans)
                 own_trans = false;
@@ -10301,8 +10341,8 @@ static int __btrfs_prealloc_file_range(struct inode *inode, int mode,
                  * sized chunks.
                  */
                 cur_bytes = min(cur_bytes, last_alloc);
-                ret = btrfs_reserve_extent(root, cur_bytes, min_size, 0,
-                                           *alloc_hint, &ins, 1, 0);
+                ret = btrfs_reserve_extent(root, cur_bytes, cur_bytes,
+                                min_size, 0, *alloc_hint, &ins, 1, 0);
                 if (ret) {
                         if (own_trans)
                                 btrfs_end_transaction(trans, root);
@@ -10388,6 +10428,9 @@ next:
                 if (own_trans)
                         btrfs_end_transaction(trans, root);
         }
+        if (cur_offset < end)
+                btrfs_free_reserved_data_space(inode, cur_offset,
+                        end - cur_offset + 1);
         return ret;
 }
 
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 14ed1e9e6bc8..7fd939bfbd99 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1634,6 +1634,9 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
         int namelen;
         int ret = 0;
 
+        if (!S_ISDIR(file_inode(file)->i_mode))
+                return -ENOTDIR;
+
         ret = mnt_want_write_file(file);
         if (ret)
                 goto out;
@@ -1691,6 +1694,9 @@ static noinline int btrfs_ioctl_snap_create(struct file *file,
         struct btrfs_ioctl_vol_args *vol_args;
         int ret;
 
+        if (!S_ISDIR(file_inode(file)->i_mode))
+                return -ENOTDIR;
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
         if (IS_ERR(vol_args))
                 return PTR_ERR(vol_args);
@@ -1714,6 +1720,9 @@ static noinline int btrfs_ioctl_snap_create_v2(struct file *file,
         bool readonly = false;
         struct btrfs_qgroup_inherit *inherit = NULL;
 
+        if (!S_ISDIR(file_inode(file)->i_mode))
+                return -ENOTDIR;
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
         if (IS_ERR(vol_args))
                 return PTR_ERR(vol_args);
@@ -2357,6 +2366,9 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
         int ret;
         int err = 0;
 
+        if (!S_ISDIR(dir->i_mode))
+                return -ENOTDIR;
+
         vol_args = memdup_user(arg, sizeof(*vol_args));
         if (IS_ERR(vol_args))
                 return PTR_ERR(vol_args);
@@ -5084,7 +5096,7 @@ static long btrfs_ioctl_quota_rescan_wait(struct file *file, void __user *arg)
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        return btrfs_qgroup_wait_for_completion(root->fs_info);
+        return btrfs_qgroup_wait_for_completion(root->fs_info, true);
 }
 
 static long _btrfs_ioctl_set_received_subvol(struct file *file,
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 93ee1c18ef9d..8db2e29fdcf4 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -995,7 +995,7 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
                 goto out;
         fs_info->quota_enabled = 0;
         fs_info->pending_quota_state = 0;
-        btrfs_qgroup_wait_for_completion(fs_info);
+        btrfs_qgroup_wait_for_completion(fs_info, false);
         spin_lock(&fs_info->qgroup_lock);
         quota_root = fs_info->quota_root;
         fs_info->quota_root = NULL;
@@ -1453,10 +1453,9 @@ int btrfs_qgroup_prepare_account_extents(struct btrfs_trans_handle *trans,
         return ret;
 }
 
-struct btrfs_qgroup_extent_record *
-btrfs_qgroup_insert_dirty_extent(struct btrfs_fs_info *fs_info,
-                                 struct btrfs_delayed_ref_root *delayed_refs,
-                                 struct btrfs_qgroup_extent_record *record)
+int btrfs_qgroup_insert_dirty_extent_nolock(struct btrfs_fs_info *fs_info,
+                                struct btrfs_delayed_ref_root *delayed_refs,
+                                struct btrfs_qgroup_extent_record *record)
 {
         struct rb_node **p = &delayed_refs->dirty_extent_root.rb_node;
         struct rb_node *parent_node = NULL;
@@ -1475,12 +1474,42 @@ btrfs_qgroup_insert_dirty_extent(struct btrfs_fs_info *fs_info,
                 else if (bytenr > entry->bytenr)
                         p = &(*p)->rb_right;
                 else
-                        return entry;
+                        return 1;
         }
 
         rb_link_node(&record->node, parent_node, p);
         rb_insert_color(&record->node, &delayed_refs->dirty_extent_root);
-        return NULL;
+        return 0;
+}
+
+int btrfs_qgroup_insert_dirty_extent(struct btrfs_trans_handle *trans,
+                struct btrfs_fs_info *fs_info, u64 bytenr, u64 num_bytes,
+                gfp_t gfp_flag)
+{
+        struct btrfs_qgroup_extent_record *record;
+        struct btrfs_delayed_ref_root *delayed_refs;
+        int ret;
+
+        if (!fs_info->quota_enabled || bytenr == 0 || num_bytes == 0)
+                return 0;
+        if (WARN_ON(trans == NULL))
+                return -EINVAL;
+        record = kmalloc(sizeof(*record), gfp_flag);
+        if (!record)
+                return -ENOMEM;
+
+        delayed_refs = &trans->transaction->delayed_refs;
+        record->bytenr = bytenr;
+        record->num_bytes = num_bytes;
+        record->old_roots = NULL;
+
+        spin_lock(&delayed_refs->lock);
+        ret = btrfs_qgroup_insert_dirty_extent_nolock(fs_info, delayed_refs,
+                                                      record);
+        spin_unlock(&delayed_refs->lock);
+        if (ret > 0)
+                kfree(record);
+        return 0;
 }
 
 #define UPDATE_NEW      0
@@ -2303,6 +2332,10 @@ static void btrfs_qgroup_rescan_worker(struct btrfs_work *work)
         int err = -ENOMEM;
         int ret = 0;
 
+        mutex_lock(&fs_info->qgroup_rescan_lock);
+        fs_info->qgroup_rescan_running = true;
+        mutex_unlock(&fs_info->qgroup_rescan_lock);
+
         path = btrfs_alloc_path();
         if (!path)
                 goto out;
@@ -2369,6 +2402,9 @@ out:
         }
 
 done:
+        mutex_lock(&fs_info->qgroup_rescan_lock);
+        fs_info->qgroup_rescan_running = false;
+        mutex_unlock(&fs_info->qgroup_rescan_lock);
         complete_all(&fs_info->qgroup_rescan_completion);
 }
 
@@ -2487,20 +2523,26 @@ btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info)
         return 0;
 }
 
-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info)
+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
+                                     bool interruptible)
 {
         int running;
         int ret = 0;
 
         mutex_lock(&fs_info->qgroup_rescan_lock);
         spin_lock(&fs_info->qgroup_lock);
-        running = fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN;
+        running = fs_info->qgroup_rescan_running;
         spin_unlock(&fs_info->qgroup_lock);
         mutex_unlock(&fs_info->qgroup_rescan_lock);
 
-        if (running)
+        if (!running)
+                return 0;
+
+        if (interruptible)
                 ret = wait_for_completion_interruptible(
                                         &fs_info->qgroup_rescan_completion);
+        else
+                wait_for_completion(&fs_info->qgroup_rescan_completion);
 
         return ret;
 }
diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
index 710887c06aaf..1bc64c864b62 100644
--- a/fs/btrfs/qgroup.h
+++ b/fs/btrfs/qgroup.h
@@ -46,7 +46,8 @@ int btrfs_quota_disable(struct btrfs_trans_handle *trans,
                         struct btrfs_fs_info *fs_info);
 int btrfs_qgroup_rescan(struct btrfs_fs_info *fs_info);
 void btrfs_qgroup_rescan_resume(struct btrfs_fs_info *fs_info);
-int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info);
+int btrfs_qgroup_wait_for_completion(struct btrfs_fs_info *fs_info,
+                                     bool interruptible);
 int btrfs_add_qgroup_relation(struct btrfs_trans_handle *trans,
                               struct btrfs_fs_info *fs_info, u64 src, u64 dst);
 int btrfs_del_qgroup_relation(struct btrfs_trans_handle *trans,
@@ -63,10 +64,35 @@ void btrfs_free_qgroup_config(struct btrfs_fs_info *fs_info);
 struct btrfs_delayed_extent_op;
 int btrfs_qgroup_prepare_account_extents(struct btrfs_trans_handle *trans,
                                          struct btrfs_fs_info *fs_info);
-struct btrfs_qgroup_extent_record *
-btrfs_qgroup_insert_dirty_extent(struct btrfs_fs_info *fs_info,
-                                 struct btrfs_delayed_ref_root *delayed_refs,
-                                 struct btrfs_qgroup_extent_record *record);
+/*
+ * Insert one dirty extent record into @delayed_refs, informing qgroup to
+ * account that extent at commit trans time.
+ *
+ * No lock version, caller must acquire delayed ref lock and allocate memory.
+ *
+ * Return 0 for success insert
+ * Return >0 for existing record, caller can free @record safely.
+ * Error is not possible
+ */
+int btrfs_qgroup_insert_dirty_extent_nolock(
+                struct btrfs_fs_info *fs_info,
+                struct btrfs_delayed_ref_root *delayed_refs,
+                struct btrfs_qgroup_extent_record *record);
+
+/*
+ * Insert one dirty extent record into @delayed_refs, informing qgroup to
+ * account that extent at commit trans time.
+ *
+ * Better encapsulated version.
+ *
+ * Return 0 if the operation is done.
+ * Return <0 for error, like memory allocation failure or invalid parameter
+ * (NULL trans)
+ */
+int btrfs_qgroup_insert_dirty_extent(struct btrfs_trans_handle *trans,
+                struct btrfs_fs_info *fs_info, u64 bytenr, u64 num_bytes,
+                gfp_t gfp_flag);
+
 int
 btrfs_qgroup_account_extent(struct btrfs_trans_handle *trans,
                             struct btrfs_fs_info *fs_info,
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index b26a5aea41b4..c0c13dc6fe12 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -31,6 +31,7 @@
 #include "async-thread.h"
 #include "free-space-cache.h"
 #include "inode-map.h"
+#include "qgroup.h"
 
 /*
  * backref_node, mapping_node and tree_block start with this
@@ -3037,15 +3038,19 @@ int prealloc_file_extent_cluster(struct inode *inode,
         u64 num_bytes;
         int nr = 0;
         int ret = 0;
+        u64 prealloc_start = cluster->start - offset;
+        u64 prealloc_end = cluster->end - offset;
+        u64 cur_offset;
 
         BUG_ON(cluster->start != cluster->boundary[0]);
         inode_lock(inode);
 
-        ret = btrfs_check_data_free_space(inode, cluster->start,
-                                          cluster->end + 1 - cluster->start);
+        ret = btrfs_check_data_free_space(inode, prealloc_start,
+                                          prealloc_end + 1 - prealloc_start);
         if (ret)
                 goto out;
 
+        cur_offset = prealloc_start;
         while (nr < cluster->nr) {
                 start = cluster->boundary[nr] - offset;
                 if (nr + 1 < cluster->nr)
@@ -3055,16 +3060,21 @@ int prealloc_file_extent_cluster(struct inode *inode,
 
                 lock_extent(&BTRFS_I(inode)->io_tree, start, end);
                 num_bytes = end + 1 - start;
+                if (cur_offset < start)
+                        btrfs_free_reserved_data_space(inode, cur_offset,
+                                        start - cur_offset);
                 ret = btrfs_prealloc_file_range(inode, 0, start,
                                                 num_bytes, num_bytes,
                                                 end + 1, &alloc_hint);
+                cur_offset = end + 1;
                 unlock_extent(&BTRFS_I(inode)->io_tree, start, end);
                 if (ret)
                         break;
                 nr++;
         }
-        btrfs_free_reserved_data_space(inode, cluster->start,
-                                       cluster->end + 1 - cluster->start);
+        if (cur_offset < prealloc_end)
+                btrfs_free_reserved_data_space(inode, cur_offset,
+                                       prealloc_end + 1 - cur_offset);
 out:
         inode_unlock(inode);
         return ret;
@@ -3916,6 +3926,90 @@ int prepare_to_relocate(struct reloc_control *rc)
         return 0;
 }
 
+/*
+ * Qgroup fixer for data chunk relocation.
+ * The data relocation is done in the following steps
+ * 1) Copy data extents into data reloc tree
+ * 2) Create tree reloc tree(special snapshot) for related subvolumes
+ * 3) Modify file extents in tree reloc tree
+ * 4) Merge tree reloc tree with original fs tree, by swapping tree blocks
+ *
+ * The problem is, data and tree reloc tree are not accounted to qgroup,
+ * and 4) will only info qgroup to track tree blocks change, not file extents
+ * in the tree blocks.
+ *
+ * The good news is, related data extents are all in data reloc tree, so we
+ * only need to info qgroup to track all file extents in data reloc tree
+ * before commit trans.
+ */
+static int qgroup_fix_relocated_data_extents(struct btrfs_trans_handle *trans,
+                                             struct reloc_control *rc)
+{
+        struct btrfs_fs_info *fs_info = rc->extent_root->fs_info;
+        struct inode *inode = rc->data_inode;
+        struct btrfs_root *data_reloc_root = BTRFS_I(inode)->root;
+        struct btrfs_path *path;
+        struct btrfs_key key;
+        int ret = 0;
+
+        if (!fs_info->quota_enabled)
+                return 0;
+
+        /*
+         * Only for stage where we update data pointers the qgroup fix is
+         * valid.
+         * For MOVING_DATA stage, we will miss the timing of swapping tree
+         * blocks, and won't fix it.
+         */
+        if (!(rc->stage == UPDATE_DATA_PTRS && rc->extents_found))
+                return 0;
+
+        path = btrfs_alloc_path();
+        if (!path)
+                return -ENOMEM;
+        key.objectid = btrfs_ino(inode);
+        key.type = BTRFS_EXTENT_DATA_KEY;
+        key.offset = 0;
+
+        ret = btrfs_search_slot(NULL, data_reloc_root, &key, path, 0, 0);
+        if (ret < 0)
+                goto out;
+
+        lock_extent(&BTRFS_I(inode)->io_tree, 0, (u64)-1);
+        while (1) {
+                struct btrfs_file_extent_item *fi;
+
+                btrfs_item_key_to_cpu(path->nodes[0], &key, path->slots[0]);
+                if (key.objectid > btrfs_ino(inode))
+                        break;
+                if (key.type != BTRFS_EXTENT_DATA_KEY)
+                        goto next;
+                fi = btrfs_item_ptr(path->nodes[0], path->slots[0],
+                                    struct btrfs_file_extent_item);
+                if (btrfs_file_extent_type(path->nodes[0], fi) !=
+                                BTRFS_FILE_EXTENT_REG)
+                        goto next;
+                ret = btrfs_qgroup_insert_dirty_extent(trans, fs_info,
+                        btrfs_file_extent_disk_bytenr(path->nodes[0], fi),
+                        btrfs_file_extent_disk_num_bytes(path->nodes[0], fi),
+                        GFP_NOFS);
+                if (ret < 0)
+                        break;
+next:
+                ret = btrfs_next_item(data_reloc_root, path);
+                if (ret < 0)
+                        break;
+                if (ret > 0) {
+                        ret = 0;
+                        break;
+                }
+        }
+        unlock_extent(&BTRFS_I(inode)->io_tree, 0 , (u64)-1);
+out:
+        btrfs_free_path(path);
+        return ret;
+}
+
 static noinline_for_stack int relocate_block_group(struct reloc_control *rc)
 {
         struct rb_root blocks = RB_ROOT;
@@ -4102,10 +4196,18 @@ restart:
 
         /* get rid of pinned extents */
         trans = btrfs_join_transaction(rc->extent_root);
-        if (IS_ERR(trans))
+        if (IS_ERR(trans)) {
                 err = PTR_ERR(trans);
-        else
-                btrfs_commit_transaction(trans, rc->extent_root);
+                goto out_free;
+        }
+        ret = qgroup_fix_relocated_data_extents(trans, rc);
+        if (ret < 0) {
+                btrfs_abort_transaction(trans, ret);
+                if (!err)
+                        err = ret;
+                goto out_free;
+        }
+        btrfs_commit_transaction(trans, rc->extent_root);
 out_free:
         btrfs_free_block_rsv(rc->extent_root, rc->block_rsv);
         btrfs_free_path(path);
@@ -4468,10 +4570,16 @@ int btrfs_recover_relocation(struct btrfs_root *root)
         unset_reloc_control(rc);
 
         trans = btrfs_join_transaction(rc->extent_root);
-        if (IS_ERR(trans))
+        if (IS_ERR(trans)) {
                 err = PTR_ERR(trans);
-        else
-                err = btrfs_commit_transaction(trans, rc->extent_root);
+                goto out_free;
+        }
+        err = qgroup_fix_relocated_data_extents(trans, rc);
+        if (err < 0) {
+                btrfs_abort_transaction(trans, err);
+                goto out_free;
+        }
+        err = btrfs_commit_transaction(trans, rc->extent_root);
 out_free:
         kfree(rc);
 out:
diff --git a/fs/btrfs/root-tree.c b/fs/btrfs/root-tree.c
index 7fd7e1830cfe..091296062456 100644
--- a/fs/btrfs/root-tree.c
+++ b/fs/btrfs/root-tree.c
@@ -272,6 +272,23 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                 root_key.objectid = key.offset;
                 key.offset++;
 
+                /*
+                 * The root might have been inserted already, as before we look
+                 * for orphan roots, log replay might have happened, which
+                 * triggers a transaction commit and qgroup accounting, which
+                 * in turn reads and inserts fs roots while doing backref
+                 * walking.
+                 */
+                root = btrfs_lookup_fs_root(tree_root->fs_info,
+                                            root_key.objectid);
+                if (root) {
+                        WARN_ON(!test_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED,
+                                          &root->state));
+                        if (btrfs_root_refs(&root->root_item) == 0)
+                                btrfs_add_dead_root(root);
+                        continue;
+                }
+
                 root = btrfs_read_fs_root(tree_root, &root_key);
                 err = PTR_ERR_OR_ZERO(root);
                 if (err && err != -ENOENT) {
@@ -310,16 +327,8 @@ int btrfs_find_orphan_roots(struct btrfs_root *tree_root)
                 set_bit(BTRFS_ROOT_ORPHAN_ITEM_INSERTED, &root->state);
 
                 err = btrfs_insert_fs_root(root->fs_info, root);
-                /*
-                 * The root might have been inserted already, as before we look
-                 * for orphan roots, log replay might have happened, which
-                 * triggers a transaction commit and qgroup accounting, which
-                 * in turn reads and inserts fs roots while doing backref
-                 * walking.
-                 */
-                if (err == -EEXIST)
-                        err = 0;
                 if (err) {
+                        BUG_ON(err == -EEXIST);
                         btrfs_free_fs_root(root);
                         break;
                 }
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index b71dd298385c..a87675ffd02b 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -231,7 +231,6 @@ struct pending_dir_move {
         u64 parent_ino;
         u64 ino;
         u64 gen;
-        bool is_orphan;
         struct list_head update_refs;
 };
 
@@ -274,6 +273,39 @@ struct name_cache_entry {
         char name[];
 };
 
+static void inconsistent_snapshot_error(struct send_ctx *sctx,
+                                        enum btrfs_compare_tree_result result,
+                                        const char *what)
+{
+        const char *result_string;
+
+        switch (result) {
+        case BTRFS_COMPARE_TREE_NEW:
+                result_string = "new";
+                break;
+        case BTRFS_COMPARE_TREE_DELETED:
+                result_string = "deleted";
+                break;
+        case BTRFS_COMPARE_TREE_CHANGED:
+                result_string = "updated";
+                break;
+        case BTRFS_COMPARE_TREE_SAME:
+                ASSERT(0);
+                result_string = "unchanged";
+                break;
+        default:
+                ASSERT(0);
+                result_string = "unexpected";
+        }
+
+        btrfs_err(sctx->send_root->fs_info,
+                  "Send: inconsistent snapshot, found %s %s for inode %llu without updated inode item, send root is %llu, parent root is %llu",
+                  result_string, what, sctx->cmp_key->objectid,
+                  sctx->send_root->root_key.objectid,
+                  (sctx->parent_root ?
+                   sctx->parent_root->root_key.objectid : 0));
+}
+
 static int is_waiting_for_move(struct send_ctx *sctx, u64 ino);
 
 static struct waiting_dir_move *
@@ -1861,7 +1893,8 @@ static int will_overwrite_ref(struct send_ctx *sctx, u64 dir, u64 dir_gen,
          * was already unlinked/moved, so we can safely assume that we will not
          * overwrite anything at this point in time.
          */
-        if (other_inode > sctx->send_progress) {
+        if (other_inode > sctx->send_progress ||
+            is_waiting_for_move(sctx, other_inode)) {
                 ret = get_inode_info(sctx->parent_root, other_inode, NULL,
                                 who_gen, NULL, NULL, NULL, NULL);
                 if (ret < 0)
@@ -2502,6 +2535,8 @@ verbose_printk("btrfs: send_utimes %llu\n", ino);
         key.type = BTRFS_INODE_ITEM_KEY;
         key.offset = 0;
         ret = btrfs_search_slot(NULL, sctx->send_root, &key, path, 0, 0);
+        if (ret > 0)
+                ret = -ENOENT;
         if (ret < 0)
                 goto out;
 
@@ -2947,6 +2982,10 @@ static int can_rmdir(struct send_ctx *sctx, u64 dir, u64 dir_gen,
                 }
 
                 if (loc.objectid > send_progress) {
+                        struct orphan_dir_info *odi;
+
+                        odi = get_orphan_dir_info(sctx, dir);
+                        free_orphan_dir_info(sctx, odi);
                         ret = 0;
                         goto out;
                 }
@@ -3047,7 +3086,6 @@ static int add_pending_dir_move(struct send_ctx *sctx,
         pm->parent_ino = parent_ino;
         pm->ino = ino;
         pm->gen = ino_gen;
-        pm->is_orphan = is_orphan;
         INIT_LIST_HEAD(&pm->list);
         INIT_LIST_HEAD(&pm->update_refs);
         RB_CLEAR_NODE(&pm->node);
@@ -3113,6 +3151,48 @@ static struct pending_dir_move *get_pending_dir_moves(struct send_ctx *sctx,
         return NULL;
 }
 
+static int path_loop(struct send_ctx *sctx, struct fs_path *name,
+                     u64 ino, u64 gen, u64 *ancestor_ino)
+{
+        int ret = 0;
+        u64 parent_inode = 0;
+        u64 parent_gen = 0;
+        u64 start_ino = ino;
+
+        *ancestor_ino = 0;
+        while (ino != BTRFS_FIRST_FREE_OBJECTID) {
+                fs_path_reset(name);
+
+                if (is_waiting_for_rm(sctx, ino))
+                        break;
+                if (is_waiting_for_move(sctx, ino)) {
+                        if (*ancestor_ino == 0)
+                                *ancestor_ino = ino;
+                        ret = get_first_ref(sctx->parent_root, ino,
+                                            &parent_inode, &parent_gen, name);
+                } else {
+                        ret = __get_cur_name_and_parent(sctx, ino, gen,
+                                                        &parent_inode,
+                                                        &parent_gen, name);
+                        if (ret > 0) {
+                                ret = 0;
+                                break;
+                        }
+                }
+                if (ret < 0)
+                        break;
+                if (parent_inode == start_ino) {
+                        ret = 1;
+                        if (*ancestor_ino == 0)
+                                *ancestor_ino = ino;
+                        break;
+                }
+                ino = parent_inode;
+                gen = parent_gen;
+        }
+        return ret;
+}
+
 static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
 {
         struct fs_path *from_path = NULL;
@@ -3123,6 +3203,8 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
         u64 parent_ino, parent_gen;
         struct waiting_dir_move *dm = NULL;
         u64 rmdir_ino = 0;
+        u64 ancestor;
+        bool is_orphan;
         int ret;
 
         name = fs_path_alloc();
@@ -3135,9 +3217,10 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
         dm = get_waiting_dir_move(sctx, pm->ino);
         ASSERT(dm);
         rmdir_ino = dm->rmdir_ino;
+        is_orphan = dm->orphanized;
         free_waiting_dir_move(sctx, dm);
 
-        if (pm->is_orphan) {
+        if (is_orphan) {
                 ret = gen_unique_name(sctx, pm->ino,
                                       pm->gen, from_path);
         } else {
@@ -3155,6 +3238,24 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
                 goto out;
 
         sctx->send_progress = sctx->cur_ino + 1;
+        ret = path_loop(sctx, name, pm->ino, pm->gen, &ancestor);
+        if (ret < 0)
+                goto out;
+        if (ret) {
+                LIST_HEAD(deleted_refs);
+                ASSERT(ancestor > BTRFS_FIRST_FREE_OBJECTID);
+                ret = add_pending_dir_move(sctx, pm->ino, pm->gen, ancestor,
+                                           &pm->update_refs, &deleted_refs,
+                                           is_orphan);
+                if (ret < 0)
+                        goto out;
+                if (rmdir_ino) {
+                        dm = get_waiting_dir_move(sctx, pm->ino);
+                        ASSERT(dm);
+                        dm->rmdir_ino = rmdir_ino;
+                }
+                goto out;
+        }
         fs_path_reset(name);
         to_path = name;
         name = NULL;
@@ -3174,7 +3275,7 @@ static int apply_dir_move(struct send_ctx *sctx, struct pending_dir_move *pm)
                         /* already deleted */
                         goto finish;
                 }
-                ret = can_rmdir(sctx, rmdir_ino, odi->gen, sctx->cur_ino + 1);
+                ret = can_rmdir(sctx, rmdir_ino, odi->gen, sctx->cur_ino);
                 if (ret < 0)
                         goto out;
                 if (!ret)
@@ -3204,8 +3305,18 @@ finish:
          * and old parent(s).
          */
         list_for_each_entry(cur, &pm->update_refs, list) {
-                if (cur->dir == rmdir_ino)
+                /*
+                 * The parent inode might have been deleted in the send snapshot
+                 */
+                ret = get_inode_info(sctx->send_root, cur->dir, NULL,
+                                     NULL, NULL, NULL, NULL, NULL);
+                if (ret == -ENOENT) {
+                        ret = 0;
                         continue;
+                }
+                if (ret < 0)
+                        goto out;
+
                 ret = send_utimes(sctx, cur->dir, cur->dir_gen);
                 if (ret < 0)
                         goto out;
@@ -3325,6 +3436,7 @@ static int wait_for_dest_dir_move(struct send_ctx *sctx,
         u64 left_gen;
         u64 right_gen;
         int ret = 0;
+        struct waiting_dir_move *wdm;
 
         if (RB_EMPTY_ROOT(&sctx->waiting_dir_moves))
                 return 0;
@@ -3383,7 +3495,8 @@ static int wait_for_dest_dir_move(struct send_ctx *sctx,
                 goto out;
         }
 
-        if (is_waiting_for_move(sctx, di_key.objectid)) {
+        wdm = get_waiting_dir_move(sctx, di_key.objectid);
+        if (wdm && !wdm->orphanized) {
                 ret = add_pending_dir_move(sctx,
                                            sctx->cur_ino,
                                            sctx->cur_inode_gen,
@@ -3470,7 +3583,8 @@ static int wait_for_parent_move(struct send_ctx *sctx,
                         ret = is_ancestor(sctx->parent_root,
                                           sctx->cur_ino, sctx->cur_inode_gen,
                                           ino, path_before);
-                        break;
+                        if (ret)
+                                break;
                 }
 
                 fs_path_reset(path_before);
@@ -3643,11 +3757,26 @@ verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
                                 goto out;
                         if (ret) {
                                 struct name_cache_entry *nce;
+                                struct waiting_dir_move *wdm;
 
                                 ret = orphanize_inode(sctx, ow_inode, ow_gen,
                                                 cur->full_path);
                                 if (ret < 0)
                                         goto out;
+
+                                /*
+                                 * If ow_inode has its rename operation delayed
+                                 * make sure that its orphanized name is used in
+                                 * the source path when performing its rename
+                                 * operation.
+                                 */
+                                if (is_waiting_for_move(sctx, ow_inode)) {
+                                        wdm = get_waiting_dir_move(sctx,
+                                                                   ow_inode);
+                                        ASSERT(wdm);
+                                        wdm->orphanized = true;
+                                }
+
                                 /*
                                  * Make sure we clear our orphanized inode's
                                  * name from the name cache. This is because the
@@ -3663,6 +3792,19 @@ verbose_printk("btrfs: process_recorded_refs %llu\n", sctx->cur_ino);
                                         name_cache_delete(sctx, nce);
                                         kfree(nce);
                                 }
+
+                                /*
+                                 * ow_inode might currently be an ancestor of
+                                 * cur_ino, therefore compute valid_path (the
+                                 * current path of cur_ino) again because it
+                                 * might contain the pre-orphanization name of
+                                 * ow_inode, which is no longer valid.
+                                 */
+                                fs_path_reset(valid_path);
+                                ret = get_cur_path(sctx, sctx->cur_ino,
+                                           sctx->cur_inode_gen, valid_path);
+                                if (ret < 0)
+                                        goto out;
                         } else {
                                 ret = send_unlink(sctx, cur->full_path);
                                 if (ret < 0)
@@ -4126,10 +4268,12 @@ static int process_all_refs(struct send_ctx *sctx,
         }
         btrfs_release_path(path);
 
+        /*
+         * We don't actually care about pending_move as we are simply
+         * re-creating this inode and will be rename'ing it into place once we
+         * rename the parent directory.
+         */
         ret = process_recorded_refs(sctx, &pending_move);
-        /* Only applicable to an incremental send. */
-        ASSERT(pending_move == 0);
-
 out:
         btrfs_free_path(path);
         return ret;
@@ -5602,7 +5746,10 @@ static int changed_ref(struct send_ctx *sctx,
 {
         int ret = 0;
 
-        BUG_ON(sctx->cur_ino != sctx->cmp_key->objectid);
+        if (sctx->cur_ino != sctx->cmp_key->objectid) {
+                inconsistent_snapshot_error(sctx, result, "reference");
+                return -EIO;
+        }
 
         if (!sctx->cur_inode_new_gen &&
             sctx->cur_ino != BTRFS_FIRST_FREE_OBJECTID) {
@@ -5627,7 +5774,10 @@ static int changed_xattr(struct send_ctx *sctx,
 {
         int ret = 0;
 
-        BUG_ON(sctx->cur_ino != sctx->cmp_key->objectid);
+        if (sctx->cur_ino != sctx->cmp_key->objectid) {
+                inconsistent_snapshot_error(sctx, result, "xattr");
+                return -EIO;
+        }
 
         if (!sctx->cur_inode_new_gen && !sctx->cur_inode_deleted) {
                 if (result == BTRFS_COMPARE_TREE_NEW)
@@ -5651,7 +5801,10 @@ static int changed_extent(struct send_ctx *sctx,
 {
         int ret = 0;
 
-        BUG_ON(sctx->cur_ino != sctx->cmp_key->objectid);
+        if (sctx->cur_ino != sctx->cmp_key->objectid) {
+                inconsistent_snapshot_error(sctx, result, "extent");
+                return -EIO;
+        }
 
         if (!sctx->cur_inode_new_gen && !sctx->cur_inode_deleted) {
                 if (result != BTRFS_COMPARE_TREE_DELETED)
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 864ce334f696..4071fe2bd098 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -2241,6 +2241,13 @@ static int btrfs_freeze(struct super_block *sb)
         struct btrfs_trans_handle *trans;
         struct btrfs_root *root = btrfs_sb(sb)->tree_root;
 
+        root->fs_info->fs_frozen = 1;
+        /*
+         * We don't need a barrier here, we'll wait for any transaction that
+         * could be in progress on other threads (and do delayed iputs that
+         * we want to avoid on a frozen filesystem), or do the commit
+         * ourselves.
+         */
         trans = btrfs_attach_transaction_barrier(root);
         if (IS_ERR(trans)) {
                 /* no transaction, don't bother */
@@ -2251,6 +2258,14 @@ static int btrfs_freeze(struct super_block *sb)
         return btrfs_commit_transaction(trans, root);
 }
 
+static int btrfs_unfreeze(struct super_block *sb)
+{
+        struct btrfs_root *root = btrfs_sb(sb)->tree_root;
+
+        root->fs_info->fs_frozen = 0;
+        return 0;
+}
+
 static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
 {
         struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb);
@@ -2299,6 +2314,7 @@ static const struct super_operations btrfs_super_ops = {
         .statfs         = btrfs_statfs,
         .remount_fs     = btrfs_remount,
         .freeze_fs      = btrfs_freeze,
+        .unfreeze_fs    = btrfs_unfreeze,
 };
 
 static const struct file_operations btrfs_ctl_fops = {
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 9cca0a721961..95d41919d034 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -2278,8 +2278,13 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
 
         kmem_cache_free(btrfs_trans_handle_cachep, trans);
 
+        /*
+         * If fs has been frozen, we can not handle delayed iputs, otherwise
+         * it'll result in deadlock about SB_FREEZE_FS.
+         */
         if (current != root->fs_info->transaction_kthread &&
-            current != root->fs_info->cleaner_kthread)
+            current != root->fs_info->cleaner_kthread &&
+            !root->fs_info->fs_frozen)
                 btrfs_run_delayed_iputs(root);
 
         return ret;
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index d31a0c4f56be..ef9c55bc7907 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -27,6 +27,7 @@
 #include "backref.h"
 #include "hash.h"
 #include "compression.h"
+#include "qgroup.h"
 
 /* magic values for the inode_only field in btrfs_log_inode:
  *
@@ -680,6 +681,21 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
                 ins.type = BTRFS_EXTENT_ITEM_KEY;
                 offset = key->offset - btrfs_file_extent_offset(eb, item);
 
+                /*
+                 * Manually record dirty extent, as here we did a shallow
+                 * file extent item copy and skip normal backref update,
+                 * but modifying extent tree all by ourselves.
+                 * So need to manually record dirty extent for qgroup,
+                 * as the owner of the file extent changed from log tree
+                 * (doesn't affect qgroup) to fs/file tree(affects qgroup)
+                 */
+                ret = btrfs_qgroup_insert_dirty_extent(trans, root->fs_info,
+                                btrfs_file_extent_disk_bytenr(eb, item),
+                                btrfs_file_extent_disk_num_bytes(eb, item),
+                                GFP_NOFS);
+                if (ret < 0)
+                        goto out;
+
                 if (ins.objectid > 0) {
                         u64 csum_start;
                         u64 csum_end;
@@ -2807,7 +2823,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
          */
         mutex_unlock(&root->log_mutex);
 
-        btrfs_init_log_ctx(&root_log_ctx);
+        btrfs_init_log_ctx(&root_log_ctx, NULL);
 
         mutex_lock(&log_root_tree->log_mutex);
         atomic_inc(&log_root_tree->log_batch);
@@ -2851,6 +2867,7 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
 
         if (log_root_tree->log_transid_committed >= root_log_ctx.log_transid) {
                 blk_finish_plug(&plug);
+                list_del_init(&root_log_ctx.list);
                 mutex_unlock(&log_root_tree->log_mutex);
                 ret = root_log_ctx.log_ret;
                 goto out;
@@ -4469,7 +4486,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
 static int btrfs_check_ref_name_override(struct extent_buffer *eb,
                                          const int slot,
                                          const struct btrfs_key *key,
-                                         struct inode *inode)
+                                         struct inode *inode,
+                                         u64 *other_ino)
 {
         int ret;
         struct btrfs_path *search_path;
@@ -4528,7 +4546,16 @@ static int btrfs_check_ref_name_override(struct extent_buffer *eb,
                                            search_path, parent,
                                            name, this_name_len, 0);
                 if (di && !IS_ERR(di)) {
-                        ret = 1;
+                        struct btrfs_key di_key;
+
+                        btrfs_dir_item_key_to_cpu(search_path->nodes[0],
+                                                  di, &di_key);
+                        if (di_key.type == BTRFS_INODE_ITEM_KEY) {
+                                ret = 1;
+                                *other_ino = di_key.objectid;
+                        } else {
+                                ret = -EAGAIN;
+                        }
                         goto out;
                 } else if (IS_ERR(di)) {
                         ret = PTR_ERR(di);
@@ -4722,16 +4749,72 @@ again:
                 if ((min_key.type == BTRFS_INODE_REF_KEY ||
                      min_key.type == BTRFS_INODE_EXTREF_KEY) &&
                     BTRFS_I(inode)->generation == trans->transid) {
+                        u64 other_ino = 0;
+
                         ret = btrfs_check_ref_name_override(path->nodes[0],
                                                             path->slots[0],
-                                                            &min_key, inode);
+                                                            &min_key, inode,
+                                                            &other_ino);
                         if (ret < 0) {
                                 err = ret;
                                 goto out_unlock;
-                        } else if (ret > 0) {
-                                err = 1;
-                                btrfs_set_log_full_commit(root->fs_info, trans);
-                                goto out_unlock;
+                        } else if (ret > 0 && ctx &&
+                                   other_ino != btrfs_ino(ctx->inode)) {
+                                struct btrfs_key inode_key;
+                                struct inode *other_inode;
+
+                                if (ins_nr > 0) {
+                                        ins_nr++;
+                                } else {
+                                        ins_nr = 1;
+                                        ins_start_slot = path->slots[0];
+                                }
+                                ret = copy_items(trans, inode, dst_path, path,
+                                                 &last_extent, ins_start_slot,
+                                                 ins_nr, inode_only,
+                                                 logged_isize);
+                                if (ret < 0) {
+                                        err = ret;
+                                        goto out_unlock;
+                                }
+                                ins_nr = 0;
+                                btrfs_release_path(path);
+                                inode_key.objectid = other_ino;
+                                inode_key.type = BTRFS_INODE_ITEM_KEY;
+                                inode_key.offset = 0;
+                                other_inode = btrfs_iget(root->fs_info->sb,
+                                                         &inode_key, root,
+                                                         NULL);
+                                /*
+                                 * If the other inode that had a conflicting dir
+                                 * entry was deleted in the current transaction,
+                                 * we don't need to do more work nor fallback to
+                                 * a transaction commit.
+                                 */
+                                if (IS_ERR(other_inode) &&
+                                    PTR_ERR(other_inode) == -ENOENT) {
+                                        goto next_key;
+                                } else if (IS_ERR(other_inode)) {
+                                        err = PTR_ERR(other_inode);
+                                        goto out_unlock;
+                                }
+                                /*
+                                 * We are safe logging the other inode without
+                                 * acquiring its i_mutex as long as we log with
+                                 * the LOG_INODE_EXISTS mode. We're safe against
+                                 * concurrent renames of the other inode as well
+                                 * because during a rename we pin the log and
+                                 * update the log with the new name before we
+                                 * unpin it.
+                                 */
+                                err = btrfs_log_inode(trans, root, other_inode,
+                                                      LOG_INODE_EXISTS,
+                                                      0, LLONG_MAX, ctx);
+                                iput(other_inode);
+                                if (err)
+                                        goto out_unlock;
+                                else
+                                        goto next_key;
                         }
                 }
 
@@ -4799,7 +4882,7 @@ next_slot:
                         ins_nr = 0;
                 }
                 btrfs_release_path(path);
-
+next_key:
                 if (min_key.offset < (u64)-1) {
                         min_key.offset++;
                 } else if (min_key.type < max_key.type) {
@@ -4993,8 +5076,12 @@ static noinline int check_parent_dirs_for_sync(struct btrfs_trans_handle *trans,
                 if (!parent || d_really_is_negative(parent) || sb != parent->d_sb)
                         break;
 
-                if (IS_ROOT(parent))
+                if (IS_ROOT(parent)) {
+                        inode = d_inode(parent);
+                        if (btrfs_must_commit_transaction(trans, inode))
+                                ret = 1;
                         break;
+                }
 
                 parent = dget_parent(parent);
                 dput(old_parent);
diff --git a/fs/btrfs/tree-log.h b/fs/btrfs/tree-log.h
index a9f1b75d080d..ab858e31ccbc 100644
--- a/fs/btrfs/tree-log.h
+++ b/fs/btrfs/tree-log.h
@@ -30,15 +30,18 @@ struct btrfs_log_ctx {
         int log_transid;
         int io_err;
         bool log_new_dentries;
+        struct inode *inode;
         struct list_head list;
 };
 
-static inline void btrfs_init_log_ctx(struct btrfs_log_ctx *ctx)
+static inline void btrfs_init_log_ctx(struct btrfs_log_ctx *ctx,
+                                      struct inode *inode)
 {
         ctx->log_ret = 0;
         ctx->log_transid = 0;
         ctx->io_err = 0;
         ctx->log_new_dentries = false;
+        ctx->inode = inode;
         INIT_LIST_HEAD(&ctx->list);
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 51f125508771..035efce603a9 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -834,10 +834,6 @@ static void __free_device(struct work_struct *work)
         struct btrfs_device *device;
 
         device = container_of(work, struct btrfs_device, rcu_work);
-
-        if (device->bdev)
-                blkdev_put(device->bdev, device->mode);
-
         rcu_string_free(device->name);
         kfree(device);
 }
@@ -852,6 +848,17 @@ static void free_device(struct rcu_head *head)
         schedule_work(&device->rcu_work);
 }
 
+static void btrfs_close_bdev(struct btrfs_device *device)
+{
+        if (device->bdev && device->writeable) {
+                sync_blockdev(device->bdev);
+                invalidate_bdev(device->bdev);
+        }
+
+        if (device->bdev)
+                blkdev_put(device->bdev, device->mode);
+}
+
 static void btrfs_close_one_device(struct btrfs_device *device)
 {
         struct btrfs_fs_devices *fs_devices = device->fs_devices;
@@ -870,10 +877,7 @@ static void btrfs_close_one_device(struct btrfs_device *device)
         if (device->missing)
                 fs_devices->missing_devices--;
 
-        if (device->bdev && device->writeable) {
-                sync_blockdev(device->bdev);
-                invalidate_bdev(device->bdev);
-        }
+        btrfs_close_bdev(device);
 
         new_device = btrfs_alloc_device(NULL, &device->devid,
                                         device->uuid);
@@ -1932,6 +1936,8 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path, u64 devid)
                 btrfs_sysfs_rm_device_link(root->fs_info->fs_devices, device);
         }
 
+        btrfs_close_bdev(device);
+
         call_rcu(&device->rcu, free_device);
 
         num_devices = btrfs_super_num_devices(root->fs_info->super_copy) - 1;
@@ -2025,6 +2031,9 @@ void btrfs_rm_dev_replace_free_srcdev(struct btrfs_fs_info *fs_info,
                 /* zero out the old super if it is writable */
                 btrfs_scratch_superblocks(srcdev->bdev, srcdev->name->str);
         }
+
+        btrfs_close_bdev(srcdev);
+
         call_rcu(&srcdev->rcu, free_device);
 
         /*
@@ -2080,6 +2089,8 @@ void btrfs_destroy_dev_replace_tgtdev(struct btrfs_fs_info *fs_info,
          * the device_list_mutex lock.
          */
         btrfs_scratch_superblocks(tgtdev->bdev, tgtdev->name->str);
+
+        btrfs_close_bdev(tgtdev);
         call_rcu(&tgtdev->rcu, free_device);
 }
 
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 99115cae1652..16e6ded0b7f2 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1347,9 +1347,12 @@ void ceph_flush_snaps(struct ceph_inode_info *ci,
 {
         struct inode *inode = &ci->vfs_inode;
         struct ceph_mds_client *mdsc = ceph_inode_to_client(inode)->mdsc;
-        struct ceph_mds_session *session = *psession;
+        struct ceph_mds_session *session = NULL;
         int mds;
+
         dout("ceph_flush_snaps %p\n", inode);
+        if (psession)
+                session = *psession;
 retry:
         spin_lock(&ci->i_ceph_lock);
         if (!(ci->i_ceph_flags & CEPH_I_FLUSH_SNAPS)) {
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index c64a0b794d49..df4b3e6fa563 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -597,7 +597,7 @@ static bool need_reset_readdir(struct ceph_file_info *fi, loff_t new_pos)
         if (is_hash_order(new_pos)) {
                 /* no need to reset last_name for a forward seek when
                  * dentries are sotred in hash order */
-        } else if (fi->frag |= fpos_frag(new_pos)) {
+        } else if (fi->frag != fpos_frag(new_pos)) {
                 return true;
         }
         rinfo = fi->last_readdir ? &fi->last_readdir->r_reply_info : NULL;
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index fa59a85226b2..f72d4ae303b2 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2759,6 +2759,7 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
         } else {
                 path = NULL;
                 pathlen = 0;
+                pathbase = 0;
         }
 
         spin_lock(&ci->i_ceph_lock);
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 6bbec5e784cd..14ae4b8e1a3c 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -609,6 +609,9 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
         char *s, *p;
         char sep;
 
+        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
+                return dget(sb->s_root);
+
         full_path = cifs_build_path_to_root(vol, cifs_sb,
                                             cifs_sb_master_tcon(cifs_sb));
         if (full_path == NULL)
@@ -686,26 +689,22 @@ cifs_do_mount(struct file_system_type *fs_type,
         cifs_sb->mountdata = kstrndup(data, PAGE_SIZE, GFP_KERNEL);
         if (cifs_sb->mountdata == NULL) {
                 root = ERR_PTR(-ENOMEM);
-                goto out_cifs_sb;
+                goto out_free;
         }
 
-        if (volume_info->prepath) {
-                cifs_sb->prepath = kstrdup(volume_info->prepath, GFP_KERNEL);
-                if (cifs_sb->prepath == NULL) {
-                        root = ERR_PTR(-ENOMEM);
-                        goto out_cifs_sb;
-                }
+        rc = cifs_setup_cifs_sb(volume_info, cifs_sb);
+        if (rc) {
+                root = ERR_PTR(rc);
+                goto out_free;
         }
 
-        cifs_setup_cifs_sb(volume_info, cifs_sb);
-
         rc = cifs_mount(cifs_sb, volume_info);
         if (rc) {
                 if (!(flags & MS_SILENT))
                         cifs_dbg(VFS, "cifs_mount failed w/return code = %d\n",
                                  rc);
                 root = ERR_PTR(rc);
-                goto out_mountdata;
+                goto out_free;
         }
 
         mnt_data.vol = volume_info;
@@ -735,11 +734,7 @@ cifs_do_mount(struct file_system_type *fs_type,
                 sb->s_flags |= MS_ACTIVE;
         }
 
-        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH)
-                root = dget(sb->s_root);
-        else
-                root = cifs_get_root(volume_info, sb);
-
+        root = cifs_get_root(volume_info, sb);
         if (IS_ERR(root))
                 goto out_super;
 
@@ -752,9 +747,9 @@ out:
         cifs_cleanup_volume_info(volume_info);
         return root;
 
-out_mountdata:
+out_free:
+        kfree(cifs_sb->prepath);
         kfree(cifs_sb->mountdata);
-out_cifs_sb:
         kfree(cifs_sb);
 out_nls:
         unload_nls(volume_info->local_nls);
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 1243bd326591..95dab43646f0 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -184,7 +184,7 @@ extern int cifs_read_from_socket(struct TCP_Server_Info *server, char *buf,
                                  unsigned int to_read);
 extern int cifs_read_page_from_socket(struct TCP_Server_Info *server,
                                       struct page *page, unsigned int to_read);
-extern void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+extern int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                                struct cifs_sb_info *cifs_sb);
 extern int cifs_match_super(struct super_block *, void *);
 extern void cifs_cleanup_volume_info(struct smb_vol *pvolume_info);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7ae03283bd61..2e4f4bad8b1e 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2781,6 +2781,24 @@ compare_mount_options(struct super_block *sb, struct cifs_mnt_data *mnt_data)
         return 1;
 }
 
+static int
+match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+{
+        struct cifs_sb_info *old = CIFS_SB(sb);
+        struct cifs_sb_info *new = mnt_data->cifs_sb;
+
+        if (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) {
+                if (!(new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH))
+                        return 0;
+                /* The prepath should be null terminated strings */
+                if (strcmp(new->prepath, old->prepath))
+                        return 0;
+
+                return 1;
+        }
+        return 0;
+}
+
 int
 cifs_match_super(struct super_block *sb, void *data)
 {
@@ -2808,7 +2826,8 @@ cifs_match_super(struct super_block *sb, void *data)
 
         if (!match_server(tcp_srv, volume_info) ||
             !match_session(ses, volume_info) ||
-            !match_tcon(tcon, volume_info->UNC)) {
+            !match_tcon(tcon, volume_info->UNC) ||
+            !match_prepath(sb, mnt_data)) {
                 rc = 0;
                 goto out;
         }
@@ -3222,7 +3241,7 @@ void reset_cifs_unix_caps(unsigned int xid, struct cifs_tcon *tcon,
         }
 }
 
-void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
+int cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                         struct cifs_sb_info *cifs_sb)
 {
         INIT_DELAYED_WORK(&cifs_sb->prune_tlinks, cifs_prune_tlinks);
@@ -3316,6 +3335,14 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 
         if ((pvolume_info->cifs_acl) && (pvolume_info->dynperm))
                 cifs_dbg(VFS, "mount option dynperm ignored if cifsacl mount option supported\n");
+
+        if (pvolume_info->prepath) {
+                cifs_sb->prepath = kstrdup(pvolume_info->prepath, GFP_KERNEL);
+                if (cifs_sb->prepath == NULL)
+                        return -ENOMEM;
+        }
+
+        return 0;
 }
 
 static void
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index c30cf49b69d2..2c6312db8516 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -333,6 +333,7 @@ configfs_write_bin_file(struct file *file, const char __user *buf,
                 if (bin_attr->cb_max_size &&
                         *ppos + count > bin_attr->cb_max_size) {
                         len = -EFBIG;
+                        goto out;
                 }
 
                 tbuf = vmalloc(*ppos + count);
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 0f9961eede1e..ed115acb5dee 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -11,6 +11,7 @@
 #include <linux/random.h>
 #include <linux/string.h>
 #include <linux/fscrypto.h>
+#include <linux/mount.h>
 
 static int inode_has_encryption_context(struct inode *inode)
 {
@@ -92,26 +93,42 @@ static int create_encryption_context_from_policy(struct inode *inode,
         return inode->i_sb->s_cop->set_context(inode, &ctx, sizeof(ctx), NULL);
 }
 
-int fscrypt_process_policy(struct inode *inode,
+int fscrypt_process_policy(struct file *filp,
                                 const struct fscrypt_policy *policy)
 {
+        struct inode *inode = file_inode(filp);
+        int ret;
+
+        if (!inode_owner_or_capable(inode))
+                return -EACCES;
+
         if (policy->version != 0)
                 return -EINVAL;
 
+        ret = mnt_want_write_file(filp);
+        if (ret)
+                return ret;
+
         if (!inode_has_encryption_context(inode)) {
-                if (!inode->i_sb->s_cop->empty_dir)
-                        return -EOPNOTSUPP;
-                if (!inode->i_sb->s_cop->empty_dir(inode))
-                        return -ENOTEMPTY;
-                return create_encryption_context_from_policy(inode, policy);
+                if (!S_ISDIR(inode->i_mode))
+                        ret = -EINVAL;
+                else if (!inode->i_sb->s_cop->empty_dir)
+                        ret = -EOPNOTSUPP;
+                else if (!inode->i_sb->s_cop->empty_dir(inode))
+                        ret = -ENOTEMPTY;
+                else
+                        ret = create_encryption_context_from_policy(inode,
+                                                                    policy);
+        } else if (!is_encryption_context_consistent_with_policy(inode,
+                                                                 policy)) {
+                printk(KERN_WARNING
+                       "%s: Policy inconsistent with encryption context\n",
+                       __func__);
+                ret = -EINVAL;
         }
 
-        if (is_encryption_context_consistent_with_policy(inode, policy))
-                return 0;
-
-        printk(KERN_WARNING "%s: Policy inconsistent with encryption context\n",
-               __func__);
-        return -EINVAL;
+        mnt_drop_write_file(filp);
+        return ret;
 }
 EXPORT_SYMBOL(fscrypt_process_policy);
 
diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index d116453b0276..79a5941c2474 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -585,7 +585,8 @@ struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)
  */
 void *devpts_get_priv(struct dentry *dentry)
 {
-        WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC);
+        if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC)
+                return NULL;
         return dentry->d_fsdata;
 }
 
diff --git a/fs/dlm/debug_fs.c b/fs/dlm/debug_fs.c
index eea64912c9c0..466f7d60edc2 100644
--- a/fs/dlm/debug_fs.c
+++ b/fs/dlm/debug_fs.c
@@ -607,20 +607,54 @@ static const struct file_operations format2_fops;
 static const struct file_operations format3_fops;
 static const struct file_operations format4_fops;
 
-static int table_open(struct inode *inode, struct file *file)
+static int table_open1(struct inode *inode, struct file *file)
 {
         struct seq_file *seq;
-        int ret = -1;
+        int ret;
 
-        if (file->f_op == &format1_fops)
-                ret = seq_open(file, &format1_seq_ops);
-        else if (file->f_op == &format2_fops)
-                ret = seq_open(file, &format2_seq_ops);
-        else if (file->f_op == &format3_fops)
-                ret = seq_open(file, &format3_seq_ops);
-        else if (file->f_op == &format4_fops)
-                ret = seq_open(file, &format4_seq_ops);
+        ret = seq_open(file, &format1_seq_ops);
+        if (ret)
+                return ret;
+
+        seq = file->private_data;
+        seq->private = inode->i_private; /* the dlm_ls */
+        return 0;
+}
+
+static int table_open2(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int ret;
+
+        ret = seq_open(file, &format2_seq_ops);
+        if (ret)
+                return ret;
+
+        seq = file->private_data;
+        seq->private = inode->i_private; /* the dlm_ls */
+        return 0;
+}
+
+static int table_open3(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int ret;
+
+        ret = seq_open(file, &format3_seq_ops);
+        if (ret)
+                return ret;
+
+        seq = file->private_data;
+        seq->private = inode->i_private; /* the dlm_ls */
+        return 0;
+}
+
+static int table_open4(struct inode *inode, struct file *file)
+{
+        struct seq_file *seq;
+        int ret;
 
+        ret = seq_open(file, &format4_seq_ops);
         if (ret)
                 return ret;
 
@@ -631,7 +665,7 @@ static int table_open(struct inode *inode, struct file *file)
 
 static const struct file_operations format1_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open1,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
@@ -639,7 +673,7 @@ static const struct file_operations format1_fops = {
 
 static const struct file_operations format2_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open2,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
@@ -647,7 +681,7 @@ static const struct file_operations format2_fops = {
 
 static const struct file_operations format3_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open3,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
@@ -655,7 +689,7 @@ static const struct file_operations format3_fops = {
 
 static const struct file_operations format4_fops = {
         .owner   = THIS_MODULE,
-        .open    = table_open,
+        .open    = table_open4,
         .read    = seq_read,
         .llseek  = seq_lseek,
         .release = seq_release
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 3131747199e1..c6ea25a190f8 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5466,8 +5466,6 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode)
                                                       sbi->s_want_extra_isize,
                                                       iloc, handle);
                         if (ret) {
-                                ext4_set_inode_state(inode,
-                                                     EXT4_STATE_NO_EXPAND);
                                 if (mnt_count !=
                                         le16_to_cpu(sbi->s_es->s_mnt_count)) {
                                         ext4_warning(inode->i_sb,
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 10686fd67fb4..1bb7df5e4536 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -776,7 +776,7 @@ resizefs_out:
                                    (struct fscrypt_policy __user *)arg,
                                    sizeof(policy)))
                         return -EFAULT;
-                return fscrypt_process_policy(inode, &policy);
+                return fscrypt_process_policy(filp, &policy);
 #else
                 return -EOPNOTSUPP;
 #endif
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 1c593aa0218e..3ec8708989ca 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2211,6 +2211,7 @@ void ext4_group_desc_csum_set(struct super_block *sb, __u32 block_group,
 
 /* Called at mount-time, super-block is locked */
 static int ext4_check_descriptors(struct super_block *sb,
+                                  ext4_fsblk_t sb_block,
                                   ext4_group_t *first_not_zeroed)
 {
         struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -2241,6 +2242,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                         grp = i;
 
                 block_bitmap = ext4_block_bitmap(sb, gdp);
+                if (block_bitmap == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Block bitmap for group %u overlaps "
+                                 "superblock", i);
+                }
                 if (block_bitmap < first_block || block_bitmap > last_block) {
                         ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
                                "Block bitmap for group %u not in group "
@@ -2248,6 +2254,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                         return 0;
                 }
                 inode_bitmap = ext4_inode_bitmap(sb, gdp);
+                if (inode_bitmap == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Inode bitmap for group %u overlaps "
+                                 "superblock", i);
+                }
                 if (inode_bitmap < first_block || inode_bitmap > last_block) {
                         ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
                                "Inode bitmap for group %u not in group "
@@ -2255,6 +2266,11 @@ static int ext4_check_descriptors(struct super_block *sb,
                         return 0;
                 }
                 inode_table = ext4_inode_table(sb, gdp);
+                if (inode_table == sb_block) {
+                        ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+                                 "Inode table for group %u overlaps "
+                                 "superblock", i);
+                }
                 if (inode_table < first_block ||
                     inode_table + sbi->s_itb_per_group - 1 > last_block) {
                         ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -3757,7 +3773,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
                         goto failed_mount2;
                 }
         }
-        if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
+        if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
                 ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
                 ret = -EFSCORRUPTED;
                 goto failed_mount2;
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 39e9cfb1b371..2eb935ca5d9e 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1353,15 +1353,19 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize,
         size_t min_offs, free;
         int total_ino;
         void *base, *start, *end;
-        int extra_isize = 0, error = 0, tried_min_extra_isize = 0;
+        int error = 0, tried_min_extra_isize = 0;
         int s_min_extra_isize = le16_to_cpu(EXT4_SB(inode->i_sb)->s_es->s_min_extra_isize);
+        int isize_diff; /* How much do we need to grow i_extra_isize */
 
         down_write(&EXT4_I(inode)->xattr_sem);
+        /*
+         * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
+         */
+        ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
 retry:
-        if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
-                up_write(&EXT4_I(inode)->xattr_sem);
-                return 0;
-        }
+        isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
+        if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
+                goto out;
 
         header = IHDR(inode, raw_inode);
         entry = IFIRST(header);
@@ -1382,7 +1386,7 @@ retry:
                 goto cleanup;
 
         free = ext4_xattr_free_space(last, &min_offs, base, &total_ino);
-        if (free >= new_extra_isize) {
+        if (free >= isize_diff) {
                 entry = IFIRST(header);
                 ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize
                                 - new_extra_isize, (void *)raw_inode +
@@ -1390,8 +1394,7 @@ retry:
                                 (void *)header, total_ino,
                                 inode->i_sb->s_blocksize);
                 EXT4_I(inode)->i_extra_isize = new_extra_isize;
-                error = 0;
-                goto cleanup;
+                goto out;
         }
 
         /*
@@ -1414,7 +1417,7 @@ retry:
                 end = bh->b_data + bh->b_size;
                 min_offs = end - base;
                 free = ext4_xattr_free_space(first, &min_offs, base, NULL);
-                if (free < new_extra_isize) {
+                if (free < isize_diff) {
                         if (!tried_min_extra_isize && s_min_extra_isize) {
                                 tried_min_extra_isize++;
                                 new_extra_isize = s_min_extra_isize;
@@ -1428,7 +1431,7 @@ retry:
                 free = inode->i_sb->s_blocksize;
         }
 
-        while (new_extra_isize > 0) {
+        while (isize_diff > 0) {
                 size_t offs, size, entry_size;
                 struct ext4_xattr_entry *small_entry = NULL;
                 struct ext4_xattr_info i = {
@@ -1459,7 +1462,7 @@ retry:
                         EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
                                         EXT4_XATTR_LEN(last->e_name_len);
                         if (total_size <= free && total_size < min_total_size) {
-                                if (total_size < new_extra_isize) {
+                                if (total_size < isize_diff) {
                                         small_entry = last;
                                 } else {
                                         entry = last;
@@ -1514,22 +1517,22 @@ retry:
                 error = ext4_xattr_ibody_set(handle, inode, &i, is);
                 if (error)
                         goto cleanup;
+                total_ino -= entry_size;
 
                 entry = IFIRST(header);
-                if (entry_size + EXT4_XATTR_SIZE(size) >= new_extra_isize)
-                        shift_bytes = new_extra_isize;
+                if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff)
+                        shift_bytes = isize_diff;
                 else
-                        shift_bytes = entry_size + size;
+                        shift_bytes = entry_size + EXT4_XATTR_SIZE(size);
                 /* Adjust the offsets and shift the remaining entries ahead */
-                ext4_xattr_shift_entries(entry, EXT4_I(inode)->i_extra_isize -
-                        shift_bytes, (void *)raw_inode +
-                        EXT4_GOOD_OLD_INODE_SIZE + extra_isize + shift_bytes,
-                        (void *)header, total_ino - entry_size,
-                        inode->i_sb->s_blocksize);
+                ext4_xattr_shift_entries(entry, -shift_bytes,
+                        (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
+                        EXT4_I(inode)->i_extra_isize + shift_bytes,
+                        (void *)header, total_ino, inode->i_sb->s_blocksize);
 
-                extra_isize += shift_bytes;
-                new_extra_isize -= shift_bytes;
-                EXT4_I(inode)->i_extra_isize = extra_isize;
+                isize_diff -= shift_bytes;
+                EXT4_I(inode)->i_extra_isize += shift_bytes;
+                header = IHDR(inode, raw_inode);
 
                 i.name = b_entry_name;
                 i.value = buffer;
@@ -1551,6 +1554,8 @@ retry:
                 kfree(bs);
         }
         brelse(bh);
+out:
+        ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
         up_write(&EXT4_I(inode)->xattr_sem);
         return 0;
 
@@ -1562,6 +1567,10 @@ cleanup:
         kfree(is);
         kfree(bs);
         brelse(bh);
+        /*
+         * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
+         * size expansion failed.
+         */
         up_write(&EXT4_I(inode)->xattr_sem);
         return error;
 }
diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h
index 69dd3e6566e0..a92e783fa057 100644
--- a/fs/ext4/xattr.h
+++ b/fs/ext4/xattr.h
@@ -24,6 +24,7 @@
 #define EXT4_XATTR_INDEX_SYSTEM                 7
 #define EXT4_XATTR_INDEX_RICHACL                8
 #define EXT4_XATTR_INDEX_ENCRYPTION             9
+#define EXT4_XATTR_INDEX_HURD                   10 /* Reserved for Hurd */
 
 struct ext4_xattr_header {
         __le32  h_magic;        /* magic number for identification */
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index d64d2a515cb2..ccb401eebc11 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1699,11 +1699,11 @@ static int f2fs_write_end(struct file *file,
         trace_f2fs_write_end(inode, pos, len, copied);
 
         set_page_dirty(page);
-        f2fs_put_page(page, 1);
 
         if (pos + copied > i_size_read(inode))
                 f2fs_i_size_write(inode, pos + copied);
 
+        f2fs_put_page(page, 1);
         f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
         return copied;
 }
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 675fa79d86f6..14f5fe2b841e 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -538,7 +538,7 @@ struct f2fs_nm_info {
         /* NAT cache management */
         struct radix_tree_root nat_root;/* root of the nat entry cache */
         struct radix_tree_root nat_set_root;/* root of the nat set cache */
-        struct percpu_rw_semaphore nat_tree_lock;       /* protect nat_tree_lock */
+        struct rw_semaphore nat_tree_lock;      /* protect nat_tree_lock */
         struct list_head nat_entries;   /* cached nat entry list (clean) */
         unsigned int nat_cnt;           /* the # of cached nat entries */
         unsigned int dirty_nat_cnt;     /* total num of nat entries in set */
@@ -787,7 +787,7 @@ struct f2fs_sb_info {
         struct f2fs_checkpoint *ckpt;           /* raw checkpoint pointer */
         struct inode *meta_inode;               /* cache meta blocks */
         struct mutex cp_mutex;                  /* checkpoint procedure lock */
-        struct percpu_rw_semaphore cp_rwsem;            /* blocking FS operations */
+        struct rw_semaphore cp_rwsem;           /* blocking FS operations */
         struct rw_semaphore node_write;         /* locking node writes */
         wait_queue_head_t cp_wait;
         unsigned long last_time[MAX_TIME];      /* to store time in jiffies */
@@ -1074,22 +1074,22 @@ static inline void clear_ckpt_flags(struct f2fs_checkpoint *cp, unsigned int f)
 
 static inline void f2fs_lock_op(struct f2fs_sb_info *sbi)
 {
-        percpu_down_read(&sbi->cp_rwsem);
+        down_read(&sbi->cp_rwsem);
 }
 
 static inline void f2fs_unlock_op(struct f2fs_sb_info *sbi)
 {
-        percpu_up_read(&sbi->cp_rwsem);
+        up_read(&sbi->cp_rwsem);
 }
 
 static inline void f2fs_lock_all(struct f2fs_sb_info *sbi)
 {
-        percpu_down_write(&sbi->cp_rwsem);
+        down_write(&sbi->cp_rwsem);
 }
 
 static inline void f2fs_unlock_all(struct f2fs_sb_info *sbi)
 {
-        percpu_up_write(&sbi->cp_rwsem);
+        up_write(&sbi->cp_rwsem);
 }
 
 static inline int __get_cp_reason(struct f2fs_sb_info *sbi)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 0e493f63ea41..28f4f4cbb8d8 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1757,21 +1757,14 @@ static int f2fs_ioc_set_encryption_policy(struct file *filp, unsigned long arg)
 {
         struct fscrypt_policy policy;
         struct inode *inode = file_inode(filp);
-        int ret;
 
         if (copy_from_user(&policy, (struct fscrypt_policy __user *)arg,
                                                         sizeof(policy)))
                 return -EFAULT;
 
-        ret = mnt_want_write_file(filp);
-        if (ret)
-                return ret;
-
         f2fs_update_time(F2FS_I_SB(inode), REQ_TIME);
-        ret = fscrypt_process_policy(inode, &policy);
 
-        mnt_drop_write_file(filp);
-        return ret;
+        return fscrypt_process_policy(filp, &policy);
 }
 
 static int f2fs_ioc_get_encryption_policy(struct file *filp, unsigned long arg)
@@ -2086,15 +2079,19 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
         if (unlikely(f2fs_readonly(src->i_sb)))
                 return -EROFS;
 
-        if (S_ISDIR(src->i_mode) || S_ISDIR(dst->i_mode))
-                return -EISDIR;
+        if (!S_ISREG(src->i_mode) || !S_ISREG(dst->i_mode))
+                return -EINVAL;
 
         if (f2fs_encrypted_inode(src) || f2fs_encrypted_inode(dst))
                 return -EOPNOTSUPP;
 
         inode_lock(src);
-        if (src != dst)
-                inode_lock(dst);
+        if (src != dst) {
+                if (!inode_trylock(dst)) {
+                        ret = -EBUSY;
+                        goto out;
+                }
+        }
 
         ret = -EINVAL;
         if (pos_in + len > src->i_size || pos_in + len < pos_in)
@@ -2152,6 +2149,7 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
 out_unlock:
         if (src != dst)
                 inode_unlock(dst);
+out:
         inode_unlock(src);
         return ret;
 }
diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
index b2fa4b615925..f75d197d5beb 100644
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -206,14 +206,14 @@ int need_dentry_mark(struct f2fs_sb_info *sbi, nid_t nid)
         struct nat_entry *e;
         bool need = false;
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, nid);
         if (e) {
                 if (!get_nat_flag(e, IS_CHECKPOINTED) &&
                                 !get_nat_flag(e, HAS_FSYNCED_INODE))
                         need = true;
         }
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         return need;
 }
 
@@ -223,11 +223,11 @@ bool is_checkpointed_node(struct f2fs_sb_info *sbi, nid_t nid)
         struct nat_entry *e;
         bool is_cp = true;
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, nid);
         if (e && !get_nat_flag(e, IS_CHECKPOINTED))
                 is_cp = false;
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         return is_cp;
 }
 
@@ -237,13 +237,13 @@ bool need_inode_block_update(struct f2fs_sb_info *sbi, nid_t ino)
         struct nat_entry *e;
         bool need_update = true;
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, ino);
         if (e && get_nat_flag(e, HAS_LAST_FSYNC) &&
                         (get_nat_flag(e, IS_CHECKPOINTED) ||
                          get_nat_flag(e, HAS_FSYNCED_INODE)))
                 need_update = false;
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         return need_update;
 }
 
@@ -284,7 +284,7 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         struct nat_entry *e;
 
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, ni->nid);
         if (!e) {
                 e = grab_nat_entry(nm_i, ni->nid);
@@ -334,7 +334,7 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
                         set_nat_flag(e, HAS_FSYNCED_INODE, true);
                 set_nat_flag(e, HAS_LAST_FSYNC, fsync_done);
         }
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 }
 
 int try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink)
@@ -342,7 +342,8 @@ int try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink)
         struct f2fs_nm_info *nm_i = NM_I(sbi);
         int nr = nr_shrink;
 
-        percpu_down_write(&nm_i->nat_tree_lock);
+        if (!down_write_trylock(&nm_i->nat_tree_lock))
+                return 0;
 
         while (nr_shrink && !list_empty(&nm_i->nat_entries)) {
                 struct nat_entry *ne;
@@ -351,7 +352,7 @@ int try_to_free_nats(struct f2fs_sb_info *sbi, int nr_shrink)
                 __del_from_nat_cache(nm_i, ne);
                 nr_shrink--;
         }
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
         return nr - nr_shrink;
 }
 
@@ -373,13 +374,13 @@ void get_node_info(struct f2fs_sb_info *sbi, nid_t nid, struct node_info *ni)
         ni->nid = nid;
 
         /* Check nat cache */
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
         e = __lookup_nat_cache(nm_i, nid);
         if (e) {
                 ni->ino = nat_get_ino(e);
                 ni->blk_addr = nat_get_blkaddr(e);
                 ni->version = nat_get_version(e);
-                percpu_up_read(&nm_i->nat_tree_lock);
+                up_read(&nm_i->nat_tree_lock);
                 return;
         }
 
@@ -403,11 +404,11 @@ void get_node_info(struct f2fs_sb_info *sbi, nid_t nid, struct node_info *ni)
         node_info_from_raw_nat(ni, &ne);
         f2fs_put_page(page, 1);
 cache:
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
         /* cache nat entry */
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
         cache_nat_entry(sbi, nid, &ne);
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 }
 
 /*
@@ -1788,7 +1789,7 @@ void build_free_nids(struct f2fs_sb_info *sbi)
         ra_meta_pages(sbi, NAT_BLOCK_OFFSET(nid), FREE_NID_PAGES,
                                                         META_NAT, true);
 
-        percpu_down_read(&nm_i->nat_tree_lock);
+        down_read(&nm_i->nat_tree_lock);
 
         while (1) {
                 struct page *page = get_current_nat_page(sbi, nid);
@@ -1820,7 +1821,7 @@ void build_free_nids(struct f2fs_sb_info *sbi)
                         remove_free_nid(nm_i, nid);
         }
         up_read(&curseg->journal_rwsem);
-        percpu_up_read(&nm_i->nat_tree_lock);
+        up_read(&nm_i->nat_tree_lock);
 
         ra_meta_pages(sbi, NAT_BLOCK_OFFSET(nm_i->next_scan_nid),
                                         nm_i->ra_nid_pages, META_NAT, false);
@@ -2209,7 +2210,7 @@ void flush_nat_entries(struct f2fs_sb_info *sbi)
         if (!nm_i->dirty_nat_cnt)
                 return;
 
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
 
         /*
          * if there are no enough space in journal to store dirty nat
@@ -2232,7 +2233,7 @@ void flush_nat_entries(struct f2fs_sb_info *sbi)
         list_for_each_entry_safe(set, tmp, &sets, set_list)
                 __flush_nat_entry_set(sbi, set);
 
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 
         f2fs_bug_on(sbi, nm_i->dirty_nat_cnt);
 }
@@ -2268,8 +2269,7 @@ static int init_node_manager(struct f2fs_sb_info *sbi)
 
         mutex_init(&nm_i->build_lock);
         spin_lock_init(&nm_i->free_nid_list_lock);
-        if (percpu_init_rwsem(&nm_i->nat_tree_lock))
-                return -ENOMEM;
+        init_rwsem(&nm_i->nat_tree_lock);
 
         nm_i->next_scan_nid = le32_to_cpu(sbi->ckpt->next_free_nid);
         nm_i->bitmap_size = __bitmap_size(sbi, NAT_BITMAP);
@@ -2326,7 +2326,7 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
         spin_unlock(&nm_i->free_nid_list_lock);
 
         /* destroy nat cache */
-        percpu_down_write(&nm_i->nat_tree_lock);
+        down_write(&nm_i->nat_tree_lock);
         while ((found = __gang_lookup_nat_cache(nm_i,
                                         nid, NATVEC_SIZE, natvec))) {
                 unsigned idx;
@@ -2351,9 +2351,8 @@ void destroy_node_manager(struct f2fs_sb_info *sbi)
                         kmem_cache_free(nat_entry_set_slab, setvec[idx]);
                 }
         }
-        percpu_up_write(&nm_i->nat_tree_lock);
+        up_write(&nm_i->nat_tree_lock);
 
-        percpu_free_rwsem(&nm_i->nat_tree_lock);
         kfree(nm_i->nat_bitmap);
         sbi->nm_info = NULL;
         kfree(nm_i);
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 1b86d3f638ef..7f863a645ab1 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -706,8 +706,6 @@ static void destroy_percpu_info(struct f2fs_sb_info *sbi)
                 percpu_counter_destroy(&sbi->nr_pages[i]);
         percpu_counter_destroy(&sbi->alloc_valid_block_count);
         percpu_counter_destroy(&sbi->total_valid_inode_count);
-
-        percpu_free_rwsem(&sbi->cp_rwsem);
 }
 
 static void f2fs_put_super(struct super_block *sb)
@@ -1483,9 +1481,6 @@ static int init_percpu_info(struct f2fs_sb_info *sbi)
 {
         int i, err;
 
-        if (percpu_init_rwsem(&sbi->cp_rwsem))
-                return -ENOMEM;
-
         for (i = 0; i < NR_COUNT_TYPE; i++) {
                 err = percpu_counter_init(&sbi->nr_pages[i], 0, GFP_KERNEL);
                 if (err)
@@ -1686,6 +1681,7 @@ try_onemore:
                 sbi->write_io[i].bio = NULL;
         }
 
+        init_rwsem(&sbi->cp_rwsem);
         init_waitqueue_head(&sbi->cp_wait);
         init_sb_info(sbi);
 
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 4d09d4441e3e..05713a5da083 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -1949,6 +1949,12 @@ void wakeup_flusher_threads(long nr_pages, enum wb_reason reason)
 {
         struct backing_dev_info *bdi;
 
+        /*
+         * If we are expecting writeback progress we must submit plugged IO.
+         */
+        if (blk_needs_flush_plug(current))
+                blk_schedule_flush_plug(current);
+
         if (!nr_pages)
                 nr_pages = get_nr_dirty_pages();
 
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index f394aff59c36..3988b43c2f5a 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -530,13 +530,13 @@ void fuse_read_fill(struct fuse_req *req, struct file *file, loff_t pos,
         req->out.args[0].size = count;
 }
 
-static void fuse_release_user_pages(struct fuse_req *req, int write)
+static void fuse_release_user_pages(struct fuse_req *req, bool should_dirty)
 {
         unsigned i;
 
         for (i = 0; i < req->num_pages; i++) {
                 struct page *page = req->pages[i];
-                if (write)
+                if (should_dirty)
                         set_page_dirty_lock(page);
                 put_page(page);
         }
@@ -1320,6 +1320,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                        loff_t *ppos, int flags)
 {
         int write = flags & FUSE_DIO_WRITE;
+        bool should_dirty = !write && iter_is_iovec(iter);
         int cuse = flags & FUSE_DIO_CUSE;
         struct file *file = io->file;
         struct inode *inode = file->f_mapping->host;
@@ -1363,7 +1364,7 @@ ssize_t fuse_direct_io(struct fuse_io_priv *io, struct iov_iter *iter,
                         nres = fuse_send_read(req, io, pos, nbytes, owner);
 
                 if (!io->async)
-                        fuse_release_user_pages(req, !write);
+                        fuse_release_user_pages(req, should_dirty);
                 if (req->out.h.error) {
                         err = req->out.h.error;
                         break;
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 0f56deb24ce6..c415668c86d4 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -568,7 +568,7 @@ static int ioctl_fsthaw(struct file *filp)
         return thaw_super(sb);
 }
 
-static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
+static int ioctl_file_dedupe_range(struct file *file, void __user *arg)
 {
         struct file_dedupe_range __user *argp = arg;
         struct file_dedupe_range *same = NULL;
@@ -582,6 +582,10 @@ static long ioctl_file_dedupe_range(struct file *file, void __user *arg)
         }
 
         size = offsetof(struct file_dedupe_range __user, info[count]);
+        if (size > PAGE_SIZE) {
+                ret = -ENOMEM;
+                goto out;
+        }
 
         same = memdup_user(argp, size);
         if (IS_ERR(same)) {
diff --git a/fs/iomap.c b/fs/iomap.c
index 48141b8eff5f..706270f21b35 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -84,8 +84,11 @@ iomap_apply(struct inode *inode, loff_t pos, loff_t length, unsigned flags,
          * Now the data has been copied, commit the range we've copied.  This
          * should not fail unless the filesystem has had a fatal error.
          */
-        ret = ops->iomap_end(inode, pos, length, written > 0 ? written : 0,
-                        flags, &iomap);
+        if (ops->iomap_end) {
+                ret = ops->iomap_end(inode, pos, length,
+                                     written > 0 ? written : 0,
+                                     flags, &iomap);
+        }
 
         return written ? written : ret;
 }
@@ -194,12 +197,9 @@ again:
                 if (mapping_writably_mapped(inode->i_mapping))
                         flush_dcache_page(page);
 
-                pagefault_disable();
                 copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
-                pagefault_enable();
 
                 flush_dcache_page(page);
-                mark_page_accessed(page);
 
                 status = iomap_write_end(inode, pos, bytes, copied, page);
                 if (unlikely(status < 0))
@@ -428,9 +428,12 @@ static int iomap_to_fiemap(struct fiemap_extent_info *fi,
                 break;
         }
 
+        if (iomap->flags & IOMAP_F_MERGED)
+                flags |= FIEMAP_EXTENT_MERGED;
+
         return fiemap_fill_next_extent(fi, iomap->offset,
                         iomap->blkno != IOMAP_NULL_BLOCK ? iomap->blkno << 9: 0,
-                        iomap->length, flags | FIEMAP_EXTENT_MERGED);
+                        iomap->length, flags);
 
 }
 
@@ -470,13 +473,18 @@ int iomap_fiemap(struct inode *inode, struct fiemap_extent_info *fi,
         if (ret)
                 return ret;
 
-        ret = filemap_write_and_wait(inode->i_mapping);
-        if (ret)
-                return ret;
+        if (fi->fi_flags & FIEMAP_FLAG_SYNC) {
+                ret = filemap_write_and_wait(inode->i_mapping);
+                if (ret)
+                        return ret;
+        }
 
         while (len > 0) {
                 ret = iomap_apply(inode, start, len, 0, ops, &ctx,
                                 iomap_fiemap_actor);
+                /* inode with no (attribute) mapping will give ENOENT */
+                if (ret == -ENOENT)
+                        break;
                 if (ret < 0)
                         return ret;
                 if (ret == 0)
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index e1574008adc9..2bcb86e6e6ca 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -840,21 +840,35 @@ repeat:
         mutex_lock(&kernfs_mutex);
 
         list_for_each_entry(info, &kernfs_root(kn)->supers, node) {
+                struct kernfs_node *parent;
                 struct inode *inode;
-                struct dentry *dentry;
 
+                /*
+                 * We want fsnotify_modify() on @kn but as the
+                 * modifications aren't originating from userland don't
+                 * have the matching @file available.  Look up the inodes
+                 * and generate the events manually.
+                 */
                 inode = ilookup(info->sb, kn->ino);
                 if (!inode)
                         continue;
 
-                dentry = d_find_any_alias(inode);
-                if (dentry) {
-                        fsnotify_parent(NULL, dentry, FS_MODIFY);
-                        fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
-                                 NULL, 0);
-                        dput(dentry);
+                parent = kernfs_get_parent(kn);
+                if (parent) {
+                        struct inode *p_inode;
+
+                        p_inode = ilookup(info->sb, parent->ino);
+                        if (p_inode) {
+                                fsnotify(p_inode, FS_MODIFY | FS_EVENT_ON_CHILD,
+                                         inode, FSNOTIFY_EVENT_INODE, kn->name, 0);
+                                iput(p_inode);
+                        }
+
+                        kernfs_put(parent);
                 }
 
+                fsnotify(inode, FS_MODIFY, inode, FSNOTIFY_EVENT_INODE,
+                         kn->name, 0);
                 iput(inode);
         }
 
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index f55a4e756047..217847679f0e 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -346,7 +346,7 @@ static void bl_write_cleanup(struct work_struct *work)
                         PAGE_SIZE - 1) & (loff_t)PAGE_MASK;
 
                 ext_tree_mark_written(bl, start >> SECTOR_SHIFT,
-                                        (end - start) >> SECTOR_SHIFT);
+                                        (end - start) >> SECTOR_SHIFT, end);
         }
 
         pnfs_ld_write_done(hdr);
diff --git a/fs/nfs/blocklayout/blocklayout.h b/fs/nfs/blocklayout/blocklayout.h
index 18e6fd0b9506..efc007f00742 100644
--- a/fs/nfs/blocklayout/blocklayout.h
+++ b/fs/nfs/blocklayout/blocklayout.h
@@ -141,6 +141,7 @@ struct pnfs_block_layout {
         struct rb_root          bl_ext_ro;
         spinlock_t              bl_ext_lock;   /* Protects list manipulation */
         bool                    bl_scsi_layout;
+        u64                     bl_lwb;
 };
 
 static inline struct pnfs_block_layout *
@@ -182,7 +183,7 @@ int ext_tree_insert(struct pnfs_block_layout *bl,
 int ext_tree_remove(struct pnfs_block_layout *bl, bool rw, sector_t start,
                 sector_t end);
 int ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
-                sector_t len);
+                sector_t len, u64 lwb);
 bool ext_tree_lookup(struct pnfs_block_layout *bl, sector_t isect,
                 struct pnfs_block_extent *ret, bool rw);
 int ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg);
diff --git a/fs/nfs/blocklayout/extent_tree.c b/fs/nfs/blocklayout/extent_tree.c
index 992bcb19c11e..c85fbfd2d0d9 100644
--- a/fs/nfs/blocklayout/extent_tree.c
+++ b/fs/nfs/blocklayout/extent_tree.c
@@ -402,7 +402,7 @@ ext_tree_split(struct rb_root *root, struct pnfs_block_extent *be,
 
 int
 ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
-                sector_t len)
+                sector_t len, u64 lwb)
 {
         struct rb_root *root = &bl->bl_ext_rw;
         sector_t end = start + len;
@@ -471,6 +471,8 @@ ext_tree_mark_written(struct pnfs_block_layout *bl, sector_t start,
                 }
         }
 out:
+        if (bl->bl_lwb < lwb)
+                bl->bl_lwb = lwb;
         spin_unlock(&bl->bl_ext_lock);
 
         __ext_put_deviceids(&tmp);
@@ -518,7 +520,7 @@ static __be32 *encode_scsi_range(struct pnfs_block_extent *be, __be32 *p)
 }
 
 static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p,
-                size_t buffer_size, size_t *count)
+                size_t buffer_size, size_t *count, __u64 *lastbyte)
 {
         struct pnfs_block_extent *be;
         int ret = 0;
@@ -542,6 +544,8 @@ static int ext_tree_encode_commit(struct pnfs_block_layout *bl, __be32 *p,
                         p = encode_block_extent(be, p);
                 be->be_tag = EXTENT_COMMITTING;
         }
+        *lastbyte = bl->bl_lwb - 1;
+        bl->bl_lwb = 0;
         spin_unlock(&bl->bl_ext_lock);
 
         return ret;
@@ -564,7 +568,7 @@ ext_tree_prepare_commit(struct nfs4_layoutcommit_args *arg)
         arg->layoutupdate_pages = &arg->layoutupdate_page;
 
 retry:
-        ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count);
+        ret = ext_tree_encode_commit(bl, start_p + 1, buffer_size, &count, &arg->lastbytewritten);
         if (unlikely(ret)) {
                 ext_tree_free_commitdata(arg, buffer_size);
 
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index a7f2e6e33305..52a28311e2a4 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -275,6 +275,7 @@ static int nfs_callback_up_net(int minorversion, struct svc_serv *serv,
 err_socks:
         svc_rpcb_cleanup(serv, net);
 err_bind:
+        nn->cb_users[minorversion]--;
         dprintk("NFS: Couldn't create callback socket: err = %d; "
                         "net = %p\n", ret, net);
         return ret;
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index c92a75e066a6..f953ef6b2f2e 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -454,11 +454,8 @@ static bool referring_call_exists(struct nfs_client *clp,
                                 ((u32 *)&rclist->rcl_sessionid.data)[3],
                                 ref->rc_sequenceid, ref->rc_slotid);
 
-                        spin_lock(&tbl->slot_tbl_lock);
-                        status = (test_bit(ref->rc_slotid, tbl->used_slots) &&
-                                  tbl->slots[ref->rc_slotid].seq_nr ==
-                                        ref->rc_sequenceid);
-                        spin_unlock(&tbl->slot_tbl_lock);
+                        status = nfs4_slot_wait_on_seqid(tbl, ref->rc_slotid,
+                                        ref->rc_sequenceid, HZ >> 1) < 0;
                         if (status)
                                 goto out;
                 }
@@ -487,7 +484,6 @@ __be32 nfs4_callback_sequence(struct cb_sequenceargs *args,
                 goto out;
 
         tbl = &clp->cl_session->bc_slot_table;
-        slot = tbl->slots + args->csa_slotid;
 
         /* Set up res before grabbing the spinlock */
         memcpy(&res->csr_sessionid, &args->csa_sessionid,
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 003ebce4bbc4..1e106780a237 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -426,7 +426,7 @@ EXPORT_SYMBOL_GPL(nfs_mark_client_ready);
  * Initialise the timeout values for a connection
  */
 void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
-                                    unsigned int timeo, unsigned int retrans)
+                                    int timeo, int retrans)
 {
         to->to_initval = timeo * HZ / 10;
         to->to_retries = retrans;
@@ -434,9 +434,9 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
         switch (proto) {
         case XPRT_TRANSPORT_TCP:
         case XPRT_TRANSPORT_RDMA:
-                if (to->to_retries == 0)
+                if (retrans == NFS_UNSPEC_RETRANS)
                         to->to_retries = NFS_DEF_TCP_RETRANS;
-                if (to->to_initval == 0)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_retries == 0)
                         to->to_initval = NFS_DEF_TCP_TIMEO * HZ / 10;
                 if (to->to_initval > NFS_MAX_TCP_TIMEOUT)
                         to->to_initval = NFS_MAX_TCP_TIMEOUT;
@@ -449,9 +449,9 @@ void nfs_init_timeout_values(struct rpc_timeout *to, int proto,
                 to->to_exponential = 0;
                 break;
         case XPRT_TRANSPORT_UDP:
-                if (to->to_retries == 0)
+                if (retrans == NFS_UNSPEC_RETRANS)
                         to->to_retries = NFS_DEF_UDP_RETRANS;
-                if (!to->to_initval)
+                if (timeo == NFS_UNSPEC_TIMEO || to->to_initval == 0)
                         to->to_initval = NFS_DEF_UDP_TIMEO * HZ / 10;
                 if (to->to_initval > NFS_MAX_UDP_TIMEOUT)
                         to->to_initval = NFS_MAX_UDP_TIMEOUT;
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 7d620970f2e1..ca699ddc11c1 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -657,7 +657,10 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from)
         if (result <= 0)
                 goto out;
 
-        written = generic_write_sync(iocb, result);
+        result = generic_write_sync(iocb, result);
+        if (result < 0)
+                goto out;
+        written = result;
         iocb->ki_pos += written;
 
         /* Return error values */
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index e6206eaf2bdf..51b51369704c 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
         if (ffl) {
                 INIT_LIST_HEAD(&ffl->error_list);
                 INIT_LIST_HEAD(&ffl->mirrors);
+                ffl->last_report_time = ktime_get();
                 return &ffl->generic_hdr;
         } else
                 return NULL;
@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_ff_layout_mirror *mirror,
 {
         static const ktime_t notime = {0};
         s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
+        struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
 
         nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
         if (ktime_equal(mirror->start_time, notime))
                 mirror->start_time = now;
-        if (ktime_equal(mirror->last_report_time, notime))
-                mirror->last_report_time = now;
         if (mirror->report_interval != 0)
                 report_interval = (s64)mirror->report_interval * 1000LL;
         else if (layoutstats_timer != 0)
                 report_interval = (s64)layoutstats_timer * 1000LL;
-        if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
+        if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
                         report_interval) {
-                mirror->last_report_time = now;
+                ffl->last_report_time = now;
                 return true;
         }
 
@@ -806,11 +806,14 @@ ff_layout_choose_best_ds_for_read(struct pnfs_layout_segment *lseg,
 {
         struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
         struct nfs4_pnfs_ds *ds;
+        bool fail_return = false;
         int idx;
 
         /* mirrors are sorted by efficiency */
         for (idx = start_idx; idx < fls->mirror_array_cnt; idx++) {
-                ds = nfs4_ff_layout_prepare_ds(lseg, idx, false);
+                if (idx+1 == fls->mirror_array_cnt)
+                        fail_return = true;
+                ds = nfs4_ff_layout_prepare_ds(lseg, idx, fail_return);
                 if (ds) {
                         *best_idx = idx;
                         return ds;
@@ -859,6 +862,7 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
         struct nfs4_pnfs_ds *ds;
         int ds_idx;
 
+retry:
         /* Use full layout for now */
         if (!pgio->pg_lseg)
                 ff_layout_pg_get_read(pgio, req, false);
@@ -871,10 +875,13 @@ ff_layout_pg_init_read(struct nfs_pageio_descriptor *pgio,
 
         ds = ff_layout_choose_best_ds_for_read(pgio->pg_lseg, 0, &ds_idx);
         if (!ds) {
-                if (ff_layout_no_fallback_to_mds(pgio->pg_lseg))
-                        goto out_pnfs;
-                else
+                if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg))
                         goto out_mds;
+                pnfs_put_lseg(pgio->pg_lseg);
+                pgio->pg_lseg = NULL;
+                /* Sleep for 1 second before retrying */
+                ssleep(1);
+                goto retry;
         }
 
         mirror = FF_LAYOUT_COMP(pgio->pg_lseg, ds_idx);
@@ -890,12 +897,6 @@ out_mds:
         pnfs_put_lseg(pgio->pg_lseg);
         pgio->pg_lseg = NULL;
         nfs_pageio_reset_read_mds(pgio);
-        return;
-
-out_pnfs:
-        pnfs_set_lo_fail(pgio->pg_lseg);
-        pnfs_put_lseg(pgio->pg_lseg);
-        pgio->pg_lseg = NULL;
 }
 
 static void
@@ -909,6 +910,7 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
         int i;
         int status;
 
+retry:
         if (!pgio->pg_lseg) {
                 pgio->pg_lseg = pnfs_update_layout(pgio->pg_inode,
                                                    req->wb_context,
@@ -940,10 +942,13 @@ ff_layout_pg_init_write(struct nfs_pageio_descriptor *pgio,
         for (i = 0; i < pgio->pg_mirror_count; i++) {
                 ds = nfs4_ff_layout_prepare_ds(pgio->pg_lseg, i, true);
                 if (!ds) {
-                        if (ff_layout_no_fallback_to_mds(pgio->pg_lseg))
-                                goto out_pnfs;
-                        else
+                        if (!ff_layout_no_fallback_to_mds(pgio->pg_lseg))
                                 goto out_mds;
+                        pnfs_put_lseg(pgio->pg_lseg);
+                        pgio->pg_lseg = NULL;
+                        /* Sleep for 1 second before retrying */
+                        ssleep(1);
+                        goto retry;
                 }
                 pgm = &pgio->pg_mirrors[i];
                 mirror = FF_LAYOUT_COMP(pgio->pg_lseg, i);
@@ -956,12 +961,6 @@ out_mds:
         pnfs_put_lseg(pgio->pg_lseg);
         pgio->pg_lseg = NULL;
         nfs_pageio_reset_write_mds(pgio);
-        return;
-
-out_pnfs:
-        pnfs_set_lo_fail(pgio->pg_lseg);
-        pnfs_put_lseg(pgio->pg_lseg);
-        pgio->pg_lseg = NULL;
 }
 
 static unsigned int
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 1bcdb15d0c41..3ee0c9fcea76 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
         struct nfs4_ff_layoutstat       read_stat;
         struct nfs4_ff_layoutstat       write_stat;
         ktime_t                         start_time;
-        ktime_t                         last_report_time;
         u32                             report_interval;
 };
 
@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
         struct pnfs_ds_commit_info commit_info;
         struct list_head        mirrors;
         struct list_head        error_list; /* nfs4_ff_layout_ds_err */
+        ktime_t                 last_report_time; /* Layoutstat report times */
 };
 
 static inline struct nfs4_flexfile_layout *
diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
index 0aa36be71fce..f7a3f6b05369 100644
--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -17,8 +17,8 @@
 
 #define NFSDBG_FACILITY         NFSDBG_PNFS_LD
 
-static unsigned int dataserver_timeo = NFS4_DEF_DS_TIMEO;
-static unsigned int dataserver_retrans = NFS4_DEF_DS_RETRANS;
+static unsigned int dataserver_timeo = NFS_DEF_TCP_RETRANS;
+static unsigned int dataserver_retrans;
 
 void nfs4_ff_layout_put_deviceid(struct nfs4_ff_layout_ds *mirror_ds)
 {
@@ -379,7 +379,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
 
         devid = &mirror->mirror_ds->id_node;
         if (ff_layout_test_devid_unavailable(devid))
-                goto out;
+                goto out_fail;
 
         ds = mirror->mirror_ds->ds;
         /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
@@ -405,15 +405,16 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
                         mirror->mirror_ds->ds_versions[0].rsize = max_payload;
                 if (mirror->mirror_ds->ds_versions[0].wsize > max_payload)
                         mirror->mirror_ds->ds_versions[0].wsize = max_payload;
-        } else {
-                ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
-                                         mirror, lseg->pls_range.offset,
-                                         lseg->pls_range.length, NFS4ERR_NXIO,
-                                         OP_ILLEGAL, GFP_NOIO);
-                if (fail_return || !ff_layout_has_available_ds(lseg))
-                        pnfs_error_mark_layout_for_return(ino, lseg);
-                ds = NULL;
+                goto out;
         }
+        ff_layout_track_ds_error(FF_LAYOUT_FROM_HDR(lseg->pls_layout),
+                                 mirror, lseg->pls_range.offset,
+                                 lseg->pls_range.length, NFS4ERR_NXIO,
+                                 OP_ILLEGAL, GFP_NOIO);
+out_fail:
+        if (fail_return || !ff_layout_has_available_ds(lseg))
+                pnfs_error_mark_layout_for_return(ino, lseg);
+        ds = NULL;
 out:
         return ds;
 }
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 7ce5e023c3c3..74935a19e4bf 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -58,6 +58,9 @@ struct nfs_clone_mount {
  */
 #define NFS_UNSPEC_PORT         (-1)
 
+#define NFS_UNSPEC_RETRANS      (UINT_MAX)
+#define NFS_UNSPEC_TIMEO        (UINT_MAX)
+
 /*
  * Maximum number of pages that readdir can use for creating
  * a vmapped array of pages.
@@ -156,7 +159,7 @@ struct nfs_client *nfs_get_client(const struct nfs_client_initdata *,
 int nfs_probe_fsinfo(struct nfs_server *server, struct nfs_fh *, struct nfs_fattr *);
 void nfs_server_insert_lists(struct nfs_server *);
 void nfs_server_remove_lists(struct nfs_server *);
-void nfs_init_timeout_values(struct rpc_timeout *, int, unsigned int, unsigned int);
+void nfs_init_timeout_values(struct rpc_timeout *to, int proto, int timeo, int retrans);
 int nfs_init_server_rpcclient(struct nfs_server *, const struct rpc_timeout *t,
                 rpc_authflavor_t);
 struct nfs_server *nfs_alloc_server(void);
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 33da841a21bb..64b43b4ad9dd 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -318,10 +318,22 @@ static void
 nfs42_layoutstat_prepare(struct rpc_task *task, void *calldata)
 {
         struct nfs42_layoutstat_data *data = calldata;
-        struct nfs_server *server = NFS_SERVER(data->args.inode);
+        struct inode *inode = data->inode;
+        struct nfs_server *server = NFS_SERVER(inode);
+        struct pnfs_layout_hdr *lo;
 
+        spin_lock(&inode->i_lock);
+        lo = NFS_I(inode)->layout;
+        if (!pnfs_layout_is_valid(lo)) {
+                spin_unlock(&inode->i_lock);
+                rpc_exit(task, 0);
+                return;
+        }
+        nfs4_stateid_copy(&data->args.stateid, &lo->plh_stateid);
+        spin_unlock(&inode->i_lock);
         nfs41_setup_sequence(nfs4_get_session(server), &data->args.seq_args,
                              &data->res.seq_res, task);
+
 }
 
 static void
@@ -338,12 +350,14 @@ nfs42_layoutstat_done(struct rpc_task *task, void *calldata)
         case 0:
                 break;
         case -NFS4ERR_EXPIRED:
+        case -NFS4ERR_ADMIN_REVOKED:
+        case -NFS4ERR_DELEG_REVOKED:
         case -NFS4ERR_STALE_STATEID:
-        case -NFS4ERR_OLD_STATEID:
         case -NFS4ERR_BAD_STATEID:
                 spin_lock(&inode->i_lock);
                 lo = NFS_I(inode)->layout;
-                if (lo && nfs4_stateid_match(&data->args.stateid,
+                if (pnfs_layout_is_valid(lo) &&
+                    nfs4_stateid_match(&data->args.stateid,
                                              &lo->plh_stateid)) {
                         LIST_HEAD(head);
 
@@ -357,11 +371,23 @@ nfs42_layoutstat_done(struct rpc_task *task, void *calldata)
                 } else
                         spin_unlock(&inode->i_lock);
                 break;
+        case -NFS4ERR_OLD_STATEID:
+                spin_lock(&inode->i_lock);
+                lo = NFS_I(inode)->layout;
+                if (pnfs_layout_is_valid(lo) &&
+                    nfs4_stateid_match_other(&data->args.stateid,
+                                        &lo->plh_stateid)) {
+                        /* Do we need to delay before resending? */
+                        if (!nfs4_stateid_is_newer(&lo->plh_stateid,
+                                                &data->args.stateid))
+                                rpc_delay(task, HZ);
+                        rpc_restart_call_prepare(task);
+                }
+                spin_unlock(&inode->i_lock);
+                break;
         case -ENOTSUPP:
         case -EOPNOTSUPP:
                 NFS_SERVER(inode)->caps &= ~NFS_CAP_LAYOUTSTATS;
-        default:
-                break;
         }
 
         dprintk("%s server returns %d\n", __func__, task->tk_status);
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 324bfdc21250..9bf64eacba5b 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -396,6 +396,10 @@ extern void nfs4_schedule_state_renewal(struct nfs_client *);
 extern void nfs4_renewd_prepare_shutdown(struct nfs_server *);
 extern void nfs4_kill_renewd(struct nfs_client *);
 extern void nfs4_renew_state(struct work_struct *);
+extern void nfs4_set_lease_period(struct nfs_client *clp,
+                unsigned long lease,
+                unsigned long lastrenewed);
+
 
 /* nfs4state.c */
 struct rpc_cred *nfs4_get_clid_cred(struct nfs_client *clp);
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 8d7d08d4f95f..cd3b7cfdde16 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -817,6 +817,11 @@ static int nfs4_set_client(struct nfs_server *server,
                 goto error;
         }
 
+        if (server->nfs_client == clp) {
+                error = -ELOOP;
+                goto error;
+        }
+
         /*
          * Query for the lease time on clientid setup or renewal
          *
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a036e93bdf96..a9dec32ba9ba 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -634,15 +634,11 @@ out_sleep:
 }
 EXPORT_SYMBOL_GPL(nfs40_setup_sequence);
 
-static int nfs40_sequence_done(struct rpc_task *task,
-                               struct nfs4_sequence_res *res)
+static void nfs40_sequence_free_slot(struct nfs4_sequence_res *res)
 {
         struct nfs4_slot *slot = res->sr_slot;
         struct nfs4_slot_table *tbl;
 
-        if (slot == NULL)
-                goto out;
-
         tbl = slot->table;
         spin_lock(&tbl->slot_tbl_lock);
         if (!nfs41_wake_and_assign_slot(tbl, slot))
@@ -650,7 +646,13 @@ static int nfs40_sequence_done(struct rpc_task *task,
         spin_unlock(&tbl->slot_tbl_lock);
 
         res->sr_slot = NULL;
-out:
+}
+
+static int nfs40_sequence_done(struct rpc_task *task,
+                               struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL)
+                nfs40_sequence_free_slot(res);
         return 1;
 }
 
@@ -666,6 +668,11 @@ static void nfs41_sequence_free_slot(struct nfs4_sequence_res *res)
         tbl = slot->table;
         session = tbl->session;
 
+        /* Bump the slot sequence number */
+        if (slot->seq_done)
+                slot->seq_nr++;
+        slot->seq_done = 0;
+
         spin_lock(&tbl->slot_tbl_lock);
         /* Be nice to the server: try to ensure that the last transmitted
          * value for highest_user_slotid <= target_highest_slotid
@@ -686,9 +693,12 @@ out_unlock:
         res->sr_slot = NULL;
         if (send_new_highest_used_slotid)
                 nfs41_notify_server(session->clp);
+        if (waitqueue_active(&tbl->slot_waitq))
+                wake_up_all(&tbl->slot_waitq);
 }
 
-int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
+static int nfs41_sequence_process(struct rpc_task *task,
+                struct nfs4_sequence_res *res)
 {
         struct nfs4_session *session;
         struct nfs4_slot *slot = res->sr_slot;
@@ -714,7 +724,7 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
         switch (res->sr_status) {
         case 0:
                 /* Update the slot's sequence and clientid lease timer */
-                ++slot->seq_nr;
+                slot->seq_done = 1;
                 clp = session->clp;
                 do_renew_lease(clp, res->sr_timestamp);
                 /* Check sequence flags */
@@ -769,16 +779,16 @@ int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
                 goto retry_nowait;
         default:
                 /* Just update the slot sequence no. */
-                ++slot->seq_nr;
+                slot->seq_done = 1;
         }
 out:
         /* The session may be reset by one of the error handlers. */
         dprintk("%s: Error %d free the slot \n", __func__, res->sr_status);
-        nfs41_sequence_free_slot(res);
 out_noaction:
         return ret;
 retry_nowait:
         if (rpc_restart_call_prepare(task)) {
+                nfs41_sequence_free_slot(res);
                 task->tk_status = 0;
                 ret = 0;
         }
@@ -789,8 +799,37 @@ out_retry:
         rpc_delay(task, NFS4_POLL_RETRY_MAX);
         return 0;
 }
+
+int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        if (!nfs41_sequence_process(task, res))
+                return 0;
+        if (res->sr_slot != NULL)
+                nfs41_sequence_free_slot(res);
+        return 1;
+
+}
 EXPORT_SYMBOL_GPL(nfs41_sequence_done);
 
+static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot == NULL)
+                return 1;
+        if (res->sr_slot->table->session != NULL)
+                return nfs41_sequence_process(task, res);
+        return nfs40_sequence_done(task, res);
+}
+
+static void nfs4_sequence_free_slot(struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL) {
+                if (res->sr_slot->table->session != NULL)
+                        nfs41_sequence_free_slot(res);
+                else
+                        nfs40_sequence_free_slot(res);
+        }
+}
+
 int nfs4_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *res)
 {
         if (res->sr_slot == NULL)
@@ -920,6 +959,17 @@ static int nfs4_setup_sequence(const struct nfs_server *server,
                                     args, res, task);
 }
 
+static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res)
+{
+        return nfs40_sequence_done(task, res);
+}
+
+static void nfs4_sequence_free_slot(struct nfs4_sequence_res *res)
+{
+        if (res->sr_slot != NULL)
+                nfs40_sequence_free_slot(res);
+}
+
 int nfs4_sequence_done(struct rpc_task *task,
                        struct nfs4_sequence_res *res)
 {
@@ -1197,6 +1247,7 @@ static void nfs4_opendata_free(struct kref *kref)
         struct super_block *sb = p->dentry->d_sb;
 
         nfs_free_seqid(p->o_arg.seqid);
+        nfs4_sequence_free_slot(&p->o_res.seq_res);
         if (p->state != NULL)
                 nfs4_put_open_state(p->state);
         nfs4_put_state_owner(p->owner);
@@ -1656,9 +1707,14 @@ err:
 static struct nfs4_state *
 nfs4_opendata_to_nfs4_state(struct nfs4_opendata *data)
 {
+        struct nfs4_state *ret;
+
         if (data->o_arg.claim == NFS4_OPEN_CLAIM_PREVIOUS)
-                return _nfs4_opendata_reclaim_to_nfs4_state(data);
-        return _nfs4_opendata_to_nfs4_state(data);
+                ret =_nfs4_opendata_reclaim_to_nfs4_state(data);
+        else
+                ret = _nfs4_opendata_to_nfs4_state(data);
+        nfs4_sequence_free_slot(&data->o_res.seq_res);
+        return ret;
 }
 
 static struct nfs_open_context *nfs4_state_find_open_context(struct nfs4_state *state)
@@ -2056,7 +2112,7 @@ static void nfs4_open_done(struct rpc_task *task, void *calldata)
 
         data->rpc_status = task->tk_status;
 
-        if (!nfs4_sequence_done(task, &data->o_res.seq_res))
+        if (!nfs4_sequence_process(task, &data->o_res.seq_res))
                 return;
 
         if (task->tk_status == 0) {
@@ -4237,12 +4293,9 @@ static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, str
                 err = _nfs4_do_fsinfo(server, fhandle, fsinfo);
                 trace_nfs4_fsinfo(server, fhandle, fsinfo->fattr, err);
                 if (err == 0) {
-                        struct nfs_client *clp = server->nfs_client;
-
-                        spin_lock(&clp->cl_lock);
-                        clp->cl_lease_time = fsinfo->lease_time * HZ;
-                        clp->cl_last_renewal = now;
-                        spin_unlock(&clp->cl_lock);
+                        nfs4_set_lease_period(server->nfs_client,
+                                        fsinfo->lease_time * HZ,
+                                        now);
                         break;
                 }
                 err = nfs4_handle_exception(server, err, &exception);
@@ -7517,12 +7570,20 @@ static int _nfs4_proc_create_session(struct nfs_client *clp,
         status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         trace_nfs4_create_session(clp, status);
 
+        switch (status) {
+        case -NFS4ERR_STALE_CLIENTID:
+        case -NFS4ERR_DELAY:
+        case -ETIMEDOUT:
+        case -EACCES:
+        case -EAGAIN:
+                goto out;
+        };
+
+        clp->cl_seqid++;
         if (!status) {
                 /* Verify the session's negotiated channel_attrs values */
                 status = nfs4_verify_channel_attrs(&args, &res);
                 /* Increment the clientid slot sequence id */
-                if (clp->cl_seqid == res.seqid)
-                        clp->cl_seqid++;
                 if (status)
                         goto out;
                 nfs4_update_session(session, &res);
@@ -7867,7 +7928,7 @@ static void nfs4_layoutget_done(struct rpc_task *task, void *calldata)
         struct nfs4_layoutget *lgp = calldata;
 
         dprintk("--> %s\n", __func__);
-        nfs41_sequence_done(task, &lgp->res.seq_res);
+        nfs41_sequence_process(task, &lgp->res.seq_res);
         dprintk("<-- %s\n", __func__);
 }
 
@@ -8083,6 +8144,7 @@ nfs4_proc_layoutget(struct nfs4_layoutget *lgp, long *timeout, gfp_t gfp_flags)
         /* if layoutp->len is 0, nfs4_layoutget_prepare called rpc_exit */
         if (status == 0 && lgp->res.layoutp->len)
                 lseg = pnfs_layout_process(lgp);
+        nfs4_sequence_free_slot(&lgp->res.seq_res);
         rpc_put_task(task);
         dprintk("<-- %s status=%d\n", __func__, status);
         if (status)
@@ -8109,7 +8171,7 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
 
         dprintk("--> %s\n", __func__);
 
-        if (!nfs41_sequence_done(task, &lrp->res.seq_res))
+        if (!nfs41_sequence_process(task, &lrp->res.seq_res))
                 return;
 
         server = NFS_SERVER(lrp->args.inode);
@@ -8121,6 +8183,7 @@ static void nfs4_layoutreturn_done(struct rpc_task *task, void *calldata)
         case -NFS4ERR_DELAY:
                 if (nfs4_async_handle_error(task, server, NULL, NULL) != -EAGAIN)
                         break;
+                nfs4_sequence_free_slot(&lrp->res.seq_res);
                 rpc_restart_call_prepare(task);
                 return;
         }
@@ -8135,12 +8198,16 @@ static void nfs4_layoutreturn_release(void *calldata)
 
         dprintk("--> %s\n", __func__);
         spin_lock(&lo->plh_inode->i_lock);
-        pnfs_mark_matching_lsegs_invalid(lo, &freeme, &lrp->args.range,
-                        be32_to_cpu(lrp->args.stateid.seqid));
-        if (lrp->res.lrs_present && pnfs_layout_is_valid(lo))
+        if (lrp->res.lrs_present) {
+                pnfs_mark_matching_lsegs_invalid(lo, &freeme,
+                                &lrp->args.range,
+                                be32_to_cpu(lrp->args.stateid.seqid));
                 pnfs_set_layout_stateid(lo, &lrp->res.stateid, true);
+        } else
+                pnfs_mark_layout_stateid_invalid(lo, &freeme);
         pnfs_clear_layoutreturn_waitbit(lo);
         spin_unlock(&lo->plh_inode->i_lock);
+        nfs4_sequence_free_slot(&lrp->res.seq_res);
         pnfs_free_lseg_list(&freeme);
         pnfs_put_layout_hdr(lrp->args.layout);
         nfs_iput_and_deactive(lrp->inode);
diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
index e1ba58c3d1ad..82e77198d17e 100644
--- a/fs/nfs/nfs4renewd.c
+++ b/fs/nfs/nfs4renewd.c
@@ -136,6 +136,26 @@ nfs4_kill_renewd(struct nfs_client *clp)
         cancel_delayed_work_sync(&clp->cl_renewd);
 }
 
+/**
+ * nfs4_set_lease_period - Sets the lease period on a nfs_client
+ *
+ * @clp: pointer to nfs_client
+ * @lease: new value for lease period
+ * @lastrenewed: time at which lease was last renewed
+ */
+void nfs4_set_lease_period(struct nfs_client *clp,
+                unsigned long lease,
+                unsigned long lastrenewed)
+{
+        spin_lock(&clp->cl_lock);
+        clp->cl_lease_time = lease;
+        clp->cl_last_renewal = lastrenewed;
+        spin_unlock(&clp->cl_lock);
+
+        /* Cap maximum reconnect timeout at 1/2 lease period */
+        rpc_cap_max_reconnect_timeout(clp->cl_rpcclient, lease >> 1);
+}
+
 /*
  * Local variables:
  *   c-basic-offset: 8
diff --git a/fs/nfs/nfs4session.c b/fs/nfs/nfs4session.c
index 332d06e64fa9..b62973045a3e 100644
--- a/fs/nfs/nfs4session.c
+++ b/fs/nfs/nfs4session.c
@@ -28,6 +28,7 @@ static void nfs4_init_slot_table(struct nfs4_slot_table *tbl, const char *queue)
         tbl->highest_used_slotid = NFS4_NO_SLOT;
         spin_lock_init(&tbl->slot_tbl_lock);
         rpc_init_priority_wait_queue(&tbl->slot_tbl_waitq, queue);
+        init_waitqueue_head(&tbl->slot_waitq);
         init_completion(&tbl->complete);
 }
 
@@ -172,6 +173,58 @@ struct nfs4_slot *nfs4_lookup_slot(struct nfs4_slot_table *tbl, u32 slotid)
         return ERR_PTR(-E2BIG);
 }
 
+static int nfs4_slot_get_seqid(struct nfs4_slot_table  *tbl, u32 slotid,
+                u32 *seq_nr)
+        __must_hold(&tbl->slot_tbl_lock)
+{
+        struct nfs4_slot *slot;
+
+        slot = nfs4_lookup_slot(tbl, slotid);
+        if (IS_ERR(slot))
+                return PTR_ERR(slot);
+        *seq_nr = slot->seq_nr;
+        return 0;
+}
+
+/*
+ * nfs4_slot_seqid_in_use - test if a slot sequence id is still in use
+ *
+ * Given a slot table, slot id and sequence number, determine if the
+ * RPC call in question is still in flight. This function is mainly
+ * intended for use by the callback channel.
+ */
+static bool nfs4_slot_seqid_in_use(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr)
+{
+        u32 cur_seq;
+        bool ret = false;
+
+        spin_lock(&tbl->slot_tbl_lock);
+        if (nfs4_slot_get_seqid(tbl, slotid, &cur_seq) == 0 &&
+            cur_seq == seq_nr && test_bit(slotid, tbl->used_slots))
+                ret = true;
+        spin_unlock(&tbl->slot_tbl_lock);
+        return ret;
+}
+
+/*
+ * nfs4_slot_wait_on_seqid - wait until a slot sequence id is complete
+ *
+ * Given a slot table, slot id and sequence number, wait until the
+ * corresponding RPC call completes. This function is mainly
+ * intended for use by the callback channel.
+ */
+int nfs4_slot_wait_on_seqid(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr,
+                unsigned long timeout)
+{
+        if (wait_event_timeout(tbl->slot_waitq,
+                        !nfs4_slot_seqid_in_use(tbl, slotid, seq_nr),
+                        timeout) == 0)
+                return -ETIMEDOUT;
+        return 0;
+}
+
 /*
  * nfs4_alloc_slot - efficiently look for a free slot
  *
diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h
index 5b51298d1d03..f703b755351b 100644
--- a/fs/nfs/nfs4session.h
+++ b/fs/nfs/nfs4session.h
@@ -21,7 +21,8 @@ struct nfs4_slot {
         unsigned long           generation;
         u32                     slot_nr;
         u32                     seq_nr;
-        unsigned int            interrupted : 1;
+        unsigned int            interrupted : 1,
+                                seq_done : 1;
 };
 
 /* Sessions */
@@ -36,6 +37,7 @@ struct nfs4_slot_table {
         unsigned long   used_slots[SLOT_TABLE_SZ]; /* used/unused bitmap */
         spinlock_t      slot_tbl_lock;
         struct rpc_wait_queue   slot_tbl_waitq; /* allocators may wait here */
+        wait_queue_head_t       slot_waitq;     /* Completion wait on slot */
         u32             max_slots;              /* # slots in table */
         u32             max_slotid;             /* Max allowed slotid value */
         u32             highest_used_slotid;    /* sent to server on each SEQ.
@@ -78,6 +80,9 @@ extern int nfs4_setup_slot_table(struct nfs4_slot_table *tbl,
 extern void nfs4_shutdown_slot_table(struct nfs4_slot_table *tbl);
 extern struct nfs4_slot *nfs4_alloc_slot(struct nfs4_slot_table *tbl);
 extern struct nfs4_slot *nfs4_lookup_slot(struct nfs4_slot_table *tbl, u32 slotid);
+extern int nfs4_slot_wait_on_seqid(struct nfs4_slot_table *tbl,
+                u32 slotid, u32 seq_nr,
+                unsigned long timeout);
 extern bool nfs4_try_to_lock_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot);
 extern void nfs4_free_slot(struct nfs4_slot_table *tbl, struct nfs4_slot *slot);
 extern void nfs4_slot_tbl_drain_complete(struct nfs4_slot_table *tbl);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 834b875900d6..cada00aa5096 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -277,20 +277,17 @@ static int nfs41_setup_state_renewal(struct nfs_client *clp)
 {
         int status;
         struct nfs_fsinfo fsinfo;
+        unsigned long now;
 
         if (!test_bit(NFS_CS_CHECK_LEASE_TIME, &clp->cl_res_state)) {
                 nfs4_schedule_state_renewal(clp);
                 return 0;
         }
 
+        now = jiffies;
         status = nfs4_proc_get_lease_time(clp, &fsinfo);
         if (status == 0) {
-                /* Update lease time and schedule renewal */
-                spin_lock(&clp->cl_lock);
-                clp->cl_lease_time = fsinfo.lease_time * HZ;
-                clp->cl_last_renewal = jiffies;
-                spin_unlock(&clp->cl_lock);
-
+                nfs4_set_lease_period(clp, fsinfo.lease_time * HZ, now);
                 nfs4_schedule_state_renewal(clp);
         }
 
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 70806cae0d36..2c93a85eda51 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -365,7 +365,8 @@ pnfs_layout_remove_lseg(struct pnfs_layout_hdr *lo,
         /* Matched by pnfs_get_layout_hdr in pnfs_layout_insert_lseg */
         atomic_dec(&lo->plh_refcount);
         if (list_empty(&lo->plh_segs)) {
-                set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+                if (atomic_read(&lo->plh_outstanding) == 0)
+                        set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
                 clear_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags);
         }
         rpc_wake_up(&NFS_SERVER(inode)->roc_rpcwaitq);
@@ -768,17 +769,32 @@ pnfs_destroy_all_layouts(struct nfs_client *clp)
         pnfs_destroy_layouts_byclid(clp, false);
 }
 
+static void
+pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
+{
+        lo->plh_return_iomode = 0;
+        lo->plh_return_seq = 0;
+        clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
+}
+
 /* update lo->plh_stateid with new if is more recent */
 void
 pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
                         bool update_barrier)
 {
         u32 oldseq, newseq, new_barrier = 0;
-        bool invalid = !pnfs_layout_is_valid(lo);
 
         oldseq = be32_to_cpu(lo->plh_stateid.seqid);
         newseq = be32_to_cpu(new->seqid);
-        if (invalid || pnfs_seqid_is_newer(newseq, oldseq)) {
+
+        if (!pnfs_layout_is_valid(lo)) {
+                nfs4_stateid_copy(&lo->plh_stateid, new);
+                lo->plh_barrier = newseq;
+                pnfs_clear_layoutreturn_info(lo);
+                clear_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
+                return;
+        }
+        if (pnfs_seqid_is_newer(newseq, oldseq)) {
                 nfs4_stateid_copy(&lo->plh_stateid, new);
                 /*
                  * Because of wraparound, we want to keep the barrier
@@ -790,7 +806,7 @@ pnfs_set_layout_stateid(struct pnfs_layout_hdr *lo, const nfs4_stateid *new,
                 new_barrier = be32_to_cpu(new->seqid);
         else if (new_barrier == 0)
                 return;
-        if (invalid || pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
+        if (pnfs_seqid_is_newer(new_barrier, lo->plh_barrier))
                 lo->plh_barrier = new_barrier;
 }
 
@@ -886,19 +902,14 @@ void pnfs_clear_layoutreturn_waitbit(struct pnfs_layout_hdr *lo)
         rpc_wake_up(&NFS_SERVER(lo->plh_inode)->roc_rpcwaitq);
 }
 
-static void
-pnfs_clear_layoutreturn_info(struct pnfs_layout_hdr *lo)
-{
-        lo->plh_return_iomode = 0;
-        lo->plh_return_seq = 0;
-        clear_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags);
-}
-
 static bool
 pnfs_prepare_layoutreturn(struct pnfs_layout_hdr *lo,
                 nfs4_stateid *stateid,
                 enum pnfs_iomode *iomode)
 {
+        /* Serialise LAYOUTGET/LAYOUTRETURN */
+        if (atomic_read(&lo->plh_outstanding) != 0)
+                return false;
         if (test_and_set_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
                 return false;
         pnfs_get_layout_hdr(lo);
@@ -1555,6 +1566,7 @@ pnfs_update_layout(struct inode *ino,
         }
 
 lookup_again:
+        nfs4_client_recover_expired_lease(clp);
         first = false;
         spin_lock(&ino->i_lock);
         lo = pnfs_find_alloc_layout(ino, ctx, gfp_flags);
@@ -1797,16 +1809,11 @@ pnfs_layout_process(struct nfs4_layoutget *lgp)
                  */
                 pnfs_mark_layout_stateid_invalid(lo, &free_me);
 
-                nfs4_stateid_copy(&lo->plh_stateid, &res->stateid);
-                lo->plh_barrier = be32_to_cpu(res->stateid.seqid);
+                pnfs_set_layout_stateid(lo, &res->stateid, true);
         }
 
         pnfs_get_lseg(lseg);
         pnfs_layout_insert_lseg(lo, lseg, &free_me);
-        if (!pnfs_layout_is_valid(lo)) {
-                pnfs_clear_layoutreturn_info(lo);
-                clear_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags);
-        }
 
 
         if (res->return_on_close)
@@ -2510,7 +2517,6 @@ pnfs_report_layoutstat(struct inode *inode, gfp_t gfp_flags)
 
         data->args.fh = NFS_FH(inode);
         data->args.inode = inode;
-        nfs4_stateid_copy(&data->args.stateid, &hdr->plh_stateid);
         status = ld->prepare_layoutstats(&data->args);
         if (status)
                 goto out_free;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 18d446e1a82b..d39601381adf 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -923,6 +923,8 @@ static struct nfs_parsed_mount_data *nfs_alloc_parsed_mount_data(void)
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data) {
+                data->timeo             = NFS_UNSPEC_TIMEO;
+                data->retrans           = NFS_UNSPEC_RETRANS;
                 data->acregmin          = NFS_DEF_ACREGMIN;
                 data->acregmax          = NFS_DEF_ACREGMAX;
                 data->acdirmin          = NFS_DEF_ACDIRMIN;
@@ -1189,6 +1191,19 @@ static int nfs_get_option_ul(substring_t args[], unsigned long *option)
         return rc;
 }
 
+static int nfs_get_option_ul_bound(substring_t args[], unsigned long *option,
+                unsigned long l_bound, unsigned long u_bound)
+{
+        int ret;
+
+        ret = nfs_get_option_ul(args, option);
+        if (ret != 0)
+                return ret;
+        if (*option < l_bound || *option > u_bound)
+                return -ERANGE;
+        return 0;
+}
+
 /*
  * Error-check and convert a string of mount options from user space into
  * a data structure.  The whole mount string is processed; bad options are
@@ -1352,12 +1367,12 @@ static int nfs_parse_mount_options(char *raw,
                         mnt->bsize = option;
                         break;
                 case Opt_timeo:
-                        if (nfs_get_option_ul(args, &option) || option == 0)
+                        if (nfs_get_option_ul_bound(args, &option, 1, INT_MAX))
                                 goto out_invalid_value;
                         mnt->timeo = option;
                         break;
                 case Opt_retrans:
-                        if (nfs_get_option_ul(args, &option) || option == 0)
+                        if (nfs_get_option_ul_bound(args, &option, 0, INT_MAX))
                                 goto out_invalid_value;
                         mnt->retrans = option;
                         break;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 8410ca275db1..a204d7e109d4 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -4903,6 +4903,32 @@ nfsd4_test_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         return nfs_ok;
 }
 
+static __be32
+nfsd4_free_lock_stateid(stateid_t *stateid, struct nfs4_stid *s)
+{
+        struct nfs4_ol_stateid *stp = openlockstateid(s);
+        __be32 ret;
+
+        mutex_lock(&stp->st_mutex);
+
+        ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
+        if (ret)
+                goto out;
+
+        ret = nfserr_locks_held;
+        if (check_for_locks(stp->st_stid.sc_file,
+                            lockowner(stp->st_stateowner)))
+                goto out;
+
+        release_lock_stateid(stp);
+        ret = nfs_ok;
+
+out:
+        mutex_unlock(&stp->st_mutex);
+        nfs4_put_stid(s);
+        return ret;
+}
+
 __be32
 nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                    struct nfsd4_free_stateid *free_stateid)
@@ -4910,7 +4936,6 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
         stateid_t *stateid = &free_stateid->fr_stateid;
         struct nfs4_stid *s;
         struct nfs4_delegation *dp;
-        struct nfs4_ol_stateid *stp;
         struct nfs4_client *cl = cstate->session->se_client;
         __be32 ret = nfserr_bad_stateid;
 
@@ -4929,18 +4954,9 @@ nfsd4_free_stateid(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                 ret = nfserr_locks_held;
                 break;
         case NFS4_LOCK_STID:
-                ret = check_stateid_generation(stateid, &s->sc_stateid, 1);
-                if (ret)
-                        break;
-                stp = openlockstateid(s);
-                ret = nfserr_locks_held;
-                if (check_for_locks(stp->st_stid.sc_file,
-                                    lockowner(stp->st_stateowner)))
-                        break;
-                WARN_ON(!unhash_lock_stateid(stp));
+                atomic_inc(&s->sc_count);
                 spin_unlock(&cl->cl_lock);
-                nfs4_put_stid(s);
-                ret = nfs_ok;
+                ret = nfsd4_free_lock_stateid(stateid, s);
                 goto out;
         case NFS4_REVOKED_DELEG_STID:
                 dp = delegstateid(s);
@@ -5507,7 +5523,7 @@ static __be32
 lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
                             struct nfs4_ol_stateid *ost,
                             struct nfsd4_lock *lock,
-                            struct nfs4_ol_stateid **lst, bool *new)
+                            struct nfs4_ol_stateid **plst, bool *new)
 {
         __be32 status;
         struct nfs4_file *fi = ost->st_stid.sc_file;
@@ -5515,7 +5531,9 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
         struct nfs4_client *cl = oo->oo_owner.so_client;
         struct inode *inode = d_inode(cstate->current_fh.fh_dentry);
         struct nfs4_lockowner *lo;
+        struct nfs4_ol_stateid *lst;
         unsigned int strhashval;
+        bool hashed;
 
         lo = find_lockowner_str(cl, &lock->lk_new_owner);
         if (!lo) {
@@ -5531,12 +5549,27 @@ lookup_or_create_lock_state(struct nfsd4_compound_state *cstate,
                         goto out;
         }
 
-        *lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
-        if (*lst == NULL) {
+retry:
+        lst = find_or_create_lock_stateid(lo, fi, inode, ost, new);
+        if (lst == NULL) {
                 status = nfserr_jukebox;
                 goto out;
         }
+
+        mutex_lock(&lst->st_mutex);
+
+        /* See if it's still hashed to avoid race with FREE_STATEID */
+        spin_lock(&cl->cl_lock);
+        hashed = !list_empty(&lst->st_perfile);
+        spin_unlock(&cl->cl_lock);
+
+        if (!hashed) {
+                mutex_unlock(&lst->st_mutex);
+                nfs4_put_stid(&lst->st_stid);
+                goto retry;
+        }
         status = nfs_ok;
+        *plst = lst;
 out:
         nfs4_put_stateowner(&lo->lo_owner);
         return status;
@@ -5603,8 +5636,6 @@ nfsd4_lock(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
                         goto out;
                 status = lookup_or_create_lock_state(cstate, open_stp, lock,
                                                         &lock_stp, &new);
-                if (status == nfs_ok)
-                        mutex_lock(&lock_stp->st_mutex);
         } else {
                 status = nfs4_preprocess_seqid_op(cstate,
                                        lock->lk_old_lock_seqid,
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index ba944123167b..ff476e654b8f 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1252,10 +1252,13 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
         if (IS_ERR(dchild))
                 return nfserrno(host_err);
         err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
-        if (err) {
-                dput(dchild);
+        /*
+         * We unconditionally drop our ref to dchild as fh_compose will have
+         * already grabbed its own ref for it.
+         */
+        dput(dchild);
+        if (err)
                 return err;
-        }
         return nfsd_create_locked(rqstp, fhp, fname, flen, iap, type,
                                         rdev, resfhp);
 }
diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c
index d2f97ecca6a5..e0e5f7c3c99f 100644
--- a/fs/notify/fanotify/fanotify.c
+++ b/fs/notify/fanotify/fanotify.c
@@ -67,18 +67,7 @@ static int fanotify_get_response(struct fsnotify_group *group,
 
         pr_debug("%s: group=%p event=%p\n", __func__, group, event);
 
-        wait_event(group->fanotify_data.access_waitq, event->response ||
-                                atomic_read(&group->fanotify_data.bypass_perm));
-
-        if (!event->response) { /* bypass_perm set */
-                /*
-                 * Event was canceled because group is being destroyed. Remove
-                 * it from group's event list because we are responsible for
-                 * freeing the permission event.
-                 */
-                fsnotify_remove_event(group, &event->fae.fse);
-                return 0;
-        }
+        wait_event(group->fanotify_data.access_waitq, event->response);
 
         /* userspace responded, convert to something usable */
         switch (event->response) {
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 8e8e6bcd1d43..a64313868d3a 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -358,16 +358,20 @@ static int fanotify_release(struct inode *ignored, struct file *file)
 
 #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
         struct fanotify_perm_event_info *event, *next;
+        struct fsnotify_event *fsn_event;
 
         /*
-         * There may be still new events arriving in the notification queue
-         * but since userspace cannot use fanotify fd anymore, no event can
-         * enter or leave access_list by now.
+         * Stop new events from arriving in the notification queue. since
+         * userspace cannot use fanotify fd anymore, no event can enter or
+         * leave access_list by now either.
          */
-        spin_lock(&group->fanotify_data.access_lock);
-
-        atomic_inc(&group->fanotify_data.bypass_perm);
+        fsnotify_group_stop_queueing(group);
 
+        /*
+         * Process all permission events on access_list and notification queue
+         * and simulate reply from userspace.
+         */
+        spin_lock(&group->fanotify_data.access_lock);
         list_for_each_entry_safe(event, next, &group->fanotify_data.access_list,
                                  fae.fse.list) {
                 pr_debug("%s: found group=%p event=%p\n", __func__, group,
@@ -379,12 +383,21 @@ static int fanotify_release(struct inode *ignored, struct file *file)
         spin_unlock(&group->fanotify_data.access_lock);
 
         /*
-         * Since bypass_perm is set, newly queued events will not wait for
-         * access response. Wake up the already sleeping ones now.
-         * synchronize_srcu() in fsnotify_destroy_group() will wait for all
-         * processes sleeping in fanotify_handle_event() waiting for access
-         * response and thus also for all permission events to be freed.
+         * Destroy all non-permission events. For permission events just
+         * dequeue them and set the response. They will be freed once the
+         * response is consumed and fanotify_get_response() returns.
          */
+        mutex_lock(&group->notification_mutex);
+        while (!fsnotify_notify_queue_is_empty(group)) {
+                fsn_event = fsnotify_remove_first_event(group);
+                if (!(fsn_event->mask & FAN_ALL_PERM_EVENTS))
+                        fsnotify_destroy_event(group, fsn_event);
+                else
+                        FANOTIFY_PE(fsn_event)->response = FAN_ALLOW;
+        }
+        mutex_unlock(&group->notification_mutex);
+
+        /* Response for all permission events it set, wakeup waiters */
         wake_up(&group->fanotify_data.access_waitq);
 #endif
 
@@ -755,7 +768,6 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
         spin_lock_init(&group->fanotify_data.access_lock);
         init_waitqueue_head(&group->fanotify_data.access_waitq);
         INIT_LIST_HEAD(&group->fanotify_data.access_list);
-        atomic_set(&group->fanotify_data.bypass_perm, 0);
 #endif
         switch (flags & FAN_ALL_CLASS_BITS) {
         case FAN_CLASS_NOTIF:
diff --git a/fs/notify/group.c b/fs/notify/group.c
index 3e2dd85be5dd..b47f7cfdcaa4 100644
--- a/fs/notify/group.c
+++ b/fs/notify/group.c
@@ -40,6 +40,17 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
 }
 
 /*
+ * Stop queueing new events for this group. Once this function returns
+ * fsnotify_add_event() will not add any new events to the group's queue.
+ */
+void fsnotify_group_stop_queueing(struct fsnotify_group *group)
+{
+        mutex_lock(&group->notification_mutex);
+        group->shutdown = true;
+        mutex_unlock(&group->notification_mutex);
+}
+
+/*
  * Trying to get rid of a group. Remove all marks, flush all events and release
  * the group reference.
  * Note that another thread calling fsnotify_clear_marks_by_group() may still
@@ -47,6 +58,14 @@ static void fsnotify_final_destroy_group(struct fsnotify_group *group)
  */
 void fsnotify_destroy_group(struct fsnotify_group *group)
 {
+        /*
+         * Stop queueing new events. The code below is careful enough to not
+         * require this but fanotify needs to stop queuing events even before
+         * fsnotify_destroy_group() is called and this makes the other callers
+         * of fsnotify_destroy_group() to see the same behavior.
+         */
+        fsnotify_group_stop_queueing(group);
+
         /* clear all inode marks for this group, attach them to destroy_list */
         fsnotify_detach_group_marks(group);
 
diff --git a/fs/notify/notification.c b/fs/notify/notification.c
index a95d8e037aeb..e455e83ceeeb 100644
--- a/fs/notify/notification.c
+++ b/fs/notify/notification.c
@@ -82,7 +82,8 @@ void fsnotify_destroy_event(struct fsnotify_group *group,
  * Add an event to the group notification queue.  The group can later pull this
  * event off the queue to deal with.  The function returns 0 if the event was
  * added to the queue, 1 if the event was merged with some other queued event,
- * 2 if the queue of events has overflown.
+ * 2 if the event was not queued - either the queue of events has overflown
+ * or the group is shutting down.
  */
 int fsnotify_add_event(struct fsnotify_group *group,
                        struct fsnotify_event *event,
@@ -96,6 +97,11 @@ int fsnotify_add_event(struct fsnotify_group *group,
 
         mutex_lock(&group->notification_mutex);
 
+        if (group->shutdown) {
+                mutex_unlock(&group->notification_mutex);
+                return 2;
+        }
+
         if (group->q_len >= group->max_events) {
                 ret = 2;
                 /* Queue overflow event only if it isn't already queued */
@@ -126,21 +132,6 @@ queue:
 }
 
 /*
- * Remove @event from group's notification queue. It is the responsibility of
- * the caller to destroy the event.
- */
-void fsnotify_remove_event(struct fsnotify_group *group,
-                           struct fsnotify_event *event)
-{
-        mutex_lock(&group->notification_mutex);
-        if (!list_empty(&event->list)) {
-                list_del_init(&event->list);
-                group->q_len--;
-        }
-        mutex_unlock(&group->notification_mutex);
-}
-
-/*
  * Remove and return the first event from the notification list.  It is the
  * responsibility of the caller to destroy the obtained event
  */
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 7dabbc31060e..f165f867f332 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5922,7 +5922,6 @@ bail:
 }
 
 static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
-                                         handle_t *handle,
                                          struct inode *data_alloc_inode,
                                          struct buffer_head *data_alloc_bh)
 {
@@ -5935,11 +5934,19 @@ static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
         struct ocfs2_truncate_log *tl;
         struct inode *tl_inode = osb->osb_tl_inode;
         struct buffer_head *tl_bh = osb->osb_tl_bh;
+        handle_t *handle;
 
         di = (struct ocfs2_dinode *) tl_bh->b_data;
         tl = &di->id2.i_dealloc;
         i = le16_to_cpu(tl->tl_used) - 1;
         while (i >= 0) {
+                handle = ocfs2_start_trans(osb, OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
+                if (IS_ERR(handle)) {
+                        status = PTR_ERR(handle);
+                        mlog_errno(status);
+                        goto bail;
+                }
+
                 /* Caller has given us at least enough credits to
                  * update the truncate log dinode */
                 status = ocfs2_journal_access_di(handle, INODE_CACHE(tl_inode), tl_bh,
@@ -5974,12 +5981,7 @@ static int ocfs2_replay_truncate_records(struct ocfs2_super *osb,
                         }
                 }
 
-                status = ocfs2_extend_trans(handle,
-                                OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
-                if (status < 0) {
-                        mlog_errno(status);
-                        goto bail;
-                }
+                ocfs2_commit_trans(osb, handle);
                 i--;
         }
 
@@ -5994,7 +5996,6 @@ int __ocfs2_flush_truncate_log(struct ocfs2_super *osb)
 {
         int status;
         unsigned int num_to_flush;
-        handle_t *handle;
         struct inode *tl_inode = osb->osb_tl_inode;
         struct inode *data_alloc_inode = NULL;
         struct buffer_head *tl_bh = osb->osb_tl_bh;
@@ -6038,21 +6039,11 @@ int __ocfs2_flush_truncate_log(struct ocfs2_super *osb)
                 goto out_mutex;
         }
 
-        handle = ocfs2_start_trans(osb, OCFS2_TRUNCATE_LOG_FLUSH_ONE_REC);
-        if (IS_ERR(handle)) {
-                status = PTR_ERR(handle);
-                mlog_errno(status);
-                goto out_unlock;
-        }
-
-        status = ocfs2_replay_truncate_records(osb, handle, data_alloc_inode,
+        status = ocfs2_replay_truncate_records(osb, data_alloc_inode,
                                                data_alloc_bh);
         if (status < 0)
                 mlog_errno(status);
 
-        ocfs2_commit_trans(osb, handle);
-
-out_unlock:
         brelse(data_alloc_bh);
         ocfs2_inode_unlock(data_alloc_inode, 1);
 
@@ -6413,43 +6404,34 @@ static int ocfs2_free_cached_blocks(struct ocfs2_super *osb,
                 goto out_mutex;
         }
 
-        handle = ocfs2_start_trans(osb, OCFS2_SUBALLOC_FREE);
-        if (IS_ERR(handle)) {
-                ret = PTR_ERR(handle);
-                mlog_errno(ret);
-                goto out_unlock;
-        }
-
         while (head) {
                 if (head->free_bg)
                         bg_blkno = head->free_bg;
                 else
                         bg_blkno = ocfs2_which_suballoc_group(head->free_blk,
                                                               head->free_bit);
+                handle = ocfs2_start_trans(osb, OCFS2_SUBALLOC_FREE);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        mlog_errno(ret);
+                        goto out_unlock;
+                }
+
                 trace_ocfs2_free_cached_blocks(
                      (unsigned long long)head->free_blk, head->free_bit);
 
                 ret = ocfs2_free_suballoc_bits(handle, inode, di_bh,
                                                head->free_bit, bg_blkno, 1);
-                if (ret) {
+                if (ret)
                         mlog_errno(ret);
-                        goto out_journal;
-                }
 
-                ret = ocfs2_extend_trans(handle, OCFS2_SUBALLOC_FREE);
-                if (ret) {
-                        mlog_errno(ret);
-                        goto out_journal;
-                }
+                ocfs2_commit_trans(osb, handle);
 
                 tmp = head;
                 head = head->free_next;
                 kfree(tmp);
         }
 
-out_journal:
-        ocfs2_commit_trans(osb, handle);
-
 out_unlock:
         ocfs2_inode_unlock(inode, 1);
         brelse(di_bh);
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 94b18369b1cc..b95e7df5b76a 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -44,9 +44,6 @@
  * version here in tcp_internal.h should not need to be bumped for
  * filesystem locking changes.
  *
- * New in version 12
- *      - Negotiate hb timeout when storage is down.
- *
  * New in version 11
  *      - Negotiation of filesystem locking in the dlm join.
  *
@@ -78,7 +75,7 @@
  *      - full 64 bit i_size in the metadata lock lvbs
  *      - introduction of "rw" lock and pushing meta/data locking down
  */
-#define O2NET_PROTOCOL_VERSION 12ULL
+#define O2NET_PROTOCOL_VERSION 11ULL
 struct o2net_handshake {
         __be64  protocol_version;
         __be64  connector_id;
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index cdeafb4e7ed6..0bb128659d4b 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -268,7 +268,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                                   struct dlm_lock *lock, int flags, int type)
 {
         enum dlm_status status;
-        u8 old_owner = res->owner;
 
         mlog(0, "type=%d, convert_type=%d, busy=%d\n", lock->ml.type,
              lock->ml.convert_type, res->state & DLM_LOCK_RES_IN_PROGRESS);
@@ -335,7 +334,6 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
 
         spin_lock(&res->spinlock);
         res->state &= ~DLM_LOCK_RES_IN_PROGRESS;
-        lock->convert_pending = 0;
         /* if it failed, move it back to granted queue.
          * if master returns DLM_NORMAL and then down before sending ast,
          * it may have already been moved to granted queue, reset to
@@ -344,12 +342,14 @@ enum dlm_status dlmconvert_remote(struct dlm_ctxt *dlm,
                 if (status != DLM_NOTQUEUED)
                         dlm_error(status);
                 dlm_revert_pending_convert(res, lock);
-        } else if ((res->state & DLM_LOCK_RES_RECOVERING) ||
-                        (old_owner != res->owner)) {
-                mlog(0, "res %.*s is in recovering or has been recovered.\n",
-                                res->lockname.len, res->lockname.name);
+        } else if (!lock->convert_pending) {
+                mlog(0, "%s: res %.*s, owner died and lock has been moved back "
+                                "to granted list, retry convert.\n",
+                                dlm->name, res->lockname.len, res->lockname.name);
                 status = DLM_RECOVERING;
         }
+
+        lock->convert_pending = 0;
 bail:
         spin_unlock(&res->spinlock);
 
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 4e7b0dc22450..0b055bfb8e86 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -1506,7 +1506,8 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
                                        u64 start, u64 len)
 {
         int ret = 0;
-        u64 tmpend, end = start + len;
+        u64 tmpend = 0;
+        u64 end = start + len;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         unsigned int csize = osb->s_clustersize;
         handle_t *handle;
@@ -1538,18 +1539,31 @@ static int ocfs2_zero_partial_clusters(struct inode *inode,
         }
 
         /*
-         * We want to get the byte offset of the end of the 1st cluster.
+         * If start is on a cluster boundary and end is somewhere in another
+         * cluster, we have not COWed the cluster starting at start, unless
+         * end is also within the same cluster. So, in this case, we skip this
+         * first call to ocfs2_zero_range_for_truncate() truncate and move on
+         * to the next one.
          */
-        tmpend = (u64)osb->s_clustersize + (start & ~(osb->s_clustersize - 1));
-        if (tmpend > end)
-                tmpend = end;
+        if ((start & (csize - 1)) != 0) {
+                /*
+                 * We want to get the byte offset of the end of the 1st
+                 * cluster.
+                 */
+                tmpend = (u64)osb->s_clustersize +
+                        (start & ~(osb->s_clustersize - 1));
+                if (tmpend > end)
+                        tmpend = end;
 
-        trace_ocfs2_zero_partial_clusters_range1((unsigned long long)start,
-                                                 (unsigned long long)tmpend);
+                trace_ocfs2_zero_partial_clusters_range1(
+                        (unsigned long long)start,
+                        (unsigned long long)tmpend);
 
-        ret = ocfs2_zero_range_for_truncate(inode, handle, start, tmpend);
-        if (ret)
-                mlog_errno(ret);
+                ret = ocfs2_zero_range_for_truncate(inode, handle, start,
+                                                    tmpend);
+                if (ret)
+                        mlog_errno(ret);
+        }
 
         if (tmpend < end) {
                 /*
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index ea47120a85ff..6ad3533940ba 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -1199,14 +1199,24 @@ retry:
                         inode_unlock((*ac)->ac_inode);
 
                         ret = ocfs2_try_to_free_truncate_log(osb, bits_wanted);
-                        if (ret == 1)
+                        if (ret == 1) {
+                                iput((*ac)->ac_inode);
+                                (*ac)->ac_inode = NULL;
                                 goto retry;
+                        }
 
                         if (ret < 0)
                                 mlog_errno(ret);
 
                         inode_lock((*ac)->ac_inode);
-                        ocfs2_inode_lock((*ac)->ac_inode, NULL, 1);
+                        ret = ocfs2_inode_lock((*ac)->ac_inode, NULL, 1);
+                        if (ret < 0) {
+                                mlog_errno(ret);
+                                inode_unlock((*ac)->ac_inode);
+                                iput((*ac)->ac_inode);
+                                (*ac)->ac_inode = NULL;
+                                goto bail;
+                        }
                 }
                 if (status < 0) {
                         if (status != -ENOSPC)
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 54e5d6681786..43fdc2765aea 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -80,6 +80,8 @@ int ovl_copy_xattr(struct dentry *old, struct dentry *new)
         }
 
         for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
+                if (ovl_is_private_xattr(name))
+                        continue;
 retry:
                 size = vfs_getxattr(old, name, value, value_size);
                 if (size == -ERANGE)
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 12bcd07b9e32..1560fdc09a5f 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -12,6 +12,8 @@
 #include <linux/xattr.h>
 #include <linux/security.h>
 #include <linux/cred.h>
+#include <linux/posix_acl.h>
+#include <linux/posix_acl_xattr.h>
 #include "overlayfs.h"
 
 void ovl_cleanup(struct inode *wdir, struct dentry *wdentry)
@@ -186,6 +188,9 @@ static int ovl_create_upper(struct dentry *dentry, struct inode *inode,
         struct dentry *newdentry;
         int err;
 
+        if (!hardlink && !IS_POSIXACL(udir))
+                stat->mode &= ~current_umask();
+
         inode_lock_nested(udir, I_MUTEX_PARENT);
         newdentry = lookup_one_len(dentry->d_name.name, upperdir,
                                    dentry->d_name.len);
@@ -335,6 +340,32 @@ out_free:
         return ret;
 }
 
+static int ovl_set_upper_acl(struct dentry *upperdentry, const char *name,
+                             const struct posix_acl *acl)
+{
+        void *buffer;
+        size_t size;
+        int err;
+
+        if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !acl)
+                return 0;
+
+        size = posix_acl_to_xattr(NULL, acl, NULL, 0);
+        buffer = kmalloc(size, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
+
+        size = posix_acl_to_xattr(&init_user_ns, acl, buffer, size);
+        err = size;
+        if (err < 0)
+                goto out_free;
+
+        err = vfs_setxattr(upperdentry, name, buffer, size, XATTR_CREATE);
+out_free:
+        kfree(buffer);
+        return err;
+}
+
 static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
                                     struct kstat *stat, const char *link,
                                     struct dentry *hardlink)
@@ -346,10 +377,18 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
         struct dentry *upper;
         struct dentry *newdentry;
         int err;
+        struct posix_acl *acl, *default_acl;
 
         if (WARN_ON(!workdir))
                 return -EROFS;
 
+        if (!hardlink) {
+                err = posix_acl_create(dentry->d_parent->d_inode,
+                                       &stat->mode, &default_acl, &acl);
+                if (err)
+                        return err;
+        }
+
         err = ovl_lock_rename_workdir(workdir, upperdir);
         if (err)
                 goto out;
@@ -384,6 +423,17 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
                 if (err)
                         goto out_cleanup;
         }
+        if (!hardlink) {
+                err = ovl_set_upper_acl(newdentry, XATTR_NAME_POSIX_ACL_ACCESS,
+                                        acl);
+                if (err)
+                        goto out_cleanup;
+
+                err = ovl_set_upper_acl(newdentry, XATTR_NAME_POSIX_ACL_DEFAULT,
+                                        default_acl);
+                if (err)
+                        goto out_cleanup;
+        }
 
         if (!hardlink && S_ISDIR(stat->mode)) {
                 err = ovl_set_opaque(newdentry);
@@ -410,6 +460,10 @@ out_dput:
 out_unlock:
         unlock_rename(workdir, upperdir);
 out:
+        if (!hardlink) {
+                posix_acl_release(acl);
+                posix_acl_release(default_acl);
+        }
         return err;
 
 out_cleanup:
@@ -950,9 +1004,9 @@ const struct inode_operations ovl_dir_inode_operations = {
         .permission     = ovl_permission,
         .getattr        = ovl_dir_getattr,
         .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
         .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
         .get_acl        = ovl_get_acl,
         .update_time    = ovl_update_time,
 };
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index 1b885c156028..c75625c1efa3 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -10,6 +10,7 @@
 #include <linux/fs.h>
 #include <linux/slab.h>
 #include <linux/xattr.h>
+#include <linux/posix_acl.h>
 #include "overlayfs.h"
 
 static int ovl_copy_up_truncate(struct dentry *dentry)
@@ -191,32 +192,44 @@ static int ovl_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
         return err;
 }
 
-static bool ovl_is_private_xattr(const char *name)
+bool ovl_is_private_xattr(const char *name)
 {
-#define OVL_XATTR_PRE_NAME OVL_XATTR_PREFIX "."
-        return strncmp(name, OVL_XATTR_PRE_NAME,
-                       sizeof(OVL_XATTR_PRE_NAME) - 1) == 0;
+        return strncmp(name, OVL_XATTR_PREFIX,
+                       sizeof(OVL_XATTR_PREFIX) - 1) == 0;
 }
 
-int ovl_setxattr(struct dentry *dentry, struct inode *inode,
-                 const char *name, const void *value,
-                 size_t size, int flags)
+int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
+                  size_t size, int flags)
 {
         int err;
-        struct dentry *upperdentry;
+        struct path realpath;
+        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
         const struct cred *old_cred;
 
         err = ovl_want_write(dentry);
         if (err)
                 goto out;
 
+        if (!value && !OVL_TYPE_UPPER(type)) {
+                err = vfs_getxattr(realpath.dentry, name, NULL, 0);
+                if (err < 0)
+                        goto out_drop_write;
+        }
+
         err = ovl_copy_up(dentry);
         if (err)
                 goto out_drop_write;
 
-        upperdentry = ovl_dentry_upper(dentry);
+        if (!OVL_TYPE_UPPER(type))
+                ovl_path_upper(dentry, &realpath);
+
         old_cred = ovl_override_creds(dentry->d_sb);
-        err = vfs_setxattr(upperdentry, name, value, size, flags);
+        if (value)
+                err = vfs_setxattr(realpath.dentry, name, value, size, flags);
+        else {
+                WARN_ON(flags != XATTR_REPLACE);
+                err = vfs_removexattr(realpath.dentry, name);
+        }
         revert_creds(old_cred);
 
 out_drop_write:
@@ -225,16 +238,13 @@ out:
         return err;
 }
 
-ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
-                     const char *name, void *value, size_t size)
+int ovl_xattr_get(struct dentry *dentry, const char *name,
+                  void *value, size_t size)
 {
         struct dentry *realdentry = ovl_dentry_real(dentry);
         ssize_t res;
         const struct cred *old_cred;
 
-        if (ovl_is_private_xattr(name))
-                return -ENODATA;
-
         old_cred = ovl_override_creds(dentry->d_sb);
         res = vfs_getxattr(realdentry, name, value, size);
         revert_creds(old_cred);
@@ -245,7 +255,8 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
 {
         struct dentry *realdentry = ovl_dentry_real(dentry);
         ssize_t res;
-        int off;
+        size_t len;
+        char *s;
         const struct cred *old_cred;
 
         old_cred = ovl_override_creds(dentry->d_sb);
@@ -255,73 +266,39 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
                 return res;
 
         /* filter out private xattrs */
-        for (off = 0; off < res;) {
-                char *s = list + off;
-                size_t slen = strlen(s) + 1;
+        for (s = list, len = res; len;) {
+                size_t slen = strnlen(s, len) + 1;
 
-                BUG_ON(off + slen > res);
+                /* underlying fs providing us with an broken xattr list? */
+                if (WARN_ON(slen > len))
+                        return -EIO;
 
+                len -= slen;
                 if (ovl_is_private_xattr(s)) {
                         res -= slen;
-                        memmove(s, s + slen, res - off);
+                        memmove(s, s + slen, len);
                 } else {
-                        off += slen;
+                        s += slen;
                 }
         }
 
         return res;
 }
 
-int ovl_removexattr(struct dentry *dentry, const char *name)
-{
-        int err;
-        struct path realpath;
-        enum ovl_path_type type = ovl_path_real(dentry, &realpath);
-        const struct cred *old_cred;
-
-        err = ovl_want_write(dentry);
-        if (err)
-                goto out;
-
-        err = -ENODATA;
-        if (ovl_is_private_xattr(name))
-                goto out_drop_write;
-
-        if (!OVL_TYPE_UPPER(type)) {
-                err = vfs_getxattr(realpath.dentry, name, NULL, 0);
-                if (err < 0)
-                        goto out_drop_write;
-
-                err = ovl_copy_up(dentry);
-                if (err)
-                        goto out_drop_write;
-
-                ovl_path_upper(dentry, &realpath);
-        }
-
-        old_cred = ovl_override_creds(dentry->d_sb);
-        err = vfs_removexattr(realpath.dentry, name);
-        revert_creds(old_cred);
-out_drop_write:
-        ovl_drop_write(dentry);
-out:
-        return err;
-}
-
 struct posix_acl *ovl_get_acl(struct inode *inode, int type)
 {
         struct inode *realinode = ovl_inode_real(inode, NULL);
         const struct cred *old_cred;
         struct posix_acl *acl;
 
-        if (!IS_POSIXACL(realinode))
+        if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !IS_POSIXACL(realinode))
                 return NULL;
 
         if (!realinode->i_op->get_acl)
                 return NULL;
 
         old_cred = ovl_override_creds(inode->i_sb);
-        acl = realinode->i_op->get_acl(realinode, type);
+        acl = get_acl(realinode, type);
         revert_creds(old_cred);
 
         return acl;
@@ -391,9 +368,9 @@ static const struct inode_operations ovl_file_inode_operations = {
         .permission     = ovl_permission,
         .getattr        = ovl_getattr,
         .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
         .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
         .get_acl        = ovl_get_acl,
         .update_time    = ovl_update_time,
 };
@@ -404,9 +381,9 @@ static const struct inode_operations ovl_symlink_inode_operations = {
         .readlink       = ovl_readlink,
         .getattr        = ovl_getattr,
         .setxattr       = generic_setxattr,
-        .getxattr       = ovl_getxattr,
+        .getxattr       = generic_getxattr,
         .listxattr      = ovl_listxattr,
-        .removexattr    = ovl_removexattr,
+        .removexattr    = generic_removexattr,
         .update_time    = ovl_update_time,
 };
 
@@ -415,6 +392,9 @@ static void ovl_fill_inode(struct inode *inode, umode_t mode)
         inode->i_ino = get_next_ino();
         inode->i_mode = mode;
         inode->i_flags |= S_NOCMTIME;
+#ifdef CONFIG_FS_POSIX_ACL
+        inode->i_acl = inode->i_default_acl = ACL_DONT_CACHE;
+#endif
 
         mode &= S_IFMT;
         switch (mode) {
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index e4f5c9536bfe..5813ccff8cd9 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -24,8 +24,8 @@ enum ovl_path_type {
         (OVL_TYPE_MERGE(type) || !OVL_TYPE_UPPER(type))
 
 
-#define OVL_XATTR_PREFIX XATTR_TRUSTED_PREFIX "overlay"
-#define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX ".opaque"
+#define OVL_XATTR_PREFIX XATTR_TRUSTED_PREFIX "overlay."
+#define OVL_XATTR_OPAQUE OVL_XATTR_PREFIX "opaque"
 
 #define OVL_ISUPPER_MASK 1UL
 
@@ -179,20 +179,21 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list);
 void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list);
 void ovl_cache_free(struct list_head *list);
 int ovl_check_d_type_supported(struct path *realpath);
+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
+                         struct dentry *dentry, int level);
 
 /* inode.c */
 int ovl_setattr(struct dentry *dentry, struct iattr *attr);
 int ovl_permission(struct inode *inode, int mask);
-int ovl_setxattr(struct dentry *dentry, struct inode *inode,
-                 const char *name, const void *value,
-                 size_t size, int flags);
-ssize_t ovl_getxattr(struct dentry *dentry, struct inode *inode,
-                     const char *name, void *value, size_t size);
+int ovl_xattr_set(struct dentry *dentry, const char *name, const void *value,
+                  size_t size, int flags);
+int ovl_xattr_get(struct dentry *dentry, const char *name,
+                  void *value, size_t size);
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
-int ovl_removexattr(struct dentry *dentry, const char *name);
 struct posix_acl *ovl_get_acl(struct inode *inode, int type);
 int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
 int ovl_update_time(struct inode *inode, struct timespec *ts, int flags);
+bool ovl_is_private_xattr(const char *name);
 
 struct inode *ovl_new_inode(struct super_block *sb, umode_t mode);
 struct inode *ovl_get_inode(struct super_block *sb, struct inode *realinode);
diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index cf37fc76fc9f..f241b4ee3d8a 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -248,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath,
                         err = rdd->err;
         } while (!err && rdd->count);
 
-        if (!err && rdd->first_maybe_whiteout)
+        if (!err && rdd->first_maybe_whiteout && rdd->dentry)
                 err = ovl_check_whiteouts(realpath->dentry, rdd);
 
         fput(realfile);
@@ -606,3 +606,64 @@ int ovl_check_d_type_supported(struct path *realpath)
 
         return rdd.d_type_supported;
 }
+
+static void ovl_workdir_cleanup_recurse(struct path *path, int level)
+{
+        int err;
+        struct inode *dir = path->dentry->d_inode;
+        LIST_HEAD(list);
+        struct ovl_cache_entry *p;
+        struct ovl_readdir_data rdd = {
+                .ctx.actor = ovl_fill_merge,
+                .dentry = NULL,
+                .list = &list,
+                .root = RB_ROOT,
+                .is_lowest = false,
+        };
+
+        err = ovl_dir_read(path, &rdd);
+        if (err)
+                goto out;
+
+        inode_lock_nested(dir, I_MUTEX_PARENT);
+        list_for_each_entry(p, &list, l_node) {
+                struct dentry *dentry;
+
+                if (p->name[0] == '.') {
+                        if (p->len == 1)
+                                continue;
+                        if (p->len == 2 && p->name[1] == '.')
+                                continue;
+                }
+                dentry = lookup_one_len(p->name, path->dentry, p->len);
+                if (IS_ERR(dentry))
+                        continue;
+                if (dentry->d_inode)
+                        ovl_workdir_cleanup(dir, path->mnt, dentry, level);
+                dput(dentry);
+        }
+        inode_unlock(dir);
+out:
+        ovl_cache_free(&list);
+}
+
+void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
+                         struct dentry *dentry, int level)
+{
+        int err;
+
+        if (!d_is_dir(dentry) || level > 1) {
+                ovl_cleanup(dir, dentry);
+                return;
+        }
+
+        err = ovl_do_rmdir(dir, dentry);
+        if (err) {
+                struct path path = { .mnt = mnt, .dentry = dentry };
+
+                inode_unlock(dir);
+                ovl_workdir_cleanup_recurse(&path, level + 1);
+                inode_lock_nested(dir, I_MUTEX_PARENT);
+                ovl_cleanup(dir, dentry);
+        }
+}
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 4036132842b5..e2a94a26767b 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -814,6 +814,10 @@ retry:
                 struct kstat stat = {
                         .mode = S_IFDIR | 0,
                 };
+                struct iattr attr = {
+                        .ia_valid = ATTR_MODE,
+                        .ia_mode = stat.mode,
+                };
 
                 if (work->d_inode) {
                         err = -EEXIST;
@@ -821,7 +825,7 @@ retry:
                                 goto out_dput;
 
                         retried = true;
-                        ovl_cleanup(dir, work);
+                        ovl_workdir_cleanup(dir, mnt, work, 0);
                         dput(work);
                         goto retry;
                 }
@@ -829,6 +833,21 @@ retry:
                 err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
                 if (err)
                         goto out_dput;
+
+                err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
+                if (err && err != -ENODATA && err != -EOPNOTSUPP)
+                        goto out_dput;
+
+                err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
+                if (err && err != -ENODATA && err != -EOPNOTSUPP)
+                        goto out_dput;
+
+                /* Clear any inherited mode bits */
+                inode_lock(work->d_inode);
+                err = notify_change(work, &attr, NULL);
+                inode_unlock(work->d_inode);
+                if (err)
+                        goto out_dput;
         }
 out_unlock:
         inode_unlock(dir);
@@ -967,10 +986,19 @@ static unsigned int ovl_split_lowerdirs(char *str)
         return ctr;
 }
 
-static int ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
-                                   struct dentry *dentry, struct inode *inode,
-                                   const char *name, const void *value,
-                                   size_t size, int flags)
+static int __maybe_unused
+ovl_posix_acl_xattr_get(const struct xattr_handler *handler,
+                        struct dentry *dentry, struct inode *inode,
+                        const char *name, void *buffer, size_t size)
+{
+        return ovl_xattr_get(dentry, handler->name, buffer, size);
+}
+
+static int __maybe_unused
+ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
+                        struct dentry *dentry, struct inode *inode,
+                        const char *name, const void *value,
+                        size_t size, int flags)
 {
         struct dentry *workdir = ovl_workdir(dentry);
         struct inode *realinode = ovl_inode_real(inode, NULL);
@@ -998,19 +1026,22 @@ static int ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
 
         posix_acl_release(acl);
 
-        return ovl_setxattr(dentry, inode, handler->name, value, size, flags);
+        err = ovl_xattr_set(dentry, handler->name, value, size, flags);
+        if (!err)
+                ovl_copyattr(ovl_inode_real(inode, NULL), inode);
+
+        return err;
 
 out_acl_release:
         posix_acl_release(acl);
         return err;
 }
 
-static int ovl_other_xattr_set(const struct xattr_handler *handler,
-                               struct dentry *dentry, struct inode *inode,
-                               const char *name, const void *value,
-                               size_t size, int flags)
+static int ovl_own_xattr_get(const struct xattr_handler *handler,
+                             struct dentry *dentry, struct inode *inode,
+                             const char *name, void *buffer, size_t size)
 {
-        return ovl_setxattr(dentry, inode, name, value, size, flags);
+        return -EPERM;
 }
 
 static int ovl_own_xattr_set(const struct xattr_handler *handler,
@@ -1021,42 +1052,59 @@ static int ovl_own_xattr_set(const struct xattr_handler *handler,
         return -EPERM;
 }
 
-static const struct xattr_handler ovl_posix_acl_access_xattr_handler = {
+static int ovl_other_xattr_get(const struct xattr_handler *handler,
+                               struct dentry *dentry, struct inode *inode,
+                               const char *name, void *buffer, size_t size)
+{
+        return ovl_xattr_get(dentry, name, buffer, size);
+}
+
+static int ovl_other_xattr_set(const struct xattr_handler *handler,
+                               struct dentry *dentry, struct inode *inode,
+                               const char *name, const void *value,
+                               size_t size, int flags)
+{
+        return ovl_xattr_set(dentry, name, value, size, flags);
+}
+
+static const struct xattr_handler __maybe_unused
+ovl_posix_acl_access_xattr_handler = {
         .name = XATTR_NAME_POSIX_ACL_ACCESS,
         .flags = ACL_TYPE_ACCESS,
+        .get = ovl_posix_acl_xattr_get,
         .set = ovl_posix_acl_xattr_set,
 };
 
-static const struct xattr_handler ovl_posix_acl_default_xattr_handler = {
+static const struct xattr_handler __maybe_unused
+ovl_posix_acl_default_xattr_handler = {
         .name = XATTR_NAME_POSIX_ACL_DEFAULT,
         .flags = ACL_TYPE_DEFAULT,
+        .get = ovl_posix_acl_xattr_get,
         .set = ovl_posix_acl_xattr_set,
 };
 
 static const struct xattr_handler ovl_own_xattr_handler = {
         .prefix = OVL_XATTR_PREFIX,
+        .get = ovl_own_xattr_get,
         .set = ovl_own_xattr_set,
 };
 
 static const struct xattr_handler ovl_other_xattr_handler = {
         .prefix = "", /* catch all */
+        .get = ovl_other_xattr_get,
         .set = ovl_other_xattr_set,
 };
 
 static const struct xattr_handler *ovl_xattr_handlers[] = {
+#ifdef CONFIG_FS_POSIX_ACL
         &ovl_posix_acl_access_xattr_handler,
         &ovl_posix_acl_default_xattr_handler,
+#endif
         &ovl_own_xattr_handler,
         &ovl_other_xattr_handler,
         NULL
 };
 
-static const struct xattr_handler *ovl_xattr_noacl_handlers[] = {
-        &ovl_own_xattr_handler,
-        &ovl_other_xattr_handler,
-        NULL,
-};
-
 static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 {
         struct path upperpath = { NULL, NULL };
@@ -1132,7 +1180,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
         err = -EINVAL;
         stacklen = ovl_split_lowerdirs(lowertmp);
         if (stacklen > OVL_MAX_STACK) {
-                pr_err("overlayfs: too many lower directries, limit is %d\n",
+                pr_err("overlayfs: too many lower directories, limit is %d\n",
                        OVL_MAX_STACK);
                 goto out_free_lowertmp;
         } else if (!ufs->config.upperdir && stacklen == 1) {
@@ -1269,10 +1317,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
 
         sb->s_magic = OVERLAYFS_SUPER_MAGIC;
         sb->s_op = &ovl_super_operations;
-        if (IS_ENABLED(CONFIG_FS_POSIX_ACL))
-                sb->s_xattr = ovl_xattr_handlers;
-        else
-                sb->s_xattr = ovl_xattr_noacl_handlers;
+        sb->s_xattr = ovl_xattr_handlers;
         sb->s_root = root_dentry;
         sb->s_fs_info = ufs;
         sb->s_flags |= MS_POSIXACL;
diff --git a/fs/pipe.c b/fs/pipe.c
index 4b32928f5426..4ebe6b2e5217 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -144,10 +144,8 @@ static int anon_pipe_buf_steal(struct pipe_inode_info *pipe,
         struct page *page = buf->page;
 
         if (page_count(page) == 1) {
-                if (memcg_kmem_enabled()) {
+                if (memcg_kmem_enabled())
                         memcg_kmem_uncharge(page, 0);
-                        __ClearPageKmemcg(page);
-                }
                 __SetPageLocked(page);
                 return 0;
         }
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 54e270262979..ac0df4dde823 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1556,18 +1556,13 @@ static const struct file_operations proc_pid_set_comm_operations = {
 static int proc_exe_link(struct dentry *dentry, struct path *exe_path)
 {
         struct task_struct *task;
-        struct mm_struct *mm;
         struct file *exe_file;
 
         task = get_proc_task(d_inode(dentry));
         if (!task)
                 return -ENOENT;
-        mm = get_task_mm(task);
+        exe_file = get_task_exe_file(task);
         put_task_struct(task);
-        if (!mm)
-                return -ENOENT;
-        exe_file = get_mm_exe_file(mm);
-        mmput(mm);
         if (exe_file) {
                 *exe_path = exe_file->f_path;
                 path_get(&exe_file->f_path);
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index a939f5ed7f89..5c89a07e3d7f 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -430,6 +430,7 @@ static void elf_kcore_store_hdr(char *bufp, int nphdr, int dataoff)
 static ssize_t
 read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
 {
+        char *buf = file->private_data;
         ssize_t acc = 0;
         size_t size, tsz;
         size_t elf_buflen;
@@ -500,23 +501,20 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
                         if (clear_user(buffer, tsz))
                                 return -EFAULT;
                 } else if (is_vmalloc_or_module_addr((void *)start)) {
-                        char * elf_buf;
-
-                        elf_buf = kzalloc(tsz, GFP_KERNEL);
-                        if (!elf_buf)
-                                return -ENOMEM;
-                        vread(elf_buf, (char *)start, tsz);
+                        vread(buf, (char *)start, tsz);
                         /* we have to zero-fill user buffer even if no read */
-                        if (copy_to_user(buffer, elf_buf, tsz)) {
-                                kfree(elf_buf);
+                        if (copy_to_user(buffer, buf, tsz))
                                 return -EFAULT;
-                        }
-                        kfree(elf_buf);
                 } else {
                         if (kern_addr_valid(start)) {
                                 unsigned long n;
 
-                                n = copy_to_user(buffer, (char *)start, tsz);
+                                /*
+                                 * Using bounce buffer to bypass the
+                                 * hardened user copy kernel text checks.
+                                 */
+                                memcpy(buf, (char *) start, tsz);
+                                n = copy_to_user(buffer, buf, tsz);
                                 /*
                                  * We cannot distinguish between fault on source
                                  * and fault on destination. When this happens
@@ -549,6 +547,11 @@ static int open_kcore(struct inode *inode, struct file *filp)
 {
         if (!capable(CAP_SYS_RAWIO))
                 return -EPERM;
+
+        filp->private_data = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        if (!filp->private_data)
+                return -ENOMEM;
+
         if (kcore_need_update)
                 kcore_update_ram();
         if (i_size_read(inode) != proc_root_kcore->size) {
@@ -559,10 +562,16 @@ static int open_kcore(struct inode *inode, struct file *filp)
         return 0;
 }
 
+static int release_kcore(struct inode *inode, struct file *file)
+{
+        kfree(file->private_data);
+        return 0;
+}
 
 static const struct file_operations proc_kcore_operations = {
         .read           = read_kcore,
         .open           = open_kcore,
+        .release        = release_kcore,
         .llseek         = default_llseek,
 };
 
diff --git a/fs/proc/meminfo.c b/fs/proc/meminfo.c
index 09e18fdf61e5..b9a8c813e5e6 100644
--- a/fs/proc/meminfo.c
+++ b/fs/proc/meminfo.c
@@ -46,7 +46,7 @@ static int meminfo_proc_show(struct seq_file *m, void *v)
                 cached = 0;
 
         for (lru = LRU_BASE; lru < NR_LRU_LISTS; lru++)
-                pages[lru] = global_page_state(NR_LRU_BASE + lru);
+                pages[lru] = global_node_page_state(NR_LRU_BASE + lru);
 
         available = si_mem_available();
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 187d84ef9de9..f6fa99eca515 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -581,6 +581,8 @@ static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
                 mss->anonymous_thp += HPAGE_PMD_SIZE;
         else if (PageSwapBacked(page))
                 mss->shmem_thp += HPAGE_PMD_SIZE;
+        else if (is_zone_device_page(page))
+                /* pass */;
         else
                 VM_BUG_ON_PAGE(1, page);
         smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd));
diff --git a/fs/ramfs/file-mmu.c b/fs/ramfs/file-mmu.c
index 183a212694bf..12af0490322f 100644
--- a/fs/ramfs/file-mmu.c
+++ b/fs/ramfs/file-mmu.c
@@ -27,9 +27,17 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/ramfs.h>
+#include <linux/sched.h>
 
 #include "internal.h"
 
+static unsigned long ramfs_mmu_get_unmapped_area(struct file *file,
+                unsigned long addr, unsigned long len, unsigned long pgoff,
+                unsigned long flags)
+{
+        return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
 const struct file_operations ramfs_file_operations = {
         .read_iter      = generic_file_read_iter,
         .write_iter     = generic_file_write_iter,
@@ -38,6 +46,7 @@ const struct file_operations ramfs_file_operations = {
         .splice_read    = generic_file_splice_read,
         .splice_write   = iter_file_splice_write,
         .llseek         = generic_file_llseek,
+        .get_unmapped_area      = ramfs_mmu_get_unmapped_area,
 };
 
 const struct inode_operations ramfs_file_inode_operations = {
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 19f532e7d35e..6dc4296eed62 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -223,8 +223,10 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
                 size -= n;
                 buf += n;
                 copied += n;
-                if (!m->count)
+                if (!m->count) {
+                        m->from = 0;
                         m->index++;
+                }
                 if (!size)
                         goto Done;
         }
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index f35523d4fa3a..b803213d1307 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -114,9 +114,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
          * If buf != of->prealloc_buf, we don't know how
          * large it is, so cannot safely pass it to ->show
          */
-        if (pos || WARN_ON_ONCE(buf != of->prealloc_buf))
+        if (WARN_ON_ONCE(buf != of->prealloc_buf))
                 return 0;
         len = ops->show(kobj, of->kn->priv, buf);
+        if (pos) {
+                if (len <= pos)
+                        return 0;
+                len -= pos;
+                memmove(buf, buf + pos, len);
+        }
         return min(count, len);
 }
 
diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c
index b45345d701e7..51157da3f76e 100644
--- a/fs/ubifs/tnc_commit.c
+++ b/fs/ubifs/tnc_commit.c
@@ -370,7 +370,7 @@ static int layout_in_gaps(struct ubifs_info *c, int cnt)
 
         p = c->gap_lebs;
         do {
-                ubifs_assert(p < c->gap_lebs + sizeof(int) * c->lst.idx_lebs);
+                ubifs_assert(p < c->gap_lebs + c->lst.idx_lebs);
                 written = layout_leb_in_gaps(c, p);
                 if (written < 0) {
                         err = written;
diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
index e237811f09ce..11a004114eba 100644
--- a/fs/ubifs/xattr.c
+++ b/fs/ubifs/xattr.c
@@ -575,7 +575,8 @@ static int ubifs_xattr_get(const struct xattr_handler *handler,
         dbg_gen("xattr '%s', ino %lu ('%pd'), buf size %zd", name,
                 inode->i_ino, dentry, size);
 
-        return  __ubifs_getxattr(inode, name, buffer, size);
+        name = xattr_full_name(handler, name);
+        return __ubifs_getxattr(inode, name, buffer, size);
 }
 
 static int ubifs_xattr_set(const struct xattr_handler *handler,
@@ -586,6 +587,8 @@ static int ubifs_xattr_set(const struct xattr_handler *handler,
         dbg_gen("xattr '%s', host ino %lu ('%pd'), size %zd",
                 name, inode->i_ino, dentry, size);
 
+        name = xattr_full_name(handler, name);
+
         if (value)
                 return __ubifs_setxattr(inode, name, value, size, flags);
         else
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 776ae2f325d1..05b5243d89f6 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -1582,6 +1582,7 @@ xfs_alloc_ag_vextent_small(
         xfs_extlen_t    *flenp, /* result length */
         int             *stat)  /* status: 0-freelist, 1-normal/none */
 {
+        struct xfs_owner_info   oinfo;
         int             error;
         xfs_agblock_t   fbno;
         xfs_extlen_t    flen;
@@ -1624,6 +1625,18 @@ xfs_alloc_ag_vextent_small(
                                 error0);
                         args->wasfromfl = 1;
                         trace_xfs_alloc_small_freelist(args);
+
+                        /*
+                         * If we're feeding an AGFL block to something that
+                         * doesn't live in the free space, we need to clear
+                         * out the OWN_AG rmap.
+                         */
+                        xfs_rmap_ag_owner(&oinfo, XFS_RMAP_OWN_AG);
+                        error = xfs_rmap_free(args->tp, args->agbp, args->agno,
+                                        fbno, 1, &oinfo);
+                        if (error)
+                                goto error0;
+
                         *stat = 0;
                         return 0;
                 }
@@ -2264,6 +2277,9 @@ xfs_alloc_log_agf(
                 offsetof(xfs_agf_t, agf_longest),
                 offsetof(xfs_agf_t, agf_btreeblks),
                 offsetof(xfs_agf_t, agf_uuid),
+                offsetof(xfs_agf_t, agf_rmap_blocks),
+                /* needed so that we don't log the whole rest of the structure: */
+                offsetof(xfs_agf_t, agf_spare64),
                 sizeof(xfs_agf_t)
         };
 
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index b5c213a051cd..08569792fe20 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -1814,6 +1814,10 @@ xfs_btree_lookup(
 
         XFS_BTREE_STATS_INC(cur, lookup);
 
+        /* No such thing as a zero-level tree. */
+        if (cur->bc_nlevels == 0)
+                return -EFSCORRUPTED;
+
         block = NULL;
         keyno = 0;
 
@@ -4554,15 +4558,22 @@ xfs_btree_simple_query_range(
         if (error)
                 goto out;
 
+        /* Nothing?  See if there's anything to the right. */
+        if (!stat) {
+                error = xfs_btree_increment(cur, 0, &stat);
+                if (error)
+                        goto out;
+        }
+
         while (stat) {
                 /* Find the record. */
                 error = xfs_btree_get_rec(cur, &recp, &stat);
                 if (error || !stat)
                         break;
-                cur->bc_ops->init_high_key_from_rec(&rec_key, recp);
 
                 /* Skip if high_key(rec) < low_key. */
                 if (firstrec) {
+                        cur->bc_ops->init_high_key_from_rec(&rec_key, recp);
                         firstrec = false;
                         diff = cur->bc_ops->diff_two_keys(cur, low_key,
                                         &rec_key);
@@ -4571,6 +4582,7 @@ xfs_btree_simple_query_range(
                 }
 
                 /* Stop if high_key < low_key(rec). */
+                cur->bc_ops->init_key_from_rec(&rec_key, recp);
                 diff = cur->bc_ops->diff_two_keys(cur, &rec_key, high_key);
                 if (diff > 0)
                         break;
diff --git a/fs/xfs/libxfs/xfs_defer.c b/fs/xfs/libxfs/xfs_defer.c
index 054a2032fdb3..c221d0ecd52e 100644
--- a/fs/xfs/libxfs/xfs_defer.c
+++ b/fs/xfs/libxfs/xfs_defer.c
@@ -194,7 +194,7 @@ xfs_defer_trans_abort(
         /* Abort intent items. */
         list_for_each_entry(dfp, &dop->dop_pending, dfp_list) {
                 trace_xfs_defer_pending_abort(tp->t_mountp, dfp);
-                if (dfp->dfp_committed)
+                if (!dfp->dfp_done)
                         dfp->dfp_type->abort_intent(dfp->dfp_intent);
         }
 
@@ -290,7 +290,6 @@ xfs_defer_finish(
         struct xfs_defer_pending        *dfp;
         struct list_head                *li;
         struct list_head                *n;
-        void                            *done_item = NULL;
         void                            *state;
         int                             error = 0;
         void                            (*cleanup_fn)(struct xfs_trans *, void *, int);
@@ -309,19 +308,11 @@ xfs_defer_finish(
                 if (error)
                         goto out;
 
-                /* Mark all pending intents as committed. */
-                list_for_each_entry_reverse(dfp, &dop->dop_pending, dfp_list) {
-                        if (dfp->dfp_committed)
-                                break;
-                        trace_xfs_defer_pending_commit((*tp)->t_mountp, dfp);
-                        dfp->dfp_committed = true;
-                }
-
                 /* Log an intent-done item for the first pending item. */
                 dfp = list_first_entry(&dop->dop_pending,
                                 struct xfs_defer_pending, dfp_list);
                 trace_xfs_defer_pending_finish((*tp)->t_mountp, dfp);
-                done_item = dfp->dfp_type->create_done(*tp, dfp->dfp_intent,
+                dfp->dfp_done = dfp->dfp_type->create_done(*tp, dfp->dfp_intent,
                                 dfp->dfp_count);
                 cleanup_fn = dfp->dfp_type->finish_cleanup;
 
@@ -331,7 +322,7 @@ xfs_defer_finish(
                         list_del(li);
                         dfp->dfp_count--;
                         error = dfp->dfp_type->finish_item(*tp, dop, li,
-                                        done_item, &state);
+                                        dfp->dfp_done, &state);
                         if (error) {
                                 /*
                                  * Clean up after ourselves and jump out.
@@ -428,8 +419,8 @@ xfs_defer_add(
                 dfp = kmem_alloc(sizeof(struct xfs_defer_pending),
                                 KM_SLEEP | KM_NOFS);
                 dfp->dfp_type = defer_op_types[type];
-                dfp->dfp_committed = false;
                 dfp->dfp_intent = NULL;
+                dfp->dfp_done = NULL;
                 dfp->dfp_count = 0;
                 INIT_LIST_HEAD(&dfp->dfp_work);
                 list_add_tail(&dfp->dfp_list, &dop->dop_intake);
diff --git a/fs/xfs/libxfs/xfs_defer.h b/fs/xfs/libxfs/xfs_defer.h
index cc3981c48296..e96533d178cf 100644
--- a/fs/xfs/libxfs/xfs_defer.h
+++ b/fs/xfs/libxfs/xfs_defer.h
@@ -30,8 +30,8 @@ struct xfs_defer_op_type;
 struct xfs_defer_pending {
         const struct xfs_defer_op_type  *dfp_type;      /* function pointers */
         struct list_head                dfp_list;       /* pending items */
-        bool                            dfp_committed;  /* committed trans? */
         void                            *dfp_intent;    /* log intent item */
+        void                            *dfp_done;      /* log done item */
         struct list_head                dfp_work;       /* work items */
         unsigned int                    dfp_count;      /* # extent items */
 };
diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h
index f814d42c73b2..270fb5cf4fa1 100644
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -640,12 +640,15 @@ typedef struct xfs_agf {
         __be32          agf_btreeblks;  /* # of blocks held in AGF btrees */
         uuid_t          agf_uuid;       /* uuid of filesystem */
 
+        __be32          agf_rmap_blocks;        /* rmapbt blocks used */
+        __be32          agf_padding;            /* padding */
+
         /*
          * reserve some contiguous space for future logged fields before we add
          * the unlogged fields. This makes the range logging via flags and
          * structure offsets much simpler.
          */
-        __be64          agf_spare64[16];
+        __be64          agf_spare64[15];
 
         /* unlogged fields, written during buffer writeback. */
         __be64          agf_lsn;        /* last write sequence */
@@ -670,7 +673,9 @@ typedef struct xfs_agf {
 #define XFS_AGF_LONGEST         0x00000400
 #define XFS_AGF_BTREEBLKS       0x00000800
 #define XFS_AGF_UUID            0x00001000
-#define XFS_AGF_NUM_BITS        13
+#define XFS_AGF_RMAP_BLOCKS     0x00002000
+#define XFS_AGF_SPARE64         0x00004000
+#define XFS_AGF_NUM_BITS        15
 #define XFS_AGF_ALL_BITS        ((1 << XFS_AGF_NUM_BITS) - 1)
 
 #define XFS_AGF_FLAGS \
@@ -686,7 +691,9 @@ typedef struct xfs_agf {
         { XFS_AGF_FREEBLKS,     "FREEBLKS" }, \
         { XFS_AGF_LONGEST,      "LONGEST" }, \
         { XFS_AGF_BTREEBLKS,    "BTREEBLKS" }, \
-        { XFS_AGF_UUID,         "UUID" }
+        { XFS_AGF_UUID,         "UUID" }, \
+        { XFS_AGF_RMAP_BLOCKS,  "RMAP_BLOCKS" }, \
+        { XFS_AGF_SPARE64,      "SPARE64" }
 
 /* disk block (xfs_daddr_t) in the AG */
 #define XFS_AGF_DADDR(mp)       ((xfs_daddr_t)(1 << (mp)->m_sectbb_log))
diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
index bc1faebc84ec..17b8eeb34ac8 100644
--- a/fs/xfs/libxfs/xfs_rmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rmap_btree.c
@@ -98,6 +98,8 @@ xfs_rmapbt_alloc_block(
         union xfs_btree_ptr     *new,
         int                     *stat)
 {
+        struct xfs_buf          *agbp = cur->bc_private.a.agbp;
+        struct xfs_agf          *agf = XFS_BUF_TO_AGF(agbp);
         int                     error;
         xfs_agblock_t           bno;
 
@@ -124,6 +126,8 @@ xfs_rmapbt_alloc_block(
 
         xfs_trans_agbtree_delta(cur->bc_tp, 1);
         new->s = cpu_to_be32(bno);
+        be32_add_cpu(&agf->agf_rmap_blocks, 1);
+        xfs_alloc_log_agf(cur->bc_tp, agbp, XFS_AGF_RMAP_BLOCKS);
 
         XFS_BTREE_TRACE_CURSOR(cur, XBT_EXIT);
         *stat = 1;
@@ -143,6 +147,8 @@ xfs_rmapbt_free_block(
         bno = xfs_daddr_to_agbno(cur->bc_mp, XFS_BUF_ADDR(bp));
         trace_xfs_rmapbt_free_block(cur->bc_mp, cur->bc_private.a.agno,
                         bno, 1);
+        be32_add_cpu(&agf->agf_rmap_blocks, -1);
+        xfs_alloc_log_agf(cur->bc_tp, agbp, XFS_AGF_RMAP_BLOCKS);
         error = xfs_alloc_put_freelist(cur->bc_tp, agbp, NULL, bno, 1);
         if (error)
                 return error;
diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index 0e3d4f5ec33c..4aecc5fefe96 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -583,7 +583,8 @@ xfs_sb_verify(
          * Only check the in progress field for the primary superblock as
          * mkfs.xfs doesn't clear it from secondary superblocks.
          */
-        return xfs_mount_validate_sb(mp, &sb, bp->b_bn == XFS_SB_DADDR,
+        return xfs_mount_validate_sb(mp, &sb,
+                                     bp->b_maps[0].bm_bn == XFS_SB_DADDR,
                                      check_version);
 }
 
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 47a318ce82e0..b5b9bffe3520 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -115,7 +115,6 @@ xfs_buf_ioacct_dec(
         if (!(bp->b_flags & _XBF_IN_FLIGHT))
                 return;
 
-        ASSERT(bp->b_flags & XBF_ASYNC);
         bp->b_flags &= ~_XBF_IN_FLIGHT;
         percpu_counter_dec(&bp->b_target->bt_io_count);
 }
@@ -1612,7 +1611,7 @@ xfs_wait_buftarg(
          */
         while (percpu_counter_sum(&btp->bt_io_count))
                 delay(100);
-        drain_workqueue(btp->bt_mount->m_buf_workqueue);
+        flush_workqueue(btp->bt_mount->m_buf_workqueue);
 
         /* loop until there is nothing left on the lru list. */
         while (list_lru_count(&btp->bt_lru)) {
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index ed95e5bb04e6..e612a0233710 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -741,9 +741,20 @@ xfs_file_dax_write(
          * page is inserted into the pagecache when we have to serve a write
          * fault on a hole.  It should never be dirtied and can simply be
          * dropped from the pagecache once we get real data for the page.
+         *
+         * XXX: This is racy against mmap, and there's nothing we can do about
+         * it. dax_do_io() should really do this invalidation internally as
+         * it will know if we've allocated over a holei for this specific IO and
+         * if so it needs to update the mapping tree and invalidate existing
+         * PTEs over the newly allocated range. Remove this invalidation when
+         * dax_do_io() is fixed up.
          */
         if (mapping->nrpages) {
-                ret = invalidate_inode_pages2(mapping);
+                loff_t end = iocb->ki_pos + iov_iter_count(from) - 1;
+
+                ret = invalidate_inode_pages2_range(mapping,
+                                                    iocb->ki_pos >> PAGE_SHIFT,
+                                                    end >> PAGE_SHIFT);
                 WARN_ON_ONCE(ret);
         }
 
diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c
index 0f96847b90e1..0b7f986745c1 100644
--- a/fs/xfs/xfs_fsops.c
+++ b/fs/xfs/xfs_fsops.c
@@ -248,6 +248,7 @@ xfs_growfs_data_private(
                         agf->agf_roots[XFS_BTNUM_RMAPi] =
                                                 cpu_to_be32(XFS_RMAP_BLOCK(mp));
                         agf->agf_levels[XFS_BTNUM_RMAPi] = cpu_to_be32(1);
+                        agf->agf_rmap_blocks = cpu_to_be32(1);
                 }
 
                 agf->agf_flfirst = cpu_to_be32(1);
diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c
index 2114d53df433..2af0dda1c978 100644
--- a/fs/xfs/xfs_iomap.c
+++ b/fs/xfs/xfs_iomap.c
@@ -715,12 +715,16 @@ xfs_iomap_write_allocate(
                  * is in the delayed allocation extent on which we sit
                  * but before our buffer starts.
                  */
-
                 nimaps = 0;
                 while (nimaps == 0) {
                         nres = XFS_EXTENTADD_SPACE_RES(mp, XFS_DATA_FORK);
-
-                        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, nres,
+                        /*
+                         * We have already reserved space for the extent and any
+                         * indirect blocks when creating the delalloc extent,
+                         * there is no need to reserve space in this transaction
+                         * again.
+                         */
+                        error = xfs_trans_alloc(mp, &M_RES(mp)->tr_write, 0,
                                         0, XFS_TRANS_RESERVE, &tp);
                         if (error)
                                 return error;
@@ -1037,20 +1041,14 @@ xfs_file_iomap_begin(
                         return error;
 
                 trace_xfs_iomap_alloc(ip, offset, length, 0, &imap);
-                xfs_bmbt_to_iomap(ip, iomap, &imap);
-        } else if (nimaps) {
-                xfs_iunlock(ip, XFS_ILOCK_EXCL);
-                trace_xfs_iomap_found(ip, offset, length, 0, &imap);
-                xfs_bmbt_to_iomap(ip, iomap, &imap);
         } else {
+                ASSERT(nimaps);
+
                 xfs_iunlock(ip, XFS_ILOCK_EXCL);
-                trace_xfs_iomap_not_found(ip, offset, length, 0, &imap);
-                iomap->blkno = IOMAP_NULL_BLOCK;
-                iomap->type = IOMAP_HOLE;
-                iomap->offset = offset;
-                iomap->length = length;
+                trace_xfs_iomap_found(ip, offset, length, 0, &imap);
         }
 
+        xfs_bmbt_to_iomap(ip, iomap, &imap);
         return 0;
 }
 
@@ -1112,3 +1110,48 @@ struct iomap_ops xfs_iomap_ops = {
         .iomap_begin            = xfs_file_iomap_begin,
         .iomap_end              = xfs_file_iomap_end,
 };
+
+static int
+xfs_xattr_iomap_begin(
+        struct inode            *inode,
+        loff_t                  offset,
+        loff_t                  length,
+        unsigned                flags,
+        struct iomap            *iomap)
+{
+        struct xfs_inode        *ip = XFS_I(inode);
+        struct xfs_mount        *mp = ip->i_mount;
+        xfs_fileoff_t           offset_fsb = XFS_B_TO_FSBT(mp, offset);
+        xfs_fileoff_t           end_fsb = XFS_B_TO_FSB(mp, offset + length);
+        struct xfs_bmbt_irec    imap;
+        int                     nimaps = 1, error = 0;
+        unsigned                lockmode;
+
+        if (XFS_FORCED_SHUTDOWN(mp))
+                return -EIO;
+
+        lockmode = xfs_ilock_data_map_shared(ip);
+
+        /* if there are no attribute fork or extents, return ENOENT */
+        if (XFS_IFORK_Q(ip) || !ip->i_d.di_anextents) {
+                error = -ENOENT;
+                goto out_unlock;
+        }
+
+        ASSERT(ip->i_d.di_aformat != XFS_DINODE_FMT_LOCAL);
+        error = xfs_bmapi_read(ip, offset_fsb, end_fsb - offset_fsb, &imap,
+                               &nimaps, XFS_BMAPI_ENTIRE | XFS_BMAPI_ATTRFORK);
+out_unlock:
+        xfs_iunlock(ip, lockmode);
+
+        if (!error) {
+                ASSERT(nimaps);
+                xfs_bmbt_to_iomap(ip, iomap, &imap);
+        }
+
+        return error;
+}
+
+struct iomap_ops xfs_xattr_iomap_ops = {
+        .iomap_begin            = xfs_xattr_iomap_begin,
+};
diff --git a/fs/xfs/xfs_iomap.h b/fs/xfs/xfs_iomap.h
index e066d045e2ff..fb8aca3d69ab 100644
--- a/fs/xfs/xfs_iomap.h
+++ b/fs/xfs/xfs_iomap.h
@@ -35,5 +35,6 @@ void xfs_bmbt_to_iomap(struct xfs_inode *, struct iomap *,
                 struct xfs_bmbt_irec *);
 
 extern struct iomap_ops xfs_iomap_ops;
+extern struct iomap_ops xfs_xattr_iomap_ops;
 
 #endif /* __XFS_IOMAP_H__*/
diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index ab820f84ed50..b24c3102fa93 100644
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -1009,7 +1009,14 @@ xfs_vn_fiemap(
         int                     error;
 
         xfs_ilock(XFS_I(inode), XFS_IOLOCK_SHARED);
-        error = iomap_fiemap(inode, fieinfo, start, length, &xfs_iomap_ops);
+        if (fieinfo->fi_flags & FIEMAP_FLAG_XATTR) {
+                fieinfo->fi_flags &= ~FIEMAP_FLAG_XATTR;
+                error = iomap_fiemap(inode, fieinfo, start, length,
+                                &xfs_xattr_iomap_ops);
+        } else {
+                error = iomap_fiemap(inode, fieinfo, start, length,
+                                &xfs_iomap_ops);
+        }
         xfs_iunlock(XFS_I(inode), XFS_IOLOCK_SHARED);
 
         return error;
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 24ef83ef04de..fd6be45b3a1e 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1574,9 +1574,16 @@ xfs_fs_fill_super(
                 }
         }
 
-        if (xfs_sb_version_hasrmapbt(&mp->m_sb))
+        if (xfs_sb_version_hasrmapbt(&mp->m_sb)) {
+                if (mp->m_sb.sb_rblocks) {
+                        xfs_alert(mp,
+        "EXPERIMENTAL reverse mapping btree not compatible with realtime device!");
+                        error = -EINVAL;
+                        goto out_filestream_unmount;
+                }
                 xfs_alert(mp,
         "EXPERIMENTAL reverse mapping btree feature enabled. Use at your own risk!");
+        }
 
         error = xfs_mountfs(mp);
         if (error)
diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h
index 551b7e26980c..d303a665dba9 100644
--- a/fs/xfs/xfs_trace.h
+++ b/fs/xfs/xfs_trace.h
@@ -1298,7 +1298,6 @@ DEFINE_IOMAP_EVENT(xfs_get_blocks_alloc);
 DEFINE_IOMAP_EVENT(xfs_get_blocks_map_direct);
 DEFINE_IOMAP_EVENT(xfs_iomap_alloc);
 DEFINE_IOMAP_EVENT(xfs_iomap_found);
-DEFINE_IOMAP_EVENT(xfs_iomap_not_found);
 
 DECLARE_EVENT_CLASS(xfs_simple_io_class,
         TP_PROTO(struct xfs_inode *ip, xfs_off_t offset, ssize_t count),
@@ -2296,7 +2295,7 @@ DECLARE_EVENT_CLASS(xfs_defer_pending_class,
                 __entry->dev = mp ? mp->m_super->s_dev : 0;
                 __entry->type = dfp->dfp_type->type;
                 __entry->intent = dfp->dfp_intent;
-                __entry->committed = dfp->dfp_committed;
+                __entry->committed = dfp->dfp_done != NULL;
                 __entry->nr = dfp->dfp_count;
         ),
         TP_printk("dev %d:%d optype %d intent %p committed %d nr %d\n",
diff --git a/include/asm-generic/qrwlock.h b/include/asm-generic/qrwlock.h
index 54a8e65e18b6..7d026bf27713 100644
--- a/include/asm-generic/qrwlock.h
+++ b/include/asm-generic/qrwlock.h
@@ -25,7 +25,20 @@
 #include <asm-generic/qrwlock_types.h>
 
 /*
- * Writer states & reader shift and bias
+ * Writer states & reader shift and bias.
+ *
+ *       | +0 | +1 | +2 | +3 |
+ *   ----+----+----+----+----+
+ *    LE | 78 | 56 | 34 | 12 | 0x12345678
+ *   ----+----+----+----+----+
+ *       | wr |      rd      |
+ *       +----+----+----+----+
+ *
+ *   ----+----+----+----+----+
+ *    BE | 12 | 34 | 56 | 78 | 0x12345678
+ *   ----+----+----+----+----+
+ *       |      rd      | wr |
+ *       +----+----+----+----+
  */
 #define _QW_WAITING     1               /* A writer is waiting     */
 #define _QW_LOCKED      0xff            /* A writer holds the lock */
@@ -134,12 +147,22 @@ static inline void queued_read_unlock(struct qrwlock *lock)
 }
 
 /**
+ * __qrwlock_write_byte - retrieve the write byte address of a queue rwlock
+ * @lock : Pointer to queue rwlock structure
+ * Return: the write byte address of a queue rwlock
+ */
+static inline u8 *__qrwlock_write_byte(struct qrwlock *lock)
+{
+        return (u8 *)lock + 3 * IS_BUILTIN(CONFIG_CPU_BIG_ENDIAN);
+}
+
+/**
  * queued_write_unlock - release write lock of a queue rwlock
  * @lock : Pointer to queue rwlock structure
  */
 static inline void queued_write_unlock(struct qrwlock *lock)
 {
-        smp_store_release((u8 *)&lock->cnts, 0);
+        smp_store_release(__qrwlock_write_byte(lock), 0);
 }
 
 /*
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index 1bfa602958f2..6df9b0749671 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -72,6 +72,7 @@ struct exception_table_entry
 /* Returns 0 if exception not found and fixup otherwise.  */
 extern unsigned long search_exception_table(unsigned long);
 
+
 /*
  * architectures with an MMU should override these two
  */
@@ -230,14 +231,18 @@ extern int __put_user_bad(void) __attribute__((noreturn));
         might_fault();                                          \
         access_ok(VERIFY_READ, __p, sizeof(*ptr)) ?             \
                 __get_user((x), (__typeof__(*(ptr)) *)__p) :    \
-                -EFAULT;                                        \
+                ((x) = (__typeof__(*(ptr)))0,-EFAULT);          \
 })
 
 #ifndef __get_user_fn
 static inline int __get_user_fn(size_t size, const void __user *ptr, void *x)
 {
-        size = __copy_from_user(x, ptr, size);
-        return size ? -EFAULT : size;
+        size_t n = __copy_from_user(x, ptr, size);
+        if (unlikely(n)) {
+                memset(x + (size - n), 0, n);
+                return -EFAULT;
+        }
+        return 0;
 }
 
 #define __get_user_fn(sz, u, k) __get_user_fn(sz, u, k)
@@ -257,11 +262,13 @@ extern int __get_user_bad(void) __attribute__((noreturn));
 static inline long copy_from_user(void *to,
                 const void __user * from, unsigned long n)
 {
+        unsigned long res = n;
         might_fault();
-        if (access_ok(VERIFY_READ, from, n))
-                return __copy_from_user(to, from, n);
-        else
-                return n;
+        if (likely(access_ok(VERIFY_READ, from, n)))
+                res = __copy_from_user(to, from, n);
+        if (unlikely(res))
+                memset(to + (n - res), 0, res);
+        return res;
 }
 
 static inline long copy_to_user(void __user *to,
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 4348d6d5877a..99c6d01d24f2 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -962,6 +962,7 @@ void ttm_mem_io_free(struct ttm_bo_device *bdev,
  *
  * @bo: A pointer to a struct ttm_buffer_object.
  * @evict: 1: This is an eviction. Don't try to pipeline.
+ * @interruptible: Sleep interruptible if waiting.
  * @no_wait_gpu: Return immediately if the GPU is busy.
  * @new_mem: struct ttm_mem_reg indicating where to move.
  *
@@ -976,7 +977,7 @@ void ttm_mem_io_free(struct ttm_bo_device *bdev,
  */
 
 extern int ttm_bo_move_ttm(struct ttm_buffer_object *bo,
-                           bool evict, bool no_wait_gpu,
+                           bool evict, bool interruptible, bool no_wait_gpu,
                            struct ttm_mem_reg *new_mem);
 
 /**
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 4d8452c2384b..c5eaf2f80a4c 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -1056,7 +1056,7 @@ static inline struct fwnode_handle *acpi_get_next_subnode(struct device *dev,
         return NULL;
 }
 
-#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, validate, data, fn) \
+#define ACPI_DECLARE_PROBE_ENTRY(table, name, table_id, subtable, valid, data, fn) \
         static const void * __acpi_table_##name[]                       \
                 __attribute__((unused))                                 \
                  = { (void *) table_id,                                 \
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 59ffaa68b11b..23ddf4b46a9b 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -71,7 +71,8 @@ static inline bool bio_has_data(struct bio *bio)
 {
         if (bio &&
             bio->bi_iter.bi_size &&
-            bio_op(bio) != REQ_OP_DISCARD)
+            bio_op(bio) != REQ_OP_DISCARD &&
+            bio_op(bio) != REQ_OP_SECURE_ERASE)
                 return true;
 
         return false;
@@ -79,7 +80,9 @@ static inline bool bio_has_data(struct bio *bio)
 
 static inline bool bio_no_advance_iter(struct bio *bio)
 {
-        return bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_WRITE_SAME;
+        return bio_op(bio) == REQ_OP_DISCARD ||
+               bio_op(bio) == REQ_OP_SECURE_ERASE ||
+               bio_op(bio) == REQ_OP_WRITE_SAME;
 }
 
 static inline bool bio_is_rw(struct bio *bio)
@@ -199,6 +202,9 @@ static inline unsigned bio_segments(struct bio *bio)
         if (bio_op(bio) == REQ_OP_DISCARD)
                 return 1;
 
+        if (bio_op(bio) == REQ_OP_SECURE_ERASE)
+                return 1;
+
         if (bio_op(bio) == REQ_OP_WRITE_SAME)
                 return 1;
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 2c210b6a7bcf..e79055c8b577 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -882,7 +882,7 @@ static inline unsigned int blk_rq_cur_sectors(const struct request *rq)
 static inline unsigned int blk_queue_get_max_sectors(struct request_queue *q,
                                                      int op)
 {
-        if (unlikely(op == REQ_OP_DISCARD))
+        if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE))
                 return min(q->limits.max_discard_sectors, UINT_MAX >> 9);
 
         if (unlikely(op == REQ_OP_WRITE_SAME))
@@ -913,7 +913,9 @@ static inline unsigned int blk_rq_get_max_sectors(struct request *rq,
         if (unlikely(rq->cmd_type != REQ_TYPE_FS))
                 return q->limits.max_hw_sectors;
 
-        if (!q->limits.chunk_sectors || (req_op(rq) == REQ_OP_DISCARD))
+        if (!q->limits.chunk_sectors ||
+            req_op(rq) == REQ_OP_DISCARD ||
+            req_op(rq) == REQ_OP_SECURE_ERASE)
                 return blk_queue_get_max_sectors(q, req_op(rq));
 
         return min(blk_max_size_offset(q, offset),
diff --git a/include/linux/bvec.h b/include/linux/bvec.h
index 701b64a3b7c5..89b65b82d98f 100644
--- a/include/linux/bvec.h
+++ b/include/linux/bvec.h
@@ -74,7 +74,8 @@ static inline void bvec_iter_advance(const struct bio_vec *bv,
                   "Attempted to advance past end of bvec iter\n");
 
         while (bytes) {
-                unsigned len = min(bytes, bvec_iter_len(bv, *iter));
+                unsigned iter_len = bvec_iter_len(bv, *iter);
+                unsigned len = min(bytes, iter_len);
 
                 bytes -= len;
                 iter->bi_size -= len;
diff --git a/include/linux/cec-funcs.h b/include/linux/cec-funcs.h
index 82c3d3b7269d..138bbf721e70 100644
--- a/include/linux/cec-funcs.h
+++ b/include/linux/cec-funcs.h
@@ -162,10 +162,11 @@ static inline void cec_msg_standby(struct cec_msg *msg)
 
 
 /* One Touch Record Feature */
-static inline void cec_msg_record_off(struct cec_msg *msg)
+static inline void cec_msg_record_off(struct cec_msg *msg, bool reply)
 {
         msg->len = 2;
         msg->msg[1] = CEC_MSG_RECORD_OFF;
+        msg->reply = reply ? CEC_MSG_RECORD_STATUS : 0;
 }
 
 struct cec_op_arib_data {
@@ -227,7 +228,7 @@ static inline void cec_set_digital_service_id(__u8 *msg,
         if (digital->service_id_method == CEC_OP_SERVICE_ID_METHOD_BY_CHANNEL) {
                 *msg++ = (digital->channel.channel_number_fmt << 2) |
                          (digital->channel.major >> 8);
-                *msg++ = digital->channel.major && 0xff;
+                *msg++ = digital->channel.major & 0xff;
                 *msg++ = digital->channel.minor >> 8;
                 *msg++ = digital->channel.minor & 0xff;
                 *msg++ = 0;
@@ -323,6 +324,7 @@ static inline void cec_msg_record_on_phys_addr(struct cec_msg *msg,
 }
 
 static inline void cec_msg_record_on(struct cec_msg *msg,
+                                     bool reply,
                                      const struct cec_op_record_src *rec_src)
 {
         switch (rec_src->type) {
@@ -346,6 +348,7 @@ static inline void cec_msg_record_on(struct cec_msg *msg,
                                             rec_src->ext_phys_addr.phys_addr);
                 break;
         }
+        msg->reply = reply ? CEC_MSG_RECORD_STATUS : 0;
 }
 
 static inline void cec_ops_record_on(const struct cec_msg *msg,
@@ -1141,6 +1144,75 @@ static inline void cec_msg_give_device_vendor_id(struct cec_msg *msg,
         msg->reply = reply ? CEC_MSG_DEVICE_VENDOR_ID : 0;
 }
 
+static inline void cec_msg_vendor_command(struct cec_msg *msg,
+                                          __u8 size, const __u8 *vendor_cmd)
+{
+        if (size > 14)
+                size = 14;
+        msg->len = 2 + size;
+        msg->msg[1] = CEC_MSG_VENDOR_COMMAND;
+        memcpy(msg->msg + 2, vendor_cmd, size);
+}
+
+static inline void cec_ops_vendor_command(const struct cec_msg *msg,
+                                          __u8 *size,
+                                          const __u8 **vendor_cmd)
+{
+        *size = msg->len - 2;
+
+        if (*size > 14)
+                *size = 14;
+        *vendor_cmd = msg->msg + 2;
+}
+
+static inline void cec_msg_vendor_command_with_id(struct cec_msg *msg,
+                                                  __u32 vendor_id, __u8 size,
+                                                  const __u8 *vendor_cmd)
+{
+        if (size > 11)
+                size = 11;
+        msg->len = 5 + size;
+        msg->msg[1] = CEC_MSG_VENDOR_COMMAND_WITH_ID;
+        msg->msg[2] = vendor_id >> 16;
+        msg->msg[3] = (vendor_id >> 8) & 0xff;
+        msg->msg[4] = vendor_id & 0xff;
+        memcpy(msg->msg + 5, vendor_cmd, size);
+}
+
+static inline void cec_ops_vendor_command_with_id(const struct cec_msg *msg,
+                                                  __u32 *vendor_id,  __u8 *size,
+                                                  const __u8 **vendor_cmd)
+{
+        *size = msg->len - 5;
+
+        if (*size > 11)
+                *size = 11;
+        *vendor_id = (msg->msg[2] << 16) | (msg->msg[3] << 8) | msg->msg[4];
+        *vendor_cmd = msg->msg + 5;
+}
+
+static inline void cec_msg_vendor_remote_button_down(struct cec_msg *msg,
+                                                     __u8 size,
+                                                     const __u8 *rc_code)
+{
+        if (size > 14)
+                size = 14;
+        msg->len = 2 + size;
+        msg->msg[1] = CEC_MSG_VENDOR_REMOTE_BUTTON_DOWN;
+        memcpy(msg->msg + 2, rc_code, size);
+}
+
+static inline void cec_ops_vendor_remote_button_down(const struct cec_msg *msg,
+                                                     __u8 *size,
+                                                     const __u8 **rc_code)
+{
+        *size = msg->len - 2;
+
+        if (*size > 14)
+                *size = 14;
+        *rc_code = msg->msg + 2;
+}
+
 static inline void cec_msg_vendor_remote_button_up(struct cec_msg *msg)
 {
         msg->len = 2;
@@ -1277,7 +1349,7 @@ static inline void cec_msg_user_control_pressed(struct cec_msg *msg,
                 msg->len += 4;
                 msg->msg[3] = (ui_cmd->channel_identifier.channel_number_fmt << 2) |
                               (ui_cmd->channel_identifier.major >> 8);
-                msg->msg[4] = ui_cmd->channel_identifier.major && 0xff;
+                msg->msg[4] = ui_cmd->channel_identifier.major & 0xff;
                 msg->msg[5] = ui_cmd->channel_identifier.minor >> 8;
                 msg->msg[6] = ui_cmd->channel_identifier.minor & 0xff;
                 break;
diff --git a/include/linux/cec.h b/include/linux/cec.h
index b3e22893a002..851968e803fa 100644
--- a/include/linux/cec.h
+++ b/include/linux/cec.h
@@ -364,7 +364,7 @@ struct cec_caps {
  * @num_log_addrs: how many logical addresses should be claimed. Set by the
  *      caller.
  * @vendor_id: the vendor ID of the device. Set by the caller.
- * @flags: set to 0.
+ * @flags: flags.
  * @osd_name: the OSD name of the device. Set by the caller.
  * @primary_device_type: the primary device type for each logical address.
  *      Set by the caller.
@@ -389,6 +389,9 @@ struct cec_log_addrs {
         __u8 features[CEC_MAX_LOG_ADDRS][12];
 };
 
+/* Allow a fallback to unregistered */
+#define CEC_LOG_ADDRS_FL_ALLOW_UNREG_FALLBACK   (1 << 0)
+
 /* Events */
 
 /* Event that occurs when the adapter state changes */
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index e2949397c19b..573c5a18908f 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -158,7 +158,7 @@
 #define __compiler_offsetof(a, b)                                       \
         __builtin_offsetof(a, b)
 
-#if GCC_VERSION >= 40100 && GCC_VERSION < 40600
+#if GCC_VERSION >= 40100
 # define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
 #endif
 
@@ -242,7 +242,11 @@
  */
 #define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
 
-#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
+/*
+ * sparse (__CHECKER__) pretends to be gcc, but can't do constant
+ * folding in __builtin_bswap*() (yet), so don't set these for it.
+ */
+#if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) && !defined(__CHECKER__)
 #if GCC_VERSION >= 40400
 #define __HAVE_BUILTIN_BSWAP32__
 #define __HAVE_BUILTIN_BSWAP64__
@@ -250,7 +254,7 @@
 #if GCC_VERSION >= 40800
 #define __HAVE_BUILTIN_BSWAP16__
 #endif
-#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
+#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP && !__CHECKER__ */
 
 #if GCC_VERSION >= 50000
 #define KASAN_ABI_VERSION 4
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 1bb954842725..668569844d37 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -527,13 +527,14 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
  * object's lifetime is managed by something other than RCU.  That
  * "something other" might be reference counting or simple immortality.
  *
- * The seemingly unused void * variable is to validate @p is indeed a pointer
- * type. All pointer types silently cast to void *.
+ * The seemingly unused variable ___typecheck_p validates that @p is
+ * indeed a pointer type by using a pointer to typeof(*p) as the type.
+ * Taking a pointer to typeof(*p) again is needed in case p is void *.
  */
 #define lockless_dereference(p) \
 ({ \
         typeof(p) _________p1 = READ_ONCE(p); \
-        __maybe_unused const void * const _________p2 = _________p1; \
+        typeof(*(p)) *___typecheck_p __maybe_unused; \
         smp_read_barrier_depends(); /* Dependency order vs. p above. */ \
         (_________p1); \
 })
diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
index 242bf530edfc..34bd80512a0c 100644
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -1,6 +1,8 @@
 #ifndef __CPUHOTPLUG_H
 #define __CPUHOTPLUG_H
 
+#include <linux/types.h>
+
 enum cpuhp_state {
         CPUHP_OFFLINE,
         CPUHP_CREATE_THREADS,
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 7f5a58225385..0148a3046b48 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -118,6 +118,15 @@ typedef struct {
         u32 imagesize;
 } efi_capsule_header_t;
 
+struct efi_boot_memmap {
+        efi_memory_desc_t       **map;
+        unsigned long           *map_size;
+        unsigned long           *desc_size;
+        u32                     *desc_ver;
+        unsigned long           *key_ptr;
+        unsigned long           *buff_size;
+};
+
 /*
  * EFI capsule flags
  */
@@ -946,7 +955,7 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm,
 /* Iterate through an efi_memory_map */
 #define for_each_efi_memory_desc_in_map(m, md)                             \
         for ((md) = (m)->map;                                              \
-             ((void *)(md) + (m)->desc_size) <= (m)->map_end;              \
+             (md) && ((void *)(md) + (m)->desc_size) <= (m)->map_end;      \
              (md) = (void *)(md) + (m)->desc_size)
 
 /**
@@ -1371,11 +1380,7 @@ char *efi_convert_cmdline(efi_system_table_t *sys_table_arg,
                           efi_loaded_image_t *image, int *cmd_line_len);
 
 efi_status_t efi_get_memory_map(efi_system_table_t *sys_table_arg,
-                                efi_memory_desc_t **map,
-                                unsigned long *map_size,
-                                unsigned long *desc_size,
-                                u32 *desc_ver,
-                                unsigned long *key_ptr);
+                                struct efi_boot_memmap *map);
 
 efi_status_t efi_low_alloc(efi_system_table_t *sys_table_arg,
                            unsigned long size, unsigned long align,
@@ -1457,4 +1462,14 @@ extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
         arch_efi_call_virt_teardown();                                  \
 })
 
+typedef efi_status_t (*efi_exit_boot_map_processing)(
+        efi_system_table_t *sys_table_arg,
+        struct efi_boot_memmap *map,
+        void *priv);
+
+efi_status_t efi_exit_boot_services(efi_system_table_t *sys_table,
+                                    void *handle,
+                                    struct efi_boot_memmap *map,
+                                    void *priv,
+                                    efi_exit_boot_map_processing priv_func);
 #endif /* _LINUX_EFI_H */
diff --git a/include/linux/fence.h b/include/linux/fence.h
index 8cc719a63728..2ac6fa5f4712 100644
--- a/include/linux/fence.h
+++ b/include/linux/fence.h
@@ -49,8 +49,6 @@ struct fence_cb;
  * @timestamp: Timestamp when the fence was signaled.
  * @status: Optional, only valid if < 0, must be set before calling
  * fence_signal, indicates that the fence has completed with an error.
- * @child_list: list of children fences
- * @active_list: list of active fences
  *
  * the flags member must be manipulated and read using the appropriate
  * atomic ops (bit_*), so taking the spinlock will not be needed most
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 3523bf62f328..901e25d495cc 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -574,6 +574,7 @@ static inline void mapping_allow_writable(struct address_space *mapping)
 
 struct posix_acl;
 #define ACL_NOT_CACHED ((void *)(-1))
+#define ACL_DONT_CACHE ((void *)(-3))
 
 static inline struct posix_acl *
 uncached_acl_sentinel(struct task_struct *task)
diff --git a/include/linux/fscrypto.h b/include/linux/fscrypto.h
index cfa6cde25f8e..76cff18bb032 100644
--- a/include/linux/fscrypto.h
+++ b/include/linux/fscrypto.h
@@ -274,8 +274,7 @@ extern void fscrypt_restore_control_page(struct page *);
 extern int fscrypt_zeroout_range(struct inode *, pgoff_t, sector_t,
                                                 unsigned int);
 /* policy.c */
-extern int fscrypt_process_policy(struct inode *,
-                                        const struct fscrypt_policy *);
+extern int fscrypt_process_policy(struct file *, const struct fscrypt_policy *);
 extern int fscrypt_get_policy(struct inode *, struct fscrypt_policy *);
 extern int fscrypt_has_permitted_context(struct inode *, struct inode *);
 extern int fscrypt_inherit_context(struct inode *, struct inode *,
@@ -345,7 +344,7 @@ static inline int fscrypt_notsupp_zeroout_range(struct inode *i, pgoff_t p,
 }
 
 /* policy.c */
-static inline int fscrypt_notsupp_process_policy(struct inode *i,
+static inline int fscrypt_notsupp_process_policy(struct file *f,
                                 const struct fscrypt_policy *p)
 {
         return -EOPNOTSUPP;
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index 58205f33af02..7268ed076be8 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -148,6 +148,7 @@ struct fsnotify_group {
         #define FS_PRIO_1       1 /* fanotify content based access control */
         #define FS_PRIO_2       2 /* fanotify pre-content access */
         unsigned int priority;
+        bool shutdown;          /* group is being shut down, don't queue more events */
 
         /* stores all fastpath marks assoc with this group so they can be cleaned on unregister */
         struct mutex mark_mutex;        /* protect marks_list */
@@ -179,7 +180,6 @@ struct fsnotify_group {
                         spinlock_t access_lock;
                         struct list_head access_list;
                         wait_queue_head_t access_waitq;
-                        atomic_t bypass_perm;
 #endif /* CONFIG_FANOTIFY_ACCESS_PERMISSIONS */
                         int f_flags;
                         unsigned int max_marks;
@@ -292,6 +292,8 @@ extern struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *op
 extern void fsnotify_get_group(struct fsnotify_group *group);
 /* drop reference on a group from fsnotify_alloc_group */
 extern void fsnotify_put_group(struct fsnotify_group *group);
+/* group destruction begins, stop queuing new events */
+extern void fsnotify_group_stop_queueing(struct fsnotify_group *group);
 /* destroy group */
 extern void fsnotify_destroy_group(struct fsnotify_group *group);
 /* fasync handler function */
@@ -304,8 +306,6 @@ extern int fsnotify_add_event(struct fsnotify_group *group,
                               struct fsnotify_event *event,
                               int (*merge)(struct list_head *,
                                            struct fsnotify_event *));
-/* Remove passed event from groups notification queue */
-extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event);
 /* true if the group notification queue is empty */
 extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group);
 /* return, but do not dequeue the first event on the notification queue */
diff --git a/include/linux/host1x.h b/include/linux/host1x.h
index d2ba7d334039..1ffbf2a8cb99 100644
--- a/include/linux/host1x.h
+++ b/include/linux/host1x.h
@@ -304,6 +304,8 @@ struct tegra_mipi_device;
 
 struct tegra_mipi_device *tegra_mipi_request(struct device *device);
 void tegra_mipi_free(struct tegra_mipi_device *device);
+int tegra_mipi_enable(struct tegra_mipi_device *device);
+int tegra_mipi_disable(struct tegra_mipi_device *device);
 int tegra_mipi_calibrate(struct tegra_mipi_device *device);
 
 #endif
diff --git a/include/linux/iio/sw_trigger.h b/include/linux/iio/sw_trigger.h
index 5198f8ed08a4..c97eab67558f 100644
--- a/include/linux/iio/sw_trigger.h
+++ b/include/linux/iio/sw_trigger.h
@@ -62,7 +62,7 @@ void iio_swt_group_init_type_name(struct iio_sw_trigger *t,
                                   const char *name,
                                   struct config_item_type *type)
 {
-#ifdef CONFIG_CONFIGFS_FS
+#if IS_ENABLED(CONFIG_CONFIGFS_FS)
         config_group_init_type_name(&t->group, name, type);
 #endif
 }
diff --git a/include/linux/iomap.h b/include/linux/iomap.h
index 3267df461012..3d70ece10313 100644
--- a/include/linux/iomap.h
+++ b/include/linux/iomap.h
@@ -19,6 +19,11 @@ struct vm_fault;
 #define IOMAP_UNWRITTEN 0x04    /* blocks allocated @blkno in unwritten state */
 
 /*
+ * Flags for iomap mappings:
+ */
+#define IOMAP_F_MERGED  0x01    /* contains multiple blocks/extents */
+
+/*
  * Magic value for blkno:
  */
 #define IOMAP_NULL_BLOCK -1LL   /* blkno is not valid */
@@ -27,7 +32,8 @@ struct iomap {
         sector_t                blkno;  /* 1st sector of mapping, 512b units */
         loff_t                  offset; /* file offset of mapping, bytes */
         u64                     length; /* length of mapping, bytes */
-        int                     type;   /* type of mapping */
+        u16                     type;   /* type of mapping */
+        u16                     flags;  /* flags for mapping */
         struct block_device     *bdev;  /* block device for I/O */
 };
 
diff --git a/include/linux/irq.h b/include/linux/irq.h
index b52424eaa0ed..0ac26c892fe2 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -945,6 +945,16 @@ static inline void irq_gc_lock(struct irq_chip_generic *gc) { }
 static inline void irq_gc_unlock(struct irq_chip_generic *gc) { }
 #endif
 
+/*
+ * The irqsave variants are for usage in non interrupt code. Do not use
+ * them in irq_chip callbacks. Use irq_gc_lock() instead.
+ */
+#define irq_gc_lock_irqsave(gc, flags)  \
+        raw_spin_lock_irqsave(&(gc)->lock, flags)
+
+#define irq_gc_unlock_irqrestore(gc, flags)     \
+        raw_spin_unlock_irqrestore(&(gc)->lock, flags)
+
 static inline void irq_reg_writel(struct irq_chip_generic *gc,
                                   u32 val, int reg_offset)
 {
diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
index 56b0b7ec66aa..99ac022edc60 100644
--- a/include/linux/irqchip/arm-gic-v3.h
+++ b/include/linux/irqchip/arm-gic-v3.h
@@ -337,6 +337,7 @@
  */
 #define E_ITS_MOVI_UNMAPPED_INTERRUPT           0x010107
 #define E_ITS_MOVI_UNMAPPED_COLLECTION          0x010109
+#define E_ITS_INT_UNMAPPED_INTERRUPT            0x010307
 #define E_ITS_CLEAR_UNMAPPED_INTERRUPT          0x010507
 #define E_ITS_MAPD_DEVICE_OOR                   0x010801
 #define E_ITS_MAPC_PROCNUM_OOR                  0x010902
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 01e908ac4a39..9c28b4d4c90b 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -1113,9 +1113,21 @@ struct kvm_device {
 /* create, destroy, and name are mandatory */
 struct kvm_device_ops {
         const char *name;
+
+        /*
+         * create is called holding kvm->lock and any operations not suitable
+         * to do while holding the lock should be deferred to init (see
+         * below).
+         */
         int (*create)(struct kvm_device *dev, u32 type);
 
         /*
+         * init is called after create if create is successful and is called
+         * outside of holding kvm->lock.
+         */
+        void (*init)(struct kvm_device *dev);
+
+        /*
          * Destroy is responsible for freeing dev.
          *
          * Destroy may be called before or after destructors are called
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 4429d255c8ab..5e5b2969d931 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -195,6 +195,7 @@ static inline bool vma_migratable(struct vm_area_struct *vma)
 }
 
 extern int mpol_misplaced(struct page *, struct vm_area_struct *, unsigned long);
+extern void mpol_put_task_policy(struct task_struct *);
 
 #else
 
@@ -297,5 +298,8 @@ static inline int mpol_misplaced(struct page *page, struct vm_area_struct *vma,
         return -1; /* no node preference */
 }
 
+static inline void mpol_put_task_policy(struct task_struct *task)
+{
+}
 #endif /* CONFIG_NUMA */
 #endif
diff --git a/include/linux/mfd/da8xx-cfgchip.h b/include/linux/mfd/da8xx-cfgchip.h
new file mode 100644
index 000000000000..304985e288d2
--- /dev/null
+++ b/include/linux/mfd/da8xx-cfgchip.h
@@ -0,0 +1,153 @@
+/*
+ * TI DaVinci DA8xx CHIPCFGx registers for syscon consumers.
+ *
+ * Copyright (C) 2016 David Lechner <david@lechnology.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef __LINUX_MFD_DA8XX_CFGCHIP_H
+#define __LINUX_MFD_DA8XX_CFGCHIP_H
+
+#include <linux/bitops.h>
+
+/* register offset (32-bit registers) */
+#define CFGCHIP(n)                              ((n) * 4)
+
+/* CFGCHIP0 (PLL0/EDMA3_0) register bits */
+#define CFGCHIP0_PLL_MASTER_LOCK                BIT(4)
+#define CFGCHIP0_EDMA30TC1DBS(n)                ((n) << 2)
+#define CFGCHIP0_EDMA30TC1DBS_MASK              CFGCHIP0_EDMA30TC1DBS(0x3)
+#define CFGCHIP0_EDMA30TC1DBS_16                CFGCHIP0_EDMA30TC1DBS(0x0)
+#define CFGCHIP0_EDMA30TC1DBS_32                CFGCHIP0_EDMA30TC1DBS(0x1)
+#define CFGCHIP0_EDMA30TC1DBS_64                CFGCHIP0_EDMA30TC1DBS(0x2)
+#define CFGCHIP0_EDMA30TC0DBS(n)                ((n) << 0)
+#define CFGCHIP0_EDMA30TC0DBS_MASK              CFGCHIP0_EDMA30TC0DBS(0x3)
+#define CFGCHIP0_EDMA30TC0DBS_16                CFGCHIP0_EDMA30TC0DBS(0x0)
+#define CFGCHIP0_EDMA30TC0DBS_32                CFGCHIP0_EDMA30TC0DBS(0x1)
+#define CFGCHIP0_EDMA30TC0DBS_64                CFGCHIP0_EDMA30TC0DBS(0x2)
+
+/* CFGCHIP1 (eCAP/HPI/EDMA3_1/eHRPWM TBCLK/McASP0 AMUTEIN) register bits */
+#define CFGCHIP1_CAP2SRC(n)                     ((n) << 27)
+#define CFGCHIP1_CAP2SRC_MASK                   CFGCHIP1_CAP2SRC(0x1f)
+#define CFGCHIP1_CAP2SRC_ECAP_PIN               CFGCHIP1_CAP2SRC(0x0)
+#define CFGCHIP1_CAP2SRC_MCASP0_TX              CFGCHIP1_CAP2SRC(0x1)
+#define CFGCHIP1_CAP2SRC_MCASP0_RX              CFGCHIP1_CAP2SRC(0x2)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0x7)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_RX             CFGCHIP1_CAP2SRC(0x8)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_TX             CFGCHIP1_CAP2SRC(0x9)
+#define CFGCHIP1_CAP2SRC_EMAC_C0_MISC           CFGCHIP1_CAP2SRC(0xa)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0xb)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_RX             CFGCHIP1_CAP2SRC(0xc)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_TX             CFGCHIP1_CAP2SRC(0xd)
+#define CFGCHIP1_CAP2SRC_EMAC_C1_MISC           CFGCHIP1_CAP2SRC(0xe)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP2SRC(0xf)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_RX             CFGCHIP1_CAP2SRC(0x10)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_TX             CFGCHIP1_CAP2SRC(0x11)
+#define CFGCHIP1_CAP2SRC_EMAC_C2_MISC           CFGCHIP1_CAP2SRC(0x12)
+#define CFGCHIP1_CAP1SRC(n)                     ((n) << 22)
+#define CFGCHIP1_CAP1SRC_MASK                   CFGCHIP1_CAP1SRC(0x1f)
+#define CFGCHIP1_CAP1SRC_ECAP_PIN               CFGCHIP1_CAP1SRC(0x0)
+#define CFGCHIP1_CAP1SRC_MCASP0_TX              CFGCHIP1_CAP1SRC(0x1)
+#define CFGCHIP1_CAP1SRC_MCASP0_RX              CFGCHIP1_CAP1SRC(0x2)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0x7)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_RX             CFGCHIP1_CAP1SRC(0x8)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_TX             CFGCHIP1_CAP1SRC(0x9)
+#define CFGCHIP1_CAP1SRC_EMAC_C0_MISC           CFGCHIP1_CAP1SRC(0xa)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0xb)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_RX             CFGCHIP1_CAP1SRC(0xc)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_TX             CFGCHIP1_CAP1SRC(0xd)
+#define CFGCHIP1_CAP1SRC_EMAC_C1_MISC           CFGCHIP1_CAP1SRC(0xe)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP1SRC(0xf)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_RX             CFGCHIP1_CAP1SRC(0x10)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_TX             CFGCHIP1_CAP1SRC(0x11)
+#define CFGCHIP1_CAP1SRC_EMAC_C2_MISC           CFGCHIP1_CAP1SRC(0x12)
+#define CFGCHIP1_CAP0SRC(n)                     ((n) << 17)
+#define CFGCHIP1_CAP0SRC_MASK                   CFGCHIP1_CAP0SRC(0x1f)
+#define CFGCHIP1_CAP0SRC_ECAP_PIN               CFGCHIP1_CAP0SRC(0x0)
+#define CFGCHIP1_CAP0SRC_MCASP0_TX              CFGCHIP1_CAP0SRC(0x1)
+#define CFGCHIP1_CAP0SRC_MCASP0_RX              CFGCHIP1_CAP0SRC(0x2)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0x7)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_RX             CFGCHIP1_CAP0SRC(0x8)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_TX             CFGCHIP1_CAP0SRC(0x9)
+#define CFGCHIP1_CAP0SRC_EMAC_C0_MISC           CFGCHIP1_CAP0SRC(0xa)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0xb)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_RX             CFGCHIP1_CAP0SRC(0xc)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_TX             CFGCHIP1_CAP0SRC(0xd)
+#define CFGCHIP1_CAP0SRC_EMAC_C1_MISC           CFGCHIP1_CAP0SRC(0xe)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_RX_THRESHOLD   CFGCHIP1_CAP0SRC(0xf)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_RX             CFGCHIP1_CAP0SRC(0x10)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_TX             CFGCHIP1_CAP0SRC(0x11)
+#define CFGCHIP1_CAP0SRC_EMAC_C2_MISC           CFGCHIP1_CAP0SRC(0x12)
+#define CFGCHIP1_HPIBYTEAD                      BIT(16)
+#define CFGCHIP1_HPIENA                         BIT(15)
+#define CFGCHIP0_EDMA31TC0DBS(n)                ((n) << 13)
+#define CFGCHIP0_EDMA31TC0DBS_MASK              CFGCHIP0_EDMA31TC0DBS(0x3)
+#define CFGCHIP0_EDMA31TC0DBS_16                CFGCHIP0_EDMA31TC0DBS(0x0)
+#define CFGCHIP0_EDMA31TC0DBS_32                CFGCHIP0_EDMA31TC0DBS(0x1)
+#define CFGCHIP0_EDMA31TC0DBS_64                CFGCHIP0_EDMA31TC0DBS(0x2)
+#define CFGCHIP1_TBCLKSYNC                      BIT(12)
+#define CFGCHIP1_AMUTESEL0(n)                   ((n) << 0)
+#define CFGCHIP1_AMUTESEL0_MASK                 CFGCHIP1_AMUTESEL0(0xf)
+#define CFGCHIP1_AMUTESEL0_LOW                  CFGCHIP1_AMUTESEL0(0x0)
+#define CFGCHIP1_AMUTESEL0_BANK_0               CFGCHIP1_AMUTESEL0(0x1)
+#define CFGCHIP1_AMUTESEL0_BANK_1               CFGCHIP1_AMUTESEL0(0x2)
+#define CFGCHIP1_AMUTESEL0_BANK_2               CFGCHIP1_AMUTESEL0(0x3)
+#define CFGCHIP1_AMUTESEL0_BANK_3               CFGCHIP1_AMUTESEL0(0x4)
+#define CFGCHIP1_AMUTESEL0_BANK_4               CFGCHIP1_AMUTESEL0(0x5)
+#define CFGCHIP1_AMUTESEL0_BANK_5               CFGCHIP1_AMUTESEL0(0x6)
+#define CFGCHIP1_AMUTESEL0_BANK_6               CFGCHIP1_AMUTESEL0(0x7)
+#define CFGCHIP1_AMUTESEL0_BANK_7               CFGCHIP1_AMUTESEL0(0x8)
+
+/* CFGCHIP2 (USB PHY) register bits */
+#define CFGCHIP2_PHYCLKGD                       BIT(17)
+#define CFGCHIP2_VBUSSENSE                      BIT(16)
+#define CFGCHIP2_RESET                          BIT(15)
+#define CFGCHIP2_OTGMODE(n)                     ((n) << 13)
+#define CFGCHIP2_OTGMODE_MASK                   CFGCHIP2_OTGMODE(0x3)
+#define CFGCHIP2_OTGMODE_NO_OVERRIDE            CFGCHIP2_OTGMODE(0x0)
+#define CFGCHIP2_OTGMODE_FORCE_HOST             CFGCHIP2_OTGMODE(0x1)
+#define CFGCHIP2_OTGMODE_FORCE_DEVICE           CFGCHIP2_OTGMODE(0x2)
+#define CFGCHIP2_OTGMODE_FORCE_HOST_VBUS_LOW    CFGCHIP2_OTGMODE(0x3)
+#define CFGCHIP2_USB1PHYCLKMUX                  BIT(12)
+#define CFGCHIP2_USB2PHYCLKMUX                  BIT(11)
+#define CFGCHIP2_PHYPWRDN                       BIT(10)
+#define CFGCHIP2_OTGPWRDN                       BIT(9)
+#define CFGCHIP2_DATPOL                         BIT(8)
+#define CFGCHIP2_USB1SUSPENDM                   BIT(7)
+#define CFGCHIP2_PHY_PLLON                      BIT(6)
+#define CFGCHIP2_SESENDEN                       BIT(5)
+#define CFGCHIP2_VBDTCTEN                       BIT(4)
+#define CFGCHIP2_REFFREQ(n)                     ((n) << 0)
+#define CFGCHIP2_REFFREQ_MASK                   CFGCHIP2_REFFREQ(0xf)
+#define CFGCHIP2_REFFREQ_12MHZ                  CFGCHIP2_REFFREQ(0x1)
+#define CFGCHIP2_REFFREQ_24MHZ                  CFGCHIP2_REFFREQ(0x2)
+#define CFGCHIP2_REFFREQ_48MHZ                  CFGCHIP2_REFFREQ(0x3)
+#define CFGCHIP2_REFFREQ_19_2MHZ                CFGCHIP2_REFFREQ(0x4)
+#define CFGCHIP2_REFFREQ_38_4MHZ                CFGCHIP2_REFFREQ(0x5)
+#define CFGCHIP2_REFFREQ_13MHZ                  CFGCHIP2_REFFREQ(0x6)
+#define CFGCHIP2_REFFREQ_26MHZ                  CFGCHIP2_REFFREQ(0x7)
+#define CFGCHIP2_REFFREQ_20MHZ                  CFGCHIP2_REFFREQ(0x8)
+#define CFGCHIP2_REFFREQ_40MHZ                  CFGCHIP2_REFFREQ(0x9)
+
+/* CFGCHIP3 (EMAC/uPP/PLL1/ASYNC3/PRU/DIV4.5/EMIFA) register bits */
+#define CFGCHIP3_RMII_SEL                       BIT(8)
+#define CFGCHIP3_UPP_TX_CLKSRC                  BIT(6)
+#define CFGCHIP3_PLL1_MASTER_LOCK               BIT(5)
+#define CFGCHIP3_ASYNC3_CLKSRC                  BIT(4)
+#define CFGCHIP3_PRUEVTSEL                      BIT(3)
+#define CFGCHIP3_DIV45PENA                      BIT(2)
+#define CFGCHIP3_EMA_CLKSRC                     BIT(1)
+
+/* CFGCHIP4 (McASP0 AMUNTEIN) register bits */
+#define CFGCHIP4_AMUTECLR0                      BIT(0)
+
+#endif /* __LINUX_MFD_DA8XX_CFGCHIP_H */
diff --git a/include/linux/mfd/ti_am335x_tscadc.h b/include/linux/mfd/ti_am335x_tscadc.h
index 2567a87872b0..7f55b8b41032 100644
--- a/include/linux/mfd/ti_am335x_tscadc.h
+++ b/include/linux/mfd/ti_am335x_tscadc.h
@@ -138,16 +138,16 @@
 /*
  * time in us for processing a single channel, calculated as follows:
  *
- * num cycles = open delay + (sample delay + conv time) * averaging
+ * max num cycles = open delay + (sample delay + conv time) * averaging
  *
- * num cycles: 152 + (1 + 13) * 16 = 376
+ * max num cycles: 262143 + (255 + 13) * 16 = 266431
  *
  * clock frequency: 26MHz / 8 = 3.25MHz
  * clock period: 1 / 3.25MHz = 308ns
  *
- * processing time: 376 * 308ns = 116us
+ * max processing time: 266431 * 308ns = 83ms(approx)
  */
-#define IDLE_TIMEOUT 116 /* microsec */
+#define IDLE_TIMEOUT 83 /* milliseconds */
 
 #define TSCADC_CELLS            2
 
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index 21bc4557b67a..d1f9a581aca8 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -6710,9 +6710,10 @@ struct mlx5_ifc_pude_reg_bits {
 };
 
 struct mlx5_ifc_ptys_reg_bits {
-        u8         an_disable_cap[0x1];
+        u8         reserved_at_0[0x1];
         u8         an_disable_admin[0x1];
-        u8         reserved_at_2[0x6];
+        u8         an_disable_cap[0x1];
+        u8         reserved_at_3[0x5];
         u8         local_port[0x8];
         u8         reserved_at_10[0xd];
         u8         proto_mask[0x3];
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 08ed53eeedd5..ef815b9cd426 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -2014,6 +2014,7 @@ extern void mm_drop_all_locks(struct mm_struct *mm);
 
 extern void set_mm_exe_file(struct mm_struct *mm, struct file *new_exe_file);
 extern struct file *get_mm_exe_file(struct mm_struct *mm);
+extern struct file *get_task_exe_file(struct task_struct *task);
 
 extern bool may_expand_vm(struct mm_struct *, vm_flags_t, unsigned long npages);
 extern void vm_stat_account(struct mm_struct *, vm_flags_t, long npages);
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index f2e4e90621ec..7f2ae99e5daf 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -68,8 +68,10 @@ extern char * const migratetype_names[MIGRATE_TYPES];
 
 #ifdef CONFIG_CMA
 #  define is_migrate_cma(migratetype) unlikely((migratetype) == MIGRATE_CMA)
+#  define is_migrate_cma_page(_page) (get_pageblock_migratetype(_page) == MIGRATE_CMA)
 #else
 #  define is_migrate_cma(migratetype) false
+#  define is_migrate_cma_page(_page) false
 #endif
 
 #define for_each_migratetype_order(order, type) \
@@ -826,9 +828,21 @@ unsigned long __init node_memmap_size_bytes(int, unsigned long, unsigned long);
  */
 #define zone_idx(zone)          ((zone) - (zone)->zone_pgdat->node_zones)
 
-static inline int populated_zone(struct zone *zone)
+/*
+ * Returns true if a zone has pages managed by the buddy allocator.
+ * All the reclaim decisions have to use this function rather than
+ * populated_zone(). If the whole zone is reserved then we can easily
+ * end up with populated_zone() && !managed_zone().
+ */
+static inline bool managed_zone(struct zone *zone)
+{
+        return zone->managed_pages;
+}
+
+/* Returns true if a zone has memory */
+static inline bool populated_zone(struct zone *zone)
 {
-        return (!!zone->present_pages);
+        return zone->present_pages;
 }
 
 extern int movable_zone;
diff --git a/include/linux/msi.h b/include/linux/msi.h
index 4f0bfe5912b2..e8c81fbd5f9c 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -270,6 +270,8 @@ enum {
         MSI_FLAG_MULTI_PCI_MSI          = (1 << 2),
         /* Support PCI MSIX interrupts */
         MSI_FLAG_PCI_MSIX               = (1 << 3),
+        /* Needs early activate, required for PCI */
+        MSI_FLAG_ACTIVATE_EARLY         = (1 << 4),
 };
 
 int msi_domain_set_affinity(struct irq_data *data, const struct cpumask *mask,
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 076df5360ba5..e8d79d4ebcfe 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3267,6 +3267,7 @@ static inline void napi_free_frags(struct napi_struct *napi)
         napi->skb = NULL;
 }
 
+bool netdev_is_rx_handler_busy(struct net_device *dev);
 int netdev_rx_handler_register(struct net_device *dev,
                                rx_handler_func_t *rx_handler,
                                void *rx_handler_data);
@@ -3891,8 +3892,7 @@ void netdev_default_l2upper_neigh_destroy(struct net_device *dev,
 extern u8 netdev_rss_key[NETDEV_RSS_KEY_LEN] __read_mostly;
 void netdev_rss_key_fill(void *buffer, size_t len);
 
-int dev_get_nest_level(struct net_device *dev,
-                       bool (*type_check)(const struct net_device *dev));
+int dev_get_nest_level(struct net_device *dev);
 int skb_checksum_help(struct sk_buff *skb);
 struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
                                   netdev_features_t features, bool tx_path);
diff --git a/include/linux/netfilter/nfnetlink_acct.h b/include/linux/netfilter/nfnetlink_acct.h
index 80ca889b164e..664da0048625 100644
--- a/include/linux/netfilter/nfnetlink_acct.h
+++ b/include/linux/netfilter/nfnetlink_acct.h
@@ -15,6 +15,6 @@ struct nf_acct;
 struct nf_acct *nfnl_acct_find_get(struct net *net, const char *filter_name);
 void nfnl_acct_put(struct nf_acct *acct);
 void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct);
-extern int nfnl_acct_overquota(const struct sk_buff *skb,
-                              struct nf_acct *nfacct);
+int nfnl_acct_overquota(struct net *net, const struct sk_buff *skb,
+                        struct nf_acct *nfacct);
 #endif /* _NFNL_ACCT_H */
diff --git a/include/linux/nvme.h b/include/linux/nvme.h
index d8b37bab2887..7676557ce357 100644
--- a/include/linux/nvme.h
+++ b/include/linux/nvme.h
@@ -794,7 +794,7 @@ struct nvmf_connect_command {
 };
 
 struct nvmf_connect_data {
-        uuid_le         hostid;
+        uuid_be         hostid;
         __le16          cntlid;
         char            resv4[238];
         char            subsysnqn[NVMF_NQN_FIELD_LEN];
diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
index 66a1260b33de..01e84436cddf 100644
--- a/include/linux/pagemap.h
+++ b/include/linux/pagemap.h
@@ -571,56 +571,57 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)
  */
 static inline int fault_in_multipages_writeable(char __user *uaddr, int size)
 {
-        int ret = 0;
         char __user *end = uaddr + size - 1;
 
         if (unlikely(size == 0))
-                return ret;
+                return 0;
 
+        if (unlikely(uaddr > end))
+                return -EFAULT;
         /*
          * Writing zeroes into userspace here is OK, because we know that if
          * the zero gets there, we'll be overwriting it.
          */
-        while (uaddr <= end) {
-                ret = __put_user(0, uaddr);
-                if (ret != 0)
-                        return ret;
+        do {
+                if (unlikely(__put_user(0, uaddr) != 0))
+                        return -EFAULT;
                 uaddr += PAGE_SIZE;
-        }
+        } while (uaddr <= end);
 
         /* Check whether the range spilled into the next page. */
         if (((unsigned long)uaddr & PAGE_MASK) ==
                         ((unsigned long)end & PAGE_MASK))
-                ret = __put_user(0, end);
+                return __put_user(0, end);
 
-        return ret;
+        return 0;
 }
 
 static inline int fault_in_multipages_readable(const char __user *uaddr,
                                                int size)
 {
         volatile char c;
-        int ret = 0;
         const char __user *end = uaddr + size - 1;
 
         if (unlikely(size == 0))
-                return ret;
+                return 0;
 
-        while (uaddr <= end) {
-                ret = __get_user(c, uaddr);
-                if (ret != 0)
-                        return ret;
+        if (unlikely(uaddr > end))
+                return -EFAULT;
+
+        do {
+                if (unlikely(__get_user(c, uaddr) != 0))
+                        return -EFAULT;
                 uaddr += PAGE_SIZE;
-        }
+        } while (uaddr <= end);
 
         /* Check whether the range spilled into the next page. */
         if (((unsigned long)uaddr & PAGE_MASK) ==
                         ((unsigned long)end & PAGE_MASK)) {
-                ret = __get_user(c, end);
-                (void)c;
+                return __get_user(c, end);
         }
 
-        return ret;
+        (void)c;
+        return 0;
 }
 
 int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 2599a980340f..0ab835965669 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -683,15 +683,6 @@ struct pci_driver {
 #define to_pci_driver(drv) container_of(drv, struct pci_driver, driver)
 
 /**
- * DEFINE_PCI_DEVICE_TABLE - macro used to describe a pci device table
- * @_table: device table name
- *
- * This macro is deprecated and should not be used in new code.
- */
-#define DEFINE_PCI_DEVICE_TABLE(_table) \
-        const struct pci_device_id _table[]
-
-/**
  * PCI_DEVICE - macro used to describe a specific pci device
  * @vend: the 16 bit PCI Vendor ID
  * @dev: the 16 bit PCI Device ID
@@ -1251,10 +1242,12 @@ resource_size_t pcibios_iov_resource_alignment(struct pci_dev *dev, int resno);
 int pci_set_vga_state(struct pci_dev *pdev, bool decode,
                       unsigned int command_bits, u32 flags);
 
-#define PCI_IRQ_NOLEGACY        (1 << 0) /* don't use legacy interrupts */
-#define PCI_IRQ_NOMSI           (1 << 1) /* don't use MSI interrupts */
-#define PCI_IRQ_NOMSIX          (1 << 2) /* don't use MSI-X interrupts */
-#define PCI_IRQ_NOAFFINITY      (1 << 3) /* don't auto-assign affinity */
+#define PCI_IRQ_LEGACY          (1 << 0) /* allow legacy interrupts */
+#define PCI_IRQ_MSI             (1 << 1) /* allow MSI interrupts */
+#define PCI_IRQ_MSIX            (1 << 2) /* allow MSI-X interrupts */
+#define PCI_IRQ_AFFINITY        (1 << 3) /* auto-assign affinity */
+#define PCI_IRQ_ALL_TYPES \
+        (PCI_IRQ_LEGACY | PCI_IRQ_MSI | PCI_IRQ_MSIX)
 
 /* kmem_cache style wrapper around pci_alloc_consistent() */
 
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 8ed4326164cc..2b6b43cc0dd5 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -743,7 +743,9 @@ struct perf_event_context {
         u64                             parent_gen;
         u64                             generation;
         int                             pin_count;
+#ifdef CONFIG_CGROUP_PERF
         int                             nr_cgroups;      /* cgroup evts */
+#endif
         void                            *task_ctx_data; /* pmu specific data */
         struct rcu_head                 rcu_head;
 };
@@ -769,7 +771,9 @@ struct perf_cpu_context {
         unsigned int                    hrtimer_active;
 
         struct pmu                      *unique_pmu;
+#ifdef CONFIG_CGROUP_PERF
         struct perf_cgroup              *cgrp;
+#endif
 };
 
 struct perf_output_handle {
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 8dc155dab3ed..696a56be7d3e 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -266,39 +266,21 @@ extern asmlinkage void dump_stack(void) __cold;
  * and other debug macros are compiled out unless either DEBUG is defined
  * or CONFIG_DYNAMIC_DEBUG is set.
  */
-
-#ifdef CONFIG_PRINTK
-
-asmlinkage __printf(1, 2) __cold void __pr_emerg(const char *fmt, ...);
-asmlinkage __printf(1, 2) __cold void __pr_alert(const char *fmt, ...);
-asmlinkage __printf(1, 2) __cold void __pr_crit(const char *fmt, ...);
-asmlinkage __printf(1, 2) __cold void __pr_err(const char *fmt, ...);
-asmlinkage __printf(1, 2) __cold void __pr_warn(const char *fmt, ...);
-asmlinkage __printf(1, 2) __cold void __pr_notice(const char *fmt, ...);
-asmlinkage __printf(1, 2) __cold void __pr_info(const char *fmt, ...);
-
-#define pr_emerg(fmt, ...)      __pr_emerg(pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_alert(fmt, ...)      __pr_alert(pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_crit(fmt, ...)       __pr_crit(pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_err(fmt, ...)        __pr_err(pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_warn(fmt, ...)       __pr_warn(pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_notice(fmt, ...)     __pr_notice(pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_info(fmt, ...)       __pr_info(pr_fmt(fmt), ##__VA_ARGS__)
-
-#else
-
-#define pr_emerg(fmt, ...)      printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_alert(fmt, ...)      printk(KERN_ALERT pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_crit(fmt, ...)       printk(KERN_CRIT pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_err(fmt, ...)        printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_warn(fmt, ...)       printk(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_notice(fmt, ...)     printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
-#define pr_info(fmt, ...)       printk(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
-
-#endif
-
-#define pr_warning pr_warn
-
+#define pr_emerg(fmt, ...) \
+        printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_alert(fmt, ...) \
+        printk(KERN_ALERT pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_crit(fmt, ...) \
+        printk(KERN_CRIT pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_err(fmt, ...) \
+        printk(KERN_ERR pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_warning(fmt, ...) \
+        printk(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_warn pr_warning
+#define pr_notice(fmt, ...) \
+        printk(KERN_NOTICE pr_fmt(fmt), ##__VA_ARGS__)
+#define pr_info(fmt, ...) \
+        printk(KERN_INFO pr_fmt(fmt), ##__VA_ARGS__)
 /*
  * Like KERN_CONT, pr_cont() should only be used when continuing
  * a line with no newline ('\n') enclosed. Otherwise it defaults
diff --git a/include/linux/qed/qed_if.h b/include/linux/qed/qed_if.h
index b1e3c57c7117..d6c4177df7cb 100644
--- a/include/linux/qed/qed_if.h
+++ b/include/linux/qed/qed_if.h
@@ -70,8 +70,16 @@ struct qed_dbcx_pfc_params {
         u8 max_tc;
 };
 
+enum qed_dcbx_sf_ieee_type {
+        QED_DCBX_SF_IEEE_ETHTYPE,
+        QED_DCBX_SF_IEEE_TCP_PORT,
+        QED_DCBX_SF_IEEE_UDP_PORT,
+        QED_DCBX_SF_IEEE_TCP_UDP_PORT
+};
+
 struct qed_app_entry {
         bool ethtype;
+        enum qed_dcbx_sf_ieee_type sf_ieee;
         bool enabled;
         u8 prio;
         u16 proto_id;
diff --git a/include/linux/sctp.h b/include/linux/sctp.h
index de1f64318fc4..fcb4c3646173 100644
--- a/include/linux/sctp.h
+++ b/include/linux/sctp.h
@@ -705,70 +705,6 @@ typedef struct sctp_auth_chunk {
         sctp_authhdr_t auth_hdr;
 } __packed sctp_auth_chunk_t;
 
-struct sctp_info {
-        __u32   sctpi_tag;
-        __u32   sctpi_state;
-        __u32   sctpi_rwnd;
-        __u16   sctpi_unackdata;
-        __u16   sctpi_penddata;
-        __u16   sctpi_instrms;
-        __u16   sctpi_outstrms;
-        __u32   sctpi_fragmentation_point;
-        __u32   sctpi_inqueue;
-        __u32   sctpi_outqueue;
-        __u32   sctpi_overall_error;
-        __u32   sctpi_max_burst;
-        __u32   sctpi_maxseg;
-        __u32   sctpi_peer_rwnd;
-        __u32   sctpi_peer_tag;
-        __u8    sctpi_peer_capable;
-        __u8    sctpi_peer_sack;
-        __u16   __reserved1;
-
-        /* assoc status info */
-        __u64   sctpi_isacks;
-        __u64   sctpi_osacks;
-        __u64   sctpi_opackets;
-        __u64   sctpi_ipackets;
-        __u64   sctpi_rtxchunks;
-        __u64   sctpi_outofseqtsns;
-        __u64   sctpi_idupchunks;
-        __u64   sctpi_gapcnt;
-        __u64   sctpi_ouodchunks;
-        __u64   sctpi_iuodchunks;
-        __u64   sctpi_oodchunks;
-        __u64   sctpi_iodchunks;
-        __u64   sctpi_octrlchunks;
-        __u64   sctpi_ictrlchunks;
-
-        /* primary transport info */
-        struct sockaddr_storage sctpi_p_address;
-        __s32   sctpi_p_state;
-        __u32   sctpi_p_cwnd;
-        __u32   sctpi_p_srtt;
-        __u32   sctpi_p_rto;
-        __u32   sctpi_p_hbinterval;
-        __u32   sctpi_p_pathmaxrxt;
-        __u32   sctpi_p_sackdelay;
-        __u32   sctpi_p_sackfreq;
-        __u32   sctpi_p_ssthresh;
-        __u32   sctpi_p_partial_bytes_acked;
-        __u32   sctpi_p_flight_size;
-        __u16   sctpi_p_error;
-        __u16   __reserved2;
-
-        /* sctp sock info */
-        __u32   sctpi_s_autoclose;
-        __u32   sctpi_s_adaptation_ind;
-        __u32   sctpi_s_pd_point;
-        __u8    sctpi_s_nodelay;
-        __u8    sctpi_s_disable_fragments;
-        __u8    sctpi_s_v4mapped;
-        __u8    sctpi_s_frag_interleave;
-        __u32   sctpi_s_type;
-        __u32   __reserved3;
-};
-
 struct sctp_infox {
         struct sctp_info *sctpinfo;
         struct sctp_association *asoc;
diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
index 923266cd294a..48ec7651989b 100644
--- a/include/linux/serial_8250.h
+++ b/include/linux/serial_8250.h
@@ -111,7 +111,6 @@ struct uart_8250_port {
                                                  *   if no_console_suspend
                                                  */
         unsigned char           probe;
-        struct mctrl_gpios      *gpios;
 #define UART_PROBE_RSA  (1 << 0)
 
         /*
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 6f0b3e0adc73..0f665cb26b50 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2847,6 +2847,18 @@ static inline int skb_linearize_cow(struct sk_buff *skb)
                __skb_linearize(skb) : 0;
 }
 
+static __always_inline void
+__skb_postpull_rcsum(struct sk_buff *skb, const void *start, unsigned int len,
+                     unsigned int off)
+{
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->csum = csum_block_sub(skb->csum,
+                                           csum_partial(start, len, 0), off);
+        else if (skb->ip_summed == CHECKSUM_PARTIAL &&
+                 skb_checksum_start_offset(skb) < 0)
+                skb->ip_summed = CHECKSUM_NONE;
+}
+
 /**
  *      skb_postpull_rcsum - update checksum for received skb after pull
  *      @skb: buffer to update
@@ -2857,36 +2869,38 @@ static inline int skb_linearize_cow(struct sk_buff *skb)
  *      update the CHECKSUM_COMPLETE checksum, or set ip_summed to
  *      CHECKSUM_NONE so that it can be recomputed from scratch.
  */
-
 static inline void skb_postpull_rcsum(struct sk_buff *skb,
                                       const void *start, unsigned int len)
 {
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
-        else if (skb->ip_summed == CHECKSUM_PARTIAL &&
-                 skb_checksum_start_offset(skb) < 0)
-                skb->ip_summed = CHECKSUM_NONE;
+        __skb_postpull_rcsum(skb, start, len, 0);
 }
 
-unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
+static __always_inline void
+__skb_postpush_rcsum(struct sk_buff *skb, const void *start, unsigned int len,
+                     unsigned int off)
+{
+        if (skb->ip_summed == CHECKSUM_COMPLETE)
+                skb->csum = csum_block_add(skb->csum,
+                                           csum_partial(start, len, 0), off);
+}
 
+/**
+ *      skb_postpush_rcsum - update checksum for received skb after push
+ *      @skb: buffer to update
+ *      @start: start of data after push
+ *      @len: length of data pushed
+ *
+ *      After doing a push on a received packet, you need to call this to
+ *      update the CHECKSUM_COMPLETE checksum.
+ */
 static inline void skb_postpush_rcsum(struct sk_buff *skb,
                                       const void *start, unsigned int len)
 {
-        /* For performing the reverse operation to skb_postpull_rcsum(),
-         * we can instead of ...
-         *
-         *   skb->csum = csum_add(skb->csum, csum_partial(start, len, 0));
-         *
-         * ... just use this equivalent version here to save a few
-         * instructions. Feeding csum of 0 in csum_partial() and later
-         * on adding skb->csum is equivalent to feed skb->csum in the
-         * first place.
-         */
-        if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_partial(start, len, skb->csum);
+        __skb_postpush_rcsum(skb, start, len, 0);
 }
 
+unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
+
 /**
  *      skb_push_rcsum - push skb and update receive checksum
  *      @skb: buffer to update
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 1a4ea551aae5..4293808d8cfb 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -155,6 +155,18 @@ void kfree(const void *);
 void kzfree(const void *);
 size_t ksize(const void *);
 
+#ifdef CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR
+const char *__check_heap_object(const void *ptr, unsigned long n,
+                                struct page *page);
+#else
+static inline const char *__check_heap_object(const void *ptr,
+                                              unsigned long n,
+                                              struct page *page)
+{
+        return NULL;
+}
+#endif
+
 /*
  * Some archs want to perform DMA into kmalloc caches and need a guaranteed
  * alignment larger than the alignment of a 64-bit integer.
diff --git a/include/linux/smc91x.h b/include/linux/smc91x.h
index 76199b75d584..e302c447e057 100644
--- a/include/linux/smc91x.h
+++ b/include/linux/smc91x.h
@@ -1,6 +1,16 @@
 #ifndef __SMC91X_H__
 #define __SMC91X_H__
 
+/*
+ * These bits define which access sizes a platform can support, rather
+ * than the maximal access size.  So, if your platform can do 16-bit
+ * and 32-bit accesses to the SMC91x device, but not 8-bit, set both
+ * SMC91X_USE_16BIT and SMC91X_USE_32BIT.
+ *
+ * The SMC91x driver requires at least one of SMC91X_USE_8BIT or
+ * SMC91X_USE_16BIT to be supported - just setting SMC91X_USE_32BIT is
+ * an invalid configuration.
+ */
 #define SMC91X_USE_8BIT (1 << 0)
 #define SMC91X_USE_16BIT (1 << 1)
 #define SMC91X_USE_32BIT (1 << 2)
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index b6810c92b8bb..5c02b0691587 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -195,6 +195,8 @@ int		rpc_clnt_add_xprt(struct rpc_clnt *, struct xprt_create *,
                                 struct rpc_xprt *,
                                 void *),
                         void *data);
+void            rpc_cap_max_reconnect_timeout(struct rpc_clnt *clnt,
+                        unsigned long timeo);
 
 const char *rpc_proc_name(const struct rpc_task *task);
 #endif /* __KERNEL__ */
diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h
index 5e3e1b63dbb3..a16070dd03ee 100644
--- a/include/linux/sunrpc/xprt.h
+++ b/include/linux/sunrpc/xprt.h
@@ -218,7 +218,8 @@ struct rpc_xprt {
         struct work_struct      task_cleanup;
         struct timer_list       timer;
         unsigned long           last_used,
-                                idle_timeout;
+                                idle_timeout,
+                                max_reconnect_timeout;
 
         /*
          * Send stuff
diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
index 697e160c78d0..a4f7203a9017 100644
--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -42,6 +42,8 @@ extern int proc_dostring(struct ctl_table *, int,
                          void __user *, size_t *, loff_t *);
 extern int proc_dointvec(struct ctl_table *, int,
                          void __user *, size_t *, loff_t *);
+extern int proc_douintvec(struct ctl_table *, int,
+                         void __user *, size_t *, loff_t *);
 extern int proc_dointvec_minmax(struct ctl_table *, int,
                                 void __user *, size_t *, loff_t *);
 extern int proc_dointvec_jiffies(struct ctl_table *, int,
diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index 352b1542f5cc..2b5b10eed74f 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -105,6 +105,31 @@ static inline int test_ti_thread_flag(struct thread_info *ti, int flag)
 
 #define tif_need_resched() test_thread_flag(TIF_NEED_RESCHED)
 
+#ifndef CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES
+static inline int arch_within_stack_frames(const void * const stack,
+                                           const void * const stackend,
+                                           const void *obj, unsigned long len)
+{
+        return 0;
+}
+#endif
+
+#ifdef CONFIG_HARDENED_USERCOPY
+extern void __check_object_size(const void *ptr, unsigned long n,
+                                        bool to_user);
+
+static __always_inline void check_object_size(const void *ptr, unsigned long n,
+                                              bool to_user)
+{
+        if (!__builtin_constant_p(n))
+                __check_object_size(ptr, n, to_user);
+}
+#else
+static inline void check_object_size(const void *ptr, unsigned long n,
+                                     bool to_user)
+{ }
+#endif /* CONFIG_HARDENED_USERCOPY */
+
 #endif  /* __KERNEL__ */
 
 #endif /* _LINUX_THREAD_INFO_H */
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 349557825428..f30c187ed785 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -114,8 +114,8 @@ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
 #ifndef user_access_begin
 #define user_access_begin() do { } while (0)
 #define user_access_end() do { } while (0)
-#define unsafe_get_user(x, ptr) __get_user(x, ptr)
-#define unsafe_put_user(x, ptr) __put_user(x, ptr)
+#define unsafe_get_user(x, ptr, err) do { if (unlikely(__get_user(x, ptr))) goto err; } while (0)
+#define unsafe_put_user(x, ptr, err) do { if (unlikely(__put_user(x, ptr))) goto err; } while (0)
 #endif
 
 #endif          /* __LINUX_UACCESS_H__ */
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 1b5d1cd796e2..75b4aaf31a9d 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -76,7 +76,7 @@ size_t iov_iter_copy_from_user_atomic(struct page *page,
                 struct iov_iter *i, unsigned long offset, size_t bytes);
 void iov_iter_advance(struct iov_iter *i, size_t bytes);
 int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes);
-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes);
+#define iov_iter_fault_in_multipages_readable iov_iter_fault_in_readable
 size_t iov_iter_single_seg_count(const struct iov_iter *i);
 size_t copy_page_to_iter(struct page *page, size_t offset, size_t bytes,
                          struct iov_iter *i);
diff --git a/include/media/cec.h b/include/media/cec.h
index dc7854b855f3..fdb5d600e4bb 100644
--- a/include/media/cec.h
+++ b/include/media/cec.h
@@ -57,8 +57,8 @@ struct cec_devnode {
         int minor;
         bool registered;
         bool unregistered;
-        struct mutex fhs_lock;
         struct list_head fhs;
+        struct mutex lock;
 };
 
 struct cec_adapter;
diff --git a/include/net/act_api.h b/include/net/act_api.h
index 41e6a24a44b9..82f3c912a5b1 100644
--- a/include/net/act_api.h
+++ b/include/net/act_api.h
@@ -176,8 +176,8 @@ int tcf_register_action(struct tc_action_ops *a, struct pernet_operations *ops);
 int tcf_unregister_action(struct tc_action_ops *a,
                           struct pernet_operations *ops);
 int tcf_action_destroy(struct list_head *actions, int bind);
-int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
-                    struct tcf_result *res);
+int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
+                    int nr_actions, struct tcf_result *res);
 int tcf_action_init(struct net *net, struct nlattr *nla,
                                   struct nlattr *est, char *n, int ovr,
                                   int bind, struct list_head *);
@@ -189,30 +189,17 @@ int tcf_action_dump_old(struct sk_buff *skb, struct tc_action *a, int, int);
 int tcf_action_dump_1(struct sk_buff *skb, struct tc_action *a, int, int);
 int tcf_action_copy_stats(struct sk_buff *, struct tc_action *, int);
 
-#define tc_no_actions(_exts) \
-        (list_empty(&(_exts)->actions))
-
-#define tc_for_each_action(_a, _exts) \
-        list_for_each_entry(a, &(_exts)->actions, list)
-
-#define tc_single_action(_exts) \
-        (list_is_singular(&(_exts)->actions))
+#endif /* CONFIG_NET_CLS_ACT */
 
 static inline void tcf_action_stats_update(struct tc_action *a, u64 bytes,
                                            u64 packets, u64 lastuse)
 {
+#ifdef CONFIG_NET_CLS_ACT
         if (!a->ops->stats_update)
                 return;
 
         a->ops->stats_update(a, bytes, packets, lastuse);
+#endif
 }
 
-#else /* CONFIG_NET_CLS_ACT */
-
-#define tc_no_actions(_exts) true
-#define tc_for_each_action(_a, _exts) while ((void)(_a), 0)
-#define tc_single_action(_exts) false
-#define tcf_action_stats_update(a, bytes, packets, lastuse)
-
-#endif /* CONFIG_NET_CLS_ACT */
 #endif
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index ac1bc3c49fbd..7b0f88699b25 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -40,12 +40,12 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *,
                                            unsigned long,
                                            gfp_t);
 int rxrpc_kernel_send_data(struct rxrpc_call *, struct msghdr *, size_t);
+void rxrpc_kernel_data_consumed(struct rxrpc_call *, struct sk_buff *);
 void rxrpc_kernel_abort_call(struct rxrpc_call *, u32);
 void rxrpc_kernel_end_call(struct rxrpc_call *);
 bool rxrpc_kernel_is_data_last(struct sk_buff *);
 u32 rxrpc_kernel_get_abort_code(struct sk_buff *);
 int rxrpc_kernel_get_error_number(struct sk_buff *);
-void rxrpc_kernel_data_delivered(struct sk_buff *);
 void rxrpc_kernel_free_skb(struct sk_buff *);
 struct rxrpc_call *rxrpc_kernel_accept_call(struct socket *, unsigned long);
 int rxrpc_kernel_reject_call(struct socket *);
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 9b4c418bebd8..fd60eccb59a6 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -52,7 +52,7 @@ struct unix_sock {
         struct sock             sk;
         struct unix_address     *addr;
         struct path             path;
-        struct mutex            readlock;
+        struct mutex            iolock, bindlock;
         struct sock             *peer;
         struct list_head        link;
         atomic_long_t           inflight;
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 9c23f4d33e06..beb7610d64e9 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -1102,6 +1102,7 @@ struct station_info {
         struct cfg80211_tid_stats pertid[IEEE80211_NUM_TIDS + 1];
 };
 
+#if IS_ENABLED(CONFIG_CFG80211)
 /**
  * cfg80211_get_station - retrieve information about a given station
  * @dev: the device where the station is supposed to be connected to
@@ -1114,6 +1115,14 @@ struct station_info {
  */
 int cfg80211_get_station(struct net_device *dev, const u8 *mac_addr,
                          struct station_info *sinfo);
+#else
+static inline int cfg80211_get_station(struct net_device *dev,
+                                       const u8 *mac_addr,
+                                       struct station_info *sinfo)
+{
+        return -ENOENT;
+}
+#endif
 
 /**
  * enum monitor_flags - monitor flags
diff --git a/include/net/gre.h b/include/net/gre.h
index 7a54a31d1d4c..73ea256eb7d7 100644
--- a/include/net/gre.h
+++ b/include/net/gre.h
@@ -104,6 +104,7 @@ static inline void gre_build_header(struct sk_buff *skb, int hdr_len,
 
         skb_push(skb, hdr_len);
 
+        skb_set_inner_protocol(skb, proto);
         skb_reset_transport_header(skb);
         greh = (struct gre_base_hdr *)skb->data;
         greh->flags = gre_tnl_flags_to_gre_flags(flags);
diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
index 0dc0a51da38f..dce2d586d9ce 100644
--- a/include/net/inet_ecn.h
+++ b/include/net/inet_ecn.h
@@ -128,7 +128,8 @@ static inline int IP6_ECN_set_ce(struct sk_buff *skb, struct ipv6hdr *iph)
         to = from | htonl(INET_ECN_CE << 20);
         *(__be32 *)iph = to;
         if (skb->ip_summed == CHECKSUM_COMPLETE)
-                skb->csum = csum_add(csum_sub(skb->csum, from), to);
+                skb->csum = csum_add(csum_sub(skb->csum, (__force __wsum)from),
+                                     (__force __wsum)to);
         return 1;
 }
 
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 4079fc18ffe4..7d4a72e75f33 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -111,6 +111,7 @@ struct fib_info {
         unsigned char           fib_scope;
         unsigned char           fib_type;
         __be32                  fib_prefsrc;
+        u32                     fib_tb_id;
         u32                     fib_priority;
         u32                     *fib_metrics;
 #define fib_mtu fib_metrics[RTAX_MTU-1]
@@ -319,7 +320,7 @@ void fib_flush_external(struct net *net);
 /* Exported by fib_semantics.c */
 int ip_fib_check_default(__be32 gw, struct net_device *dev);
 int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force);
-int fib_sync_down_addr(struct net *net, __be32 local);
+int fib_sync_down_addr(struct net_device *dev, __be32 local);
 int fib_sync_up(struct net_device *dev, unsigned int nh_flags);
 
 extern u32 fib_multipath_secret __read_mostly;
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index b4faadbb4e01..cca510a585c3 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -3620,7 +3620,8 @@ struct ieee80211_ops {
 
         int (*join_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
         void (*leave_ibss)(struct ieee80211_hw *hw, struct ieee80211_vif *vif);
-        u32 (*get_expected_throughput)(struct ieee80211_sta *sta);
+        u32 (*get_expected_throughput)(struct ieee80211_hw *hw,
+                                       struct ieee80211_sta *sta);
         int (*get_txpower)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                            int *dbm);
 
diff --git a/include/net/netfilter/nf_conntrack_synproxy.h b/include/net/netfilter/nf_conntrack_synproxy.h
index 6793614e6502..e6937318546c 100644
--- a/include/net/netfilter/nf_conntrack_synproxy.h
+++ b/include/net/netfilter/nf_conntrack_synproxy.h
@@ -27,6 +27,20 @@ static inline struct nf_conn_synproxy *nfct_synproxy_ext_add(struct nf_conn *ct)
 #endif
 }
 
+static inline bool nf_ct_add_synproxy(struct nf_conn *ct,
+                                      const struct nf_conn *tmpl)
+{
+        if (tmpl && nfct_synproxy(tmpl)) {
+                if (!nfct_seqadj_ext_add(ct))
+                        return false;
+
+                if (!nfct_synproxy_ext_add(ct))
+                        return false;
+        }
+
+        return true;
+}
+
 struct synproxy_stats {
         unsigned int                    syn_received;
         unsigned int                    cookie_invalid;
diff --git a/include/net/netfilter/nft_meta.h b/include/net/netfilter/nft_meta.h
index d27588c8dbd9..1139cde0fdc5 100644
--- a/include/net/netfilter/nft_meta.h
+++ b/include/net/netfilter/nft_meta.h
@@ -36,4 +36,8 @@ void nft_meta_set_eval(const struct nft_expr *expr,
 void nft_meta_set_destroy(const struct nft_ctx *ctx,
                           const struct nft_expr *expr);
 
+int nft_meta_set_validate(const struct nft_ctx *ctx,
+                          const struct nft_expr *expr,
+                          const struct nft_data **data);
+
 #endif
diff --git a/include/net/netfilter/nft_reject.h b/include/net/netfilter/nft_reject.h
index 60fa1530006b..02e28c529b29 100644
--- a/include/net/netfilter/nft_reject.h
+++ b/include/net/netfilter/nft_reject.h
@@ -8,6 +8,10 @@ struct nft_reject {
 
 extern const struct nla_policy nft_reject_policy[];
 
+int nft_reject_validate(const struct nft_ctx *ctx,
+                        const struct nft_expr *expr,
+                        const struct nft_data **data);
+
 int nft_reject_init(const struct nft_ctx *ctx,
                     const struct nft_expr *expr,
                     const struct nlattr * const tb[]);
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index 6f8d65342d3a..c99508d426cc 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -59,7 +59,8 @@ tcf_unbind_filter(struct tcf_proto *tp, struct tcf_result *r)
 struct tcf_exts {
 #ifdef CONFIG_NET_CLS_ACT
         __u32   type; /* for backward compat(TCA_OLD_COMPAT) */
-        struct list_head actions;
+        int nr_actions;
+        struct tc_action **actions;
 #endif
         /* Map to export classifier specific extension TLV types to the
          * generic extensions API. Unsupported extensions must be set to 0.
@@ -72,7 +73,10 @@ static inline void tcf_exts_init(struct tcf_exts *exts, int action, int police)
 {
 #ifdef CONFIG_NET_CLS_ACT
         exts->type = 0;
-        INIT_LIST_HEAD(&exts->actions);
+        exts->nr_actions = 0;
+        exts->actions = kcalloc(TCA_ACT_MAX_PRIO, sizeof(struct tc_action *),
+                                GFP_KERNEL);
+        WARN_ON(!exts->actions); /* TODO: propagate the error to callers */
 #endif
         exts->action = action;
         exts->police = police;
@@ -89,7 +93,7 @@ static inline int
 tcf_exts_is_predicative(struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        return !list_empty(&exts->actions);
+        return exts->nr_actions;
 #else
         return 0;
 #endif
@@ -108,6 +112,20 @@ tcf_exts_is_available(struct tcf_exts *exts)
         return tcf_exts_is_predicative(exts);
 }
 
+static inline void tcf_exts_to_list(const struct tcf_exts *exts,
+                                    struct list_head *actions)
+{
+#ifdef CONFIG_NET_CLS_ACT
+        int i;
+
+        for (i = 0; i < exts->nr_actions; i++) {
+                struct tc_action *a = exts->actions[i];
+
+                list_add(&a->list, actions);
+        }
+#endif
+}
+
 /**
  * tcf_exts_exec - execute tc filter extensions
  * @skb: socket buffer
@@ -124,12 +142,25 @@ tcf_exts_exec(struct sk_buff *skb, struct tcf_exts *exts,
                struct tcf_result *res)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        if (!list_empty(&exts->actions))
-                return tcf_action_exec(skb, &exts->actions, res);
+        if (exts->nr_actions)
+                return tcf_action_exec(skb, exts->actions, exts->nr_actions,
+                                       res);
 #endif
         return 0;
 }
 
+#ifdef CONFIG_NET_CLS_ACT
+
+#define tc_no_actions(_exts)  ((_exts)->nr_actions == 0)
+#define tc_single_action(_exts) ((_exts)->nr_actions == 1)
+
+#else /* CONFIG_NET_CLS_ACT */
+
+#define tc_no_actions(_exts) true
+#define tc_single_action(_exts) false
+
+#endif /* CONFIG_NET_CLS_ACT */
+
 int tcf_exts_validate(struct net *net, struct tcf_proto *tp,
                       struct nlattr **tb, struct nlattr *rate_tlv,
                       struct tcf_exts *exts, bool ovr);
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index efc01743b9d6..bafe2a0ab908 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -382,7 +382,7 @@ enum {
         ADDIP_SERIAL_SIGN_BIT = (1<<31)
 };
 
-static inline int ADDIP_SERIAL_gte(__u16 s, __u16 t)
+static inline int ADDIP_SERIAL_gte(__u32 s, __u32 t)
 {
         return ((s) == (t)) || (((t) - (s)) & ADDIP_SERIAL_SIGN_BIT);
 }
diff --git a/include/net/sock.h b/include/net/sock.h
index ff5be7e8ddea..8741988e6880 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1332,6 +1332,16 @@ static inline void sk_mem_uncharge(struct sock *sk, int size)
         if (!sk_has_account(sk))
                 return;
         sk->sk_forward_alloc += size;
+
+        /* Avoid a possible overflow.
+         * TCP send queues can make this happen, if sk_mem_reclaim()
+         * is not called and more than 2 GBytes are released at once.
+         *
+         * If we reach 2 MBytes, reclaim 1 MBytes right now, there is
+         * no need to hold that much forward allocation anyway.
+         */
+        if (unlikely(sk->sk_forward_alloc >= 1 << 21))
+                __sk_mem_reclaim(sk, 1 << 20);
 }
 
 static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index c00e7d51bb18..7717302cab91 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1523,6 +1523,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli
 {
         if (sk->sk_send_head == skb_unlinked)
                 sk->sk_send_head = NULL;
+        if (tcp_sk(sk)->highest_sack == skb_unlinked)
+                tcp_sk(sk)->highest_sack = NULL;
 }
 
 static inline void tcp_init_send_head(struct sock *sk)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index adfebd6f243c..17934312eecb 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1540,8 +1540,10 @@ int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
 int xfrm6_extract_header(struct sk_buff *skb);
 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
-int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
+int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
+                  struct ip6_tnl *t);
 int xfrm6_transport_finish(struct sk_buff *skb, int async);
+int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
 int xfrm6_rcv(struct sk_buff *skb);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                      xfrm_address_t *saddr, u8 proto);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 8e90dd28bb75..e1f96737c2a1 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -2115,22 +2115,17 @@ static inline bool ib_is_udata_cleared(struct ib_udata *udata,
                                        size_t len)
 {
         const void __user *p = udata->inbuf + offset;
-        bool ret = false;
+        bool ret;
         u8 *buf;
 
         if (len > USHRT_MAX)
                 return false;
 
-        buf = kmalloc(len, GFP_KERNEL);
-        if (!buf)
+        buf = memdup_user(p, len);
+        if (IS_ERR(buf))
                 return false;
 
-        if (copy_from_user(buf, p, len))
-                goto free;
-
         ret = !memchr_inv(buf, 0, len);
-
-free:
         kfree(buf);
         return ret;
 }
diff --git a/include/scsi/scsi_transport_sas.h b/include/scsi/scsi_transport_sas.h
index 13c0b2ba1b6c..73d870918939 100644
--- a/include/scsi/scsi_transport_sas.h
+++ b/include/scsi/scsi_transport_sas.h
@@ -11,12 +11,12 @@ struct sas_rphy;
 struct request;
 
 #if !IS_ENABLED(CONFIG_SCSI_SAS_ATTRS)
-static inline int is_sas_attached(struct scsi_device *sdev)
+static inline int scsi_is_sas_rphy(const struct device *sdev)
 {
         return 0;
 }
 #else
-extern int is_sas_attached(struct scsi_device *sdev);
+extern int scsi_is_sas_rphy(const struct device *);
 #endif
 
 static inline int sas_protocol_ata(enum sas_protocol proto)
@@ -202,7 +202,6 @@ extern int sas_rphy_add(struct sas_rphy *);
 extern void sas_rphy_remove(struct sas_rphy *);
 extern void sas_rphy_delete(struct sas_rphy *);
 extern void sas_rphy_unlink(struct sas_rphy *);
-extern int scsi_is_sas_rphy(const struct device *);
 
 struct sas_port *sas_port_alloc(struct device *, int);
 struct sas_port *sas_port_alloc_num(struct device *);
diff --git a/include/sound/da7219.h b/include/sound/da7219.h
index 02876acdc840..409ef1397fd3 100644
--- a/include/sound/da7219.h
+++ b/include/sound/da7219.h
@@ -34,6 +34,8 @@ enum da7219_mic_amp_in_sel {
 struct da7219_aad_pdata;
 
 struct da7219_pdata {
+        bool wakeup_source;
+
         /* Mic */
         enum da7219_micbias_voltage micbias_lvl;
         enum da7219_mic_amp_in_sel mic_amp_in_sel;
diff --git a/include/sound/hda_register.h b/include/sound/hda_register.h
index ff1aecf325e8..0013063db7f2 100644
--- a/include/sound/hda_register.h
+++ b/include/sound/hda_register.h
@@ -89,6 +89,19 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 #define AZX_REG_SD_BDLPL                0x18
 #define AZX_REG_SD_BDLPU                0x1c
 
+/* GTS registers */
+#define AZX_REG_LLCH                    0x14
+
+#define AZX_REG_GTS_BASE                0x520
+
+#define AZX_REG_GTSCC   (AZX_REG_GTS_BASE + 0x00)
+#define AZX_REG_WALFCC  (AZX_REG_GTS_BASE + 0x04)
+#define AZX_REG_TSCCL   (AZX_REG_GTS_BASE + 0x08)
+#define AZX_REG_TSCCU   (AZX_REG_GTS_BASE + 0x0C)
+#define AZX_REG_LLPFOC  (AZX_REG_GTS_BASE + 0x14)
+#define AZX_REG_LLPCL   (AZX_REG_GTS_BASE + 0x18)
+#define AZX_REG_LLPCU   (AZX_REG_GTS_BASE + 0x1C)
+
 /* Haswell/Broadwell display HD-A controller Extended Mode registers */
 #define AZX_REG_HSW_EM4                 0x100c
 #define AZX_REG_HSW_EM5                 0x1010
@@ -242,6 +255,29 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
 /* Interval used to calculate the iterating register offset */
 #define AZX_DRSM_INTERVAL               0x08
 
+/* Global time synchronization registers */
+#define GTSCC_TSCCD_MASK                0x80000000
+#define GTSCC_TSCCD_SHIFT               BIT(31)
+#define GTSCC_TSCCI_MASK                0x20
+#define GTSCC_CDMAS_DMA_DIR_SHIFT       4
+
+#define WALFCC_CIF_MASK                 0x1FF
+#define WALFCC_FN_SHIFT                 9
+#define HDA_CLK_CYCLES_PER_FRAME        512
+
+/*
+ * An error occurs near frame "rollover". The clocks in frame value indicates
+ * whether this error may have occurred. Here we use the value of 10. Please
+ * see the errata for the right number [<10]
+ */
+#define HDA_MAX_CYCLE_VALUE             499
+#define HDA_MAX_CYCLE_OFFSET            10
+#define HDA_MAX_CYCLE_READ_RETRY        10
+
+#define TSCCU_CCU_SHIFT                 32
+#define LLPC_CCU_SHIFT                  32
+
+
 /*
  * helpers to read the stream position
  */
diff --git a/include/sound/hdaudio.h b/include/sound/hdaudio.h
index 93e63c56f48f..56004ec8d441 100644
--- a/include/sound/hdaudio.h
+++ b/include/sound/hdaudio.h
@@ -245,6 +245,12 @@ struct hdac_rb {
 
 /*
  * HD-audio bus base driver
+ *
+ * @ppcap: pp capabilities pointer
+ * @spbcap: SPIB capabilities pointer
+ * @mlcap: MultiLink capabilities pointer
+ * @gtscap: gts capabilities pointer
+ * @drsmcap: dma resume capabilities pointer
  */
 struct hdac_bus {
         struct device *dev;
@@ -256,6 +262,12 @@ struct hdac_bus {
         void __iomem *remap_addr;
         int irq;
 
+        void __iomem *ppcap;
+        void __iomem *spbcap;
+        void __iomem *mlcap;
+        void __iomem *gtscap;
+        void __iomem *drsmcap;
+
         /* codec linked list */
         struct list_head codec_list;
         unsigned int num_codecs;
@@ -335,6 +347,7 @@ static inline void snd_hdac_codec_link_down(struct hdac_device *codec)
 int snd_hdac_bus_send_cmd(struct hdac_bus *bus, unsigned int val);
 int snd_hdac_bus_get_response(struct hdac_bus *bus, unsigned int addr,
                               unsigned int *res);
+int snd_hdac_bus_parse_capabilities(struct hdac_bus *bus);
 int snd_hdac_link_power(struct hdac_device *codec, bool enable);
 
 bool snd_hdac_bus_init_chip(struct hdac_bus *bus, bool full_reset);
diff --git a/include/sound/hdaudio_ext.h b/include/sound/hdaudio_ext.h
index b9593b201599..8660a7f10851 100644
--- a/include/sound/hdaudio_ext.h
+++ b/include/sound/hdaudio_ext.h
@@ -8,11 +8,6 @@
  *
  * @bus: hdac bus
  * @num_streams: streams supported
- * @ppcap: pp capabilities pointer
- * @spbcap: SPIB capabilities pointer
- * @mlcap: MultiLink capabilities pointer
- * @gtscap: gts capabilities pointer
- * @drsmcap: dma resume capabilities pointer
  * @hlink_list: link list of HDA links
  * @lock: lock for link mgmt
  * @cmd_dma_state: state of cmd DMAs: CORB and RIRB
@@ -22,12 +17,6 @@ struct hdac_ext_bus {
         int num_streams;
         int idx;
 
-        void __iomem *ppcap;
-        void __iomem *spbcap;
-        void __iomem *mlcap;
-        void __iomem *gtscap;
-        void __iomem *drsmcap;
-
         struct list_head hlink_list;
 
         struct mutex lock;
@@ -54,7 +43,6 @@ void snd_hdac_ext_bus_device_remove(struct hdac_ext_bus *ebus);
 #define HDA_CODEC_EXT_ENTRY(_vid, _revid, _name, _drv_data) \
         HDA_CODEC_REV_EXT_ENTRY(_vid, _revid, _name, _drv_data)
 
-int snd_hdac_ext_bus_parse_capabilities(struct hdac_ext_bus *sbus);
 void snd_hdac_ext_bus_ppcap_enable(struct hdac_ext_bus *chip, bool enable);
 void snd_hdac_ext_bus_ppcap_int_enable(struct hdac_ext_bus *chip, bool enable);
 
diff --git a/include/sound/l3.h b/include/sound/l3.h
index 423a08f0f1b0..1471da22adad 100644
--- a/include/sound/l3.h
+++ b/include/sound/l3.h
@@ -2,9 +2,15 @@
 #define _L3_H_ 1
 
 struct l3_pins {
-        void (*setdat)(int);
-        void (*setclk)(int);
-        void (*setmode)(int);
+        void (*setdat)(struct l3_pins *, int);
+        void (*setclk)(struct l3_pins *, int);
+        void (*setmode)(struct l3_pins *, int);
+
+        int gpio_data;
+        int gpio_clk;
+        int gpio_mode;
+        int use_gpios;
+
         int data_hold;
         int data_setup;
         int clock_high;
@@ -13,6 +19,9 @@ struct l3_pins {
         int mode_setup;
 };
 
+struct device;
+
 int l3_write(struct l3_pins *adap, u8 addr, u8 *data, int len);
+int l3_set_gpio_ops(struct device *dev, struct l3_pins *adap);
 
 #endif
diff --git a/include/sound/rt5660.h b/include/sound/rt5660.h
new file mode 100644
index 000000000000..065f83a24db6
--- /dev/null
+++ b/include/sound/rt5660.h
@@ -0,0 +1,31 @@
+/*
+ * linux/sound/rt5660.h -- Platform data for RT5660
+ *
+ * Copyright 2016 Realtek Semiconductor Corp.
+ * Author: Oder Chiou <oder_chiou@realtek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __LINUX_SND_RT5660_H
+#define __LINUX_SND_RT5660_H
+
+enum rt5660_dmic1_data_pin {
+        RT5660_DMIC1_NULL,
+        RT5660_DMIC1_DATA_GPIO2,
+        RT5660_DMIC1_DATA_IN1P,
+};
+
+struct rt5660_platform_data {
+        /* IN1 & IN3 can optionally be differential */
+        bool in1_diff;
+        bool in3_diff;
+        bool use_ldo2;
+        bool poweroff_codec_in_suspend;
+
+        enum rt5660_dmic1_data_pin dmic1_data_pin;
+};
+
+#endif
diff --git a/include/sound/s3c24xx_uda134x.h b/include/sound/s3c24xx_uda134x.h
index 33df4cb909d3..ffaf1f098c8e 100644
--- a/include/sound/s3c24xx_uda134x.h
+++ b/include/sound/s3c24xx_uda134x.h
@@ -7,7 +7,6 @@ struct s3c24xx_uda134x_platform_data {
         int l3_clk;
         int l3_mode;
         int l3_data;
-        void (*power) (int);
         int model;
 };
 
diff --git a/include/sound/simple_card_utils.h b/include/sound/simple_card_utils.h
index 86088aed9002..fd6412551145 100644
--- a/include/sound/simple_card_utils.h
+++ b/include/sound/simple_card_utils.h
@@ -27,10 +27,45 @@ int asoc_simple_card_parse_daifmt(struct device *dev,
                                   struct device_node *codec,
                                   char *prefix,
                                   unsigned int *retfmt);
+__printf(3, 4)
 int asoc_simple_card_set_dailink_name(struct device *dev,
                                       struct snd_soc_dai_link *dai_link,
                                       const char *fmt, ...);
 int asoc_simple_card_parse_card_name(struct snd_soc_card *card,
                                      char *prefix);
 
+#define asoc_simple_card_parse_clk_cpu(node, dai_link, simple_dai)              \
+        asoc_simple_card_parse_clk(node, dai_link->cpu_of_node, simple_dai)
+#define asoc_simple_card_parse_clk_codec(node, dai_link, simple_dai)            \
+        asoc_simple_card_parse_clk(node, dai_link->codec_of_node, simple_dai)
+int asoc_simple_card_parse_clk(struct device_node *node,
+                               struct device_node *dai_of_node,
+                               struct asoc_simple_dai *simple_dai);
+
+#define asoc_simple_card_parse_cpu(node, dai_link,                              \
+                                   list_name, cells_name, is_single_link)       \
+        asoc_simple_card_parse_dai(node, &dai_link->cpu_of_node,                \
+                &dai_link->cpu_dai_name, list_name, cells_name, is_single_link)
+#define asoc_simple_card_parse_codec(node, dai_link, list_name, cells_name)     \
+        asoc_simple_card_parse_dai(node, &dai_link->codec_of_node,              \
+                &dai_link->codec_dai_name, list_name, cells_name, NULL)
+#define asoc_simple_card_parse_platform(node, dai_link, list_name, cells_name)  \
+        asoc_simple_card_parse_dai(node, &dai_link->platform_of_node,           \
+                NULL, list_name, cells_name, NULL)
+int asoc_simple_card_parse_dai(struct device_node *node,
+                                  struct device_node **endpoint_np,
+                                  const char **dai_name,
+                                  const char *list_name,
+                                  const char *cells_name,
+                                  int *is_single_links);
+
+int asoc_simple_card_init_dai(struct snd_soc_dai *dai,
+                              struct asoc_simple_dai *simple_dai);
+
+int asoc_simple_card_canonicalize_dailink(struct snd_soc_dai_link *dai_link);
+void asoc_simple_card_canonicalize_cpu(struct snd_soc_dai_link *dai_link,
+                                      int is_single_links);
+
+int asoc_simple_card_clean_reference(struct snd_soc_card *card);
+
 #endif /* __SIMPLE_CARD_CORE_H */
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 6144882cc96a..4f1c784e44f6 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -898,14 +898,6 @@ struct snd_soc_codec_driver {
         int (*resume)(struct snd_soc_codec *);
         struct snd_soc_component_driver component_driver;
 
-        /* Default control and setup, added after probe() is run */
-        const struct snd_kcontrol_new *controls;
-        int num_controls;
-        const struct snd_soc_dapm_widget *dapm_widgets;
-        int num_dapm_widgets;
-        const struct snd_soc_dapm_route *dapm_routes;
-        int num_dapm_routes;
-
         /* codec wide operations */
         int (*set_sysclk)(struct snd_soc_codec *codec,
                           int clk_id, int source, unsigned int freq, int dir);
@@ -1547,17 +1539,6 @@ static inline void *snd_soc_platform_get_drvdata(struct snd_soc_platform *platfo
         return snd_soc_component_get_drvdata(&platform->component);
 }
 
-static inline void snd_soc_pcm_set_drvdata(struct snd_soc_pcm_runtime *rtd,
-                void *data)
-{
-        dev_set_drvdata(rtd->dev, data);
-}
-
-static inline void *snd_soc_pcm_get_drvdata(struct snd_soc_pcm_runtime *rtd)
-{
-        return dev_get_drvdata(rtd->dev);
-}
-
 static inline void snd_soc_initialize_card_lists(struct snd_soc_card *card)
 {
         INIT_LIST_HEAD(&card->codec_dev_list);
diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h
index 51440131d337..28c5da6fdfac 100644
--- a/include/trace/events/timer.h
+++ b/include/trace/events/timer.h
@@ -330,24 +330,32 @@ TRACE_EVENT(itimer_expire,
 #ifdef CONFIG_NO_HZ_COMMON
 
 #define TICK_DEP_NAMES                                  \
-                tick_dep_name(NONE)                     \
+                tick_dep_mask_name(NONE)                \
                 tick_dep_name(POSIX_TIMER)              \
                 tick_dep_name(PERF_EVENTS)              \
                 tick_dep_name(SCHED)                    \
                 tick_dep_name_end(CLOCK_UNSTABLE)
 
 #undef tick_dep_name
+#undef tick_dep_mask_name
 #undef tick_dep_name_end
 
-#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
-#define tick_dep_name_end(sdep)  TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
+/* The MASK will convert to their bits and they need to be processed too */
+#define tick_dep_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \
+        TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
+#define tick_dep_name_end(sdep)  TRACE_DEFINE_ENUM(TICK_DEP_BIT_##sdep); \
+        TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
+/* NONE only has a mask defined for it */
+#define tick_dep_mask_name(sdep) TRACE_DEFINE_ENUM(TICK_DEP_MASK_##sdep);
 
 TICK_DEP_NAMES
 
 #undef tick_dep_name
+#undef tick_dep_mask_name
 #undef tick_dep_name_end
 
 #define tick_dep_name(sdep) { TICK_DEP_MASK_##sdep, #sdep },
+#define tick_dep_mask_name(sdep) { TICK_DEP_MASK_##sdep, #sdep },
 #define tick_dep_name_end(sdep) { TICK_DEP_MASK_##sdep, #sdep }
 
 #define show_tick_dep_name(val)                         \
diff --git a/include/uapi/linux/atm_zatm.h b/include/uapi/linux/atm_zatm.h
index 9c9c6ad55f14..5cd4d4d2dd1d 100644
--- a/include/uapi/linux/atm_zatm.h
+++ b/include/uapi/linux/atm_zatm.h
@@ -14,6 +14,7 @@
 
 #include <linux/atmapi.h>
 #include <linux/atmioc.h>
+#include <linux/time.h>
 
 #define ZATM_GETPOOL    _IOW('a',ATMIOC_SARPRV+1,struct atmif_sioc)
                                                 /* get pool statistics */
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index da218fec6056..9e5fc168c8a3 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -339,7 +339,7 @@ enum bpf_func_id {
         BPF_FUNC_skb_change_type,
 
         /**
-         * bpf_skb_in_cgroup(skb, map, index) - Check cgroup2 membership of skb
+         * bpf_skb_under_cgroup(skb, map, index) - Check cgroup2 membership of skb
          * @skb: pointer to skb
          * @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type
          * @index: index of the cgroup in the bpf_map
@@ -348,7 +348,7 @@ enum bpf_func_id {
          *   == 1 skb succeeded the cgroup2 descendant test
          *    < 0 error
          */
-        BPF_FUNC_skb_in_cgroup,
+        BPF_FUNC_skb_under_cgroup,
 
         /**
          * bpf_get_hash_recalc(skb)
diff --git a/include/uapi/linux/if_pppol2tp.h b/include/uapi/linux/if_pppol2tp.h
index 163e8adac2d6..4bd1f55d6377 100644
--- a/include/uapi/linux/if_pppol2tp.h
+++ b/include/uapi/linux/if_pppol2tp.h
@@ -16,7 +16,8 @@
 #define _UAPI__LINUX_IF_PPPOL2TP_H
 
 #include <linux/types.h>
-
+#include <linux/in.h>
+#include <linux/in6.h>
 
 /* Structure used to connect() the socket to a particular tunnel UDP
  * socket over IPv4.
diff --git a/include/uapi/linux/if_pppox.h b/include/uapi/linux/if_pppox.h
index e128769331b5..d37bbb17a007 100644
--- a/include/uapi/linux/if_pppox.h
+++ b/include/uapi/linux/if_pppox.h
@@ -21,8 +21,11 @@
 #include <asm/byteorder.h>
 
 #include <linux/socket.h>
+#include <linux/if.h>
 #include <linux/if_ether.h>
 #include <linux/if_pppol2tp.h>
+#include <linux/in.h>
+#include <linux/in6.h>
 
 /* For user-space programs to pick up these definitions
  * which they wouldn't get otherwise without defining __KERNEL__
diff --git a/include/uapi/linux/if_tunnel.h b/include/uapi/linux/if_tunnel.h
index 1046f5515174..777b6cdb1b7b 100644
--- a/include/uapi/linux/if_tunnel.h
+++ b/include/uapi/linux/if_tunnel.h
@@ -2,6 +2,9 @@
 #define _UAPI_IF_TUNNEL_H_
 
 #include <linux/types.h>
+#include <linux/if.h>
+#include <linux/ip.h>
+#include <linux/in6.h>
 #include <asm/byteorder.h>
 
 
diff --git a/include/uapi/linux/ipx.h b/include/uapi/linux/ipx.h
index 3d48014cdd71..30f031db12f6 100644
--- a/include/uapi/linux/ipx.h
+++ b/include/uapi/linux/ipx.h
@@ -1,11 +1,13 @@
 #ifndef _IPX_H_
 #define _IPX_H_
+#include <linux/libc-compat.h>  /* for compatibility with glibc netipx/ipx.h */
 #include <linux/types.h>
 #include <linux/sockios.h>
 #include <linux/socket.h>
 #define IPX_NODE_LEN    6
 #define IPX_MTU         576
 
+#if __UAPI_DEF_SOCKADDR_IPX
 struct sockaddr_ipx {
         __kernel_sa_family_t sipx_family;
         __be16          sipx_port;
@@ -14,6 +16,7 @@ struct sockaddr_ipx {
         __u8            sipx_type;
         unsigned char   sipx_zero;      /* 16 byte fill */
 };
+#endif /* __UAPI_DEF_SOCKADDR_IPX */
 
 /*
  * So we can fit the extra info for SIOCSIFADDR into the address nicely
@@ -23,12 +26,15 @@ struct sockaddr_ipx {
 #define IPX_DLTITF      0
 #define IPX_CRTITF      1
 
+#if __UAPI_DEF_IPX_ROUTE_DEFINITION
 struct ipx_route_definition {
         __be32        ipx_network;
         __be32        ipx_router_network;
         unsigned char ipx_router_node[IPX_NODE_LEN];
 };
+#endif /* __UAPI_DEF_IPX_ROUTE_DEFINITION */
 
+#if __UAPI_DEF_IPX_INTERFACE_DEFINITION
 struct ipx_interface_definition {
         __be32        ipx_network;
         unsigned char ipx_device[16];
@@ -45,16 +51,20 @@ struct ipx_interface_definition {
 #define IPX_INTERNAL            2
         unsigned char ipx_node[IPX_NODE_LEN];
 };
-        
+#endif /* __UAPI_DEF_IPX_INTERFACE_DEFINITION */
+
+#if __UAPI_DEF_IPX_CONFIG_DATA
 struct ipx_config_data {
         unsigned char   ipxcfg_auto_select_primary;
         unsigned char   ipxcfg_auto_create_interfaces;
 };
+#endif /* __UAPI_DEF_IPX_CONFIG_DATA */
 
 /*
  * OLD Route Definition for backward compatibility.
  */
 
+#if __UAPI_DEF_IPX_ROUTE_DEF
 struct ipx_route_def {
         __be32          ipx_network;
         __be32          ipx_router_network;
@@ -67,6 +77,7 @@ struct ipx_route_def {
 #define IPX_RT_BLUEBOOK         2
 #define IPX_RT_ROUTED           1
 };
+#endif /* __UAPI_DEF_IPX_ROUTE_DEF */
 
 #define SIOCAIPXITFCRT          (SIOCPROTOPRIVATE)
 #define SIOCAIPXPRISLT          (SIOCPROTOPRIVATE + 1)
diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h
index e4f048ee7043..44b8a6bd5fe1 100644
--- a/include/uapi/linux/libc-compat.h
+++ b/include/uapi/linux/libc-compat.h
@@ -139,6 +139,25 @@
 
 #endif /* _NETINET_IN_H */
 
+/* Coordinate with glibc netipx/ipx.h header. */
+#if defined(__NETIPX_IPX_H)
+
+#define __UAPI_DEF_SOCKADDR_IPX                 0
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         0
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     0
+#define __UAPI_DEF_IPX_CONFIG_DATA              0
+#define __UAPI_DEF_IPX_ROUTE_DEF                0
+
+#else /* defined(__NETIPX_IPX_H) */
+
+#define __UAPI_DEF_SOCKADDR_IPX                 1
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         1
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     1
+#define __UAPI_DEF_IPX_CONFIG_DATA              1
+#define __UAPI_DEF_IPX_ROUTE_DEF                1
+
+#endif /* defined(__NETIPX_IPX_H) */
+
 /* Definitions for xattr.h */
 #if defined(_SYS_XATTR_H)
 #define __UAPI_DEF_XATTR                0
@@ -179,6 +198,13 @@
 #define __UAPI_DEF_IN6_PKTINFO          1
 #define __UAPI_DEF_IP6_MTUINFO          1
 
+/* Definitions for ipx.h */
+#define __UAPI_DEF_SOCKADDR_IPX                 1
+#define __UAPI_DEF_IPX_ROUTE_DEFINITION         1
+#define __UAPI_DEF_IPX_INTERFACE_DEFINITION     1
+#define __UAPI_DEF_IPX_CONFIG_DATA              1
+#define __UAPI_DEF_IPX_ROUTE_DEF                1
+
 /* Definitions for xattr.h */
 #define __UAPI_DEF_XATTR                1
 
diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index 01751faccaf8..c674ba2563b7 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -24,7 +24,7 @@ enum nft_registers {
         __NFT_REG_MAX,
 
         NFT_REG32_00    = 8,
-        MFT_REG32_01,
+        NFT_REG32_01,
         NFT_REG32_02,
         NFT_REG32_03,
         NFT_REG32_04,
diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
index d95a3018f6a1..54c3b4f4aceb 100644
--- a/include/uapi/linux/openvswitch.h
+++ b/include/uapi/linux/openvswitch.h
@@ -583,7 +583,7 @@ enum ovs_userspace_attr {
 #define OVS_USERSPACE_ATTR_MAX (__OVS_USERSPACE_ATTR_MAX - 1)
 
 struct ovs_action_trunc {
-        uint32_t max_len; /* Max packet size in bytes. */
+        __u32 max_len; /* Max packet size in bytes. */
 };
 
 /**
@@ -632,8 +632,8 @@ enum ovs_hash_alg {
  * @hash_basis: basis used for computing hash.
  */
 struct ovs_action_hash {
-        uint32_t  hash_alg;     /* One of ovs_hash_alg. */
-        uint32_t  hash_basis;
+        __u32  hash_alg;     /* One of ovs_hash_alg. */
+        __u32  hash_basis;
 };
 
 /**
diff --git a/include/uapi/linux/sctp.h b/include/uapi/linux/sctp.h
index d304f4c9792c..a406adcc0793 100644
--- a/include/uapi/linux/sctp.h
+++ b/include/uapi/linux/sctp.h
@@ -944,4 +944,68 @@ struct sctp_default_prinfo {
         __u16 pr_policy;
 };
 
+struct sctp_info {
+        __u32   sctpi_tag;
+        __u32   sctpi_state;
+        __u32   sctpi_rwnd;
+        __u16   sctpi_unackdata;
+        __u16   sctpi_penddata;
+        __u16   sctpi_instrms;
+        __u16   sctpi_outstrms;
+        __u32   sctpi_fragmentation_point;
+        __u32   sctpi_inqueue;
+        __u32   sctpi_outqueue;
+        __u32   sctpi_overall_error;
+        __u32   sctpi_max_burst;
+        __u32   sctpi_maxseg;
+        __u32   sctpi_peer_rwnd;
+        __u32   sctpi_peer_tag;
+        __u8    sctpi_peer_capable;
+        __u8    sctpi_peer_sack;
+        __u16   __reserved1;
+
+        /* assoc status info */
+        __u64   sctpi_isacks;
+        __u64   sctpi_osacks;
+        __u64   sctpi_opackets;
+        __u64   sctpi_ipackets;
+        __u64   sctpi_rtxchunks;
+        __u64   sctpi_outofseqtsns;
+        __u64   sctpi_idupchunks;
+        __u64   sctpi_gapcnt;
+        __u64   sctpi_ouodchunks;
+        __u64   sctpi_iuodchunks;
+        __u64   sctpi_oodchunks;
+        __u64   sctpi_iodchunks;
+        __u64   sctpi_octrlchunks;
+        __u64   sctpi_ictrlchunks;
+
+        /* primary transport info */
+        struct sockaddr_storage sctpi_p_address;
+        __s32   sctpi_p_state;
+        __u32   sctpi_p_cwnd;
+        __u32   sctpi_p_srtt;
+        __u32   sctpi_p_rto;
+        __u32   sctpi_p_hbinterval;
+        __u32   sctpi_p_pathmaxrxt;
+        __u32   sctpi_p_sackdelay;
+        __u32   sctpi_p_sackfreq;
+        __u32   sctpi_p_ssthresh;
+        __u32   sctpi_p_partial_bytes_acked;
+        __u32   sctpi_p_flight_size;
+        __u16   sctpi_p_error;
+        __u16   __reserved2;
+
+        /* sctp sock info */
+        __u32   sctpi_s_autoclose;
+        __u32   sctpi_s_adaptation_ind;
+        __u32   sctpi_s_pd_point;
+        __u8    sctpi_s_nodelay;
+        __u8    sctpi_s_disable_fragments;
+        __u8    sctpi_s_v4mapped;
+        __u8    sctpi_s_frag_interleave;
+        __u32   sctpi_s_type;
+        __u32   __reserved3;
+};
+
 #endif /* _UAPI_SCTP_H */
diff --git a/include/uapi/linux/virtio_vsock.h b/include/uapi/linux/virtio_vsock.h
index 6b011c19b50f..1d57ed3d84d2 100644
--- a/include/uapi/linux/virtio_vsock.h
+++ b/include/uapi/linux/virtio_vsock.h
@@ -32,7 +32,7 @@
  */
 
 #ifndef _UAPI_LINUX_VIRTIO_VSOCK_H
-#define _UAPI_LINUX_VIRTIO_VOSCK_H
+#define _UAPI_LINUX_VIRTIO_VSOCK_H
 
 #include <linux/types.h>
 #include <linux/virtio_ids.h>
diff --git a/include/uapi/misc/cxl.h b/include/uapi/misc/cxl.h
index cbae529b7ce0..180d526a55c3 100644
--- a/include/uapi/misc/cxl.h
+++ b/include/uapi/misc/cxl.h
@@ -136,8 +136,8 @@ struct cxl_event_afu_driver_reserved {
          *
          * Of course the contents will be ABI, but that's up the AFU driver.
          */
-        size_t data_size;
-        u8 data[];
+        __u32 data_size;
+        __u8 data[];
 };
 
 struct cxl_event {
diff --git a/include/uapi/sound/Kbuild b/include/uapi/sound/Kbuild
index 691984cb0b91..9578d8bdbf31 100644
--- a/include/uapi/sound/Kbuild
+++ b/include/uapi/sound/Kbuild
@@ -13,3 +13,4 @@ header-y += sb16_csp.h
 header-y += sfnt_info.h
 header-y += tlv.h
 header-y += usb_stream.h
+header-y += snd_sst_tokens.h
diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h
index e4701a3c6331..33d00a4ce656 100644
--- a/include/uapi/sound/asoc.h
+++ b/include/uapi/sound/asoc.h
@@ -83,7 +83,7 @@
 #define SND_SOC_TPLG_NUM_TEXTS          16
 
 /* ABI version */
-#define SND_SOC_TPLG_ABI_VERSION        0x4
+#define SND_SOC_TPLG_ABI_VERSION        0x5
 
 /* Max size of TLV data */
 #define SND_SOC_TPLG_TLV_SIZE           32
@@ -105,7 +105,8 @@
 #define SND_SOC_TPLG_TYPE_CODEC_LINK    9
 #define SND_SOC_TPLG_TYPE_BACKEND_LINK  10
 #define SND_SOC_TPLG_TYPE_PDATA         11
-#define SND_SOC_TPLG_TYPE_MAX   SND_SOC_TPLG_TYPE_PDATA
+#define SND_SOC_TPLG_TYPE_BE_DAI        12
+#define SND_SOC_TPLG_TYPE_MAX           SND_SOC_TPLG_TYPE_BE_DAI
 
 /* vendor block IDs - please add new vendor types to end */
 #define SND_SOC_TPLG_TYPE_VENDOR_FW     1000
@@ -124,6 +125,11 @@
 #define SND_SOC_TPLG_TUPLE_TYPE_WORD    4
 #define SND_SOC_TPLG_TUPLE_TYPE_SHORT   5
 
+/* BE DAI flags */
+#define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_RATES         (1 << 0)
+#define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_CHANNELS      (1 << 1)
+#define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_SAMPLEBITS    (1 << 2)
+
 /*
  * Block Header.
  * This header precedes all object and object arrays below.
@@ -251,6 +257,7 @@ struct snd_soc_tplg_stream_caps {
         __le32 period_size_max; /* max period size bytes */
         __le32 buffer_size_min; /* min buffer size bytes */
         __le32 buffer_size_max; /* max buffer size bytes */
+        __le32 sig_bits;        /* number of bits of content */
 } __attribute__((packed));
 
 /*
@@ -285,6 +292,8 @@ struct snd_soc_tplg_manifest {
         __le32 graph_elems;     /* number of graph elements */
         __le32 pcm_elems;       /* number of PCM elements */
         __le32 dai_link_elems;  /* number of DAI link elements */
+        __le32 be_dai_elems;    /* number of BE DAI elements */
+        __le32 reserved[20];    /* reserved for new ABI element types */
         struct snd_soc_tplg_private priv;
 } __attribute__((packed));
 
@@ -450,4 +459,26 @@ struct snd_soc_tplg_link_config {
         struct snd_soc_tplg_stream stream[SND_SOC_TPLG_STREAM_CONFIG_MAX]; /* supported configs playback and captrure */
         __le32 num_streams;     /* number of streams */
 } __attribute__((packed));
+
+/*
+ * Describes SW/FW specific features of BE DAI.
+ *
+ * File block representation for BE DAI :-
+ * +-----------------------------------+-----+
+ * | struct snd_soc_tplg_hdr           |  1  |
+ * +-----------------------------------+-----+
+ * | struct snd_soc_tplg_be_dai        |  N  |
+ * +-----------------------------------+-----+
+ */
+struct snd_soc_tplg_be_dai {
+        __le32 size;            /* in bytes of this structure */
+        char dai_name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN]; /* name - used to match */
+        __le32 dai_id;          /* unique ID - used to match */
+        __le32 playback;        /* supports playback mode */
+        __le32 capture;         /* supports capture mode */
+        struct snd_soc_tplg_stream_caps caps[2]; /* playback and capture for DAI */
+        __le32 flag_mask;       /* bitmask of flags to configure */
+        __le32 flags;           /* SND_SOC_TPLG_DAI_FLGBIT_* */
+        struct snd_soc_tplg_private priv;
+} __attribute__((packed));
 #endif
diff --git a/include/uapi/sound/snd_sst_tokens.h b/include/uapi/sound/snd_sst_tokens.h
new file mode 100644
index 000000000000..1ee2e943d66a
--- /dev/null
+++ b/include/uapi/sound/snd_sst_tokens.h
@@ -0,0 +1,214 @@
+/*
+ * snd_sst_tokens.h - Intel SST tokens definition
+ *
+ * Copyright (C) 2016 Intel Corp
+ * Author: Shreyas NC <shreyas.nc@intel.com>
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ */
+#ifndef __SND_SST_TOKENS_H__
+#define __SND_SST_TOKENS_H__
+
+/**
+ * %SKL_TKN_UUID:               Module UUID
+ *
+ * %SKL_TKN_U8_BLOCK_TYPE:      Type of the private data block.Can be:
+ *                              tuples, bytes, short and words
+ *
+ * %SKL_TKN_U8_IN_PIN_TYPE:     Input pin type,
+ *                              homogenous=0, heterogenous=1
+ *
+ * %SKL_TKN_U8_OUT_PIN_TYPE:    Output pin type,
+ *                              homogenous=0, heterogenous=1
+ * %SKL_TKN_U8_DYN_IN_PIN:      Configure Input pin dynamically
+ *                              if true
+ *
+ * %SKL_TKN_U8_DYN_OUT_PIN:     Configure Output pin dynamically
+ *                              if true
+ *
+ * %SKL_TKN_U8_IN_QUEUE_COUNT:  Store the number of Input pins
+ *
+ * %SKL_TKN_U8_OUT_QUEUE_COUNT: Store the number of Output pins
+ *
+ * %SKL_TKN_U8_TIME_SLOT:       TDM slot number
+ *
+ * %SKL_TKN_U8_CORE_ID:         Stores module affinity value.Can take
+ *                              the values:
+ *                              SKL_AFFINITY_CORE_0 = 0,
+ *                              SKL_AFFINITY_CORE_1,
+ *                              SKL_AFFINITY_CORE_MAX
+ *
+ * %SKL_TKN_U8_MOD_TYPE:        Module type value.
+ *
+ * %SKL_TKN_U8_CONN_TYPE:       Module connection type can be a FE,
+ *                              BE or NONE as defined :
+ *                              SKL_PIPE_CONN_TYPE_NONE = 0,
+ *                              SKL_PIPE_CONN_TYPE_FE = 1 (HOST_DMA)
+ *                              SKL_PIPE_CONN_TYPE_BE = 2 (LINK_DMA)
+ *
+ * %SKL_TKN_U8_DEV_TYPE:        Type of device to which the module is
+ *                              connected
+ *                              Can take the values:
+ *                              SKL_DEVICE_BT = 0x0,
+ *                              SKL_DEVICE_DMIC = 0x1,
+ *                              SKL_DEVICE_I2S = 0x2,
+ *                              SKL_DEVICE_SLIMBUS = 0x3,
+ *                              SKL_DEVICE_HDALINK = 0x4,
+ *                              SKL_DEVICE_HDAHOST = 0x5,
+ *                              SKL_DEVICE_NONE
+ *
+ * %SKL_TKN_U8_HW_CONN_TYPE:    Connection type of the HW to which the
+ *                              module is connected
+ *                              SKL_CONN_NONE = 0,
+ *                              SKL_CONN_SOURCE = 1,
+ *                              SKL_CONN_SINK = 2
+ *
+ * %SKL_TKN_U16_PIN_INST_ID:    Stores the pin instance id
+ *
+ * %SKL_TKN_U16_MOD_INST_ID:    Stores the mdule instance id
+ *
+ * %SKL_TKN_U32_MAX_MCPS:       Module max mcps value
+ *
+ * %SKL_TKN_U32_MEM_PAGES:      Module resource pages
+ *
+ * %SKL_TKN_U32_OBS:            Stores Output Buffer size
+ *
+ * %SKL_TKN_U32_IBS:            Stores input buffer size
+ *
+ * %SKL_TKN_U32_VBUS_ID:        Module VBUS_ID. PDM=0, SSP0=0,
+ *                              SSP1=1,SSP2=2,
+ *                              SSP3=3, SSP4=4,
+ *                              SSP5=5, SSP6=6,INVALID
+ *
+ * %SKL_TKN_U32_PARAMS_FIXUP:   Module Params fixup mask
+ * %SKL_TKN_U32_CONVERTER:      Module params converter mask
+ * %SKL_TKN_U32_PIPE_ID:        Stores the pipe id
+ *
+ * %SKL_TKN_U32_PIPE_CONN_TYPE: Type of the token to which the pipe is
+ *                              connected to. It can be
+ *                              SKL_PIPE_CONN_TYPE_NONE = 0,
+ *                              SKL_PIPE_CONN_TYPE_FE = 1 (HOST_DMA),
+ *                              SKL_PIPE_CONN_TYPE_BE = 2 (LINK_DMA),
+ *
+ * %SKL_TKN_U32_PIPE_PRIORITY:  Pipe priority value
+ * %SKL_TKN_U32_PIPE_MEM_PGS:   Pipe resource pages
+ *
+ * %SKL_TKN_U32_DIR_PIN_COUNT:  Value for the direction to set input/output
+ *                              formats and the pin count.
+ *                              The first 4 bits have the direction
+ *                              value and the next 4 have
+ *                              the pin count value.
+ *                              SKL_DIR_IN = 0, SKL_DIR_OUT = 1.
+ *                              The input and output formats
+ *                              share the same set of tokens
+ *                              with the distinction between input
+ *                              and output made by reading direction
+ *                              token.
+ *
+ * %SKL_TKN_U32_FMT_CH:         Supported channel count
+ *
+ * %SKL_TKN_U32_FMT_FREQ:       Supported frequency/sample rate
+ *
+ * %SKL_TKN_U32_FMT_BIT_DEPTH:  Supported container size
+ *
+ * %SKL_TKN_U32_FMT_SAMPLE_SIZE:Number of samples in the container
+ *
+ * %SKL_TKN_U32_FMT_CH_CONFIG:  Supported channel configurations for the
+ *                              input/output.
+ *
+ * %SKL_TKN_U32_FMT_INTERLEAVE: Interleaving style which can be per
+ *                              channel or per sample. The values can be :
+ *                              SKL_INTERLEAVING_PER_CHANNEL = 0,
+ *                              SKL_INTERLEAVING_PER_SAMPLE = 1,
+ *
+ * %SKL_TKN_U32_FMT_SAMPLE_TYPE:
+ *                              Specifies the sample type. Can take the
+ *                              values: SKL_SAMPLE_TYPE_INT_MSB = 0,
+ *                              SKL_SAMPLE_TYPE_INT_LSB = 1,
+ *                              SKL_SAMPLE_TYPE_INT_SIGNED = 2,
+ *                              SKL_SAMPLE_TYPE_INT_UNSIGNED = 3,
+ *                              SKL_SAMPLE_TYPE_FLOAT = 4
+ *
+ * %SKL_TKN_U32_CH_MAP:         Channel map values
+ * %SKL_TKN_U32_MOD_SET_PARAMS: It can take these values:
+ *                              SKL_PARAM_DEFAULT, SKL_PARAM_INIT,
+ *                              SKL_PARAM_SET, SKL_PARAM_BIND
+ *
+ * %SKL_TKN_U32_MOD_PARAM_ID:   ID of the module params
+ *
+ * %SKL_TKN_U32_CAPS_SET_PARAMS:
+ *                              Set params value
+ *
+ * %SKL_TKN_U32_CAPS_PARAMS_ID: Params ID
+ *
+ * %SKL_TKN_U32_CAPS_SIZE:      Caps size
+ *
+ * %SKL_TKN_U32_PROC_DOMAIN:    Specify processing domain
+ *
+ * %SKL_TKN_U32_LIB_COUNT:      Specifies the number of libraries
+ *
+ * %SKL_TKN_STR_LIB_NAME:       Specifies the library name
+ *
+ * module_id and loadable flags dont have tokens as these values will be
+ * read from the DSP FW manifest
+ */
+enum SKL_TKNS {
+        SKL_TKN_UUID = 1,
+        SKL_TKN_U8_NUM_BLOCKS,
+        SKL_TKN_U8_BLOCK_TYPE,
+        SKL_TKN_U8_IN_PIN_TYPE,
+        SKL_TKN_U8_OUT_PIN_TYPE,
+        SKL_TKN_U8_DYN_IN_PIN,
+        SKL_TKN_U8_DYN_OUT_PIN,
+        SKL_TKN_U8_IN_QUEUE_COUNT,
+        SKL_TKN_U8_OUT_QUEUE_COUNT,
+        SKL_TKN_U8_TIME_SLOT,
+        SKL_TKN_U8_CORE_ID,
+        SKL_TKN_U8_MOD_TYPE,
+        SKL_TKN_U8_CONN_TYPE,
+        SKL_TKN_U8_DEV_TYPE,
+        SKL_TKN_U8_HW_CONN_TYPE,
+        SKL_TKN_U16_MOD_INST_ID,
+        SKL_TKN_U16_BLOCK_SIZE,
+        SKL_TKN_U32_MAX_MCPS,
+        SKL_TKN_U32_MEM_PAGES,
+        SKL_TKN_U32_OBS,
+        SKL_TKN_U32_IBS,
+        SKL_TKN_U32_VBUS_ID,
+        SKL_TKN_U32_PARAMS_FIXUP,
+        SKL_TKN_U32_CONVERTER,
+        SKL_TKN_U32_PIPE_ID,
+        SKL_TKN_U32_PIPE_CONN_TYPE,
+        SKL_TKN_U32_PIPE_PRIORITY,
+        SKL_TKN_U32_PIPE_MEM_PGS,
+        SKL_TKN_U32_DIR_PIN_COUNT,
+        SKL_TKN_U32_FMT_CH,
+        SKL_TKN_U32_FMT_FREQ,
+        SKL_TKN_U32_FMT_BIT_DEPTH,
+        SKL_TKN_U32_FMT_SAMPLE_SIZE,
+        SKL_TKN_U32_FMT_CH_CONFIG,
+        SKL_TKN_U32_FMT_INTERLEAVE,
+        SKL_TKN_U32_FMT_SAMPLE_TYPE,
+        SKL_TKN_U32_FMT_CH_MAP,
+        SKL_TKN_U32_PIN_MOD_ID,
+        SKL_TKN_U32_PIN_INST_ID,
+        SKL_TKN_U32_MOD_SET_PARAMS,
+        SKL_TKN_U32_MOD_PARAM_ID,
+        SKL_TKN_U32_CAPS_SET_PARAMS,
+        SKL_TKN_U32_CAPS_PARAMS_ID,
+        SKL_TKN_U32_CAPS_SIZE,
+        SKL_TKN_U32_PROC_DOMAIN,
+        SKL_TKN_U32_LIB_COUNT,
+        SKL_TKN_STR_LIB_NAME,
+        SKL_TKN_MAX = SKL_TKN_STR_LIB_NAME,
+};
+
+#endif
diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h
index 9a37c541822f..b5486e648607 100644
--- a/include/xen/xen-ops.h
+++ b/include/xen/xen-ops.h
@@ -9,8 +9,8 @@
 
 DECLARE_PER_CPU(struct vcpu_info *, xen_vcpu);
 
-DECLARE_PER_CPU(int, xen_vcpu_id);
-static inline int xen_vcpu_nr(int cpu)
+DECLARE_PER_CPU(uint32_t, xen_vcpu_id);
+static inline uint32_t xen_vcpu_nr(int cpu)
 {
         return per_cpu(xen_vcpu_id, cpu);
 }
diff --git a/init/Kconfig b/init/Kconfig
index 69886493ff1e..cac3f096050d 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1761,6 +1761,7 @@ choice
 
 config SLAB
         bool "SLAB"
+        select HAVE_HARDENED_USERCOPY_ALLOCATOR
         help
           The regular slab allocator that is established and known to work
           well in all environments. It organizes cache hot objects in
@@ -1768,6 +1769,7 @@ config SLAB
 
 config SLUB
         bool "SLUB (Unqueued Allocator)"
+        select HAVE_HARDENED_USERCOPY_ALLOCATOR
         help
            SLUB is a slab allocator that minimizes cache line usage
            instead of managing queues of cached objects (SLAB approach).
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index d6709eb70970..0d302a87f21b 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -19,6 +19,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
+#include <linux/file.h>
 #include <linux/kernel.h>
 #include <linux/audit.h>
 #include <linux/kthread.h>
@@ -544,10 +545,11 @@ int audit_exe_compare(struct task_struct *tsk, struct audit_fsnotify_mark *mark)
         unsigned long ino;
         dev_t dev;
 
-        rcu_read_lock();
-        exe_file = rcu_dereference(tsk->mm->exe_file);
+        exe_file = get_task_exe_file(tsk);
+        if (!exe_file)
+                return 0;
         ino = exe_file->f_inode->i_ino;
         dev = exe_file->f_inode->i_sb->s_dev;
-        rcu_read_unlock();
+        fput(exe_file);
         return audit_mark_compare(mark, ino, dev);
 }
diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
index fff3650d52fc..570eeca7bdfa 100644
--- a/kernel/bpf/hashtab.c
+++ b/kernel/bpf/hashtab.c
@@ -26,11 +26,18 @@ struct bpf_htab {
         struct bucket *buckets;
         void *elems;
         struct pcpu_freelist freelist;
+        void __percpu *extra_elems;
         atomic_t count; /* number of elements in this hashtable */
         u32 n_buckets;  /* number of hash buckets */
         u32 elem_size;  /* size of each element in bytes */
 };
 
+enum extra_elem_state {
+        HTAB_NOT_AN_EXTRA_ELEM = 0,
+        HTAB_EXTRA_ELEM_FREE,
+        HTAB_EXTRA_ELEM_USED
+};
+
 /* each htab element is struct htab_elem + key + value */
 struct htab_elem {
         union {
@@ -38,7 +45,10 @@ struct htab_elem {
                 struct bpf_htab *htab;
                 struct pcpu_freelist_node fnode;
         };
-        struct rcu_head rcu;
+        union {
+                struct rcu_head rcu;
+                enum extra_elem_state state;
+        };
         u32 hash;
         char key[0] __aligned(8);
 };
@@ -113,6 +123,23 @@ free_elems:
         return err;
 }
 
+static int alloc_extra_elems(struct bpf_htab *htab)
+{
+        void __percpu *pptr;
+        int cpu;
+
+        pptr = __alloc_percpu_gfp(htab->elem_size, 8, GFP_USER | __GFP_NOWARN);
+        if (!pptr)
+                return -ENOMEM;
+
+        for_each_possible_cpu(cpu) {
+                ((struct htab_elem *)per_cpu_ptr(pptr, cpu))->state =
+                        HTAB_EXTRA_ELEM_FREE;
+        }
+        htab->extra_elems = pptr;
+        return 0;
+}
+
 /* Called from syscall */
 static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
 {
@@ -185,6 +212,8 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
         if (percpu)
                 cost += (u64) round_up(htab->map.value_size, 8) *
                         num_possible_cpus() * htab->map.max_entries;
+        else
+               cost += (u64) htab->elem_size * num_possible_cpus();
 
         if (cost >= U32_MAX - PAGE_SIZE)
                 /* make sure page count doesn't overflow */
@@ -212,14 +241,22 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
                 raw_spin_lock_init(&htab->buckets[i].lock);
         }
 
+        if (!percpu) {
+                err = alloc_extra_elems(htab);
+                if (err)
+                        goto free_buckets;
+        }
+
         if (!(attr->map_flags & BPF_F_NO_PREALLOC)) {
                 err = prealloc_elems_and_freelist(htab);
                 if (err)
-                        goto free_buckets;
+                        goto free_extra_elems;
         }
 
         return &htab->map;
 
+free_extra_elems:
+        free_percpu(htab->extra_elems);
 free_buckets:
         kvfree(htab->buckets);
 free_htab:
@@ -349,7 +386,6 @@ static void htab_elem_free(struct bpf_htab *htab, struct htab_elem *l)
         if (htab->map.map_type == BPF_MAP_TYPE_PERCPU_HASH)
                 free_percpu(htab_elem_get_ptr(l, htab->map.key_size));
         kfree(l);
-
 }
 
 static void htab_elem_free_rcu(struct rcu_head *head)
@@ -370,6 +406,11 @@ static void htab_elem_free_rcu(struct rcu_head *head)
 
 static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 {
+        if (l->state == HTAB_EXTRA_ELEM_USED) {
+                l->state = HTAB_EXTRA_ELEM_FREE;
+                return;
+        }
+
         if (!(htab->map.map_flags & BPF_F_NO_PREALLOC)) {
                 pcpu_freelist_push(&htab->freelist, &l->fnode);
         } else {
@@ -381,25 +422,44 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
 
 static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
                                          void *value, u32 key_size, u32 hash,
-                                         bool percpu, bool onallcpus)
+                                         bool percpu, bool onallcpus,
+                                         bool old_elem_exists)
 {
         u32 size = htab->map.value_size;
         bool prealloc = !(htab->map.map_flags & BPF_F_NO_PREALLOC);
         struct htab_elem *l_new;
         void __percpu *pptr;
+        int err = 0;
 
         if (prealloc) {
                 l_new = (struct htab_elem *)pcpu_freelist_pop(&htab->freelist);
                 if (!l_new)
-                        return ERR_PTR(-E2BIG);
+                        err = -E2BIG;
         } else {
                 if (atomic_inc_return(&htab->count) > htab->map.max_entries) {
                         atomic_dec(&htab->count);
-                        return ERR_PTR(-E2BIG);
+                        err = -E2BIG;
+                } else {
+                        l_new = kmalloc(htab->elem_size,
+                                        GFP_ATOMIC | __GFP_NOWARN);
+                        if (!l_new)
+                                return ERR_PTR(-ENOMEM);
                 }
-                l_new = kmalloc(htab->elem_size, GFP_ATOMIC | __GFP_NOWARN);
-                if (!l_new)
-                        return ERR_PTR(-ENOMEM);
+        }
+
+        if (err) {
+                if (!old_elem_exists)
+                        return ERR_PTR(err);
+
+                /* if we're updating the existing element and the hash table
+                 * is full, use per-cpu extra elems
+                 */
+                l_new = this_cpu_ptr(htab->extra_elems);
+                if (l_new->state != HTAB_EXTRA_ELEM_FREE)
+                        return ERR_PTR(-E2BIG);
+                l_new->state = HTAB_EXTRA_ELEM_USED;
+        } else {
+                l_new->state = HTAB_NOT_AN_EXTRA_ELEM;
         }
 
         memcpy(l_new->key, key, key_size);
@@ -489,7 +549,8 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
         if (ret)
                 goto err;
 
-        l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false);
+        l_new = alloc_htab_elem(htab, key, value, key_size, hash, false, false,
+                                !!l_old);
         if (IS_ERR(l_new)) {
                 /* all pre-allocated elements are in use or memory exhausted */
                 ret = PTR_ERR(l_new);
@@ -563,7 +624,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
                 }
         } else {
                 l_new = alloc_htab_elem(htab, key, value, key_size,
-                                        hash, true, onallcpus);
+                                        hash, true, onallcpus, false);
                 if (IS_ERR(l_new)) {
                         ret = PTR_ERR(l_new);
                         goto err;
@@ -652,6 +713,7 @@ static void htab_map_free(struct bpf_map *map)
                 htab_free_elems(htab);
                 pcpu_freelist_destroy(&htab->freelist);
         }
+        free_percpu(htab->extra_elems);
         kvfree(htab->buckets);
         kfree(htab);
 }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index f72f23b8fdab..daea765d72e6 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -194,6 +194,7 @@ struct verifier_env {
         struct verifier_state_list **explored_states; /* search pruning optimization */
         struct bpf_map *used_maps[MAX_USED_MAPS]; /* array of map's used by eBPF program */
         u32 used_map_cnt;               /* number of used maps */
+        u32 id_gen;                     /* used to generate unique reg IDs */
         bool allow_ptr_leaks;
 };
 
@@ -1052,7 +1053,7 @@ static int check_map_func_compatibility(struct bpf_map *map, int func_id)
                         goto error;
                 break;
         case BPF_MAP_TYPE_CGROUP_ARRAY:
-                if (func_id != BPF_FUNC_skb_in_cgroup)
+                if (func_id != BPF_FUNC_skb_under_cgroup)
                         goto error;
                 break;
         default:
@@ -1074,7 +1075,7 @@ static int check_map_func_compatibility(struct bpf_map *map, int func_id)
                 if (map->map_type != BPF_MAP_TYPE_STACK_TRACE)
                         goto error;
                 break;
-        case BPF_FUNC_skb_in_cgroup:
+        case BPF_FUNC_skb_under_cgroup:
                 if (map->map_type != BPF_MAP_TYPE_CGROUP_ARRAY)
                         goto error;
                 break;
@@ -1301,7 +1302,7 @@ add_imm:
                 /* dst_reg stays as pkt_ptr type and since some positive
                  * integer value was added to the pointer, increment its 'id'
                  */
-                dst_reg->id++;
+                dst_reg->id = ++env->id_gen;
 
                 /* something was added to pkt_ptr, set range and off to zero */
                 dst_reg->off = 0;
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index d1c51b7f5221..5e8dab5bf9ad 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -6270,6 +6270,12 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd)
         if (cgroup_sk_alloc_disabled)
                 return;
 
+        /* Socket clone path */
+        if (skcd->val) {
+                cgroup_get(sock_cgroup_ptr(skcd));
+                return;
+        }
+
         rcu_read_lock();
 
         while (true) {
diff --git a/kernel/configs/tiny.config b/kernel/configs/tiny.config
index c2de56ab0fce..7fa0c4ae6394 100644
--- a/kernel/configs/tiny.config
+++ b/kernel/configs/tiny.config
@@ -1,4 +1,12 @@
+# CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+# CONFIG_KERNEL_GZIP is not set
+# CONFIG_KERNEL_BZIP2 is not set
+# CONFIG_KERNEL_LZMA is not set
 CONFIG_KERNEL_XZ=y
+# CONFIG_KERNEL_LZO is not set
+# CONFIG_KERNEL_LZ4 is not set
 CONFIG_OPTIMIZE_INLINING=y
+# CONFIG_SLAB is not set
+# CONFIG_SLUB is not set
 CONFIG_SLOB=y
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index c7fd2778ed50..c27e53326bef 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -2069,6 +2069,20 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
         mutex_unlock(&cpuset_mutex);
 }
 
+/*
+ * Make sure the new task conform to the current state of its parent,
+ * which could have been changed by cpuset just after it inherits the
+ * state from the parent and before it sits on the cgroup's task list.
+ */
+void cpuset_fork(struct task_struct *task)
+{
+        if (task_css_is_root(task, cpuset_cgrp_id))
+                return;
+
+        set_cpus_allowed_ptr(task, &current->cpus_allowed);
+        task->mems_allowed = current->mems_allowed;
+}
+
 struct cgroup_subsys cpuset_cgrp_subsys = {
         .css_alloc      = cpuset_css_alloc,
         .css_online     = cpuset_css_online,
@@ -2079,6 +2093,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = {
         .attach         = cpuset_attach,
         .post_attach    = cpuset_post_attach,
         .bind           = cpuset_bind,
+        .fork           = cpuset_fork,
         .legacy_cftypes = files,
         .early_init     = true,
 };
diff --git a/kernel/events/core.c b/kernel/events/core.c
index a19550d80ab1..fc9bb2225291 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -242,18 +242,6 @@ unlock:
         return ret;
 }
 
-static void event_function_local(struct perf_event *event, event_f func, void *data)
-{
-        struct event_function_struct efs = {
-                .event = event,
-                .func = func,
-                .data = data,
-        };
-
-        int ret = event_function(&efs);
-        WARN_ON_ONCE(ret);
-}
-
 static void event_function_call(struct perf_event *event, event_f func, void *data)
 {
         struct perf_event_context *ctx = event->ctx;
@@ -303,6 +291,54 @@ again:
         raw_spin_unlock_irq(&ctx->lock);
 }
 
+/*
+ * Similar to event_function_call() + event_function(), but hard assumes IRQs
+ * are already disabled and we're on the right CPU.
+ */
+static void event_function_local(struct perf_event *event, event_f func, void *data)
+{
+        struct perf_event_context *ctx = event->ctx;
+        struct perf_cpu_context *cpuctx = __get_cpu_context(ctx);
+        struct task_struct *task = READ_ONCE(ctx->task);
+        struct perf_event_context *task_ctx = NULL;
+
+        WARN_ON_ONCE(!irqs_disabled());
+
+        if (task) {
+                if (task == TASK_TOMBSTONE)
+                        return;
+
+                task_ctx = ctx;
+        }
+
+        perf_ctx_lock(cpuctx, task_ctx);
+
+        task = ctx->task;
+        if (task == TASK_TOMBSTONE)
+                goto unlock;
+
+        if (task) {
+                /*
+                 * We must be either inactive or active and the right task,
+                 * otherwise we're screwed, since we cannot IPI to somewhere
+                 * else.
+                 */
+                if (ctx->is_active) {
+                        if (WARN_ON_ONCE(task != current))
+                                goto unlock;
+
+                        if (WARN_ON_ONCE(cpuctx->task_ctx != ctx))
+                                goto unlock;
+                }
+        } else {
+                WARN_ON_ONCE(&cpuctx->ctx != ctx);
+        }
+
+        func(event, cpuctx, ctx, data);
+unlock:
+        perf_ctx_unlock(cpuctx, task_ctx);
+}
+
 #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\
                        PERF_FLAG_FD_OUTPUT  |\
                        PERF_FLAG_PID_CGROUP |\
@@ -843,6 +879,32 @@ perf_cgroup_mark_enabled(struct perf_event *event,
                 }
         }
 }
+
+/*
+ * Update cpuctx->cgrp so that it is set when first cgroup event is added and
+ * cleared when last cgroup event is removed.
+ */
+static inline void
+list_update_cgroup_event(struct perf_event *event,
+                         struct perf_event_context *ctx, bool add)
+{
+        struct perf_cpu_context *cpuctx;
+
+        if (!is_cgroup_event(event))
+                return;
+
+        if (add && ctx->nr_cgroups++)
+                return;
+        else if (!add && --ctx->nr_cgroups)
+                return;
+        /*
+         * Because cgroup events are always per-cpu events,
+         * this will always be called from the right CPU.
+         */
+        cpuctx = __get_cpu_context(ctx);
+        cpuctx->cgrp = add ? event->cgrp : NULL;
+}
+
 #else /* !CONFIG_CGROUP_PERF */
 
 static inline bool
@@ -920,6 +982,13 @@ perf_cgroup_mark_enabled(struct perf_event *event,
                          struct perf_event_context *ctx)
 {
 }
+
+static inline void
+list_update_cgroup_event(struct perf_event *event,
+                         struct perf_event_context *ctx, bool add)
+{
+}
+
 #endif
 
 /*
@@ -1392,6 +1461,7 @@ ctx_group_list(struct perf_event *event, struct perf_event_context *ctx)
 static void
 list_add_event(struct perf_event *event, struct perf_event_context *ctx)
 {
+
         lockdep_assert_held(&ctx->lock);
 
         WARN_ON_ONCE(event->attach_state & PERF_ATTACH_CONTEXT);
@@ -1412,8 +1482,7 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
                 list_add_tail(&event->group_entry, list);
         }
 
-        if (is_cgroup_event(event))
-                ctx->nr_cgroups++;
+        list_update_cgroup_event(event, ctx, true);
 
         list_add_rcu(&event->event_entry, &ctx->event_list);
         ctx->nr_events++;
@@ -1581,8 +1650,6 @@ static void perf_group_attach(struct perf_event *event)
 static void
 list_del_event(struct perf_event *event, struct perf_event_context *ctx)
 {
-        struct perf_cpu_context *cpuctx;
-
         WARN_ON_ONCE(event->ctx != ctx);
         lockdep_assert_held(&ctx->lock);
 
@@ -1594,20 +1661,7 @@ list_del_event(struct perf_event *event, struct perf_event_context *ctx)
 
         event->attach_state &= ~PERF_ATTACH_CONTEXT;
 
-        if (is_cgroup_event(event)) {
-                ctx->nr_cgroups--;
-                /*
-                 * Because cgroup events are always per-cpu events, this will
-                 * always be called from the right CPU.
-                 */
-                cpuctx = __get_cpu_context(ctx);
-                /*
-                 * If there are no more cgroup events then clear cgrp to avoid
-                 * stale pointer in update_cgrp_time_from_cpuctx().
-                 */
-                if (!ctx->nr_cgroups)
-                        cpuctx->cgrp = NULL;
-        }
+        list_update_cgroup_event(event, ctx, false);
 
         ctx->nr_events--;
         if (event->attr.inherit_stat)
@@ -1716,8 +1770,8 @@ static inline int pmu_filter_match(struct perf_event *event)
 static inline int
 event_filter_match(struct perf_event *event)
 {
-        return (event->cpu == -1 || event->cpu == smp_processor_id())
-            && perf_cgroup_match(event) && pmu_filter_match(event);
+        return (event->cpu == -1 || event->cpu == smp_processor_id()) &&
+               perf_cgroup_match(event) && pmu_filter_match(event);
 }
 
 static void
@@ -1737,8 +1791,8 @@ event_sched_out(struct perf_event *event,
          * maintained, otherwise bogus information is return
          * via read() for time_enabled, time_running:
          */
-        if (event->state == PERF_EVENT_STATE_INACTIVE
-            && !event_filter_match(event)) {
+        if (event->state == PERF_EVENT_STATE_INACTIVE &&
+            !event_filter_match(event)) {
                 delta = tstamp - event->tstamp_stopped;
                 event->tstamp_running += delta;
                 event->tstamp_stopped = tstamp;
@@ -2236,10 +2290,15 @@ perf_install_in_context(struct perf_event_context *ctx,
 
         lockdep_assert_held(&ctx->mutex);
 
-        event->ctx = ctx;
         if (event->cpu != -1)
                 event->cpu = cpu;
 
+        /*
+         * Ensures that if we can observe event->ctx, both the event and ctx
+         * will be 'complete'. See perf_iterate_sb_cpu().
+         */
+        smp_store_release(&event->ctx, ctx);
+
         if (!task) {
                 cpu_function_call(cpu, __perf_install_in_context, event);
                 return;
@@ -2437,11 +2496,11 @@ static int __perf_event_stop(void *info)
         return 0;
 }
 
-static int perf_event_restart(struct perf_event *event)
+static int perf_event_stop(struct perf_event *event, int restart)
 {
         struct stop_event_data sd = {
                 .event          = event,
-                .restart        = 1,
+                .restart        = restart,
         };
         int ret = 0;
 
@@ -3490,8 +3549,17 @@ static int perf_event_read(struct perf_event *event, bool group)
                         .group = group,
                         .ret = 0,
                 };
-                smp_call_function_single(event->oncpu,
-                                         __perf_event_read, &data, 1);
+                /*
+                 * Purposely ignore the smp_call_function_single() return
+                 * value.
+                 *
+                 * If event->oncpu isn't a valid CPU it means the event got
+                 * scheduled out and that will have updated the event count.
+                 *
+                 * Therefore, either way, we'll have an up-to-date event count
+                 * after this.
+                 */
+                (void)smp_call_function_single(event->oncpu, __perf_event_read, &data, 1);
                 ret = data.ret;
         } else if (event->state == PERF_EVENT_STATE_INACTIVE) {
                 struct perf_event_context *ctx = event->ctx;
@@ -3861,7 +3929,7 @@ static void exclusive_event_destroy(struct perf_event *event)
 
 static bool exclusive_event_match(struct perf_event *e1, struct perf_event *e2)
 {
-        if ((e1->pmu->capabilities & PERF_PMU_CAP_EXCLUSIVE) &&
+        if ((e1->pmu == e2->pmu) &&
             (e1->cpu == e2->cpu ||
              e1->cpu == -1 ||
              e2->cpu == -1))
@@ -4777,6 +4845,19 @@ static void ring_buffer_attach(struct perf_event *event,
                 spin_unlock_irqrestore(&rb->event_lock, flags);
         }
 
+        /*
+         * Avoid racing with perf_mmap_close(AUX): stop the event
+         * before swizzling the event::rb pointer; if it's getting
+         * unmapped, its aux_mmap_count will be 0 and it won't
+         * restart. See the comment in __perf_pmu_output_stop().
+         *
+         * Data will inevitably be lost when set_output is done in
+         * mid-air, but then again, whoever does it like this is
+         * not in for the data anyway.
+         */
+        if (has_aux(event))
+                perf_event_stop(event, 0);
+
         rcu_assign_pointer(event->rb, rb);
 
         if (old_rb) {
@@ -5969,6 +6050,14 @@ static void perf_iterate_sb_cpu(perf_iterate_f output, void *data)
         struct perf_event *event;
 
         list_for_each_entry_rcu(event, &pel->list, sb_list) {
+                /*
+                 * Skip events that are not fully formed yet; ensure that
+                 * if we observe event->ctx, both event and ctx will be
+                 * complete enough. See perf_install_in_context().
+                 */
+                if (!smp_load_acquire(&event->ctx))
+                        continue;
+
                 if (event->state < PERF_EVENT_STATE_INACTIVE)
                         continue;
                 if (!event_filter_match(event))
@@ -6044,7 +6133,7 @@ static void perf_event_addr_filters_exec(struct perf_event *event, void *data)
         raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
         if (restart)
-                perf_event_restart(event);
+                perf_event_stop(event, 1);
 }
 
 void perf_event_exec(void)
@@ -6088,7 +6177,13 @@ static void __perf_event_output_stop(struct perf_event *event, void *data)
 
         /*
          * In case of inheritance, it will be the parent that links to the
-         * ring-buffer, but it will be the child that's actually using it:
+         * ring-buffer, but it will be the child that's actually using it.
+         *
+         * We are using event::rb to determine if the event should be stopped,
+         * however this may race with ring_buffer_attach() (through set_output),
+         * which will make us skip the event that actually needs to be stopped.
+         * So ring_buffer_attach() has to stop an aux event before re-assigning
+         * its rb pointer.
          */
         if (rcu_dereference(parent->rb) == rb)
                 ro->err = __perf_event_stop(&sd);
@@ -6098,7 +6193,7 @@ static int __perf_pmu_output_stop(void *info)
 {
         struct perf_event *event = info;
         struct pmu *pmu = event->pmu;
-        struct perf_cpu_context *cpuctx = get_cpu_ptr(pmu->pmu_cpu_context);
+        struct perf_cpu_context *cpuctx = this_cpu_ptr(pmu->pmu_cpu_context);
         struct remote_output ro = {
                 .rb     = event->rb,
         };
@@ -6553,15 +6648,6 @@ got_name:
 }
 
 /*
- * Whether this @filter depends on a dynamic object which is not loaded
- * yet or its load addresses are not known.
- */
-static bool perf_addr_filter_needs_mmap(struct perf_addr_filter *filter)
-{
-        return filter->filter && filter->inode;
-}
-
-/*
  * Check whether inode and address range match filter criteria.
  */
 static bool perf_addr_filter_match(struct perf_addr_filter *filter,
@@ -6611,7 +6697,7 @@ static void __perf_addr_filters_adjust(struct perf_event *event, void *data)
         raw_spin_unlock_irqrestore(&ifh->lock, flags);
 
         if (restart)
-                perf_event_restart(event);
+                perf_event_stop(event, 1);
 }
 
 /*
@@ -6622,6 +6708,13 @@ static void perf_addr_filters_adjust(struct vm_area_struct *vma)
         struct perf_event_context *ctx;
         int ctxn;
 
+        /*
+         * Data tracing isn't supported yet and as such there is no need
+         * to keep track of anything that isn't related to executable code:
+         */
+        if (!(vma->vm_flags & VM_EXEC))
+                return;
+
         rcu_read_lock();
         for_each_task_context_nr(ctxn) {
                 ctx = rcu_dereference(current->perf_event_ctxp[ctxn]);
@@ -7774,7 +7867,11 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
         list_for_each_entry(filter, &ifh->list, entry) {
                 event->addr_filters_offs[count] = 0;
 
-                if (perf_addr_filter_needs_mmap(filter))
+                /*
+                 * Adjust base offset if the filter is associated to a binary
+                 * that needs to be mapped:
+                 */
+                if (filter->inode)
                         event->addr_filters_offs[count] =
                                 perf_addr_filter_apply(filter, mm);
 
@@ -7789,7 +7886,7 @@ static void perf_event_addr_filters_apply(struct perf_event *event)
         mmput(mm);
 
 restart:
-        perf_event_restart(event);
+        perf_event_stop(event, 1);
 }
 
 /*
@@ -7905,8 +8002,10 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
                                         goto fail;
                         }
 
-                        if (token == IF_SRC_FILE) {
-                                filename = match_strdup(&args[2]);
+                        if (token == IF_SRC_FILE || token == IF_SRC_FILEADDR) {
+                                int fpos = filter->range ? 2 : 1;
+
+                                filename = match_strdup(&args[fpos]);
                                 if (!filename) {
                                         ret = -ENOMEM;
                                         goto fail;
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index ae9b90dc9a5a..257fa460b846 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -330,15 +330,22 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
         if (!rb)
                 return NULL;
 
-        if (!rb_has_aux(rb) || !atomic_inc_not_zero(&rb->aux_refcount))
+        if (!rb_has_aux(rb))
                 goto err;
 
         /*
-         * If rb::aux_mmap_count is zero (and rb_has_aux() above went through),
-         * the aux buffer is in perf_mmap_close(), about to get freed.
+         * If aux_mmap_count is zero, the aux buffer is in perf_mmap_close(),
+         * about to get freed, so we leave immediately.
+         *
+         * Checking rb::aux_mmap_count and rb::refcount has to be done in
+         * the same order, see perf_mmap_close. Otherwise we end up freeing
+         * aux pages in this path, which is a bug, because in_atomic().
          */
         if (!atomic_read(&rb->aux_mmap_count))
-                goto err_put;
+                goto err;
+
+        if (!atomic_inc_not_zero(&rb->aux_refcount))
+                goto err;
 
         /*
          * Nesting is not supported for AUX area, make sure nested
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index b7a525ab2083..8c50276b60d1 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -172,8 +172,10 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
         mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
         err = -EAGAIN;
         ptep = page_check_address(page, mm, addr, &ptl, 0);
-        if (!ptep)
+        if (!ptep) {
+                mem_cgroup_cancel_charge(kpage, memcg, false);
                 goto unlock;
+        }
 
         get_page(kpage);
         page_add_new_anon_rmap(kpage, vma, addr, false);
@@ -200,7 +202,6 @@ static int __replace_page(struct vm_area_struct *vma, unsigned long addr,
 
         err = 0;
  unlock:
-        mem_cgroup_cancel_charge(kpage, memcg, false);
         mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
         unlock_page(page);
         return err;
diff --git a/kernel/exit.c b/kernel/exit.c
index 2f974ae042a6..091a78be3b09 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -848,12 +848,7 @@ void do_exit(long code)
         TASKS_RCU(preempt_enable());
         exit_notify(tsk, group_dead);
         proc_exit_connector(tsk);
-#ifdef CONFIG_NUMA
-        task_lock(tsk);
-        mpol_put(tsk->mempolicy);
-        tsk->mempolicy = NULL;
-        task_unlock(tsk);
-#endif
+        mpol_put_task_policy(tsk);
 #ifdef CONFIG_FUTEX
         if (unlikely(current->pi_state_cache))
                 kfree(current->pi_state_cache);
diff --git a/kernel/fork.c b/kernel/fork.c
index 52e725d4a866..beb31725f7e2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -799,6 +799,29 @@ struct file *get_mm_exe_file(struct mm_struct *mm)
 EXPORT_SYMBOL(get_mm_exe_file);
 
 /**
+ * get_task_exe_file - acquire a reference to the task's executable file
+ *
+ * Returns %NULL if task's mm (if any) has no associated executable file or
+ * this is a kernel thread with borrowed mm (see the comment above get_task_mm).
+ * User must release file via fput().
+ */
+struct file *get_task_exe_file(struct task_struct *task)
+{
+        struct file *exe_file = NULL;
+        struct mm_struct *mm;
+
+        task_lock(task);
+        mm = task->mm;
+        if (mm) {
+                if (!(task->flags & PF_KTHREAD))
+                        exe_file = get_mm_exe_file(mm);
+        }
+        task_unlock(task);
+        return exe_file;
+}
+EXPORT_SYMBOL(get_task_exe_file);
+
+/**
  * get_task_mm - acquire a reference to the task's mm
  *
  * Returns %NULL if the task has no mm.  Checks PF_KTHREAD (meaning
@@ -913,14 +936,12 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
         deactivate_mm(tsk, mm);
 
         /*
-         * If we're exiting normally, clear a user-space tid field if
-         * requested.  We leave this alone when dying by signal, to leave
-         * the value intact in a core dump, and to save the unnecessary
-         * trouble, say, a killed vfork parent shouldn't touch this mm.
-         * Userland only wants this done for a sys_exit.
+         * Signal userspace if we're not exiting with a core dump
+         * because we want to leave the value intact for debugging
+         * purposes.
          */
         if (tsk->clear_child_tid) {
-                if (!(tsk->flags & PF_SIGNALED) &&
+                if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
                     atomic_read(&mm->mm_users) > 1) {
                         /*
                          * We don't check the error code - if userspace has
@@ -1404,7 +1425,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         p->real_start_time = ktime_get_boot_ns();
         p->io_context = NULL;
         p->audit_context = NULL;
-        threadgroup_change_begin(current);
         cgroup_fork(p);
 #ifdef CONFIG_NUMA
         p->mempolicy = mpol_dup(p->mempolicy);
@@ -1556,6 +1576,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         INIT_LIST_HEAD(&p->thread_group);
         p->task_works = NULL;
 
+        threadgroup_change_begin(current);
         /*
          * Ensure that the cgroup subsystem policies allow the new process to be
          * forked. It should be noted the the new process's css_set can be changed
@@ -1656,6 +1677,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 bad_fork_cancel_cgroup:
         cgroup_cancel_fork(p);
 bad_fork_free_pid:
+        threadgroup_change_end(current);
         if (pid != &init_struct_pid)
                 free_pid(pid);
 bad_fork_cleanup_thread:
@@ -1688,7 +1710,6 @@ bad_fork_cleanup_policy:
         mpol_put(p->mempolicy);
 bad_fork_cleanup_threadgroup_lock:
 #endif
-        threadgroup_change_end(current);
         delayacct_tsk_free(p);
 bad_fork_cleanup_count:
         atomic_dec(&p->cred->user->processes);
diff --git a/kernel/futex.c b/kernel/futex.c
index 33664f70e2d2..46cb3a301bc1 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -179,7 +179,15 @@ int __read_mostly futex_cmpxchg_enabled;
  * Futex flags used to encode options to functions and preserve them across
  * restarts.
  */
-#define FLAGS_SHARED            0x01
+#ifdef CONFIG_MMU
+# define FLAGS_SHARED           0x01
+#else
+/*
+ * NOMMU does not have per process address space. Let the compiler optimize
+ * code away.
+ */
+# define FLAGS_SHARED           0x00
+#endif
 #define FLAGS_CLOCKRT           0x02
 #define FLAGS_HAS_TIMEOUT       0x04
 
@@ -405,6 +413,16 @@ static void get_futex_key_refs(union futex_key *key)
         if (!key->both.ptr)
                 return;
 
+        /*
+         * On MMU less systems futexes are always "private" as there is no per
+         * process address space. We need the smp wmb nevertheless - yes,
+         * arch/blackfin has MMU less SMP ...
+         */
+        if (!IS_ENABLED(CONFIG_MMU)) {
+                smp_mb(); /* explicit smp_mb(); (B) */
+                return;
+        }
+
         switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
         case FUT_OFF_INODE:
                 ihold(key->shared.inode); /* implies smp_mb(); (B) */
@@ -436,6 +454,9 @@ static void drop_futex_key_refs(union futex_key *key)
                 return;
         }
 
+        if (!IS_ENABLED(CONFIG_MMU))
+                return;
+
         switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
         case FUT_OFF_INODE:
                 iput(key->shared.inode);
diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c
index f68959341c0f..32f6cfcff212 100644
--- a/kernel/irq/affinity.c
+++ b/kernel/irq/affinity.c
@@ -39,6 +39,7 @@ struct cpumask *irq_create_affinity_mask(unsigned int *nr_vecs)
                 return NULL;
         }
 
+        get_online_cpus();
         if (max_vecs >= num_online_cpus()) {
                 cpumask_copy(affinity_mask, cpu_online_mask);
                 *nr_vecs = num_online_cpus();
@@ -56,6 +57,7 @@ struct cpumask *irq_create_affinity_mask(unsigned int *nr_vecs)
                 }
                 *nr_vecs = vecs;
         }
+        put_online_cpus();
 
         return affinity_mask;
 }
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index b4c1bc7c9ca2..26ba5654d9d5 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -820,6 +820,21 @@ __irq_do_set_handler(struct irq_desc *desc, irq_flow_handler_t handle,
         desc->name = name;
 
         if (handle != handle_bad_irq && is_chained) {
+                unsigned int type = irqd_get_trigger_type(&desc->irq_data);
+
+                /*
+                 * We're about to start this interrupt immediately,
+                 * hence the need to set the trigger configuration.
+                 * But the .set_type callback may have overridden the
+                 * flow handler, ignoring that we're dealing with a
+                 * chained interrupt. Reset it immediately because we
+                 * do know better.
+                 */
+                if (type != IRQ_TYPE_NONE) {
+                        __irq_set_trigger(desc, type);
+                        desc->handle_irq = handle;
+                }
+
                 irq_settings_set_noprobe(desc);
                 irq_settings_set_norequest(desc);
                 irq_settings_set_nothread(desc);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 73a2b786b5e9..9530fcd27704 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1681,8 +1681,10 @@ int request_threaded_irq(unsigned int irq, irq_handler_t handler,
         action->dev_id = dev_id;
 
         retval = irq_chip_pm_get(&desc->irq_data);
-        if (retval < 0)
+        if (retval < 0) {
+                kfree(action);
                 return retval;
+        }
 
         chip_bus_lock(desc);
         retval = __setup_irq(irq, desc, action);
@@ -1985,8 +1987,10 @@ int request_percpu_irq(unsigned int irq, irq_handler_t handler,
         action->percpu_dev_id = dev_id;
 
         retval = irq_chip_pm_get(&desc->irq_data);
-        if (retval < 0)
+        if (retval < 0) {
+                kfree(action);
                 return retval;
+        }
 
         chip_bus_lock(desc);
         retval = __setup_irq(irq, desc, action);
diff --git a/kernel/irq/msi.c b/kernel/irq/msi.c
index 54999350162c..19e9dfbe97fa 100644
--- a/kernel/irq/msi.c
+++ b/kernel/irq/msi.c
@@ -359,6 +359,17 @@ int msi_domain_alloc_irqs(struct irq_domain *domain, struct device *dev,
                 else
                         dev_dbg(dev, "irq [%d-%d] for MSI\n",
                                 virq, virq + desc->nvec_used - 1);
+                /*
+                 * This flag is set by the PCI layer as we need to activate
+                 * the MSI entries before the PCI layer enables MSI in the
+                 * card. Otherwise the card latches a random msi message.
+                 */
+                if (info->flags & MSI_FLAG_ACTIVATE_EARLY) {
+                        struct irq_data *irq_data;
+
+                        irq_data = irq_domain_get_irq_data(domain, desc->irq);
+                        irq_domain_activate_irq(irq_data);
+                }
         }
 
         return 0;
diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c
index 503bc2d348e5..037c321c5618 100644
--- a/kernel/kexec_file.c
+++ b/kernel/kexec_file.c
@@ -887,7 +887,10 @@ int kexec_load_purgatory(struct kimage *image, unsigned long min,
         return 0;
 out:
         vfree(pi->sechdrs);
+        pi->sechdrs = NULL;
+
         vfree(pi->purgatory_buf);
+        pi->purgatory_buf = NULL;
         return ret;
 }
 
diff --git a/kernel/locking/qspinlock_paravirt.h b/kernel/locking/qspinlock_paravirt.h
index 37649e69056c..8a99abf58080 100644
--- a/kernel/locking/qspinlock_paravirt.h
+++ b/kernel/locking/qspinlock_paravirt.h
@@ -450,7 +450,7 @@ pv_wait_head_or_lock(struct qspinlock *lock, struct mcs_spinlock *node)
                                 goto gotlock;
                         }
                 }
-                WRITE_ONCE(pn->state, vcpu_halted);
+                WRITE_ONCE(pn->state, vcpu_hashed);
                 qstat_inc(qstat_pv_wait_head, true);
                 qstat_inc(qstat_pv_wait_again, waitcnt);
                 pv_wait(&l->locked, _Q_SLOW_VAL);
diff --git a/kernel/locking/qspinlock_stat.h b/kernel/locking/qspinlock_stat.h
index 22e025309845..b9d031516254 100644
--- a/kernel/locking/qspinlock_stat.h
+++ b/kernel/locking/qspinlock_stat.h
@@ -153,7 +153,6 @@ static ssize_t qstat_read(struct file *file, char __user *user_buf,
                  */
                 if ((counter == qstat_pv_latency_kick) ||
                     (counter == qstat_pv_latency_wake)) {
-                        stat = 0;
                         if (kicks)
                                 stat = DIV_ROUND_CLOSEST_ULL(stat, kicks);
                 }
diff --git a/kernel/memremap.c b/kernel/memremap.c
index 251d16b4cb41..b501e390bb34 100644
--- a/kernel/memremap.c
+++ b/kernel/memremap.c
@@ -247,6 +247,7 @@ static void devm_memremap_pages_release(struct device *dev, void *data)
         align_start = res->start & ~(SECTION_SIZE - 1);
         align_size = ALIGN(resource_size(res), SECTION_SIZE);
         arch_remove_memory(align_start, align_size);
+        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
         pgmap_radix_release(res);
         dev_WARN_ONCE(dev, pgmap->altmap && pgmap->altmap->alloc,
                         "%s: failed to free all reserved pages\n", __func__);
@@ -282,6 +283,7 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
                 struct percpu_ref *ref, struct vmem_altmap *altmap)
 {
         resource_size_t key, align_start, align_size, align_end;
+        pgprot_t pgprot = PAGE_KERNEL;
         struct dev_pagemap *pgmap;
         struct page_map *page_map;
         int error, nid, is_ram;
@@ -351,6 +353,11 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         if (nid < 0)
                 nid = numa_mem_id();
 
+        error = track_pfn_remap(NULL, &pgprot, PHYS_PFN(align_start), 0,
+                        align_size);
+        if (error)
+                goto err_pfn_remap;
+
         error = arch_add_memory(nid, align_start, align_size, true);
         if (error)
                 goto err_add_memory;
@@ -371,6 +378,8 @@ void *devm_memremap_pages(struct device *dev, struct resource *res,
         return __va(res->start);
 
  err_add_memory:
+        untrack_pfn(NULL, PHYS_PFN(align_start), align_size);
+ err_pfn_remap:
  err_radix:
         pgmap_radix_release(res);
         devres_free(page_map);
diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
index a881c6a7ba74..33c79b6105c5 100644
--- a/kernel/power/hibernate.c
+++ b/kernel/power/hibernate.c
@@ -300,12 +300,12 @@ static int create_image(int platform_mode)
         save_processor_state();
         trace_suspend_resume(TPS("machine_suspend"), PM_EVENT_HIBERNATE, true);
         error = swsusp_arch_suspend();
+        /* Restore control flow magically appears here */
+        restore_processor_state();
         trace_suspend_resume(TPS("machine_suspend"), PM_EVENT_HIBERNATE, false);
         if (error)
                 printk(KERN_ERR "PM: Error %d creating hibernation image\n",
                         error);
-        /* Restore control flow magically appears here */
-        restore_processor_state();
         if (!in_suspend)
                 events_check_enabled = false;
 
diff --git a/kernel/power/qos.c b/kernel/power/qos.c
index 97b0df71303e..168ff442ebde 100644
--- a/kernel/power/qos.c
+++ b/kernel/power/qos.c
@@ -482,7 +482,16 @@ void pm_qos_update_request(struct pm_qos_request *req,
                 return;
         }
 
-        cancel_delayed_work_sync(&req->work);
+        /*
+         * This function may be called very early during boot, for example,
+         * from of_clk_init(), where irq needs to stay disabled.
+         * cancel_delayed_work_sync() assumes that irq is enabled on
+         * invocation and re-enables it on return.  Avoid calling it until
+         * workqueue is initialized.
+         */
+        if (keventd_up())
+                cancel_delayed_work_sync(&req->work);
+
         __pm_qos_update_request(req, new_value);
 }
 EXPORT_SYMBOL_GPL(pm_qos_update_request);
diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
index 9a0178c2ac1d..b02228411d57 100644
--- a/kernel/power/snapshot.c
+++ b/kernel/power/snapshot.c
@@ -835,9 +835,9 @@ static bool memory_bm_pfn_present(struct memory_bitmap *bm, unsigned long pfn)
  */
 static bool rtree_next_node(struct memory_bitmap *bm)
 {
-        bm->cur.node = list_entry(bm->cur.node->list.next,
-                                  struct rtree_node, list);
-        if (&bm->cur.node->list != &bm->cur.zone->leaves) {
+        if (!list_is_last(&bm->cur.node->list, &bm->cur.zone->leaves)) {
+                bm->cur.node = list_entry(bm->cur.node->list.next,
+                                          struct rtree_node, list);
                 bm->cur.node_pfn += BM_BITS_PER_BLOCK;
                 bm->cur.node_bit  = 0;
                 touch_softlockup_watchdog();
@@ -845,9 +845,9 @@ static bool rtree_next_node(struct memory_bitmap *bm)
         }
 
         /* No more nodes, goto next zone */
-        bm->cur.zone = list_entry(bm->cur.zone->list.next,
+        if (!list_is_last(&bm->cur.zone->list, &bm->zones)) {
+                bm->cur.zone = list_entry(bm->cur.zone->list.next,
                                   struct mem_zone_bm_rtree, list);
-        if (&bm->cur.zone->list != &bm->zones) {
                 bm->cur.node = list_entry(bm->cur.zone->leaves.next,
                                           struct rtree_node, list);
                 bm->cur.node_pfn = 0;
diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
index 276762f3a460..d5760c42f042 100644
--- a/kernel/printk/braille.c
+++ b/kernel/printk/braille.c
@@ -9,10 +9,10 @@
 
 char *_braille_console_setup(char **str, char **brl_options)
 {
-        if (!memcmp(*str, "brl,", 4)) {
+        if (!strncmp(*str, "brl,", 4)) {
                 *brl_options = "";
                 *str += 4;
-        } else if (!memcmp(str, "brl=", 4)) {
+        } else if (!strncmp(*str, "brl=", 4)) {
                 *brl_options = *str + 4;
                 *str = strchr(*brl_options, ',');
                 if (!*str)
diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h
index 5d4505f30083..7fd2838fa417 100644
--- a/kernel/printk/internal.h
+++ b/kernel/printk/internal.h
@@ -16,11 +16,9 @@
  */
 #include <linux/percpu.h>
 
-typedef __printf(2, 0) int (*printk_func_t)(int level, const char *fmt,
-                                            va_list args);
+typedef __printf(1, 0) int (*printk_func_t)(const char *fmt, va_list args);
 
-__printf(2, 0)
-int vprintk_default(int level, const char *fmt, va_list args);
+int __printf(1, 0) vprintk_default(const char *fmt, va_list args);
 
 #ifdef CONFIG_PRINTK_NMI
 
@@ -33,10 +31,9 @@ extern raw_spinlock_t logbuf_lock;
  * via per-CPU variable.
  */
 DECLARE_PER_CPU(printk_func_t, printk_func);
-__printf(2, 0)
-static inline int vprintk_func(int level, const char *fmt, va_list args)
+static inline __printf(1, 0) int vprintk_func(const char *fmt, va_list args)
 {
-        return this_cpu_read(printk_func)(level, fmt, args);
+        return this_cpu_read(printk_func)(fmt, args);
 }
 
 extern atomic_t nmi_message_lost;
@@ -47,10 +44,9 @@ static inline int get_nmi_message_lost(void)
 
 #else /* CONFIG_PRINTK_NMI */
 
-__printf(2, 0)
-static inline int vprintk_func(int level, const char *fmt, va_list args)
+static inline __printf(1, 0) int vprintk_func(const char *fmt, va_list args)
 {
-        return vprintk_default(level, fmt, args);
+        return vprintk_default(fmt, args);
 }
 
 static inline int get_nmi_message_lost(void)
diff --git a/kernel/printk/nmi.c b/kernel/printk/nmi.c
index bc3eeb1ae6da..16bab471c7e2 100644
--- a/kernel/printk/nmi.c
+++ b/kernel/printk/nmi.c
@@ -58,7 +58,7 @@ static DEFINE_PER_CPU(struct nmi_seq_buf, nmi_print_seq);
  * one writer running. But the buffer might get flushed from another
  * CPU, so we need to be careful.
  */
-static int vprintk_nmi(int level, const char *fmt, va_list args)
+static int vprintk_nmi(const char *fmt, va_list args)
 {
         struct nmi_seq_buf *s = this_cpu_ptr(&nmi_print_seq);
         int add = 0;
@@ -79,16 +79,7 @@ again:
         if (!len)
                 smp_rmb();
 
-        if (level != LOGLEVEL_DEFAULT) {
-                add = snprintf(s->buffer + len, sizeof(s->buffer) - len,
-                                KERN_SOH "%c", '0' + level);
-                add += vsnprintf(s->buffer + len + add,
-                                 sizeof(s->buffer) - len - add,
-                                 fmt, args);
-        } else {
-                add = vsnprintf(s->buffer + len, sizeof(s->buffer) - len,
-                                fmt, args);
-        }
+        add = vsnprintf(s->buffer + len, sizeof(s->buffer) - len, fmt, args);
 
         /*
          * Do it once again if the buffer has been flushed in the meantime.
@@ -108,24 +99,30 @@ again:
         return add;
 }
 
-/*
- * printk one line from the temporary buffer from @start index until
- * and including the @end index.
- */
-static void print_nmi_seq_line(struct nmi_seq_buf *s, int start, int end)
+static void printk_nmi_flush_line(const char *text, int len)
 {
-        const char *buf = s->buffer + start;
-
         /*
          * The buffers are flushed in NMI only on panic.  The messages must
          * go only into the ring buffer at this stage.  Consoles will get
          * explicitly called later when a crashdump is not generated.
          */
         if (in_nmi())
-                printk_deferred("%.*s", (end - start) + 1, buf);
+                printk_deferred("%.*s", len, text);
         else
-                printk("%.*s", (end - start) + 1, buf);
+                printk("%.*s", len, text);
+
+}
 
+/*
+ * printk one line from the temporary buffer from @start index until
+ * and including the @end index.
+ */
+static void printk_nmi_flush_seq_line(struct nmi_seq_buf *s,
+                                        int start, int end)
+{
+        const char *buf = s->buffer + start;
+
+        printk_nmi_flush_line(buf, (end - start) + 1);
 }
 
 /*
@@ -159,9 +156,11 @@ more:
          * the buffer an unexpected way. If we printed something then
          * @len must only increase.
          */
-        if (i && i >= len)
-                pr_err("printk_nmi_flush: internal error: i=%d >= len=%zu\n",
-                       i, len);
+        if (i && i >= len) {
+                const char *msg = "printk_nmi_flush: internal error\n";
+
+                printk_nmi_flush_line(msg, strlen(msg));
+        }
 
         if (!len)
                 goto out; /* Someone else has already flushed the buffer. */
@@ -175,14 +174,14 @@ more:
         /* Print line by line. */
         for (; i < size; i++) {
                 if (s->buffer[i] == '\n') {
-                        print_nmi_seq_line(s, last_i, i);
+                        printk_nmi_flush_seq_line(s, last_i, i);
                         last_i = i + 1;
                 }
         }
         /* Check if there was a partial line. */
         if (last_i < size) {
-                print_nmi_seq_line(s, last_i, size - 1);
-                pr_cont("\n");
+                printk_nmi_flush_seq_line(s, last_i, size - 1);
+                printk_nmi_flush_line("\n", strlen("\n"));
         }
 
         /*
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index a5ef95ca18c9..eea6dbc2d8cf 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -1930,28 +1930,7 @@ asmlinkage int printk_emit(int facility, int level,
 }
 EXPORT_SYMBOL(printk_emit);
 
-#ifdef CONFIG_PRINTK
-#define define_pr_level(func, loglevel)                         \
-asmlinkage __visible void func(const char *fmt, ...)            \
-{                                                               \
-        va_list args;                                           \
-                                                                \
-        va_start(args, fmt);                                    \
-        vprintk_default(loglevel, fmt, args);                   \
-        va_end(args);                                           \
-}                                                               \
-EXPORT_SYMBOL(func)
-
-define_pr_level(__pr_emerg, LOGLEVEL_EMERG);
-define_pr_level(__pr_alert, LOGLEVEL_ALERT);
-define_pr_level(__pr_crit, LOGLEVEL_CRIT);
-define_pr_level(__pr_err, LOGLEVEL_ERR);
-define_pr_level(__pr_warn, LOGLEVEL_WARNING);
-define_pr_level(__pr_notice, LOGLEVEL_NOTICE);
-define_pr_level(__pr_info, LOGLEVEL_INFO);
-#endif
-
-int vprintk_default(int level, const char *fmt, va_list args)
+int vprintk_default(const char *fmt, va_list args)
 {
         int r;
 
@@ -1961,7 +1940,7 @@ int vprintk_default(int level, const char *fmt, va_list args)
                 return r;
         }
 #endif
-        r = vprintk_emit(0, level, NULL, 0, fmt, args);
+        r = vprintk_emit(0, LOGLEVEL_DEFAULT, NULL, 0, fmt, args);
 
         return r;
 }
@@ -1994,7 +1973,7 @@ asmlinkage __visible int printk(const char *fmt, ...)
         int r;
 
         va_start(args, fmt);
-        r = vprintk_func(LOGLEVEL_DEFAULT, fmt, args);
+        r = vprintk_func(fmt, args);
         va_end(args);
 
         return r;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 5c883fe8e440..44817c640e99 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -74,6 +74,7 @@
 #include <linux/context_tracking.h>
 #include <linux/compiler.h>
 #include <linux/frame.h>
+#include <linux/prefetch.h>
 
 #include <asm/switch_to.h>
 #include <asm/tlb.h>
@@ -2015,6 +2016,28 @@ try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
         success = 1; /* we're going to change ->state */
         cpu = task_cpu(p);
 
+        /*
+         * Ensure we load p->on_rq _after_ p->state, otherwise it would
+         * be possible to, falsely, observe p->on_rq == 0 and get stuck
+         * in smp_cond_load_acquire() below.
+         *
+         * sched_ttwu_pending()                 try_to_wake_up()
+         *   [S] p->on_rq = 1;                  [L] P->state
+         *       UNLOCK rq->lock  -----.
+         *                              \
+         *                               +---   RMB
+         * schedule()                   /
+         *       LOCK rq->lock    -----'
+         *       UNLOCK rq->lock
+         *
+         * [task p]
+         *   [S] p->state = UNINTERRUPTIBLE     [L] p->on_rq
+         *
+         * Pairs with the UNLOCK+LOCK on rq->lock from the
+         * last wakeup of our task and the schedule that got our task
+         * current.
+         */
+        smp_rmb();
         if (p->on_rq && ttwu_remote(p, wake_flags))
                 goto stat;
 
@@ -2972,6 +2995,23 @@ EXPORT_PER_CPU_SYMBOL(kstat);
 EXPORT_PER_CPU_SYMBOL(kernel_cpustat);
 
 /*
+ * The function fair_sched_class.update_curr accesses the struct curr
+ * and its field curr->exec_start; when called from task_sched_runtime(),
+ * we observe a high rate of cache misses in practice.
+ * Prefetching this data results in improved performance.
+ */
+static inline void prefetch_curr_exec_start(struct task_struct *p)
+{
+#ifdef CONFIG_FAIR_GROUP_SCHED
+        struct sched_entity *curr = (&p->se)->cfs_rq->curr;
+#else
+        struct sched_entity *curr = (&task_rq(p)->cfs)->curr;
+#endif
+        prefetch(curr);
+        prefetch(&curr->exec_start);
+}
+
+/*
  * Return accounted runtime for the task.
  * In case the task is currently running, return the runtime plus current's
  * pending runtime that have not been accounted yet.
@@ -3005,6 +3045,7 @@ unsigned long long task_sched_runtime(struct task_struct *p)
          * thread, breaking clock_gettime().
          */
         if (task_current(rq, p) && task_on_rq_queued(p)) {
+                prefetch_curr_exec_start(p);
                 update_rq_clock(rq);
                 p->sched_class->update_curr(rq);
         }
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
index 5be58820465c..d4184498c9f5 100644
--- a/kernel/sched/cpudeadline.c
+++ b/kernel/sched/cpudeadline.c
@@ -168,7 +168,7 @@ void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid)
 
         if (old_idx == IDX_INVALID) {
                 cp->size++;
-                cp->elements[cp->size - 1].dl = 0;
+                cp->elements[cp->size - 1].dl = dl;
                 cp->elements[cp->size - 1].cpu = cpu;
                 cp->elements[cpu].idx = cp->size - 1;
                 cpudl_change_key(cp, cp->size - 1, dl);
diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c
index 1934f658c036..a846cf89eb96 100644
--- a/kernel/sched/cputime.c
+++ b/kernel/sched/cputime.c
@@ -263,6 +263,11 @@ void account_idle_time(cputime_t cputime)
                 cpustat[CPUTIME_IDLE] += (__force u64) cputime;
 }
 
+/*
+ * When a guest is interrupted for a longer amount of time, missed clock
+ * ticks are not redelivered later. Due to that, this function may on
+ * occasion account more time than the calling functions think elapsed.
+ */
 static __always_inline cputime_t steal_account_process_time(cputime_t maxtime)
 {
 #ifdef CONFIG_PARAVIRT
@@ -371,7 +376,7 @@ static void irqtime_account_process_tick(struct task_struct *p, int user_tick,
          * idle, or potentially user or system time. Due to rounding,
          * other time can exceed ticks occasionally.
          */
-        other = account_other_time(cputime);
+        other = account_other_time(ULONG_MAX);
         if (other >= cputime)
                 return;
         cputime -= other;
@@ -486,7 +491,7 @@ void account_process_tick(struct task_struct *p, int user_tick)
         }
 
         cputime = cputime_one_jiffy;
-        steal = steal_account_process_time(cputime);
+        steal = steal_account_process_time(ULONG_MAX);
 
         if (steal >= cputime)
                 return;
@@ -508,13 +513,21 @@ void account_process_tick(struct task_struct *p, int user_tick)
  */
 void account_idle_ticks(unsigned long ticks)
 {
+        cputime_t cputime, steal;
 
         if (sched_clock_irqtime) {
                 irqtime_account_idle_ticks(ticks);
                 return;
         }
 
-        account_idle_time(jiffies_to_cputime(ticks));
+        cputime = jiffies_to_cputime(ticks);
+        steal = steal_account_process_time(ULONG_MAX);
+
+        if (steal >= cputime)
+                return;
+
+        cputime -= steal;
+        account_idle_time(cputime);
 }
 
 /*
@@ -606,19 +619,25 @@ static void cputime_adjust(struct task_cputime *curr,
         stime = curr->stime;
         utime = curr->utime;
 
-        if (utime == 0) {
-                stime = rtime;
+        /*
+         * If either stime or both stime and utime are 0, assume all runtime is
+         * userspace. Once a task gets some ticks, the monotonicy code at
+         * 'update' will ensure things converge to the observed ratio.
+         */
+        if (stime == 0) {
+                utime = rtime;
                 goto update;
         }
 
-        if (stime == 0) {
-                utime = rtime;
+        if (utime == 0) {
+                stime = rtime;
                 goto update;
         }
 
         stime = scale_stime((__force u64)stime, (__force u64)rtime,
                             (__force u64)(stime + utime));
 
+update:
         /*
          * Make sure stime doesn't go backwards; this preserves monotonicity
          * for utime because rtime is monotonic.
@@ -641,7 +660,6 @@ static void cputime_adjust(struct task_cputime *curr,
                 stime = rtime - utime;
         }
 
-update:
         prev->stime = stime;
         prev->utime = utime;
 out:
@@ -686,6 +704,13 @@ static cputime_t get_vtime_delta(struct task_struct *tsk)
         unsigned long now = READ_ONCE(jiffies);
         cputime_t delta, other;
 
+        /*
+         * Unlike tick based timing, vtime based timing never has lost
+         * ticks, and no need for steal time accounting to make up for
+         * lost ticks. Vtime accounts a rounded version of actual
+         * elapsed time. Limit account_other_time to prevent rounding
+         * errors from causing elapsed vtime to go negative.
+         */
         delta = jiffies_to_cputime(now - tsk->vtime_snap);
         other = account_other_time(delta);
         WARN_ON_ONCE(tsk->vtime_snap_whence == VTIME_INACTIVE);
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index fcb7f0217ff4..1ce8867283dc 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -658,8 +658,11 @@ static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
          *
          * XXX figure out if select_task_rq_dl() deals with offline cpus.
          */
-        if (unlikely(!rq->online))
+        if (unlikely(!rq->online)) {
+                lockdep_unpin_lock(&rq->lock, rf.cookie);
                 rq = dl_task_offline_migration(rq, p);
+                rf.cookie = lockdep_pin_lock(&rq->lock);
+        }
 
         /*
          * Queueing this task back might have overloaded rq, check if we need
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 4088eedea763..039de34f1521 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -4269,7 +4269,7 @@ static void sync_throttle(struct task_group *tg, int cpu)
         pcfs_rq = tg->parent->cfs_rq[cpu];
 
         cfs_rq->throttle_count = pcfs_rq->throttle_count;
-        pcfs_rq->throttled_clock_task = rq_clock_task(cpu_rq(cpu));
+        cfs_rq->throttled_clock_task = rq_clock_task(cpu_rq(cpu));
 }
 
 /* conditionally throttle active cfs_rq's from put_prev_entity() */
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index ef6c6c3f9d8a..0db7c8a2afe2 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -605,12 +605,16 @@ static int __seccomp_filter(int this_syscall, const struct seccomp_data *sd,
                 ptrace_event(PTRACE_EVENT_SECCOMP, data);
                 /*
                  * The delivery of a fatal signal during event
-                 * notification may silently skip tracer notification.
-                 * Terminating the task now avoids executing a system
-                 * call that may not be intended.
+                 * notification may silently skip tracer notification,
+                 * which could leave us with a potentially unmodified
+                 * syscall that the tracer would have liked to have
+                 * changed. Since the process is about to die, we just
+                 * force the syscall to be skipped and let the signal
+                 * kill the process and correctly handle any tracer exit
+                 * notifications.
                  */
                 if (fatal_signal_pending(current))
-                        do_exit(SIGSYS);
+                        goto skip;
                 /* Check if the tracer forced the syscall to be skipped. */
                 this_syscall = syscall_get_nr(current, task_pt_regs(current));
                 if (this_syscall < 0)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index b43d0b27c1fe..a13bbdaab47d 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2140,6 +2140,21 @@ static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
         return 0;
 }
 
+static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
+                                 int *valp,
+                                 int write, void *data)
+{
+        if (write) {
+                if (*negp)
+                        return -EINVAL;
+                *valp = *lvalp;
+        } else {
+                unsigned int val = *valp;
+                *lvalp = (unsigned long)val;
+        }
+        return 0;
+}
+
 static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
 
 static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
@@ -2259,8 +2274,27 @@ static int do_proc_dointvec(struct ctl_table *table, int write,
 int proc_dointvec(struct ctl_table *table, int write,
                      void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_dointvec(table,write,buffer,lenp,ppos,
-                            NULL,NULL);
+        return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL);
+}
+
+/**
+ * proc_douintvec - read a vector of unsigned integers
+ * @table: the sysctl table
+ * @write: %TRUE if this is a write to the sysctl file
+ * @buffer: the user buffer
+ * @lenp: the size of the user buffer
+ * @ppos: file position
+ *
+ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer
+ * values from/to the user buffer, treated as an ASCII string.
+ *
+ * Returns 0 on success.
+ */
+int proc_douintvec(struct ctl_table *table, int write,
+                     void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        return do_proc_dointvec(table, write, buffer, lenp, ppos,
+                                do_proc_douintvec_conv, NULL);
 }
 
 /*
@@ -2858,6 +2892,12 @@ int proc_dointvec(struct ctl_table *table, int write,
         return -ENOSYS;
 }
 
+int proc_douintvec(struct ctl_table *table, int write,
+                  void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        return -ENOSYS;
+}
+
 int proc_dointvec_minmax(struct ctl_table *table, int write,
                     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -2903,6 +2943,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table *table, int write,
  * exception granted :-)
  */
 EXPORT_SYMBOL(proc_dointvec);
+EXPORT_SYMBOL(proc_douintvec);
 EXPORT_SYMBOL(proc_dointvec_jiffies);
 EXPORT_SYMBOL(proc_dointvec_minmax);
 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index 204fdc86863d..2ec7c00228f3 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -908,10 +908,11 @@ static void __tick_nohz_idle_enter(struct tick_sched *ts)
         ktime_t now, expires;
         int cpu = smp_processor_id();
 
+        now = tick_nohz_start_idle(ts);
+
         if (can_stop_idle_tick(cpu, ts)) {
                 int was_stopped = ts->tick_stopped;
 
-                now = tick_nohz_start_idle(ts);
                 ts->idle_calls++;
 
                 expires = tick_nohz_stop_sched_tick(ts, now, cpu);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 3b65746c7f15..e07fb093f819 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -401,7 +401,10 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf)
         do {
                 seq = raw_read_seqcount_latch(&tkf->seq);
                 tkr = tkf->base + (seq & 0x01);
-                now = ktime_to_ns(tkr->base) + timekeeping_get_ns(tkr);
+                now = ktime_to_ns(tkr->base);
+
+                now += clocksource_delta(tkr->read(tkr->clock),
+                                         tkr->cycle_last, tkr->mask);
         } while (read_seqcount_retry(&tkf->seq, seq));
 
         return now;
diff --git a/kernel/time/timekeeping_debug.c b/kernel/time/timekeeping_debug.c
index f6bd65236712..107310a6f36f 100644
--- a/kernel/time/timekeeping_debug.c
+++ b/kernel/time/timekeeping_debug.c
@@ -23,7 +23,9 @@
 
 #include "timekeeping_internal.h"
 
-static unsigned int sleep_time_bin[32] = {0};
+#define NUM_BINS 32
+
+static unsigned int sleep_time_bin[NUM_BINS] = {0};
 
 static int tk_debug_show_sleep_time(struct seq_file *s, void *data)
 {
@@ -69,6 +71,9 @@ late_initcall(tk_debug_sleep_time_init);
 
 void tk_debug_account_sleep_time(struct timespec64 *t)
 {
-        sleep_time_bin[fls(t->tv_sec)]++;
+        /* Cap bin index so we don't overflow the array */
+        int bin = min(fls(t->tv_sec), NUM_BINS-1);
+
+        sleep_time_bin[bin]++;
 }
 
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index 555670a5143c..32bf6f75a8fe 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -1496,6 +1496,7 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
         struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
         u64 expires = KTIME_MAX;
         unsigned long nextevt;
+        bool is_max_delta;
 
         /*
          * Pretend that there is no timer pending if the cpu is offline.
@@ -1506,6 +1507,7 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
 
         spin_lock(&base->lock);
         nextevt = __next_timer_interrupt(base);
+        is_max_delta = (nextevt == base->clk + NEXT_TIMER_MAX_DELTA);
         base->next_expiry = nextevt;
         /*
          * We have a fresh next event. Check whether we can forward the base:
@@ -1519,7 +1521,8 @@ u64 get_next_timer_interrupt(unsigned long basej, u64 basem)
                 expires = basem;
                 base->is_idle = false;
         } else {
-                expires = basem + (nextevt - basej) * TICK_NSEC;
+                if (!is_max_delta)
+                        expires = basem + (nextevt - basej) * TICK_NSEC;
                 /*
                  * If we expect to sleep more than a tick, mark the base idle:
                  */
diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
index 7598e6ca817a..dbafc5df03f3 100644
--- a/kernel/trace/blktrace.c
+++ b/kernel/trace/blktrace.c
@@ -223,7 +223,7 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
         what |= MASK_TC_BIT(op_flags, META);
         what |= MASK_TC_BIT(op_flags, PREFLUSH);
         what |= MASK_TC_BIT(op_flags, FUA);
-        if (op == REQ_OP_DISCARD)
+        if (op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE)
                 what |= BLK_TC_ACT(BLK_TC_DISCARD);
         if (op == REQ_OP_FLUSH)
                 what |= BLK_TC_ACT(BLK_TC_FLUSH);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index dade4c9559cc..7bc56762ca35 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5124,19 +5124,20 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,
         struct trace_iterator *iter = filp->private_data;
         ssize_t sret;
 
-        /* return any leftover data */
-        sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
-        if (sret != -EBUSY)
-                return sret;
-
-        trace_seq_init(&iter->seq);
-
         /*
          * Avoid more than one consumer on a single file descriptor
          * This is just a matter of traces coherency, the ring buffer itself
          * is protected.
          */
         mutex_lock(&iter->mutex);
+
+        /* return any leftover data */
+        sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
+        if (sret != -EBUSY)
+                goto out;
+
+        trace_seq_init(&iter->seq);
+
         if (iter->trace->read) {
                 sret = iter->trace->read(iter, filp, ubuf, cnt, ppos);
                 if (sret)
@@ -6163,9 +6164,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                 return -EBUSY;
 #endif
 
-        if (splice_grow_spd(pipe, &spd))
-                return -ENOMEM;
-
         if (*ppos & (PAGE_SIZE - 1))
                 return -EINVAL;
 
@@ -6175,6 +6173,9 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
                 len &= PAGE_MASK;
         }
 
+        if (splice_grow_spd(pipe, &spd))
+                return -ENOMEM;
+
  again:
         trace_access_lock(iter->cpu_file);
         entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file);
@@ -6232,19 +6233,21 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
         /* did we read anything? */
         if (!spd.nr_pages) {
                 if (ret)
-                        return ret;
+                        goto out;
 
+                ret = -EAGAIN;
                 if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK))
-                        return -EAGAIN;
+                        goto out;
 
                 ret = wait_on_pipe(iter, true);
                 if (ret)
-                        return ret;
+                        goto out;
 
                 goto again;
         }
 
         ret = splice_to_pipe(pipe, &spd);
+out:
         splice_shrink_spd(&spd);
 
         return ret;
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 2307d7c89dac..cab7405f48d2 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -821,7 +821,7 @@ config DETECT_HUNG_TASK
         help
           Say Y here to enable the kernel to detect "hung tasks",
           which are bugs that cause the task to be stuck in
-          uninterruptible "D" state indefinitiley.
+          uninterruptible "D" state indefinitely.
 
           When a hung task is detected, the kernel will print the
           current stack trace (which you should report), but the
@@ -1686,24 +1686,6 @@ config LATENCYTOP
           Enable this option if you want to use the LatencyTOP tool
           to find out which userspace is blocking on what kernel operations.
 
-config ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        bool
-
-config DEBUG_STRICT_USER_COPY_CHECKS
-        bool "Strict user copy size checks"
-        depends on ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
-        depends on DEBUG_KERNEL && !TRACE_BRANCH_PROFILING
-        help
-          Enabling this option turns a certain set of sanity checks for user
-          copy operations into compile time failures.
-
-          The copy_from_user() etc checks are there to help test if there
-          are sufficient security checks on the length argument of
-          the copy operation, by having gcc prove that the argument is
-          within bounds.
-
-          If unsure, say N.
-
 source kernel/trace/Kconfig
 
 menu "Runtime Testing"
diff --git a/lib/Makefile b/lib/Makefile
index cfa68eb269e4..5dc77a8ec297 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -24,7 +24,6 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
          is_single_threaded.o plist.o decompress.o kobject_uevent.o \
          earlycpio.o seq_buf.o nmi_backtrace.o nodemask.o
 
-obj-$(CONFIG_ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS) += usercopy.o
 lib-$(CONFIG_MMU) += ioremap.o
 lib-$(CONFIG_SMP) += cpumask.o
 lib-$(CONFIG_HAS_DMA) += dma-noop.o
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 9e8c7386b3a0..7e3138cfc8c9 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -291,33 +291,13 @@ done:
 }
 
 /*
- * Fault in the first iovec of the given iov_iter, to a maximum length
- * of bytes. Returns 0 on success, or non-zero if the memory could not be
- * accessed (ie. because it is an invalid address).
- *
- * writev-intensive code may want this to prefault several iovecs -- that
- * would be possible (callers must not rely on the fact that _only_ the
- * first iovec will be faulted with the current implementation).
- */
-int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
-{
-        if (!(i->type & (ITER_BVEC|ITER_KVEC))) {
-                char __user *buf = i->iov->iov_base + i->iov_offset;
-                bytes = min(bytes, i->iov->iov_len - i->iov_offset);
-                return fault_in_pages_readable(buf, bytes);
-        }
-        return 0;
-}
-EXPORT_SYMBOL(iov_iter_fault_in_readable);
-
-/*
  * Fault in one or more iovecs of the given iov_iter, to a maximum length of
  * bytes.  For each iovec, fault in each page that constitutes the iovec.
  *
  * Return 0 on success, or non-zero if the memory could not be accessed (i.e.
  * because it is an invalid address).
  */
-int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
+int iov_iter_fault_in_readable(struct iov_iter *i, size_t bytes)
 {
         size_t skip = i->iov_offset;
         const struct iovec *iov;
@@ -334,7 +314,7 @@ int iov_iter_fault_in_multipages_readable(struct iov_iter *i, size_t bytes)
         }
         return 0;
 }
-EXPORT_SYMBOL(iov_iter_fault_in_multipages_readable);
+EXPORT_SYMBOL(iov_iter_fault_in_readable);
 
 void iov_iter_init(struct iov_iter *i, int direction,
                         const struct iovec *iov, unsigned long nr_segs,
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 1b7bf7314141..91f0727e3cad 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -105,10 +105,10 @@ static unsigned int radix_tree_descend(struct radix_tree_node *parent,
 
 #ifdef CONFIG_RADIX_TREE_MULTIORDER
         if (radix_tree_is_internal_node(entry)) {
-                unsigned long siboff = get_slot_offset(parent, entry);
-                if (siboff < RADIX_TREE_MAP_SIZE) {
-                        offset = siboff;
-                        entry = rcu_dereference_raw(parent->slots[offset]);
+                if (is_sibling_entry(parent, entry)) {
+                        void **sibentry = (void **) entry_to_node(entry);
+                        offset = get_slot_offset(parent, sibentry);
+                        entry = rcu_dereference_raw(*sibentry);
                 }
         }
 #endif
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 5d845ffd7982..56054e541a0f 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -30,7 +30,7 @@
 
 #define HASH_DEFAULT_SIZE       64UL
 #define HASH_MIN_SIZE           4U
-#define BUCKET_LOCKS_PER_CPU   128UL
+#define BUCKET_LOCKS_PER_CPU    32UL
 
 static u32 head_hashfn(struct rhashtable *ht,
                        const struct bucket_table *tbl,
@@ -70,21 +70,25 @@ static int alloc_bucket_locks(struct rhashtable *ht, struct bucket_table *tbl,
         unsigned int nr_pcpus = num_possible_cpus();
 #endif
 
-        nr_pcpus = min_t(unsigned int, nr_pcpus, 32UL);
+        nr_pcpus = min_t(unsigned int, nr_pcpus, 64UL);
         size = roundup_pow_of_two(nr_pcpus * ht->p.locks_mul);
 
         /* Never allocate more than 0.5 locks per bucket */
         size = min_t(unsigned int, size, tbl->size >> 1);
 
         if (sizeof(spinlock_t) != 0) {
+                tbl->locks = NULL;
 #ifdef CONFIG_NUMA
                 if (size * sizeof(spinlock_t) > PAGE_SIZE &&
                     gfp == GFP_KERNEL)
                         tbl->locks = vmalloc(size * sizeof(spinlock_t));
-                else
 #endif
-                tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
-                                           gfp);
+                if (gfp != GFP_KERNEL)
+                        gfp |= __GFP_NOWARN | __GFP_NORETRY;
+
+                if (!tbl->locks)
+                        tbl->locks = kmalloc_array(size, sizeof(spinlock_t),
+                                                   gfp);
                 if (!tbl->locks)
                         return -ENOMEM;
                 for (i = 0; i < size; i++)
@@ -321,12 +325,14 @@ static int rhashtable_expand(struct rhashtable *ht)
 static int rhashtable_shrink(struct rhashtable *ht)
 {
         struct bucket_table *new_tbl, *old_tbl = rht_dereference(ht->tbl, ht);
-        unsigned int size;
+        unsigned int nelems = atomic_read(&ht->nelems);
+        unsigned int size = 0;
         int err;
 
         ASSERT_RHT_MUTEX(ht);
 
-        size = roundup_pow_of_two(atomic_read(&ht->nelems) * 3 / 2);
+        if (nelems)
+                size = roundup_pow_of_two(nelems * 3 / 2);
         if (size < ht->p.min_size)
                 size = ht->p.min_size;
 
diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
index 33f655ef48cd..9c5fe8110413 100644
--- a/lib/strncpy_from_user.c
+++ b/lib/strncpy_from_user.c
@@ -40,8 +40,8 @@ static inline long do_strncpy_from_user(char *dst, const char __user *src, long
                 unsigned long c, data;
 
                 /* Fall back to byte-at-a-time if we get a page fault */
-                if (unlikely(unsafe_get_user(c,(unsigned long __user *)(src+res))))
-                        break;
+                unsafe_get_user(c, (unsigned long __user *)(src+res), byte_at_a_time);
+
                 *(unsigned long *)(dst+res) = c;
                 if (has_zero(c, &data, &constants)) {
                         data = prep_zero_mask(c, data, &constants);
@@ -56,8 +56,7 @@ byte_at_a_time:
         while (max) {
                 char c;
 
-                if (unlikely(unsafe_get_user(c,src+res)))
-                        return -EFAULT;
+                unsafe_get_user(c,src+res, efault);
                 dst[res] = c;
                 if (!c)
                         return res;
@@ -76,6 +75,7 @@ byte_at_a_time:
          * Nope: we hit the address space limit, and we still had more
          * characters the caller would have wanted. That's an EFAULT.
          */
+efault:
         return -EFAULT;
 }
 
diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
index 2625943625d7..8e105ed4df12 100644
--- a/lib/strnlen_user.c
+++ b/lib/strnlen_user.c
@@ -45,8 +45,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
         src -= align;
         max += align;
 
-        if (unlikely(unsafe_get_user(c,(unsigned long __user *)src)))
-                return 0;
+        unsafe_get_user(c, (unsigned long __user *)src, efault);
         c |= aligned_byte_mask(align);
 
         for (;;) {
@@ -61,8 +60,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
                 if (unlikely(max <= sizeof(unsigned long)))
                         break;
                 max -= sizeof(unsigned long);
-                if (unlikely(unsafe_get_user(c,(unsigned long __user *)(src+res))))
-                        return 0;
+                unsafe_get_user(c, (unsigned long __user *)(src+res), efault);
         }
         res -= align;
 
@@ -77,6 +75,7 @@ static inline long do_strnlen_user(const char __user *src, unsigned long count,
          * Nope: we hit the address space limit, and we still had more
          * characters the caller would have wanted. That's 0.
          */
+efault:
         return 0;
 }
 
diff --git a/lib/test_hash.c b/lib/test_hash.c
index 66c5fc8351e8..cac20c5fb304 100644
--- a/lib/test_hash.c
+++ b/lib/test_hash.c
@@ -143,7 +143,7 @@ static int __init
 test_hash_init(void)
 {
         char buf[SIZE+1];
-        u32 string_or = 0, hash_or[2][33] = { 0 };
+        u32 string_or = 0, hash_or[2][33] = { { 0, } };
         unsigned tests = 0;
         unsigned long long h64 = 0;
         int i, j;
@@ -219,21 +219,27 @@ test_hash_init(void)
         }
 
         /* Issue notices about skipped tests. */
-#ifndef HAVE_ARCH__HASH_32
-        pr_info("__hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH__HASH_32 != 1
+#ifdef HAVE_ARCH__HASH_32
+#if HAVE_ARCH__HASH_32 != 1
         pr_info("__hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_32
-        pr_info("hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_32 != 1
+#else
+        pr_info("__hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_32
+#if HAVE_ARCH_HASH_32 != 1
         pr_info("hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_64
-        pr_info("hash_64() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_64 != 1
+#else
+        pr_info("hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_64
+#if HAVE_ARCH_HASH_64 != 1
         pr_info("hash_64() is arch-specific; not compared to generic.");
 #endif
+#else
+        pr_info("hash_64() has no arch implementation to test.");
+#endif
 
         pr_notice("%u tests passed.", tests);
 
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 297fdb5e74bd..64e899b63337 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(runs, "Number of test runs per variant (default: 4)");
 
 static int max_size = 0;
 module_param(max_size, int, 0);
-MODULE_PARM_DESC(runs, "Maximum table size (default: calculated)");
+MODULE_PARM_DESC(max_size, "Maximum table size (default: calculated)");
 
 static bool shrinking = false;
 module_param(shrinking, bool, 0);
diff --git a/lib/usercopy.c b/lib/usercopy.c
deleted file mode 100644
index 4f5b1ddbcd25..000000000000
--- a/lib/usercopy.c
+++ /dev/null
@@ -1,9 +0,0 @@
-#include <linux/export.h>
-#include <linux/bug.h>
-#include <linux/uaccess.h>
-
-void copy_from_user_overflow(void)
-{
-        WARN(1, "Buffer overflow detected!\n");
-}
-EXPORT_SYMBOL(copy_from_user_overflow);
diff --git a/mm/Kconfig b/mm/Kconfig
index 78a23c5c302d..be0ee11fa0d9 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -262,7 +262,14 @@ config COMPACTION
         select MIGRATION
         depends on MMU
         help
-          Allows the compaction of memory for the allocation of huge pages.
+          Compaction is the only memory management component to form
+          high order (larger physically contiguous) memory blocks
+          reliably. The page allocator relies on compaction heavily and
+          the lack of the feature can lead to unexpected OOM killer
+          invocations for high order memory requests. You shouldn't
+          disable this option unless there really is a strong reason for
+          it and then we would be really interested to hear about that at
+          linux-mm@kvack.org.
 
 #
 # support for page migration
diff --git a/mm/Makefile b/mm/Makefile
index fc059666c760..2ca1faf3fa09 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -21,6 +21,9 @@ KCOV_INSTRUMENT_memcontrol.o := n
 KCOV_INSTRUMENT_mmzone.o := n
 KCOV_INSTRUMENT_vmstat.o := n
 
+# Since __builtin_frame_address does work as used, disable the warning.
+CFLAGS_usercopy.o += $(call cc-disable-warning, frame-address)
+
 mmu-y                   := nommu.o
 mmu-$(CONFIG_MMU)       := gup.o highmem.o memory.o mincore.o \
                            mlock.o mmap.o mprotect.o mremap.o msync.o rmap.o \
@@ -99,3 +102,4 @@ obj-$(CONFIG_USERFAULTFD) += userfaultfd.o
 obj-$(CONFIG_IDLE_PAGE_TRACKING) += page_idle.o
 obj-$(CONFIG_FRAME_VECTOR) += frame_vector.o
 obj-$(CONFIG_DEBUG_PAGE_REF) += debug_page_ref.o
+obj-$(CONFIG_HARDENED_USERCOPY) += usercopy.o
diff --git a/mm/debug.c b/mm/debug.c
index 8865bfb41b0b..74c7cae4f683 100644
--- a/mm/debug.c
+++ b/mm/debug.c
@@ -42,9 +42,11 @@ const struct trace_print_flags vmaflag_names[] = {
 
 void __dump_page(struct page *page, const char *reason)
 {
+        int mapcount = PageSlab(page) ? 0 : page_mapcount(page);
+
         pr_emerg("page:%p count:%d mapcount:%d mapping:%p index:%#lx",
-                  page, page_ref_count(page), page_mapcount(page),
-                  page->mapping, page->index);
+                  page, page_ref_count(page), mapcount,
+                  page->mapping, page_to_pgoff(page));
         if (PageCompound(page))
                 pr_cont(" compound_mapcount: %d", compound_mapcount(page));
         pr_cont("\n");
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 2373f0a7d340..53ae6d00656a 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1078,7 +1078,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
                 goto out;
 
         page = pmd_page(*pmd);
-        VM_BUG_ON_PAGE(!PageHead(page), page);
+        VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
         if (flags & FOLL_TOUCH)
                 touch_pmd(vma, addr, pmd);
         if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
@@ -1116,7 +1116,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
         }
 skip_mlock:
         page += (addr & ~HPAGE_PMD_MASK) >> PAGE_SHIFT;
-        VM_BUG_ON_PAGE(!PageCompound(page), page);
+        VM_BUG_ON_PAGE(!PageCompound(page) && !is_zone_device_page(page), page);
         if (flags & FOLL_GET)
                 get_page(page);
 
@@ -1138,9 +1138,6 @@ int do_huge_pmd_numa_page(struct fault_env *fe, pmd_t pmd)
         bool was_writable;
         int flags = 0;
 
-        /* A PROT_NONE fault should not end up here */
-        BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
-
         fe->ptl = pmd_lock(vma->vm_mm, fe->pmd);
         if (unlikely(!pmd_same(pmd, *fe->pmd)))
                 goto out_unlock;
@@ -1512,7 +1509,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
         struct page *page;
         pgtable_t pgtable;
         pmd_t _pmd;
-        bool young, write, dirty;
+        bool young, write, dirty, soft_dirty;
         unsigned long addr;
         int i;
 
@@ -1546,6 +1543,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
         write = pmd_write(*pmd);
         young = pmd_young(*pmd);
         dirty = pmd_dirty(*pmd);
+        soft_dirty = pmd_soft_dirty(*pmd);
 
         pmdp_huge_split_prepare(vma, haddr, pmd);
         pgtable = pgtable_trans_huge_withdraw(mm, pmd);
@@ -1562,6 +1560,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                         swp_entry_t swp_entry;
                         swp_entry = make_migration_entry(page + i, write);
                         entry = swp_entry_to_pte(swp_entry);
+                        if (soft_dirty)
+                                entry = pte_swp_mksoft_dirty(entry);
                 } else {
                         entry = mk_pte(page + i, vma->vm_page_prot);
                         entry = maybe_mkwrite(entry, vma);
@@ -1569,6 +1569,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd,
                                 entry = pte_wrprotect(entry);
                         if (!young)
                                 entry = pte_mkold(entry);
+                        if (soft_dirty)
+                                entry = pte_mksoft_dirty(entry);
                 }
                 if (dirty)
                         SetPageDirty(page + i);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index b9aa1b0b38b0..87e11d8ad536 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1448,6 +1448,7 @@ static void dissolve_free_huge_page(struct page *page)
                 list_del(&page->lru);
                 h->free_huge_pages--;
                 h->free_huge_pages_node[nid]--;
+                h->max_huge_pages--;
                 update_and_free_page(h, page);
         }
         spin_unlock(&hugetlb_lock);
diff --git a/mm/kasan/quarantine.c b/mm/kasan/quarantine.c
index b6728a33a4ac..baabaad4a4aa 100644
--- a/mm/kasan/quarantine.c
+++ b/mm/kasan/quarantine.c
@@ -217,11 +217,8 @@ void quarantine_reduce(void)
         new_quarantine_size = (READ_ONCE(totalram_pages) << PAGE_SHIFT) /
                 QUARANTINE_FRACTION;
         percpu_quarantines = QUARANTINE_PERCPU_SIZE * num_online_cpus();
-        if (WARN_ONCE(new_quarantine_size < percpu_quarantines,
-                "Too little memory, disabling global KASAN quarantine.\n"))
-                new_quarantine_size = 0;
-        else
-                new_quarantine_size -= percpu_quarantines;
+        new_quarantine_size = (new_quarantine_size < percpu_quarantines) ?
+                0 : new_quarantine_size - percpu_quarantines;
         WRITE_ONCE(quarantine_size, new_quarantine_size);
 
         last = global_quarantine.head;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index 79c52d0061af..728d7790dc2d 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -838,7 +838,8 @@ static bool hugepage_vma_check(struct vm_area_struct *vma)
  * value (scan code).
  */
 
-static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
+static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address,
+                struct vm_area_struct **vmap)
 {
         struct vm_area_struct *vma;
         unsigned long hstart, hend;
@@ -846,7 +847,7 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)
         if (unlikely(khugepaged_test_exit(mm)))
                 return SCAN_ANY_PROCESS;
 
-        vma = find_vma(mm, address);
+        *vmap = vma = find_vma(mm, address);
         if (!vma)
                 return SCAN_VMA_NULL;
 
@@ -881,6 +882,11 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                 .pmd = pmd,
         };
 
+        /* we only decide to swapin, if there is enough young ptes */
+        if (referenced < HPAGE_PMD_NR/2) {
+                trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
+                return false;
+        }
         fe.pte = pte_offset_map(pmd, address);
         for (; fe.address < address + HPAGE_PMD_NR*PAGE_SIZE;
                         fe.pte++, fe.address += PAGE_SIZE) {
@@ -888,17 +894,12 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
                 if (!is_swap_pte(pteval))
                         continue;
                 swapped_in++;
-                /* we only decide to swapin, if there is enough young ptes */
-                if (referenced < HPAGE_PMD_NR/2) {
-                        trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
-                        return false;
-                }
                 ret = do_swap_page(&fe, pteval);
 
                 /* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */
                 if (ret & VM_FAULT_RETRY) {
                         down_read(&mm->mmap_sem);
-                        if (hugepage_vma_revalidate(mm, address)) {
+                        if (hugepage_vma_revalidate(mm, address, &fe.vma)) {
                                 /* vma is no longer available, don't continue to swapin */
                                 trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
                                 return false;
@@ -923,7 +924,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
 static void collapse_huge_page(struct mm_struct *mm,
                                    unsigned long address,
                                    struct page **hpage,
-                                   struct vm_area_struct *vma,
                                    int node, int referenced)
 {
         pmd_t *pmd, _pmd;
@@ -933,6 +933,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         spinlock_t *pmd_ptl, *pte_ptl;
         int isolated = 0, result = 0;
         struct mem_cgroup *memcg;
+        struct vm_area_struct *vma;
         unsigned long mmun_start;       /* For mmu_notifiers */
         unsigned long mmun_end;         /* For mmu_notifiers */
         gfp_t gfp;
@@ -961,7 +962,7 @@ static void collapse_huge_page(struct mm_struct *mm,
         }
 
         down_read(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
         if (result) {
                 mem_cgroup_cancel_charge(new_page, memcg, true);
                 up_read(&mm->mmap_sem);
@@ -994,7 +995,7 @@ static void collapse_huge_page(struct mm_struct *mm,
          * handled by the anon_vma lock + PG_lock.
          */
         down_write(&mm->mmap_sem);
-        result = hugepage_vma_revalidate(mm, address);
+        result = hugepage_vma_revalidate(mm, address, &vma);
         if (result)
                 goto out;
         /* check if the pmd is still valid */
@@ -1202,7 +1203,7 @@ out_unmap:
         if (ret) {
                 node = khugepaged_find_target_node();
                 /* collapse_huge_page will return with the mmap_sem released */
-                collapse_huge_page(mm, address, hpage, vma, node, referenced);
+                collapse_huge_page(mm, address, hpage, node, referenced);
         }
 out:
         trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced,
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 66beca1ad92f..4be518d4e68a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1740,17 +1740,22 @@ static DEFINE_MUTEX(percpu_charge_mutex);
 static bool consume_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
         struct memcg_stock_pcp *stock;
+        unsigned long flags;
         bool ret = false;
 
         if (nr_pages > CHARGE_BATCH)
                 return ret;
 
-        stock = &get_cpu_var(memcg_stock);
+        local_irq_save(flags);
+
+        stock = this_cpu_ptr(&memcg_stock);
         if (memcg == stock->cached && stock->nr_pages >= nr_pages) {
                 stock->nr_pages -= nr_pages;
                 ret = true;
         }
-        put_cpu_var(memcg_stock);
+
+        local_irq_restore(flags);
+
         return ret;
 }
 
@@ -1771,15 +1776,18 @@ static void drain_stock(struct memcg_stock_pcp *stock)
         stock->cached = NULL;
 }
 
-/*
- * This must be called under preempt disabled or must be called by
- * a thread which is pinned to local cpu.
- */
 static void drain_local_stock(struct work_struct *dummy)
 {
-        struct memcg_stock_pcp *stock = this_cpu_ptr(&memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        stock = this_cpu_ptr(&memcg_stock);
         drain_stock(stock);
         clear_bit(FLUSHING_CACHED_CHARGE, &stock->flags);
+
+        local_irq_restore(flags);
 }
 
 /*
@@ -1788,14 +1796,19 @@ static void drain_local_stock(struct work_struct *dummy)
  */
 static void refill_stock(struct mem_cgroup *memcg, unsigned int nr_pages)
 {
-        struct memcg_stock_pcp *stock = &get_cpu_var(memcg_stock);
+        struct memcg_stock_pcp *stock;
+        unsigned long flags;
+
+        local_irq_save(flags);
 
+        stock = this_cpu_ptr(&memcg_stock);
         if (stock->cached != memcg) { /* reset if necessary */
                 drain_stock(stock);
                 stock->cached = memcg;
         }
         stock->nr_pages += nr_pages;
-        put_cpu_var(memcg_stock);
+
+        local_irq_restore(flags);
 }
 
 /*
@@ -2337,8 +2350,11 @@ int memcg_kmem_charge(struct page *page, gfp_t gfp, int order)
                 return 0;
 
         memcg = get_mem_cgroup_from_mm(current->mm);
-        if (!mem_cgroup_is_root(memcg))
+        if (!mem_cgroup_is_root(memcg)) {
                 ret = memcg_kmem_charge_memcg(page, gfp, order, memcg);
+                if (!ret)
+                        __SetPageKmemcg(page);
+        }
         css_put(&memcg->css);
         return ret;
 }
@@ -2365,6 +2381,11 @@ void memcg_kmem_uncharge(struct page *page, int order)
                 page_counter_uncharge(&memcg->memsw, nr_pages);
 
         page->mem_cgroup = NULL;
+
+        /* slab pages do not have PageKmemcg flag set */
+        if (PageKmemcg(page))
+                __ClearPageKmemcg(page);
+
         css_put_many(&memcg->css, nr_pages);
 }
 #endif /* !CONFIG_SLOB */
@@ -4069,14 +4090,14 @@ static struct cftype mem_cgroup_legacy_files[] = {
 
 static DEFINE_IDR(mem_cgroup_idr);
 
-static void mem_cgroup_id_get(struct mem_cgroup *memcg)
+static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n)
 {
-        atomic_inc(&memcg->id.ref);
+        atomic_add(n, &memcg->id.ref);
 }
 
-static void mem_cgroup_id_put(struct mem_cgroup *memcg)
+static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n)
 {
-        if (atomic_dec_and_test(&memcg->id.ref)) {
+        if (atomic_sub_and_test(n, &memcg->id.ref)) {
                 idr_remove(&mem_cgroup_idr, memcg->id.id);
                 memcg->id.id = 0;
 
@@ -4085,6 +4106,16 @@ static void mem_cgroup_id_put(struct mem_cgroup *memcg)
         }
 }
 
+static inline void mem_cgroup_id_get(struct mem_cgroup *memcg)
+{
+        mem_cgroup_id_get_many(memcg, 1);
+}
+
+static inline void mem_cgroup_id_put(struct mem_cgroup *memcg)
+{
+        mem_cgroup_id_put_many(memcg, 1);
+}
+
 /**
  * mem_cgroup_from_id - look up a memcg from a memcg id
  * @id: the memcg id to look up
@@ -4719,6 +4750,8 @@ static void __mem_cgroup_clear_mc(void)
                 if (!mem_cgroup_is_root(mc.from))
                         page_counter_uncharge(&mc.from->memsw, mc.moved_swap);
 
+                mem_cgroup_id_put_many(mc.from, mc.moved_swap);
+
                 /*
                  * we charged both to->memory and to->memsw, so we
                  * should uncharge to->memory.
@@ -4726,9 +4759,9 @@ static void __mem_cgroup_clear_mc(void)
                 if (!mem_cgroup_is_root(mc.to))
                         page_counter_uncharge(&mc.to->memory, mc.moved_swap);
 
-                css_put_many(&mc.from->css, mc.moved_swap);
+                mem_cgroup_id_get_many(mc.to, mc.moved_swap);
+                css_put_many(&mc.to->css, mc.moved_swap);
 
-                /* we've already done css_get(mc.to) */
                 mc.moved_swap = 0;
         }
         memcg_oom_recover(from);
@@ -5537,8 +5570,10 @@ static void uncharge_list(struct list_head *page_list)
                         else
                                 nr_file += nr_pages;
                         pgpgout++;
-                } else
+                } else {
                         nr_kmem += 1 << compound_order(page);
+                        __ClearPageKmemcg(page);
+                }
 
                 page->mem_cgroup = NULL;
         } while (next != page_list);
@@ -5781,6 +5816,24 @@ static int __init mem_cgroup_init(void)
 subsys_initcall(mem_cgroup_init);
 
 #ifdef CONFIG_MEMCG_SWAP
+static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg)
+{
+        while (!atomic_inc_not_zero(&memcg->id.ref)) {
+                /*
+                 * The root cgroup cannot be destroyed, so it's refcount must
+                 * always be >= 1.
+                 */
+                if (WARN_ON_ONCE(memcg == root_mem_cgroup)) {
+                        VM_BUG_ON(1);
+                        break;
+                }
+                memcg = parent_mem_cgroup(memcg);
+                if (!memcg)
+                        memcg = root_mem_cgroup;
+        }
+        return memcg;
+}
+
 /**
  * mem_cgroup_swapout - transfer a memsw charge to swap
  * @page: page whose memsw charge to transfer
@@ -5790,7 +5843,7 @@ subsys_initcall(mem_cgroup_init);
  */
 void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
 {
-        struct mem_cgroup *memcg;
+        struct mem_cgroup *memcg, *swap_memcg;
         unsigned short oldid;
 
         VM_BUG_ON_PAGE(PageLRU(page), page);
@@ -5805,16 +5858,27 @@ void mem_cgroup_swapout(struct page *page, swp_entry_t entry)
         if (!memcg)
                 return;
 
-        mem_cgroup_id_get(memcg);
-        oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
+        /*
+         * In case the memcg owning these pages has been offlined and doesn't
+         * have an ID allocated to it anymore, charge the closest online
+         * ancestor for the swap instead and transfer the memory+swap charge.
+         */
+        swap_memcg = mem_cgroup_id_get_online(memcg);
+        oldid = swap_cgroup_record(entry, mem_cgroup_id(swap_memcg));
         VM_BUG_ON_PAGE(oldid, page);
-        mem_cgroup_swap_statistics(memcg, true);
+        mem_cgroup_swap_statistics(swap_memcg, true);
 
         page->mem_cgroup = NULL;
 
         if (!mem_cgroup_is_root(memcg))
                 page_counter_uncharge(&memcg->memory, 1);
 
+        if (memcg != swap_memcg) {
+                if (!mem_cgroup_is_root(swap_memcg))
+                        page_counter_charge(&swap_memcg->memsw, 1);
+                page_counter_uncharge(&memcg->memsw, 1);
+        }
+
         /*
          * Interrupts should be disabled here because the caller holds the
          * mapping->tree_lock lock which is taken with interrupts-off. It is
@@ -5853,11 +5917,14 @@ int mem_cgroup_try_charge_swap(struct page *page, swp_entry_t entry)
         if (!memcg)
                 return 0;
 
+        memcg = mem_cgroup_id_get_online(memcg);
+
         if (!mem_cgroup_is_root(memcg) &&
-            !page_counter_try_charge(&memcg->swap, 1, &counter))
+            !page_counter_try_charge(&memcg->swap, 1, &counter)) {
+                mem_cgroup_id_put(memcg);
                 return -ENOMEM;
+        }
 
-        mem_cgroup_id_get(memcg);
         oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
         VM_BUG_ON_PAGE(oldid, page);
         mem_cgroup_swap_statistics(memcg, true);
diff --git a/mm/memory.c b/mm/memory.c
index 83be99d9d8a1..793fe0f9841c 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3351,9 +3351,6 @@ static int do_numa_page(struct fault_env *fe, pte_t pte)
         bool was_writable = pte_write(pte);
         int flags = 0;
 
-        /* A PROT_NONE fault should not end up here */
-        BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
-
         /*
         * The "pte" at this point cannot be used safely without
         * validation through pte_unmap_same(). It's of NUMA type but
@@ -3458,6 +3455,11 @@ static int wp_huge_pmd(struct fault_env *fe, pmd_t orig_pmd)
         return VM_FAULT_FALLBACK;
 }
 
+static inline bool vma_is_accessible(struct vm_area_struct *vma)
+{
+        return vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE);
+}
+
 /*
  * These routines also need to handle stuff like marking pages dirty
  * and/or accessed for architectures that don't do it in hardware (most
@@ -3524,7 +3526,7 @@ static int handle_pte_fault(struct fault_env *fe)
         if (!pte_present(entry))
                 return do_swap_page(fe, entry);
 
-        if (pte_protnone(entry))
+        if (pte_protnone(entry) && vma_is_accessible(fe->vma))
                 return do_numa_page(fe, entry);
 
         fe->ptl = pte_lockptr(fe->vma->vm_mm, fe->pmd);
@@ -3590,7 +3592,7 @@ static int __handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
 
                 barrier();
                 if (pmd_trans_huge(orig_pmd) || pmd_devmap(orig_pmd)) {
-                        if (pmd_protnone(orig_pmd))
+                        if (pmd_protnone(orig_pmd) && vma_is_accessible(vma))
                                 return do_huge_pmd_numa_page(&fe, orig_pmd);
 
                         if ((fe.flags & FAULT_FLAG_WRITE) &&
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 3894b65b1555..b58906b6215c 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1219,6 +1219,7 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
 
         /* init node's zones as empty zones, we don't have any present pages.*/
         free_area_init_node(nid, zones_size, start_pfn, zholes_size);
+        pgdat->per_cpu_nodestats = alloc_percpu(struct per_cpu_nodestat);
 
         /*
          * The node we allocated has no zone fallback lists. For avoiding
@@ -1249,6 +1250,7 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
 static void rollback_node_hotadd(int nid, pg_data_t *pgdat)
 {
         arch_refresh_nodedata(nid, NULL);
+        free_percpu(pgdat->per_cpu_nodestats);
         arch_free_nodedata(pgdat);
         return;
 }
@@ -1565,7 +1567,9 @@ static struct page *new_node_page(struct page *page, unsigned long private,
                 return alloc_huge_page_node(page_hstate(compound_head(page)),
                                         next_node_in(nid, nmask));
 
-        node_clear(nid, nmask);
+        if (nid != next_node_in(nid, nmask))
+                node_clear(nid, nmask);
+
         if (PageHighMem(page)
             || (zone_idx(page_zone(page)) == ZONE_MOVABLE))
                 gfp_mask |= __GFP_HIGHMEM;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index d8c4e38fb5f4..2da72a5b6ecc 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2336,6 +2336,23 @@ out:
         return ret;
 }
 
+/*
+ * Drop the (possibly final) reference to task->mempolicy.  It needs to be
+ * dropped after task->mempolicy is set to NULL so that any allocation done as
+ * part of its kmem_cache_free(), such as by KASAN, doesn't reference a freed
+ * policy.
+ */
+void mpol_put_task_policy(struct task_struct *task)
+{
+        struct mempolicy *pol;
+
+        task_lock(task);
+        pol = task->mempolicy;
+        task->mempolicy = NULL;
+        task_unlock(task);
+        mpol_put(pol);
+}
+
 static void sp_delete(struct shared_policy *sp, struct sp_node *n)
 {
         pr_debug("deleting %lx-l%lx\n", n->start, n->end);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 7d0a275df822..d53a9aa00977 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -764,7 +764,7 @@ bool task_will_free_mem(struct task_struct *task)
 {
         struct mm_struct *mm = task->mm;
         struct task_struct *p;
-        bool ret;
+        bool ret = true;
 
         /*
          * Skip tasks without mm because it might have passed its exit_mm and
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index fb975cec3518..a2214c64ed3c 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1008,10 +1008,8 @@ static __always_inline bool free_pages_prepare(struct page *page,
         }
         if (PageMappingFlags(page))
                 page->mapping = NULL;
-        if (memcg_kmem_enabled() && PageKmemcg(page)) {
+        if (memcg_kmem_enabled() && PageKmemcg(page))
                 memcg_kmem_uncharge(page, order);
-                __ClearPageKmemcg(page);
-        }
         if (check_free)
                 bad += free_pages_check(page);
         if (bad)
@@ -3139,54 +3137,6 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         return NULL;
 }
 
-static inline bool
-should_compact_retry(struct alloc_context *ac, int order, int alloc_flags,
-                     enum compact_result compact_result,
-                     enum compact_priority *compact_priority,
-                     int compaction_retries)
-{
-        int max_retries = MAX_COMPACT_RETRIES;
-
-        if (!order)
-                return false;
-
-        /*
-         * compaction considers all the zone as desperately out of memory
-         * so it doesn't really make much sense to retry except when the
-         * failure could be caused by insufficient priority
-         */
-        if (compaction_failed(compact_result)) {
-                if (*compact_priority > MIN_COMPACT_PRIORITY) {
-                        (*compact_priority)--;
-                        return true;
-                }
-                return false;
-        }
-
-        /*
-         * make sure the compaction wasn't deferred or didn't bail out early
-         * due to locks contention before we declare that we should give up.
-         * But do not retry if the given zonelist is not suitable for
-         * compaction.
-         */
-        if (compaction_withdrawn(compact_result))
-                return compaction_zonelist_suitable(ac, order, alloc_flags);
-
-        /*
-         * !costly requests are much more important than __GFP_REPEAT
-         * costly ones because they are de facto nofail and invoke OOM
-         * killer to move on while costly can fail and users are ready
-         * to cope with that. 1/4 retries is rather arbitrary but we
-         * would need much more detailed feedback from compaction to
-         * make a better decision.
-         */
-        if (order > PAGE_ALLOC_COSTLY_ORDER)
-                max_retries /= 4;
-        if (compaction_retries <= max_retries)
-                return true;
-
-        return false;
-}
 #else
 static inline struct page *
 __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
@@ -3197,6 +3147,8 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         return NULL;
 }
 
+#endif /* CONFIG_COMPACTION */
+
 static inline bool
 should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_flags,
                      enum compact_result compact_result,
@@ -3223,7 +3175,6 @@ should_compact_retry(struct alloc_context *ac, unsigned int order, int alloc_fla
         }
         return false;
 }
-#endif /* CONFIG_COMPACTION */
 
 /* Perform direct synchronous page reclaim */
 static int
@@ -3756,12 +3707,10 @@ no_zone:
         }
 
 out:
-        if (memcg_kmem_enabled() && (gfp_mask & __GFP_ACCOUNT) && page) {
-                if (unlikely(memcg_kmem_charge(page, gfp_mask, order))) {
-                        __free_pages(page, order);
-                        page = NULL;
-                } else
-                        __SetPageKmemcg(page);
+        if (memcg_kmem_enabled() && (gfp_mask & __GFP_ACCOUNT) && page &&
+            unlikely(memcg_kmem_charge(page, gfp_mask, order) != 0)) {
+                __free_pages(page, order);
+                page = NULL;
         }
 
         if (kmemcheck_enabled && page)
@@ -4064,7 +4013,7 @@ long si_mem_available(void)
         int lru;
 
         for (lru = LRU_BASE; lru < NR_LRU_LISTS; lru++)
-                pages[lru] = global_page_state(NR_LRU_BASE + lru);
+                pages[lru] = global_node_page_state(NR_LRU_BASE + lru);
 
         for_each_zone(zone)
                 wmark_low += zone->watermark[WMARK_LOW];
@@ -4411,7 +4360,7 @@ static int build_zonelists_node(pg_data_t *pgdat, struct zonelist *zonelist,
         do {
                 zone_type--;
                 zone = pgdat->node_zones + zone_type;
-                if (populated_zone(zone)) {
+                if (managed_zone(zone)) {
                         zoneref_set_zone(zone,
                                 &zonelist->_zonerefs[nr_zones++]);
                         check_highest_zone(zone_type);
@@ -4649,7 +4598,7 @@ static void build_zonelists_in_zone_order(pg_data_t *pgdat, int nr_nodes)
                 for (j = 0; j < nr_nodes; j++) {
                         node = node_order[j];
                         z = &NODE_DATA(node)->node_zones[zone_type];
-                        if (populated_zone(z)) {
+                        if (managed_zone(z)) {
                                 zoneref_set_zone(z,
                                         &zonelist->_zonerefs[pos++]);
                                 check_highest_zone(zone_type);
@@ -4761,6 +4710,8 @@ int local_memory_node(int node)
 }
 #endif
 
+static void setup_min_unmapped_ratio(void);
+static void setup_min_slab_ratio(void);
 #else   /* CONFIG_NUMA */
 
 static void set_zonelist_order(void)
@@ -5882,9 +5833,6 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat)
                 zone->managed_pages = is_highmem_idx(j) ? realsize : freesize;
 #ifdef CONFIG_NUMA
                 zone->node = nid;
-                pgdat->min_unmapped_pages += (freesize*sysctl_min_unmapped_ratio)
-                                                / 100;
-                pgdat->min_slab_pages += (freesize * sysctl_min_slab_ratio) / 100;
 #endif
                 zone->name = zone_names[j];
                 zone->zone_pgdat = pgdat;
@@ -6805,6 +6753,12 @@ int __meminit init_per_zone_wmark_min(void)
         setup_per_zone_wmarks();
         refresh_zone_stat_thresholds();
         setup_per_zone_lowmem_reserve();
+
+#ifdef CONFIG_NUMA
+        setup_min_unmapped_ratio();
+        setup_min_slab_ratio();
+#endif
+
         return 0;
 }
 core_initcall(init_per_zone_wmark_min)
@@ -6846,43 +6800,58 @@ int watermark_scale_factor_sysctl_handler(struct ctl_table *table, int write,
 }
 
 #ifdef CONFIG_NUMA
+static void setup_min_unmapped_ratio(void)
+{
+        pg_data_t *pgdat;
+        struct zone *zone;
+
+        for_each_online_pgdat(pgdat)
+                pgdat->min_unmapped_pages = 0;
+
+        for_each_zone(zone)
+                zone->zone_pgdat->min_unmapped_pages += (zone->managed_pages *
+                                sysctl_min_unmapped_ratio) / 100;
+}
+
+
 int sysctl_min_unmapped_ratio_sysctl_handler(struct ctl_table *table, int write,
         void __user *buffer, size_t *length, loff_t *ppos)
 {
-        struct pglist_data *pgdat;
-        struct zone *zone;
         int rc;
 
         rc = proc_dointvec_minmax(table, write, buffer, length, ppos);
         if (rc)
                 return rc;
 
+        setup_min_unmapped_ratio();
+
+        return 0;
+}
+
+static void setup_min_slab_ratio(void)
+{
+        pg_data_t *pgdat;
+        struct zone *zone;
+
         for_each_online_pgdat(pgdat)
                 pgdat->min_slab_pages = 0;
 
         for_each_zone(zone)
-                zone->zone_pgdat->min_unmapped_pages += (zone->managed_pages *
-                                sysctl_min_unmapped_ratio) / 100;
-        return 0;
+                zone->zone_pgdat->min_slab_pages += (zone->managed_pages *
+                                sysctl_min_slab_ratio) / 100;
 }
 
 int sysctl_min_slab_ratio_sysctl_handler(struct ctl_table *table, int write,
         void __user *buffer, size_t *length, loff_t *ppos)
 {
-        struct pglist_data *pgdat;
-        struct zone *zone;
         int rc;
 
         rc = proc_dointvec_minmax(table, write, buffer, length, ppos);
         if (rc)
                 return rc;
 
-        for_each_online_pgdat(pgdat)
-                pgdat->min_slab_pages = 0;
+        setup_min_slab_ratio();
 
-        for_each_zone(zone)
-                zone->zone_pgdat->min_slab_pages += (zone->managed_pages *
-                                sysctl_min_slab_ratio) / 100;
         return 0;
 }
 #endif
diff --git a/mm/page_io.c b/mm/page_io.c
index 16bd82fad38c..eafe5ddc2b54 100644
--- a/mm/page_io.c
+++ b/mm/page_io.c
@@ -264,6 +264,7 @@ int __swap_writepage(struct page *page, struct writeback_control *wbc,
         int ret;
         struct swap_info_struct *sis = page_swap_info(page);
 
+        BUG_ON(!PageSwapCache(page));
         if (sis->flags & SWP_FILE) {
                 struct kiocb kiocb;
                 struct file *swap_file = sis->swap_file;
@@ -337,6 +338,7 @@ int swap_readpage(struct page *page)
         int ret = 0;
         struct swap_info_struct *sis = page_swap_info(page);
 
+        BUG_ON(!PageSwapCache(page));
         VM_BUG_ON_PAGE(!PageLocked(page), page);
         VM_BUG_ON_PAGE(PageUptodate(page), page);
         if (frontswap_load(page) == 0) {
@@ -386,6 +388,7 @@ int swap_set_page_dirty(struct page *page)
 
         if (sis->flags & SWP_FILE) {
                 struct address_space *mapping = sis->swap_file->f_mapping;
+                BUG_ON(!PageSwapCache(page));
                 return mapping->a_ops->set_page_dirty(page);
         } else {
                 return __set_page_dirty_no_writeback(page);
diff --git a/mm/readahead.c b/mm/readahead.c
index 65ec288dc057..c8a955b1297e 100644
--- a/mm/readahead.c
+++ b/mm/readahead.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/dax.h>
 #include <linux/gfp.h>
 #include <linux/export.h>
 #include <linux/blkdev.h>
@@ -544,6 +545,14 @@ do_readahead(struct address_space *mapping, struct file *filp,
         if (!mapping || !mapping->a_ops)
                 return -EINVAL;
 
+        /*
+         * Readahead doesn't make sense for DAX inodes, but we don't want it
+         * to report a failure either.  Instead, we just return success and
+         * don't do any work.
+         */
+        if (dax_mapping(mapping))
+                return 0;
+
         return force_page_cache_readahead(mapping, filp, index, nr);
 }
 
diff --git a/mm/rmap.c b/mm/rmap.c
index 709bc83703b1..1ef36404e7b2 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1284,8 +1284,9 @@ void page_add_file_rmap(struct page *page, bool compound)
                 VM_BUG_ON_PAGE(!PageSwapBacked(page), page);
                 __inc_node_page_state(page, NR_SHMEM_PMDMAPPED);
         } else {
-                if (PageTransCompound(page)) {
-                        VM_BUG_ON_PAGE(!PageLocked(page), page);
+                if (PageTransCompound(page) && page_mapping(page)) {
+                        VM_WARN_ON_ONCE(!PageLocked(page));
+
                         SetPageDoubleMap(compound_head(page));
                         if (PageMlocked(page))
                                 clear_page_mlock(compound_head(page));
@@ -1303,7 +1304,7 @@ static void page_remove_file_rmap(struct page *page, bool compound)
 {
         int i, nr = 1;
 
-        VM_BUG_ON_PAGE(compound && !PageTransHuge(page), page);
+        VM_BUG_ON_PAGE(compound && !PageHead(page), page);
         lock_page_memcg(page);
 
         /* Hugepages are not counted in NR_FILE_MAPPED for now. */
diff --git a/mm/shmem.c b/mm/shmem.c
index 7f7748a0f9e1..971fc83e6402 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -270,7 +270,7 @@ bool shmem_charge(struct inode *inode, long pages)
                 info->alloced -= pages;
                 shmem_recalc_inode(inode);
                 spin_unlock_irqrestore(&info->lock, flags);
-
+                shmem_unacct_blocks(info->flags, pages);
                 return false;
         }
         percpu_counter_add(&sbinfo->used_blocks, pages);
@@ -291,6 +291,7 @@ void shmem_uncharge(struct inode *inode, long pages)
 
         if (sbinfo->max_blocks)
                 percpu_counter_sub(&sbinfo->used_blocks, pages);
+        shmem_unacct_blocks(info->flags, pages);
 }
 
 /*
@@ -1980,7 +1981,7 @@ unsigned long shmem_get_unmapped_area(struct file *file,
                                 return addr;
                         sb = shm_mnt->mnt_sb;
                 }
-                if (SHMEM_SB(sb)->huge != SHMEM_HUGE_NEVER)
+                if (SHMEM_SB(sb)->huge == SHMEM_HUGE_NEVER)
                         return addr;
         }
 
@@ -3975,7 +3976,9 @@ static ssize_t shmem_enabled_store(struct kobject *kobj,
 
 struct kobj_attribute shmem_enabled_attr =
         __ATTR(shmem_enabled, 0644, shmem_enabled_show, shmem_enabled_store);
+#endif /* CONFIG_TRANSPARENT_HUGE_PAGECACHE && CONFIG_SYSFS */
 
+#ifdef CONFIG_TRANSPARENT_HUGE_PAGECACHE
 bool shmem_huge_enabled(struct vm_area_struct *vma)
 {
         struct inode *inode = file_inode(vma->vm_file);
@@ -4006,7 +4009,7 @@ bool shmem_huge_enabled(struct vm_area_struct *vma)
                         return false;
         }
 }
-#endif /* CONFIG_TRANSPARENT_HUGE_PAGECACHE && CONFIG_SYSFS */
+#endif /* CONFIG_TRANSPARENT_HUGE_PAGECACHE */
 
 #else /* !CONFIG_SHMEM */
 
diff --git a/mm/slab.c b/mm/slab.c
index 261147ba156f..b67271024135 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4441,6 +4441,36 @@ static int __init slab_proc_init(void)
 module_init(slab_proc_init);
 #endif
 
+#ifdef CONFIG_HARDENED_USERCOPY
+/*
+ * Rejects objects that are incorrectly sized.
+ *
+ * Returns NULL if check passes, otherwise const char * to name of cache
+ * to indicate an error.
+ */
+const char *__check_heap_object(const void *ptr, unsigned long n,
+                                struct page *page)
+{
+        struct kmem_cache *cachep;
+        unsigned int objnr;
+        unsigned long offset;
+
+        /* Find and validate object. */
+        cachep = page->slab_cache;
+        objnr = obj_to_index(cachep, page, (void *)ptr);
+        BUG_ON(objnr >= cachep->num);
+
+        /* Find offset within object. */
+        offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
+
+        /* Allow address range falling entirely within object size. */
+        if (offset <= cachep->object_size && n <= cachep->object_size - offset)
+                return NULL;
+
+        return cachep->name;
+}
+#endif /* CONFIG_HARDENED_USERCOPY */
+
 /**
  * ksize - get the actual amount of memory allocated for a given object
  * @objp: Pointer to the object
diff --git a/mm/slub.c b/mm/slub.c
index 850737bdfbd8..9adae58462f8 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3629,6 +3629,7 @@ static void list_slab_objects(struct kmem_cache *s, struct page *page,
  */
 static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
 {
+        LIST_HEAD(discard);
         struct page *page, *h;
 
         BUG_ON(irqs_disabled());
@@ -3636,13 +3637,16 @@ static void free_partial(struct kmem_cache *s, struct kmem_cache_node *n)
         list_for_each_entry_safe(page, h, &n->partial, lru) {
                 if (!page->inuse) {
                         remove_partial(n, page);
-                        discard_slab(s, page);
+                        list_add(&page->lru, &discard);
                 } else {
                         list_slab_objects(s, page,
                         "Objects remaining in %s on __kmem_cache_shutdown()");
                 }
         }
         spin_unlock_irq(&n->list_lock);
+
+        list_for_each_entry_safe(page, h, &discard, lru)
+                discard_slab(s, page);
 }
 
 /*
@@ -3764,6 +3768,46 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
 EXPORT_SYMBOL(__kmalloc_node);
 #endif
 
+#ifdef CONFIG_HARDENED_USERCOPY
+/*
+ * Rejects objects that are incorrectly sized.
+ *
+ * Returns NULL if check passes, otherwise const char * to name of cache
+ * to indicate an error.
+ */
+const char *__check_heap_object(const void *ptr, unsigned long n,
+                                struct page *page)
+{
+        struct kmem_cache *s;
+        unsigned long offset;
+        size_t object_size;
+
+        /* Find object and usable object size. */
+        s = page->slab_cache;
+        object_size = slab_ksize(s);
+
+        /* Reject impossible pointers. */
+        if (ptr < page_address(page))
+                return s->name;
+
+        /* Find offset within object. */
+        offset = (ptr - page_address(page)) % s->size;
+
+        /* Adjust for redzone and reject if within the redzone. */
+        if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE) {
+                if (offset < s->red_left_pad)
+                        return s->name;
+                offset -= s->red_left_pad;
+        }
+
+        /* Allow address range falling entirely within object size. */
+        if (offset <= object_size && n <= object_size - offset)
+                return NULL;
+
+        return s->name;
+}
+#endif /* CONFIG_HARDENED_USERCOPY */
+
 static size_t __ksize(const void *object)
 {
         struct page *page;
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 78cfa292a29a..2657accc6e2b 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -2724,7 +2724,6 @@ int swapcache_prepare(swp_entry_t entry)
 struct swap_info_struct *page_swap_info(struct page *page)
 {
         swp_entry_t swap = { .val = page_private(page) };
-        BUG_ON(!PageSwapCache(page));
         return swap_info[swp_type(swap)];
 }
 
diff --git a/mm/usercopy.c b/mm/usercopy.c
new file mode 100644
index 000000000000..3c8da0af9695
--- /dev/null
+++ b/mm/usercopy.c
@@ -0,0 +1,280 @@
+/*
+ * This implements the various checks for CONFIG_HARDENED_USERCOPY*,
+ * which are designed to protect kernel memory from needless exposure
+ * and overwrite under many unintended conditions. This code is based
+ * on PAX_USERCOPY, which is:
+ *
+ * Copyright (C) 2001-2016 PaX Team, Bradley Spengler, Open Source
+ * Security Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <asm/sections.h>
+
+enum {
+        BAD_STACK = -1,
+        NOT_STACK = 0,
+        GOOD_FRAME,
+        GOOD_STACK,
+};
+
+/*
+ * Checks if a given pointer and length is contained by the current
+ * stack frame (if possible).
+ *
+ * Returns:
+ *      NOT_STACK: not at all on the stack
+ *      GOOD_FRAME: fully within a valid stack frame
+ *      GOOD_STACK: fully on the stack (when can't do frame-checking)
+ *      BAD_STACK: error condition (invalid stack position or bad stack frame)
+ */
+static noinline int check_stack_object(const void *obj, unsigned long len)
+{
+        const void * const stack = task_stack_page(current);
+        const void * const stackend = stack + THREAD_SIZE;
+        int ret;
+
+        /* Object is not on the stack at all. */
+        if (obj + len <= stack || stackend <= obj)
+                return NOT_STACK;
+
+        /*
+         * Reject: object partially overlaps the stack (passing the
+         * the check above means at least one end is within the stack,
+         * so if this check fails, the other end is outside the stack).
+         */
+        if (obj < stack || stackend < obj + len)
+                return BAD_STACK;
+
+        /* Check if object is safely within a valid frame. */
+        ret = arch_within_stack_frames(stack, stackend, obj, len);
+        if (ret)
+                return ret;
+
+        return GOOD_STACK;
+}
+
+static void report_usercopy(const void *ptr, unsigned long len,
+                            bool to_user, const char *type)
+{
+        pr_emerg("kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
+                to_user ? "exposure" : "overwrite",
+                to_user ? "from" : "to", ptr, type ? : "unknown", len);
+        /*
+         * For greater effect, it would be nice to do do_group_exit(),
+         * but BUG() actually hooks all the lock-breaking and per-arch
+         * Oops code, so that is used here instead.
+         */
+        BUG();
+}
+
+/* Returns true if any portion of [ptr,ptr+n) over laps with [low,high). */
+static bool overlaps(const void *ptr, unsigned long n, unsigned long low,
+                     unsigned long high)
+{
+        unsigned long check_low = (uintptr_t)ptr;
+        unsigned long check_high = check_low + n;
+
+        /* Does not overlap if entirely above or entirely below. */
+        if (check_low >= high || check_high <= low)
+                return false;
+
+        return true;
+}
+
+/* Is this address range in the kernel text area? */
+static inline const char *check_kernel_text_object(const void *ptr,
+                                                   unsigned long n)
+{
+        unsigned long textlow = (unsigned long)_stext;
+        unsigned long texthigh = (unsigned long)_etext;
+        unsigned long textlow_linear, texthigh_linear;
+
+        if (overlaps(ptr, n, textlow, texthigh))
+                return "<kernel text>";
+
+        /*
+         * Some architectures have virtual memory mappings with a secondary
+         * mapping of the kernel text, i.e. there is more than one virtual
+         * kernel address that points to the kernel image. It is usually
+         * when there is a separate linear physical memory mapping, in that
+         * __pa() is not just the reverse of __va(). This can be detected
+         * and checked:
+         */
+        textlow_linear = (unsigned long)__va(__pa(textlow));
+        /* No different mapping: we're done. */
+        if (textlow_linear == textlow)
+                return NULL;
+
+        /* Check the secondary mapping... */
+        texthigh_linear = (unsigned long)__va(__pa(texthigh));
+        if (overlaps(ptr, n, textlow_linear, texthigh_linear))
+                return "<linear kernel text>";
+
+        return NULL;
+}
+
+static inline const char *check_bogus_address(const void *ptr, unsigned long n)
+{
+        /* Reject if object wraps past end of memory. */
+        if ((unsigned long)ptr + n < (unsigned long)ptr)
+                return "<wrapped address>";
+
+        /* Reject if NULL or ZERO-allocation. */
+        if (ZERO_OR_NULL_PTR(ptr))
+                return "<null>";
+
+        return NULL;
+}
+
+/* Checks for allocs that are marked in some way as spanning multiple pages. */
+static inline const char *check_page_span(const void *ptr, unsigned long n,
+                                          struct page *page, bool to_user)
+{
+#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN
+        const void *end = ptr + n - 1;
+        struct page *endpage;
+        bool is_reserved, is_cma;
+
+        /*
+         * Sometimes the kernel data regions are not marked Reserved (see
+         * check below). And sometimes [_sdata,_edata) does not cover
+         * rodata and/or bss, so check each range explicitly.
+         */
+
+        /* Allow reads of kernel rodata region (if not marked as Reserved). */
+        if (ptr >= (const void *)__start_rodata &&
+            end <= (const void *)__end_rodata) {
+                if (!to_user)
+                        return "<rodata>";
+                return NULL;
+        }
+
+        /* Allow kernel data region (if not marked as Reserved). */
+        if (ptr >= (const void *)_sdata && end <= (const void *)_edata)
+                return NULL;
+
+        /* Allow kernel bss region (if not marked as Reserved). */
+        if (ptr >= (const void *)__bss_start &&
+            end <= (const void *)__bss_stop)
+                return NULL;
+
+        /* Is the object wholly within one base page? */
+        if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) ==
+                   ((unsigned long)end & (unsigned long)PAGE_MASK)))
+                return NULL;
+
+        /* Allow if fully inside the same compound (__GFP_COMP) page. */
+        endpage = virt_to_head_page(end);
+        if (likely(endpage == page))
+                return NULL;
+
+        /*
+         * Reject if range is entirely either Reserved (i.e. special or
+         * device memory), or CMA. Otherwise, reject since the object spans
+         * several independently allocated pages.
+         */
+        is_reserved = PageReserved(page);
+        is_cma = is_migrate_cma_page(page);
+        if (!is_reserved && !is_cma)
+                return "<spans multiple pages>";
+
+        for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {
+                page = virt_to_head_page(ptr);
+                if (is_reserved && !PageReserved(page))
+                        return "<spans Reserved and non-Reserved pages>";
+                if (is_cma && !is_migrate_cma_page(page))
+                        return "<spans CMA and non-CMA pages>";
+        }
+#endif
+
+        return NULL;
+}
+
+static inline const char *check_heap_object(const void *ptr, unsigned long n,
+                                            bool to_user)
+{
+        struct page *page;
+
+        /*
+         * Some architectures (arm64) return true for virt_addr_valid() on
+         * vmalloced addresses. Work around this by checking for vmalloc
+         * first.
+         *
+         * We also need to check for module addresses explicitly since we
+         * may copy static data from modules to userspace
+         */
+        if (is_vmalloc_or_module_addr(ptr))
+                return NULL;
+
+        if (!virt_addr_valid(ptr))
+                return NULL;
+
+        page = virt_to_head_page(ptr);
+
+        /* Check slab allocator for flags and size. */
+        if (PageSlab(page))
+                return __check_heap_object(ptr, n, page);
+
+        /* Verify object does not incorrectly span multiple pages. */
+        return check_page_span(ptr, n, page, to_user);
+}
+
+/*
+ * Validates that the given object is:
+ * - not bogus address
+ * - known-safe heap or stack object
+ * - not in kernel text
+ */
+void __check_object_size(const void *ptr, unsigned long n, bool to_user)
+{
+        const char *err;
+
+        /* Skip all tests if size is zero. */
+        if (!n)
+                return;
+
+        /* Check for invalid addresses. */
+        err = check_bogus_address(ptr, n);
+        if (err)
+                goto report;
+
+        /* Check for bad heap object. */
+        err = check_heap_object(ptr, n, to_user);
+        if (err)
+                goto report;
+
+        /* Check for bad stack object. */
+        switch (check_stack_object(ptr, n)) {
+        case NOT_STACK:
+                /* Object is not touching the current process stack. */
+                break;
+        case GOOD_FRAME:
+        case GOOD_STACK:
+                /*
+                 * Object is either in the correct frame (when it
+                 * is possible to check) or just generally on the
+                 * process stack (when frame checking not available).
+                 */
+                return;
+        default:
+                err = "<process stack>";
+                goto report;
+        }
+
+        /* Check for object in kernel to avoid text exposure. */
+        err = check_kernel_text_object(ptr, n);
+        if (!err)
+                return;
+
+report:
+        report_usercopy(ptr, n, to_user, err);
+}
+EXPORT_SYMBOL(__check_object_size);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 374d95d04178..0fe8b7113868 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1665,7 +1665,7 @@ static bool inactive_reclaimable_pages(struct lruvec *lruvec,
 
         for (zid = sc->reclaim_idx; zid >= 0; zid--) {
                 zone = &pgdat->node_zones[zid];
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 if (zone_page_state_snapshot(zone, NR_ZONE_LRU_BASE +
@@ -2036,7 +2036,7 @@ static bool inactive_list_is_low(struct lruvec *lruvec, bool file,
                 struct zone *zone = &pgdat->node_zones[zid];
                 unsigned long inactive_zone, active_zone;
 
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 inactive_zone = zone_page_state(zone,
@@ -2171,7 +2171,7 @@ static void get_scan_count(struct lruvec *lruvec, struct mem_cgroup *memcg,
 
                 for (z = 0; z < MAX_NR_ZONES; z++) {
                         struct zone *zone = &pgdat->node_zones[z];
-                        if (!populated_zone(zone))
+                        if (!managed_zone(zone))
                                 continue;
 
                         total_high_wmark += high_wmark_pages(zone);
@@ -2303,23 +2303,6 @@ out:
         }
 }
 
-#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH
-static void init_tlb_ubc(void)
-{
-        /*
-         * This deliberately does not clear the cpumask as it's expensive
-         * and unnecessary. If there happens to be data in there then the
-         * first SWAP_CLUSTER_MAX pages will send an unnecessary IPI and
-         * then will be cleared.
-         */
-        current->tlb_ubc.flush_required = false;
-}
-#else
-static inline void init_tlb_ubc(void)
-{
-}
-#endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */
-
 /*
  * This is a basic per-node page freer.  Used by both kswapd and direct reclaim.
  */
@@ -2355,8 +2338,6 @@ static void shrink_node_memcg(struct pglist_data *pgdat, struct mem_cgroup *memc
         scan_adjusted = (global_reclaim(sc) && !current_is_kswapd() &&
                          sc->priority == DEF_PRIORITY);
 
-        init_tlb_ubc();
-
         blk_start_plug(&plug);
         while (nr[LRU_INACTIVE_ANON] || nr[LRU_ACTIVE_FILE] ||
                                         nr[LRU_INACTIVE_FILE]) {
@@ -2510,7 +2491,7 @@ static inline bool should_continue_reclaim(struct pglist_data *pgdat,
         /* If compaction would go ahead or the allocation would succeed, stop */
         for (z = 0; z <= sc->reclaim_idx; z++) {
                 struct zone *zone = &pgdat->node_zones[z];
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 switch (compaction_suitable(zone, sc->order, 0, sc->reclaim_idx)) {
@@ -2840,7 +2821,7 @@ static bool pfmemalloc_watermark_ok(pg_data_t *pgdat)
 
         for (i = 0; i <= ZONE_NORMAL; i++) {
                 zone = &pgdat->node_zones[i];
-                if (!populated_zone(zone) ||
+                if (!managed_zone(zone) ||
                     pgdat_reclaimable_pages(pgdat) == 0)
                         continue;
 
@@ -3141,7 +3122,7 @@ static bool prepare_kswapd_sleep(pg_data_t *pgdat, int order, int classzone_idx)
         for (i = 0; i <= classzone_idx; i++) {
                 struct zone *zone = pgdat->node_zones + i;
 
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 if (!zone_balanced(zone, order, classzone_idx))
@@ -3169,7 +3150,7 @@ static bool kswapd_shrink_node(pg_data_t *pgdat,
         sc->nr_to_reclaim = 0;
         for (z = 0; z <= sc->reclaim_idx; z++) {
                 zone = pgdat->node_zones + z;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 sc->nr_to_reclaim += max(high_wmark_pages(zone), SWAP_CLUSTER_MAX);
@@ -3242,7 +3223,7 @@ static int balance_pgdat(pg_data_t *pgdat, int order, int classzone_idx)
                 if (buffer_heads_over_limit) {
                         for (i = MAX_NR_ZONES - 1; i >= 0; i--) {
                                 zone = pgdat->node_zones + i;
-                                if (!populated_zone(zone))
+                                if (!managed_zone(zone))
                                         continue;
 
                                 sc.reclaim_idx = i;
@@ -3262,7 +3243,7 @@ static int balance_pgdat(pg_data_t *pgdat, int order, int classzone_idx)
                  */
                 for (i = classzone_idx; i >= 0; i--) {
                         zone = pgdat->node_zones + i;
-                        if (!populated_zone(zone))
+                        if (!managed_zone(zone))
                                 continue;
 
                         if (zone_balanced(zone, sc.order, classzone_idx))
@@ -3508,7 +3489,7 @@ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
         pg_data_t *pgdat;
         int z;
 
-        if (!populated_zone(zone))
+        if (!managed_zone(zone))
                 return;
 
         if (!cpuset_zone_allowed(zone, GFP_KERNEL | __GFP_HARDWALL))
@@ -3522,7 +3503,7 @@ void wakeup_kswapd(struct zone *zone, int order, enum zone_type classzone_idx)
         /* Only wake kswapd if all zones are unbalanced */
         for (z = 0; z <= classzone_idx; z++) {
                 zone = pgdat->node_zones + z;
-                if (!populated_zone(zone))
+                if (!managed_zone(zone))
                         continue;
 
                 if (zone_balanced(zone, order, classzone_idx))
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 82a116ba590e..8de138d3306b 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -169,7 +169,7 @@ int register_vlan_dev(struct net_device *dev)
         if (err < 0)
                 goto out_uninit_mvrp;
 
-        vlan->nest_level = dev_get_nest_level(real_dev, is_vlan_dev) + 1;
+        vlan->nest_level = dev_get_nest_level(real_dev) + 1;
         err = register_netdevice(dev);
         if (err < 0)
                 goto out_uninit_mvrp;
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 4acb1d5417aa..f24b25c25106 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -507,8 +507,8 @@ err_out:
                 /* wakeup anybody waiting for slots to pin pages */
                 wake_up(&vp_wq);
         }
-        kfree(in_pages);
-        kfree(out_pages);
+        kvfree(in_pages);
+        kvfree(out_pages);
         return err;
 }
 
diff --git a/net/batman-adv/bat_v_elp.c b/net/batman-adv/bat_v_elp.c
index 7d170010beb9..ee08540ce503 100644
--- a/net/batman-adv/bat_v_elp.c
+++ b/net/batman-adv/bat_v_elp.c
@@ -335,7 +335,7 @@ int batadv_v_elp_iface_enable(struct batadv_hard_iface *hard_iface)
                 goto out;
 
         skb_reserve(hard_iface->bat_v.elp_skb, ETH_HLEN + NET_IP_ALIGN);
-        elp_buff = skb_push(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
+        elp_buff = skb_put(hard_iface->bat_v.elp_skb, BATADV_ELP_HLEN);
         elp_packet = (struct batadv_elp_packet *)elp_buff;
         memset(elp_packet, 0, BATADV_ELP_HLEN);
 
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 7602c001e92b..3d199478c405 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -470,6 +470,29 @@ static int batadv_check_unicast_packet(struct batadv_priv *bat_priv,
 }
 
 /**
+ * batadv_last_bonding_get - Get last_bonding_candidate of orig_node
+ * @orig_node: originator node whose last bonding candidate should be retrieved
+ *
+ * Return: last bonding candidate of router or NULL if not found
+ *
+ * The object is returned with refcounter increased by 1.
+ */
+static struct batadv_orig_ifinfo *
+batadv_last_bonding_get(struct batadv_orig_node *orig_node)
+{
+        struct batadv_orig_ifinfo *last_bonding_candidate;
+
+        spin_lock_bh(&orig_node->neigh_list_lock);
+        last_bonding_candidate = orig_node->last_bonding_candidate;
+
+        if (last_bonding_candidate)
+                kref_get(&last_bonding_candidate->refcount);
+        spin_unlock_bh(&orig_node->neigh_list_lock);
+
+        return last_bonding_candidate;
+}
+
+/**
  * batadv_last_bonding_replace - Replace last_bonding_candidate of orig_node
  * @orig_node: originator node whose bonding candidates should be replaced
  * @new_candidate: new bonding candidate or NULL
@@ -539,7 +562,7 @@ batadv_find_router(struct batadv_priv *bat_priv,
          * router - obviously there are no other candidates.
          */
         rcu_read_lock();
-        last_candidate = orig_node->last_bonding_candidate;
+        last_candidate = batadv_last_bonding_get(orig_node);
         if (last_candidate)
                 last_cand_router = rcu_dereference(last_candidate->router);
 
@@ -631,6 +654,9 @@ next:
                 batadv_orig_ifinfo_put(next_candidate);
         }
 
+        if (last_candidate)
+                batadv_orig_ifinfo_put(last_candidate);
+
         return router;
 }
 
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ece45e0683fd..0b5f729d08d2 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -250,7 +250,7 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
         skb_free_datagram(sk, skb);
 
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                 copied = skblen;
 
         return err ? : copied;
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index c045b3c54768..b0e23dfc5c34 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -262,6 +262,8 @@ int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
                 break;
         }
 
+        kfree_skb(hdev->req_skb);
+        hdev->req_skb = NULL;
         hdev->req_status = hdev->req_result = 0;
 
         BT_DBG("%s end: err %d", hdev->name, err);
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 6ef8a01a9ad4..96f04b7b9556 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1091,7 +1091,7 @@ static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
 
         skb_free_datagram(sk, skb);
 
-        if (msg->msg_flags & MSG_TRUNC)
+        if (flags & MSG_TRUNC)
                 copied = skblen;
 
         return err ? : copied;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 54ceb1f2cc9a..d4cad29b033f 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -32,6 +32,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/crc16.h>
+#include <linux/filter.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -5835,6 +5836,9 @@ static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
                 if (chan->sdu)
                         break;
 
+                if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
+                        break;
+
                 chan->sdu_len = get_unaligned_le16(skb->data);
                 skb_pull(skb, L2CAP_SDULEN_SIZE);
 
@@ -6610,6 +6614,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                 goto drop;
         }
 
+        if ((chan->mode == L2CAP_MODE_ERTM ||
+             chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
+                goto drop;
+
         if (!control->sframe) {
                 int err;
 
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1842141baedb..a8ba752732c9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1019,7 +1019,7 @@ static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
                 goto done;
 
         if (pi->rx_busy_skb) {
-                if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
+                if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
                         pi->rx_busy_skb = NULL;
                 else
                         goto done;
@@ -1270,7 +1270,17 @@ static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
                 goto done;
         }
 
-        err = sock_queue_rcv_skb(sk, skb);
+        if (chan->mode != L2CAP_MODE_ERTM &&
+            chan->mode != L2CAP_MODE_STREAMING) {
+                /* Even if no filter is attached, we could potentially
+                 * get errors from security modules, etc.
+                 */
+                err = sk_filter(sk, skb);
+                if (err)
+                        goto done;
+        }
+
+        err = __sock_queue_rcv_skb(sk, skb);
 
         /* For ERTM, handle one skb that doesn't fit into the recv
          * buffer.  This is important to do because the data frames
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index c18080ad4085..cd620fab41b0 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -267,7 +267,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
 
         /* If old entry was unassociated with any port, then delete it. */
         f = __br_fdb_get(br, br->dev->dev_addr, 0);
-        if (f && f->is_local && !f->dst)
+        if (f && f->is_local && !f->dst && !f->added_by_user)
                 fdb_delete_local(br, NULL, f);
 
         fdb_insert(br, NULL, newaddr, 0);
@@ -282,7 +282,7 @@ void br_fdb_change_mac_address(struct net_bridge *br, const u8 *newaddr)
                 if (!br_vlan_should_use(v))
                         continue;
                 f = __br_fdb_get(br, br->dev->dev_addr, v->vid);
-                if (f && f->is_local && !f->dst)
+                if (f && f->is_local && !f->dst && !f->added_by_user)
                         fdb_delete_local(br, NULL, f);
                 fdb_insert(br, NULL, newaddr, v->vid);
         }
@@ -764,20 +764,25 @@ out:
 }
 
 /* Update (create or replace) forwarding database entry */
-static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
-                         __u16 state, __u16 flags, __u16 vid)
+static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,
+                         const __u8 *addr, __u16 state, __u16 flags, __u16 vid)
 {
-        struct net_bridge *br = source->br;
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
         bool modified = false;
 
         /* If the port cannot learn allow only local and static entries */
-        if (!(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
+        if (source && !(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
             !(source->state == BR_STATE_LEARNING ||
               source->state == BR_STATE_FORWARDING))
                 return -EPERM;
 
+        if (!source && !(state & NUD_PERMANENT)) {
+                pr_info("bridge: RTM_NEWNEIGH %s without NUD_PERMANENT\n",
+                        br->dev->name);
+                return -EINVAL;
+        }
+
         fdb = fdb_find(head, addr, vid);
         if (fdb == NULL) {
                 if (!(flags & NLM_F_CREATE))
@@ -832,22 +837,28 @@ static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
         return 0;
 }
 
-static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
-               const unsigned char *addr, u16 nlh_flags, u16 vid)
+static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br,
+                        struct net_bridge_port *p, const unsigned char *addr,
+                        u16 nlh_flags, u16 vid)
 {
         int err = 0;
 
         if (ndm->ndm_flags & NTF_USE) {
+                if (!p) {
+                        pr_info("bridge: RTM_NEWNEIGH %s with NTF_USE is not supported\n",
+                                br->dev->name);
+                        return -EINVAL;
+                }
                 local_bh_disable();
                 rcu_read_lock();
-                br_fdb_update(p->br, p, addr, vid, true);
+                br_fdb_update(br, p, addr, vid, true);
                 rcu_read_unlock();
                 local_bh_enable();
         } else {
-                spin_lock_bh(&p->br->hash_lock);
-                err = fdb_add_entry(p, addr, ndm->ndm_state,
+                spin_lock_bh(&br->hash_lock);
+                err = fdb_add_entry(br, p, addr, ndm->ndm_state,
                                     nlh_flags, vid);
-                spin_unlock_bh(&p->br->hash_lock);
+                spin_unlock_bh(&br->hash_lock);
         }
 
         return err;
@@ -884,6 +895,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                                 dev->name);
                         return -EINVAL;
                 }
+                br = p->br;
                 vg = nbp_vlan_group(p);
         }
 
@@ -895,15 +907,9 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 }
 
                 /* VID was specified, so use it. */
-                if (dev->priv_flags & IFF_EBRIDGE)
-                        err = br_fdb_insert(br, NULL, addr, vid);
-                else
-                        err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
+                err = __br_fdb_add(ndm, br, p, addr, nlh_flags, vid);
         } else {
-                if (dev->priv_flags & IFF_EBRIDGE)
-                        err = br_fdb_insert(br, NULL, addr, 0);
-                else
-                        err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
+                err = __br_fdb_add(ndm, br, p, addr, nlh_flags, 0);
                 if (err || !vg || !vg->num_vlans)
                         goto out;
 
@@ -914,11 +920,7 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 list_for_each_entry(v, &vg->vlan_list, vlist) {
                         if (!br_vlan_should_use(v))
                                 continue;
-                        if (dev->priv_flags & IFF_EBRIDGE)
-                                err = br_fdb_insert(br, NULL, addr, v->vid);
-                        else
-                                err = __br_fdb_add(ndm, p, addr, nlh_flags,
-                                                   v->vid);
+                        err = __br_fdb_add(ndm, br, p, addr, nlh_flags, v->vid);
                         if (err)
                                 goto out;
                 }
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 8e486203d133..abe11f085479 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,13 +80,10 @@ static void br_do_proxy_arp(struct sk_buff *skb, struct net_bridge *br,
 
         BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
 
-        if (dev->flags & IFF_NOARP)
+        if ((dev->flags & IFF_NOARP) ||
+            !pskb_may_pull(skb, arp_hdr_len(dev)))
                 return;
 
-        if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
-                dev->stats.tx_dropped++;
-                return;
-        }
         parp = arp_hdr(skb);
 
         if (parp->ar_pro != htons(ETH_P_IP) ||
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index a5423a1eec05..c5fea9393946 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1138,7 +1138,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
                 } else {
                         err = br_ip6_multicast_add_group(br, port,
                                                          &grec->grec_mca, vid);
-                        if (!err)
+                        if (err)
                                 break;
                 }
         }
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index cceac5bb658f..0833c251aef7 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -368,6 +368,8 @@ ebt_check_match(struct ebt_entry_match *m, struct xt_mtchk_param *par,
 
         match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
         if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
+                if (!IS_ERR(match))
+                        module_put(match->me);
                 request_module("ebt_%s", m->u.name);
                 match = xt_find_match(NFPROTO_BRIDGE, m->u.name, 0);
         }
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 4b901d9f2e7c..ad47a921b701 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -86,6 +86,7 @@ static const struct nft_expr_ops nft_meta_bridge_set_ops = {
         .init           = nft_meta_set_init,
         .destroy        = nft_meta_set_destroy,
         .dump           = nft_meta_set_dump,
+        .validate       = nft_meta_set_validate,
 };
 
 static const struct nft_expr_ops *
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index c83326c5ba58..ef34a02719d7 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -574,7 +574,7 @@ static void complete_generic_request(struct ceph_mon_generic_request *req)
         put_generic_request(req);
 }
 
-void cancel_generic_request(struct ceph_mon_generic_request *req)
+static void cancel_generic_request(struct ceph_mon_generic_request *req)
 {
         struct ceph_mon_client *monc = req->monc;
         struct ceph_mon_generic_request *lookup_req;
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index b5ec09612ff7..a97e7b506612 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -4220,7 +4220,7 @@ static struct ceph_msg *alloc_msg_with_page_vector(struct ceph_msg_header *hdr)
 
                 pages = ceph_alloc_page_vector(calc_pages_for(0, data_len),
                                                GFP_NOIO);
-                if (!pages) {
+                if (IS_ERR(pages)) {
                         ceph_msg_put(m);
                         return NULL;
                 }
diff --git a/net/ceph/string_table.c b/net/ceph/string_table.c
index ca53c8319209..22fb96efcf34 100644
--- a/net/ceph/string_table.c
+++ b/net/ceph/string_table.c
@@ -84,12 +84,6 @@ retry:
 }
 EXPORT_SYMBOL(ceph_find_or_create_string);
 
-static void ceph_free_string(struct rcu_head *head)
-{
-        struct ceph_string *cs = container_of(head, struct ceph_string, rcu);
-        kfree(cs);
-}
-
 void ceph_release_string(struct kref *ref)
 {
         struct ceph_string *cs = container_of(ref, struct ceph_string, kref);
@@ -101,7 +95,7 @@ void ceph_release_string(struct kref *ref)
         }
         spin_unlock(&string_tree_lock);
 
-        call_rcu(&cs->rcu, ceph_free_string);
+        kfree_rcu(cs, rcu);
 }
 EXPORT_SYMBOL(ceph_release_string);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 4ce07dc25573..ea6312057a71 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3975,6 +3975,22 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret,
 }
 
 /**
+ *      netdev_is_rx_handler_busy - check if receive handler is registered
+ *      @dev: device to check
+ *
+ *      Check if a receive handler is already registered for a given device.
+ *      Return true if there one.
+ *
+ *      The caller must hold the rtnl_mutex.
+ */
+bool netdev_is_rx_handler_busy(struct net_device *dev)
+{
+        ASSERT_RTNL();
+        return dev && rtnl_dereference(dev->rx_handler);
+}
+EXPORT_SYMBOL_GPL(netdev_is_rx_handler_busy);
+
+/**
  *      netdev_rx_handler_register - register receive handler
  *      @dev: device to register a handler for
  *      @rx_handler: receive handler to register
@@ -6045,8 +6061,7 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
 EXPORT_SYMBOL(netdev_lower_dev_get_private);
 
 
-int dev_get_nest_level(struct net_device *dev,
-                       bool (*type_check)(const struct net_device *dev))
+int dev_get_nest_level(struct net_device *dev)
 {
         struct net_device *lower = NULL;
         struct list_head *iter;
@@ -6056,15 +6071,12 @@ int dev_get_nest_level(struct net_device *dev,
         ASSERT_RTNL();
 
         netdev_for_each_lower_dev(dev, lower, iter) {
-                nest = dev_get_nest_level(lower, type_check);
+                nest = dev_get_nest_level(lower);
                 if (max_nest < nest)
                         max_nest = nest;
         }
 
-        if (type_check(dev))
-                max_nest++;
-
-        return max_nest;
+        return max_nest + 1;
 }
 EXPORT_SYMBOL(dev_get_nest_level);
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 5708999f8a79..cb06aceb512a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1355,56 +1355,47 @@ static inline int bpf_try_make_writable(struct sk_buff *skb,
 {
         int err;
 
-        if (!skb_cloned(skb))
-                return 0;
-        if (skb_clone_writable(skb, write_len))
-                return 0;
-        err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
-        if (!err)
-                bpf_compute_data_end(skb);
+        err = skb_ensure_writable(skb, write_len);
+        bpf_compute_data_end(skb);
+
         return err;
 }
 
+static inline void bpf_push_mac_rcsum(struct sk_buff *skb)
+{
+        if (skb_at_tc_ingress(skb))
+                skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len);
+}
+
+static inline void bpf_pull_mac_rcsum(struct sk_buff *skb)
+{
+        if (skb_at_tc_ingress(skb))
+                skb_postpull_rcsum(skb, skb_mac_header(skb), skb->mac_len);
+}
+
 static u64 bpf_skb_store_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 flags)
 {
-        struct bpf_scratchpad *sp = this_cpu_ptr(&bpf_sp);
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
-        int offset = (int) r2;
+        unsigned int offset = (unsigned int) r2;
         void *from = (void *) (long) r3;
         unsigned int len = (unsigned int) r4;
         void *ptr;
 
         if (unlikely(flags & ~(BPF_F_RECOMPUTE_CSUM | BPF_F_INVALIDATE_HASH)))
                 return -EINVAL;
-
-        /* bpf verifier guarantees that:
-         * 'from' pointer points to bpf program stack
-         * 'len' bytes of it were initialized
-         * 'len' > 0
-         * 'skb' is a valid pointer to 'struct sk_buff'
-         *
-         * so check for invalid 'offset' and too large 'len'
-         */
-        if (unlikely((u32) offset > 0xffff || len > sizeof(sp->buff)))
+        if (unlikely(offset > 0xffff))
                 return -EFAULT;
         if (unlikely(bpf_try_make_writable(skb, offset + len)))
                 return -EFAULT;
 
-        ptr = skb_header_pointer(skb, offset, len, sp->buff);
-        if (unlikely(!ptr))
-                return -EFAULT;
-
+        ptr = skb->data + offset;
         if (flags & BPF_F_RECOMPUTE_CSUM)
-                skb_postpull_rcsum(skb, ptr, len);
+                __skb_postpull_rcsum(skb, ptr, len, offset);
 
         memcpy(ptr, from, len);
 
-        if (ptr == sp->buff)
-                /* skb_store_bits cannot return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, len);
-
         if (flags & BPF_F_RECOMPUTE_CSUM)
-                skb_postpush_rcsum(skb, ptr, len);
+                __skb_postpush_rcsum(skb, ptr, len, offset);
         if (flags & BPF_F_INVALIDATE_HASH)
                 skb_clear_hash(skb);
 
@@ -1425,12 +1416,12 @@ static const struct bpf_func_proto bpf_skb_store_bytes_proto = {
 static u64 bpf_skb_load_bytes(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
 {
         const struct sk_buff *skb = (const struct sk_buff *)(unsigned long) r1;
-        int offset = (int) r2;
+        unsigned int offset = (unsigned int) r2;
         void *to = (void *)(unsigned long) r3;
         unsigned int len = (unsigned int) r4;
         void *ptr;
 
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff))
                 goto err_clear;
 
         ptr = skb_header_pointer(skb, offset, len, to);
@@ -1458,20 +1449,17 @@ static const struct bpf_func_proto bpf_skb_load_bytes_proto = {
 static u64 bpf_l3_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
 {
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
-        int offset = (int) r2;
-        __sum16 sum, *ptr;
+        unsigned int offset = (unsigned int) r2;
+        __sum16 *ptr;
 
         if (unlikely(flags & ~(BPF_F_HDR_FIELD_MASK)))
                 return -EINVAL;
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff || offset & 1))
                 return -EFAULT;
-        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(sum))))
-                return -EFAULT;
-
-        ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum);
-        if (unlikely(!ptr))
+        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(*ptr))))
                 return -EFAULT;
 
+        ptr = (__sum16 *)(skb->data + offset);
         switch (flags & BPF_F_HDR_FIELD_MASK) {
         case 0:
                 if (unlikely(from != 0))
@@ -1489,10 +1477,6 @@ static u64 bpf_l3_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
                 return -EINVAL;
         }
 
-        if (ptr == &sum)
-                /* skb_store_bits guaranteed to not return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, sizeof(sum));
-
         return 0;
 }
 
@@ -1512,20 +1496,18 @@ static u64 bpf_l4_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
         bool is_pseudo = flags & BPF_F_PSEUDO_HDR;
         bool is_mmzero = flags & BPF_F_MARK_MANGLED_0;
-        int offset = (int) r2;
-        __sum16 sum, *ptr;
+        unsigned int offset = (unsigned int) r2;
+        __sum16 *ptr;
 
         if (unlikely(flags & ~(BPF_F_MARK_MANGLED_0 | BPF_F_PSEUDO_HDR |
                                BPF_F_HDR_FIELD_MASK)))
                 return -EINVAL;
-        if (unlikely((u32) offset > 0xffff))
+        if (unlikely(offset > 0xffff || offset & 1))
                 return -EFAULT;
-        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(sum))))
+        if (unlikely(bpf_try_make_writable(skb, offset + sizeof(*ptr))))
                 return -EFAULT;
 
-        ptr = skb_header_pointer(skb, offset, sizeof(sum), &sum);
-        if (unlikely(!ptr))
-                return -EFAULT;
+        ptr = (__sum16 *)(skb->data + offset);
         if (is_mmzero && !*ptr)
                 return 0;
 
@@ -1548,10 +1530,6 @@ static u64 bpf_l4_csum_replace(u64 r1, u64 r2, u64 from, u64 to, u64 flags)
 
         if (is_mmzero && !*ptr)
                 *ptr = CSUM_MANGLED_0;
-        if (ptr == &sum)
-                /* skb_store_bits guaranteed to not return -EFAULT here */
-                skb_store_bits(skb, offset, ptr, sizeof(sum));
-
         return 0;
 }
 
@@ -1607,9 +1585,6 @@ static const struct bpf_func_proto bpf_csum_diff_proto = {
 
 static inline int __bpf_rx_skb(struct net_device *dev, struct sk_buff *skb)
 {
-        if (skb_at_tc_ingress(skb))
-                skb_postpush_rcsum(skb, skb_mac_header(skb), skb->mac_len);
-
         return dev_forward_skb(dev, skb);
 }
 
@@ -1648,6 +1623,8 @@ static u64 bpf_clone_redirect(u64 r1, u64 ifindex, u64 flags, u64 r4, u64 r5)
         if (unlikely(!skb))
                 return -ENOMEM;
 
+        bpf_push_mac_rcsum(skb);
+
         return flags & BPF_F_INGRESS ?
                __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
 }
@@ -1693,6 +1670,8 @@ int skb_do_redirect(struct sk_buff *skb)
                 return -EINVAL;
         }
 
+        bpf_push_mac_rcsum(skb);
+
         return ri->flags & BPF_F_INGRESS ?
                __bpf_rx_skb(dev, skb) : __bpf_tx_skb(dev, skb);
 }
@@ -1756,7 +1735,10 @@ static u64 bpf_skb_vlan_push(u64 r1, u64 r2, u64 vlan_tci, u64 r4, u64 r5)
                      vlan_proto != htons(ETH_P_8021AD)))
                 vlan_proto = htons(ETH_P_8021Q);
 
+        bpf_push_mac_rcsum(skb);
         ret = skb_vlan_push(skb, vlan_proto, vlan_tci);
+        bpf_pull_mac_rcsum(skb);
+
         bpf_compute_data_end(skb);
         return ret;
 }
@@ -1776,7 +1758,10 @@ static u64 bpf_skb_vlan_pop(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
         struct sk_buff *skb = (struct sk_buff *) (long) r1;
         int ret;
 
+        bpf_push_mac_rcsum(skb);
         ret = skb_vlan_pop(skb);
+        bpf_pull_mac_rcsum(skb);
+
         bpf_compute_data_end(skb);
         return ret;
 }
@@ -2298,7 +2283,7 @@ bpf_get_skb_set_tunnel_proto(enum bpf_func_id which)
 }
 
 #ifdef CONFIG_SOCK_CGROUP_DATA
-static u64 bpf_skb_in_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
+static u64 bpf_skb_under_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
 {
         struct sk_buff *skb = (struct sk_buff *)(long)r1;
         struct bpf_map *map = (struct bpf_map *)(long)r2;
@@ -2321,8 +2306,8 @@ static u64 bpf_skb_in_cgroup(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5)
         return cgroup_is_descendant(sock_cgroup_ptr(&sk->sk_cgrp_data), cgrp);
 }
 
-static const struct bpf_func_proto bpf_skb_in_cgroup_proto = {
-        .func           = bpf_skb_in_cgroup,
+static const struct bpf_func_proto bpf_skb_under_cgroup_proto = {
+        .func           = bpf_skb_under_cgroup,
         .gpl_only       = false,
         .ret_type       = RET_INTEGER,
         .arg1_type      = ARG_PTR_TO_CTX,
@@ -2402,8 +2387,8 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_get_smp_processor_id:
                 return &bpf_get_smp_processor_id_proto;
 #ifdef CONFIG_SOCK_CGROUP_DATA
-        case BPF_FUNC_skb_in_cgroup:
-                return &bpf_skb_in_cgroup_proto;
+        case BPF_FUNC_skb_under_cgroup:
+                return &bpf_skb_under_cgroup_proto;
 #endif
         default:
                 return sk_filter_func_proto(func_id);
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 61ad43f61c5e..52742a02814f 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -680,11 +680,13 @@ EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
 void __skb_get_hash(struct sk_buff *skb)
 {
         struct flow_keys keys;
+        u32 hash;
 
         __flow_hash_secret_init();
 
-        __skb_set_sw_hash(skb, ___skb_get_hash(skb, &keys, hashrnd),
-                          flow_keys_have_l4(&keys));
+        hash = ___skb_get_hash(skb, &keys, hashrnd);
+
+        __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
 }
 EXPORT_SYMBOL(__skb_get_hash);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 25dab8b60223..fd7b41edf1ce 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1362,7 +1362,6 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
                 if (!try_module_get(prot->owner))
                         goto out_free_sec;
                 sk_tx_queue_clear(sk);
-                cgroup_sk_alloc(&sk->sk_cgrp_data);
         }
 
         return sk;
@@ -1422,6 +1421,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
                 sock_net_set(sk, net);
                 atomic_set(&sk->sk_wmem_alloc, 1);
 
+                cgroup_sk_alloc(&sk->sk_cgrp_data);
                 sock_update_classid(&sk->sk_cgrp_data);
                 sock_update_netprioidx(&sk->sk_cgrp_data);
         }
@@ -1566,6 +1566,9 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority)
                 newsk->sk_priority = 0;
                 newsk->sk_incoming_cpu = raw_smp_processor_id();
                 atomic64_set(&newsk->sk_cookie, 0);
+
+                cgroup_sk_alloc(&newsk->sk_cgrp_data);
+
                 /*
                  * Before updating sk_refcnt, we must commit prior changes to memory
                  * (Documentation/RCU/rculist_nulls.txt for details)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 415e117967c7..062a67ca9a21 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -2232,7 +2232,7 @@ static struct devinet_sysctl_table {
 };
 
 static int __devinet_sysctl_register(struct net *net, char *dev_name,
-                                        struct ipv4_devconf *p)
+                                     int ifindex, struct ipv4_devconf *p)
 {
         int i;
         struct devinet_sysctl_table *t;
@@ -2255,6 +2255,8 @@ static int __devinet_sysctl_register(struct net *net, char *dev_name,
                 goto free;
 
         p->sysctl = t;
+
+        inet_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
         return 0;
 
 free:
@@ -2286,7 +2288,7 @@ static int devinet_sysctl_register(struct in_device *idev)
         if (err)
                 return err;
         err = __devinet_sysctl_register(dev_net(idev->dev), idev->dev->name,
-                                        &idev->cnf);
+                                        idev->dev->ifindex, &idev->cnf);
         if (err)
                 neigh_sysctl_unregister(idev->arp_parms);
         return err;
@@ -2347,11 +2349,12 @@ static __net_init int devinet_init_net(struct net *net)
         }
 
 #ifdef CONFIG_SYSCTL
-        err = __devinet_sysctl_register(net, "all", all);
+        err = __devinet_sysctl_register(net, "all", NETCONFA_IFINDEX_ALL, all);
         if (err < 0)
                 goto err_reg_all;
 
-        err = __devinet_sysctl_register(net, "default", dflt);
+        err = __devinet_sysctl_register(net, "default",
+                                        NETCONFA_IFINDEX_DEFAULT, dflt);
         if (err < 0)
                 goto err_reg_dflt;
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index ef2ebeb89d0f..1b25daf8c7f1 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -509,6 +509,7 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt,
                 if (!dev)
                         return -ENODEV;
                 cfg->fc_oif = dev->ifindex;
+                cfg->fc_table = l3mdev_fib_table(dev);
                 if (colon) {
                         struct in_ifaddr *ifa;
                         struct in_device *in_dev = __in_dev_get_rtnl(dev);
@@ -1027,7 +1028,7 @@ no_promotions:
                          * First of all, we scan fib_info list searching
                          * for stray nexthop entries, then ignite fib_flush.
                          */
-                        if (fib_sync_down_addr(dev_net(dev), ifa->ifa_local))
+                        if (fib_sync_down_addr(dev, ifa->ifa_local))
                                 fib_flush(dev_net(dev));
                 }
         }
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 539fa264e67d..e9f56225e53f 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1057,6 +1057,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
         fi->fib_priority = cfg->fc_priority;
         fi->fib_prefsrc = cfg->fc_prefsrc;
         fi->fib_type = cfg->fc_type;
+        fi->fib_tb_id = cfg->fc_table;
 
         fi->fib_nhs = nhs;
         change_nexthops(fi) {
@@ -1337,18 +1338,21 @@ nla_put_failure:
  *   referring to it.
  * - device went down -> we must shutdown all nexthops going via it.
  */
-int fib_sync_down_addr(struct net *net, __be32 local)
+int fib_sync_down_addr(struct net_device *dev, __be32 local)
 {
         int ret = 0;
         unsigned int hash = fib_laddr_hashfn(local);
         struct hlist_head *head = &fib_info_laddrhash[hash];
+        struct net *net = dev_net(dev);
+        int tb_id = l3mdev_fib_table(dev);
         struct fib_info *fi;
 
         if (!fib_info_laddrhash || local == 0)
                 return 0;
 
         hlist_for_each_entry(fi, head, fib_lhash) {
-                if (!net_eq(fi->fib_net, net))
+                if (!net_eq(fi->fib_net, net) ||
+                    fi->fib_tb_id != tb_id)
                         continue;
                 if (fi->fib_prefsrc == local) {
                         fi->fib_flags |= RTNH_F_DEAD;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index d07fc076bea0..e2ffc2a5c7db 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -249,7 +249,7 @@ static inline unsigned long get_index(t_key key, struct key_vector *kv)
  * index into the parent's child array. That is, they will be used to find
  * 'n' among tp's children.
  *
- * The bits from (n->pos + n->bits) to (tn->pos - 1) - "S" - are skipped bits
+ * The bits from (n->pos + n->bits) to (tp->pos - 1) - "S" - are skipped bits
  * for the node n.
  *
  * All the bits we have seen so far are significant to the node n. The rest
@@ -258,7 +258,7 @@ static inline unsigned long get_index(t_key key, struct key_vector *kv)
  * The bits from (n->pos) to (n->pos + n->bits - 1) - "C" - are the index into
  * n's child array, and will of course be different for each child.
  *
- * The rest of the bits, from 0 to (n->pos + n->bits), are completely unknown
+ * The rest of the bits, from 0 to (n->pos -1) - "u" - are completely unknown
  * at this point.
  */
 
@@ -2452,9 +2452,7 @@ struct fib_route_iter {
 static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
                                             loff_t pos)
 {
-        struct fib_table *tb = iter->main_tb;
         struct key_vector *l, **tp = &iter->tnode;
-        struct trie *t;
         t_key key;
 
         /* use cache location of next-to-find key */
@@ -2462,8 +2460,6 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter,
                 pos -= iter->pos;
                 key = iter->key;
         } else {
-                t = (struct trie *)tb->tb_data;
-                iter->tnode = t->kv;
                 iter->pos = 0;
                 key = 0;
         }
@@ -2504,12 +2500,12 @@ static void *fib_route_seq_start(struct seq_file *seq, loff_t *pos)
                 return NULL;
 
         iter->main_tb = tb;
+        t = (struct trie *)tb->tb_data;
+        iter->tnode = t->kv;
 
         if (*pos != 0)
                 return fib_route_get_idx(iter, *pos);
 
-        t = (struct trie *)tb->tb_data;
-        iter->tnode = t->kv;
         iter->pos = 0;
         iter->key = 0;
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 5b1481be0282..113cc43df789 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -370,7 +370,6 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
                          tunnel->parms.o_flags, proto, tunnel->parms.o_key,
                          htonl(tunnel->o_seqno));
 
-        skb_set_inner_protocol(skb, proto);
         ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
 }
 
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 4b351af3e67b..d6feabb03516 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -312,6 +312,7 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
         const struct iphdr *iph = ip_hdr(skb);
         struct rtable *rt;
+        struct net_device *dev = skb->dev;
 
         /* if ingress device is enslaved to an L3 master device pass the
          * skb to its handler for processing
@@ -341,7 +342,7 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
          */
         if (!skb_valid_dst(skb)) {
                 int err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
-                                               iph->tos, skb->dev);
+                                               iph->tos, dev);
                 if (unlikely(err)) {
                         if (err == -EXDEV)
                                 __NET_INC_STATS(net, LINUX_MIB_IPRPFILTER);
@@ -370,7 +371,7 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
                 __IP_UPD_PO_STATS(net, IPSTATS_MIB_INBCAST, skb->len);
         } else if (skb->pkt_type == PACKET_BROADCAST ||
                    skb->pkt_type == PACKET_MULTICAST) {
-                struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+                struct in_device *in_dev = __in_dev_get_rcu(dev);
 
                 /* RFC 1122 3.3.6:
                  *
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 9d847c302551..0f227db0e9ac 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -73,9 +73,11 @@ void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
         skb_dst_set(skb, &rt->dst);
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
-        if (skb_iif && proto == IPPROTO_UDP) {
-                /* Arrived from an ingress interface and got udp encapuslated.
-                 * The encapsulated network segment length may exceed dst mtu.
+        if (skb_iif && !(df & htons(IP_DF))) {
+                /* Arrived from an ingress interface, got encapsulated, with
+                 * fragmentation of encapulating frames allowed.
+                 * If skb is gso, the resulting encapsulated network segments
+                 * may exceed dst mtu.
                  * Allow IP Fragmentation of segments.
                  */
                 IPCB(skb)->flags |= IPSKB_FRAG_SEGS;
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index a917903d5e97..5d7944f394d9 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -88,6 +88,7 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
         struct net_device *dev;
         struct pcpu_sw_netstats *tstats;
         struct xfrm_state *x;
+        struct xfrm_mode *inner_mode;
         struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
         u32 orig_mark = skb->mark;
         int ret;
@@ -105,7 +106,19 @@ static int vti_rcv_cb(struct sk_buff *skb, int err)
         }
 
         x = xfrm_input_state(skb);
-        family = x->inner_mode->afinfo->family;
+
+        inner_mode = x->inner_mode;
+
+        if (x->sel.family == AF_UNSPEC) {
+                inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
+                if (inner_mode == NULL) {
+                        XFRM_INC_STATS(dev_net(skb->dev),
+                                       LINUX_MIB_XFRMINSTATEMODEERROR);
+                        return -EINVAL;
+                }
+        }
+
+        family = inner_mode->afinfo->family;
 
         skb->mark = be32_to_cpu(tunnel->parms.i_key);
         ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
@@ -557,6 +570,33 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = {
         .get_link_net   = ip_tunnel_get_link_net,
 };
 
+static bool is_vti_tunnel(const struct net_device *dev)
+{
+        return dev->netdev_ops == &vti_netdev_ops;
+}
+
+static int vti_device_event(struct notifier_block *unused,
+                            unsigned long event, void *ptr)
+{
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+
+        if (!is_vti_tunnel(dev))
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_DOWN:
+                if (!net_eq(tunnel->net, dev_net(dev)))
+                        xfrm_garbage_collect(tunnel->net);
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block vti_notifier_block __read_mostly = {
+        .notifier_call = vti_device_event,
+};
+
 static int __init vti_init(void)
 {
         const char *msg;
@@ -564,6 +604,8 @@ static int __init vti_init(void)
 
         pr_info("IPv4 over IPsec tunneling driver\n");
 
+        register_netdevice_notifier(&vti_notifier_block);
+
         msg = "tunnel device";
         err = register_pernet_device(&vti_net_ops);
         if (err < 0)
@@ -596,6 +638,7 @@ xfrm_proto_ah_failed:
 xfrm_proto_esp_failed:
         unregister_pernet_device(&vti_net_ops);
 pernet_dev_failed:
+        unregister_netdevice_notifier(&vti_notifier_block);
         pr_err("vti init: failed to register %s\n", msg);
         return err;
 }
@@ -607,6 +650,7 @@ static void __exit vti_fini(void)
         xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
         xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
         unregister_pernet_device(&vti_net_ops);
+        unregister_netdevice_notifier(&vti_notifier_block);
 }
 
 module_init(vti_init);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 26253328d227..a87bcd2d4a94 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -2076,6 +2076,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
         struct rta_mfc_stats mfcs;
         struct nlattr *mp_attr;
         struct rtnexthop *nhp;
+        unsigned long lastuse;
         int ct;
 
         /* If cache is unresolved, don't try to parse IIF and OIF */
@@ -2105,12 +2106,14 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
 
         nla_nest_end(skb, mp_attr);
 
+        lastuse = READ_ONCE(c->mfc_un.res.lastuse);
+        lastuse = time_after_eq(jiffies, lastuse) ? jiffies - lastuse : 0;
+
         mfcs.mfcs_packets = c->mfc_un.res.pkt;
         mfcs.mfcs_bytes = c->mfc_un.res.bytes;
         mfcs.mfcs_wrong_if = c->mfc_un.res.wrong_if;
         if (nla_put_64bit(skb, RTA_MFC_STATS, sizeof(mfcs), &mfcs, RTA_PAD) ||
-            nla_put_u64_64bit(skb, RTA_EXPIRES,
-                              jiffies_to_clock_t(c->mfc_un.res.lastuse),
+            nla_put_u64_64bit(skb, RTA_EXPIRES, jiffies_to_clock_t(lastuse),
                               RTA_PAD))
                 return -EMSGSIZE;
 
diff --git a/net/ipv4/netfilter/nft_chain_route_ipv4.c b/net/ipv4/netfilter/nft_chain_route_ipv4.c
index 2375b0a8be46..30493beb611a 100644
--- a/net/ipv4/netfilter/nft_chain_route_ipv4.c
+++ b/net/ipv4/netfilter/nft_chain_route_ipv4.c
@@ -31,6 +31,7 @@ static unsigned int nf_route_table_hook(void *priv,
         __be32 saddr, daddr;
         u_int8_t tos;
         const struct iphdr *iph;
+        int err;
 
         /* root is playing with raw sockets. */
         if (skb->len < sizeof(struct iphdr) ||
@@ -46,15 +47,17 @@ static unsigned int nf_route_table_hook(void *priv,
         tos = iph->tos;
 
         ret = nft_do_chain(&pkt, priv);
-        if (ret != NF_DROP && ret != NF_QUEUE) {
+        if (ret != NF_DROP && ret != NF_STOLEN) {
                 iph = ip_hdr(skb);
 
                 if (iph->saddr != saddr ||
                     iph->daddr != daddr ||
                     skb->mark != mark ||
-                    iph->tos != tos)
-                        if (ip_route_me_harder(state->net, skb, RTN_UNSPEC))
-                                ret = NF_DROP;
+                    iph->tos != tos) {
+                        err = ip_route_me_harder(state->net, skb, RTN_UNSPEC);
+                        if (err < 0)
+                                ret = NF_DROP_ERR(err);
+                }
         }
         return ret;
 }
diff --git a/net/ipv4/netfilter/nft_reject_ipv4.c b/net/ipv4/netfilter/nft_reject_ipv4.c
index c24f41c816b3..2c2553b9026c 100644
--- a/net/ipv4/netfilter/nft_reject_ipv4.c
+++ b/net/ipv4/netfilter/nft_reject_ipv4.c
@@ -46,6 +46,7 @@ static const struct nft_expr_ops nft_reject_ipv4_ops = {
         .eval           = nft_reject_ipv4_eval,
         .init           = nft_reject_init,
         .dump           = nft_reject_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_ipv4_type __read_mostly = {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a1f2830d8110..b5b47a26d4ec 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -476,12 +476,18 @@ u32 ip_idents_reserve(u32 hash, int segs)
         atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
         u32 old = ACCESS_ONCE(*p_tstamp);
         u32 now = (u32)jiffies;
-        u32 delta = 0;
+        u32 new, delta = 0;
 
         if (old != now && cmpxchg(p_tstamp, old, now) == old)
                 delta = prandom_u32_max(now - old);
 
-        return atomic_add_return(segs + delta, p_id) - segs;
+        /* Do not use atomic_add_return() as it makes UBSAN unhappy */
+        do {
+                old = (u32)atomic_read(p_id);
+                new = old + delta + segs;
+        } while (atomic_cmpxchg(p_id, old, new) != old);
+
+        return new - segs;
 }
 EXPORT_SYMBOL(ip_idents_reserve);
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 032a96d78c99..ffbb218de520 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3193,7 +3193,6 @@ int tcp_abort(struct sock *sk, int err)
                         local_bh_enable();
                         return 0;
                 }
-                sock_gen_put(sk);
                 return -EOPNOTSUPP;
         }
 
@@ -3222,7 +3221,6 @@ int tcp_abort(struct sock *sk, int err)
         bh_unlock_sock(sk);
         local_bh_enable();
         release_sock(sk);
-        sock_put(sk);
         return 0;
 }
 EXPORT_SYMBOL_GPL(tcp_abort);
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index 4d610934fb39..a748c74aa8b7 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -54,11 +54,16 @@ static int tcp_diag_destroy(struct sk_buff *in_skb,
 {
         struct net *net = sock_net(in_skb->sk);
         struct sock *sk = inet_diag_find_one_icsk(net, &tcp_hashinfo, req);
+        int err;
 
         if (IS_ERR(sk))
                 return PTR_ERR(sk);
 
-        return sock_diag_destroy(sk, ECONNABORTED);
+        err = sock_diag_destroy(sk, ECONNABORTED);
+
+        sock_gen_put(sk);
+
+        return err;
 }
 #endif
 
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 54d9f9b0120f..4e777a3243f9 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -150,6 +150,7 @@ void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb)
         tp->segs_in = 0;
         tcp_segs_in(tp, skb);
         __skb_pull(skb, tcp_hdrlen(skb));
+        sk_forced_mem_schedule(sk, skb->truesize);
         skb_set_owner_r(skb, sk);
 
         TCP_SKB_CB(skb)->seq++;
@@ -226,6 +227,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
         tcp_fastopen_add_skb(child, skb);
 
         tcp_rsk(req)->rcv_nxt = tp->rcv_nxt;
+        tp->rcv_wup = tp->rcv_nxt;
         /* tcp_conn_request() is sending the SYNACK,
          * and queues the child into listener accept queue.
          */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3ebf45b38bc3..08323bd95f2a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5885,7 +5885,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
                  * so release it.
                  */
                 if (req) {
-                        tp->total_retrans = req->num_retrans;
+                        inet_csk(sk)->icsk_retransmits = 0;
                         reqsk_fastopen_remove(sk, req, false);
                 } else {
                         /* Make sure socket is routed, for correct metrics. */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 32b048e524d6..7158d4f8dae4 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -814,8 +814,14 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
         u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
                                              tcp_sk(sk)->snd_nxt;
 
+        /* RFC 7323 2.3
+         * The window field (SEG.WND) of every outgoing segment, with the
+         * exception of <SYN> segments, MUST be right-shifted by
+         * Rcv.Wind.Shift bits:
+         */
         tcp_v4_send_ack(sock_net(sk), skb, seq,
-                        tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
+                        tcp_rsk(req)->rcv_nxt,
+                        req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
                         tcp_time_stamp,
                         req->ts_recent,
                         0,
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index bdaef7fd6e47..5288cec4a2b2 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2605,7 +2605,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
          * copying overhead: fragmentation, tunneling, mangling etc.
          */
         if (atomic_read(&sk->sk_wmem_alloc) >
-            min(sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2), sk->sk_sndbuf))
+            min_t(u32, sk->sk_wmem_queued + (sk->sk_wmem_queued >> 2),
+                  sk->sk_sndbuf))
                 return -EAGAIN;
 
         if (skb_still_in_host_queue(sk, skb))
@@ -2830,7 +2831,7 @@ begin_fwd:
                 if (tcp_retransmit_skb(sk, skb, segs))
                         return;
 
-                NET_INC_STATS(sock_net(sk), mib_idx);
+                NET_ADD_STATS(sock_net(sk), mib_idx, tcp_skb_pcount(skb));
 
                 if (tcp_in_cwnd_reduction(sk))
                         tp->prr_out += tcp_skb_pcount(skb);
@@ -3567,6 +3568,8 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req)
         if (!res) {
                 __TCP_INC_STATS(sock_net(sk), TCP_MIB_RETRANSSEGS);
                 __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
+                if (unlikely(tcp_passive_fastopen(sk)))
+                        tcp_sk(sk)->total_retrans++;
         }
         return res;
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index d84930b2dd95..f712b411f6ed 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -384,6 +384,7 @@ static void tcp_fastopen_synack_timer(struct sock *sk)
          */
         inet_rtx_syn_ack(sk, req);
         req->num_timeout++;
+        icsk->icsk_retransmits++;
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
                           TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX);
 }
diff --git a/net/ipv4/tcp_yeah.c b/net/ipv4/tcp_yeah.c
index 028eb046ea40..9c5fc973267f 100644
--- a/net/ipv4/tcp_yeah.c
+++ b/net/ipv4/tcp_yeah.c
@@ -76,7 +76,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)
         if (!tcp_is_cwnd_limited(sk))
                 return;
 
-        if (tp->snd_cwnd <= tp->snd_ssthresh)
+        if (tcp_in_slow_start(tp))
                 tcp_slow_start(tp, acked);
 
         else if (!yeah->doing_reno_now) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index e61f7cd65d08..5fdcb8d108d4 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1182,13 +1182,13 @@ out:
  *      @sk: socket
  *
  *      Drops all bad checksum frames, until a valid one is found.
- *      Returns the length of found skb, or 0 if none is found.
+ *      Returns the length of found skb, or -1 if none is found.
  */
-static unsigned int first_packet_length(struct sock *sk)
+static int first_packet_length(struct sock *sk)
 {
         struct sk_buff_head list_kill, *rcvq = &sk->sk_receive_queue;
         struct sk_buff *skb;
-        unsigned int res;
+        int res;
 
         __skb_queue_head_init(&list_kill);
 
@@ -1203,7 +1203,7 @@ static unsigned int first_packet_length(struct sock *sk)
                 __skb_unlink(skb, rcvq);
                 __skb_queue_tail(&list_kill, skb);
         }
-        res = skb ? skb->len : 0;
+        res = skb ? skb->len : -1;
         spin_unlock_bh(&rcvq->lock);
 
         if (!skb_queue_empty(&list_kill)) {
@@ -1232,7 +1232,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
 
         case SIOCINQ:
         {
-                unsigned int amount = first_packet_length(sk);
+                int amount = max_t(int, 0, first_packet_length(sk));
 
                 return put_user(amount, (int __user *)arg);
         }
@@ -2184,7 +2184,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
 
         /* Check for false positives due to checksum errors */
         if ((mask & POLLRDNORM) && !(file->f_flags & O_NONBLOCK) &&
-            !(sk->sk_shutdown & RCV_SHUTDOWN) && !first_packet_length(sk))
+            !(sk->sk_shutdown & RCV_SHUTDOWN) && first_packet_length(sk) == -1)
                 mask &= ~(POLLIN | POLLRDNORM);
 
         return mask;
@@ -2216,7 +2216,6 @@ struct proto udp_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udp_setsockopt,
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index 3b3efbda48e1..2eea073e27ef 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -55,7 +55,6 @@ struct proto 	udplite_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v4_get_port,
         .obj_size          = sizeof(struct udp_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udp_setsockopt,
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index b644a23c3db0..41f5b504a782 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -29,7 +29,7 @@ static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
         memset(fl4, 0, sizeof(*fl4));
         fl4->daddr = daddr->a4;
         fl4->flowi4_tos = tos;
-        fl4->flowi4_oif = oif;
+        fl4->flowi4_oif = l3mdev_master_ifindex_by_index(net, oif);
         if (saddr)
                 fl4->saddr = saddr->a4;
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ab3e796596b1..2f1f5d439788 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -778,7 +778,14 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
         }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
+                int old_dflt = net->ipv6.devconf_dflt->forwarding;
+
                 net->ipv6.devconf_dflt->forwarding = newf;
+                if ((!newf) ^ (!old_dflt))
+                        inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
+                                                     NETCONFA_IFINDEX_DEFAULT,
+                                                     net->ipv6.devconf_dflt);
+
                 addrconf_forward_change(net, newf);
                 if ((!newf) ^ (!old))
                         inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
@@ -1872,7 +1879,6 @@ static int addrconf_dad_end(struct inet6_ifaddr *ifp)
 
 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 {
-        struct in6_addr addr;
         struct inet6_dev *idev = ifp->idev;
         struct net *net = dev_net(ifp->idev->dev);
 
@@ -1934,18 +1940,6 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                 in6_ifa_put(ifp2);
 lock_errdad:
                 spin_lock_bh(&ifp->lock);
-        } else if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
-                addr.s6_addr32[0] = htonl(0xfe800000);
-                addr.s6_addr32[1] = 0;
-
-                if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
-                    ipv6_addr_equal(&ifp->addr, &addr)) {
-                        /* DAD failed for link-local based on MAC address */
-                        idev->cnf.disable_ipv6 = 1;
-
-                        pr_info("%s: IPv6 being disabled!\n",
-                                ifp->idev->dev->name);
-                }
         }
 
 errdad:
@@ -1954,6 +1948,7 @@ errdad:
         spin_unlock_bh(&ifp->lock);
 
         addrconf_mod_dad_work(ifp, 0);
+        in6_ifa_put(ifp);
 }
 
 /* Join to solicited addr multicast group.
@@ -3543,7 +3538,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
         /* combine the user config with event to determine if permanent
          * addresses are to be removed from address hash table
          */
-        keep_addr = !(how || _keep_addr <= 0);
+        keep_addr = !(how || _keep_addr <= 0 || idev->cnf.disable_ipv6);
 
         /* Step 2: clear hash table */
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
@@ -3599,7 +3594,7 @@ restart:
         /* re-combine the user config with event to determine if permanent
          * addresses are to be removed from the interface list
          */
-        keep_addr = (!how && _keep_addr > 0);
+        keep_addr = (!how && _keep_addr > 0 && !idev->cnf.disable_ipv6);
 
         INIT_LIST_HEAD(&del_list);
         list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
@@ -3821,6 +3816,7 @@ static void addrconf_dad_work(struct work_struct *w)
                                                 dad_work);
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr mcaddr;
+        bool disable_ipv6 = false;
 
         enum {
                 DAD_PROCESS,
@@ -3837,6 +3833,24 @@ static void addrconf_dad_work(struct work_struct *w)
         } else if (ifp->state == INET6_IFADDR_STATE_ERRDAD) {
                 action = DAD_ABORT;
                 ifp->state = INET6_IFADDR_STATE_POSTDAD;
+
+                if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6 &&
+                    !(ifp->flags & IFA_F_STABLE_PRIVACY)) {
+                        struct in6_addr addr;
+
+                        addr.s6_addr32[0] = htonl(0xfe800000);
+                        addr.s6_addr32[1] = 0;
+
+                        if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
+                            ipv6_addr_equal(&ifp->addr, &addr)) {
+                                /* DAD failed for link-local based on MAC */
+                                idev->cnf.disable_ipv6 = 1;
+
+                                pr_info("%s: IPv6 being disabled!\n",
+                                        ifp->idev->dev->name);
+                                disable_ipv6 = true;
+                        }
+                }
         }
         spin_unlock_bh(&ifp->lock);
 
@@ -3844,7 +3858,10 @@ static void addrconf_dad_work(struct work_struct *w)
                 addrconf_dad_begin(ifp);
                 goto out;
         } else if (action == DAD_ABORT) {
+                in6_ifa_hold(ifp);
                 addrconf_dad_stop(ifp, 1);
+                if (disable_ipv6)
+                        addrconf_ifdown(idev->dev, 0);
                 goto out;
         }
 
@@ -6017,7 +6034,7 @@ static const struct ctl_table addrconf_sysctl[] = {
 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
                 struct inet6_dev *idev, struct ipv6_devconf *p)
 {
-        int i;
+        int i, ifindex;
         struct ctl_table *table;
         char path[sizeof("net/ipv6/conf/") + IFNAMSIZ];
 
@@ -6037,6 +6054,13 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
         if (!p->sysctl_header)
                 goto free;
 
+        if (!strcmp(dev_name, "all"))
+                ifindex = NETCONFA_IFINDEX_ALL;
+        else if (!strcmp(dev_name, "default"))
+                ifindex = NETCONFA_IFINDEX_DEFAULT;
+        else
+                ifindex = idev->dev->ifindex;
+        inet6_netconf_notify_devconf(net, NETCONFA_ALL, ifindex, p);
         return 0;
 
 free:
diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c
index c53b92c617c5..37ac9de713c6 100644
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -952,8 +952,10 @@ calipso_opt_insert(struct ipv6_opt_hdr *hop,
                 memcpy(new, hop, start);
         ret_val = calipso_genopt((unsigned char *)new, start, buf_len, doi_def,
                                  secattr);
-        if (ret_val < 0)
+        if (ret_val < 0) {
+                kfree(new);
                 return ERR_PTR(ret_val);
+        }
 
         buf_len = start + ret_val;
         /* At this point buf_len aligns to 4n, so (buf_len & 4) pads to 8n */
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 776d145113e1..704274cbd495 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -519,8 +519,6 @@ static netdev_tx_t __gre6_xmit(struct sk_buff *skb,
         gre_build_header(skb, tunnel->tun_hlen, tunnel->parms.o_flags,
                          protocol, tunnel->parms.o_key, htonl(tunnel->o_seqno));
 
-        skb_set_inner_protocol(skb, protocol);
-
         return ip6_tnl_xmit(skb, dev, dsfield, fl6, encap_limit, pmtu,
                             NEXTHDR_GRE);
 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7b0481e3738f..888543debe4e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1174,6 +1174,7 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 encap_limit = t->parms.encap_limit;
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPIP;
 
         dsfield = ipv4_get_dsfield(iph);
 
@@ -1233,6 +1234,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                 encap_limit = t->parms.encap_limit;
 
         memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_IPV6;
 
         dsfield = ipv6_get_dsfield(ipv6h);
         if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index d90a11f14040..5bd3afdcc771 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -321,11 +321,9 @@ static int vti6_rcv(struct sk_buff *skb)
                         goto discard;
                 }
 
-                XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
-
                 rcu_read_unlock();
 
-                return xfrm6_rcv(skb);
+                return xfrm6_rcv_tnl(skb, t);
         }
         rcu_read_unlock();
         return -EINVAL;
@@ -340,6 +338,7 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
         struct net_device *dev;
         struct pcpu_sw_netstats *tstats;
         struct xfrm_state *x;
+        struct xfrm_mode *inner_mode;
         struct ip6_tnl *t = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6;
         u32 orig_mark = skb->mark;
         int ret;
@@ -357,7 +356,19 @@ static int vti6_rcv_cb(struct sk_buff *skb, int err)
         }
 
         x = xfrm_input_state(skb);
-        family = x->inner_mode->afinfo->family;
+
+        inner_mode = x->inner_mode;
+
+        if (x->sel.family == AF_UNSPEC) {
+                inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
+                if (inner_mode == NULL) {
+                        XFRM_INC_STATS(dev_net(skb->dev),
+                                       LINUX_MIB_XFRMINSTATEMODEERROR);
+                        return -EINVAL;
+                }
+        }
+
+        family = inner_mode->afinfo->family;
 
         skb->mark = be32_to_cpu(t->parms.i_key);
         ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 6122f9c5cc49..fccb5dd91902 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -2239,6 +2239,7 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
         struct rta_mfc_stats mfcs;
         struct nlattr *mp_attr;
         struct rtnexthop *nhp;
+        unsigned long lastuse;
         int ct;
 
         /* If cache is unresolved, don't try to parse IIF and OIF */
@@ -2269,12 +2270,14 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
 
         nla_nest_end(skb, mp_attr);
 
+        lastuse = READ_ONCE(c->mfc_un.res.lastuse);
+        lastuse = time_after_eq(jiffies, lastuse) ? jiffies - lastuse : 0;
+
         mfcs.mfcs_packets = c->mfc_un.res.pkt;
         mfcs.mfcs_bytes = c->mfc_un.res.bytes;
         mfcs.mfcs_wrong_if = c->mfc_un.res.wrong_if;
         if (nla_put_64bit(skb, RTA_MFC_STATS, sizeof(mfcs), &mfcs, RTA_PAD) ||
-            nla_put_u64_64bit(skb, RTA_EXPIRES,
-                              jiffies_to_clock_t(c->mfc_un.res.lastuse),
+            nla_put_u64_64bit(skb, RTA_EXPIRES, jiffies_to_clock_t(lastuse),
                               RTA_PAD))
                 return -EMSGSIZE;
 
diff --git a/net/ipv6/netfilter/nft_chain_route_ipv6.c b/net/ipv6/netfilter/nft_chain_route_ipv6.c
index 71d995ff3108..2535223ba956 100644
--- a/net/ipv6/netfilter/nft_chain_route_ipv6.c
+++ b/net/ipv6/netfilter/nft_chain_route_ipv6.c
@@ -31,6 +31,7 @@ static unsigned int nf_route_table_hook(void *priv,
         struct in6_addr saddr, daddr;
         u_int8_t hop_limit;
         u32 mark, flowlabel;
+        int err;
 
         /* malformed packet, drop it */
         if (nft_set_pktinfo_ipv6(&pkt, skb, state) < 0)
@@ -46,13 +47,16 @@ static unsigned int nf_route_table_hook(void *priv,
         flowlabel = *((u32 *)ipv6_hdr(skb));
 
         ret = nft_do_chain(&pkt, priv);
-        if (ret != NF_DROP && ret != NF_QUEUE &&
+        if (ret != NF_DROP && ret != NF_STOLEN &&
             (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
              memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
              skb->mark != mark ||
              ipv6_hdr(skb)->hop_limit != hop_limit ||
-             flowlabel != *((u_int32_t *)ipv6_hdr(skb))))
-                return ip6_route_me_harder(state->net, skb) == 0 ? ret : NF_DROP;
+             flowlabel != *((u_int32_t *)ipv6_hdr(skb)))) {
+                err = ip6_route_me_harder(state->net, skb);
+                if (err < 0)
+                        ret = NF_DROP_ERR(err);
+        }
 
         return ret;
 }
diff --git a/net/ipv6/netfilter/nft_reject_ipv6.c b/net/ipv6/netfilter/nft_reject_ipv6.c
index 533cd5719c59..92bda9908bb9 100644
--- a/net/ipv6/netfilter/nft_reject_ipv6.c
+++ b/net/ipv6/netfilter/nft_reject_ipv6.c
@@ -47,6 +47,7 @@ static const struct nft_expr_ops nft_reject_ipv6_ops = {
         .eval           = nft_reject_ipv6_eval,
         .init           = nft_reject_init,
         .dump           = nft_reject_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_ipv6_type __read_mostly = {
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index fed40d1ec29b..0e983b694ee8 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -55,7 +55,7 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         struct icmp6hdr user_icmph;
         int addr_type;
         struct in6_addr *daddr;
-        int iif = 0;
+        int oif = 0;
         struct flowi6 fl6;
         int err;
         struct dst_entry *dst;
@@ -78,25 +78,30 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
                 if (u->sin6_family != AF_INET6) {
                         return -EAFNOSUPPORT;
                 }
-                if (sk->sk_bound_dev_if &&
-                    sk->sk_bound_dev_if != u->sin6_scope_id) {
-                        return -EINVAL;
-                }
                 daddr = &(u->sin6_addr);
-                iif = u->sin6_scope_id;
+                if (__ipv6_addr_needs_scope_id(ipv6_addr_type(daddr)))
+                        oif = u->sin6_scope_id;
         } else {
                 if (sk->sk_state != TCP_ESTABLISHED)
                         return -EDESTADDRREQ;
                 daddr = &sk->sk_v6_daddr;
         }
 
-        if (!iif)
-                iif = sk->sk_bound_dev_if;
+        if (!oif)
+                oif = sk->sk_bound_dev_if;
+
+        if (!oif)
+                oif = np->sticky_pktinfo.ipi6_ifindex;
+
+        if (!oif && ipv6_addr_is_multicast(daddr))
+                oif = np->mcast_oif;
+        else if (!oif)
+                oif = np->ucast_oif;
 
         addr_type = ipv6_addr_type(daddr);
-        if (__ipv6_addr_needs_scope_id(addr_type) && !iif)
-                return -EINVAL;
-        if (addr_type & IPV6_ADDR_MAPPED)
+        if ((__ipv6_addr_needs_scope_id(addr_type) && !oif) ||
+            (addr_type & IPV6_ADDR_MAPPED) ||
+            (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if))
                 return -EINVAL;
 
         /* TODO: use ip6_datagram_send_ctl to get options from cmsg */
@@ -106,16 +111,12 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         fl6.flowi6_proto = IPPROTO_ICMPV6;
         fl6.saddr = np->saddr;
         fl6.daddr = *daddr;
+        fl6.flowi6_oif = oif;
         fl6.flowi6_mark = sk->sk_mark;
         fl6.fl6_icmp_type = user_icmph.icmp6_type;
         fl6.fl6_icmp_code = user_icmph.icmp6_code;
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
-        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
-                fl6.flowi6_oif = np->mcast_oif;
-        else if (!fl6.flowi6_oif)
-                fl6.flowi6_oif = np->ucast_oif;
-
         ipc6.tclass = np->tclass;
         fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 
@@ -125,8 +126,10 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         rt = (struct rt6_info *) dst;
 
         np = inet6_sk(sk);
-        if (!np)
-                return -EBADF;
+        if (!np) {
+                err = -EBADF;
+                goto dst_err_out;
+        }
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
                 fl6.flowi6_oif = np->mcast_oif;
@@ -162,6 +165,9 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         }
         release_sock(sk);
 
+dst_err_out:
+        dst_release(dst);
+
         if (err)
                 return err;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 49817555449e..e3a224b97905 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1986,9 +1986,18 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg)
                         if (!(gwa_type & IPV6_ADDR_UNICAST))
                                 goto out;
 
-                        if (cfg->fc_table)
+                        if (cfg->fc_table) {
                                 grt = ip6_nh_lookup_table(net, cfg, gw_addr);
 
+                                if (grt) {
+                                        if (grt->rt6i_flags & RTF_GATEWAY ||
+                                            (dev && dev != grt->dst.dev)) {
+                                                ip6_rt_put(grt);
+                                                grt = NULL;
+                                        }
+                                }
+                        }
+
                         if (!grt)
                                 grt = rt6_lookup(net, gw_addr, NULL,
                                                  cfg->fc_ifindex, 1);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 33df8b8575cc..94f4f89d73e7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -944,9 +944,15 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
          */
+        /* RFC 7323 2.3
+         * The window field (SEG.WND) of every outgoing segment, with the
+         * exception of <SYN> segments, MUST be right-shifted by
+         * Rcv.Wind.Shift bits:
+         */
         tcp_v6_send_ack(sk, skb, (sk->sk_state == TCP_LISTEN) ?
                         tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
-                        tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
+                        tcp_rsk(req)->rcv_nxt,
+                        req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale,
                         tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
                         tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
                         0, 0);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 81e2f98b958d..19ac3a1c308d 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1460,7 +1460,6 @@ struct proto udpv6_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp6_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 9cf097e206e9..fd6ef414899b 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -50,7 +50,6 @@ struct proto udplitev6_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
         .obj_size          = sizeof(struct udp6_sock),
-        .slab_flags        = SLAB_DESTROY_BY_RCU,
         .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 0eaab1fa6be5..b5789562aded 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -21,8 +21,10 @@ int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
         return xfrm6_extract_header(skb);
 }
 
-int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
+int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
+                  struct ip6_tnl *t)
 {
+        XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
         XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
         XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
         return xfrm_input(skb, nexthdr, spi, 0);
@@ -48,13 +50,18 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
         return -1;
 }
 
-int xfrm6_rcv(struct sk_buff *skb)
+int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t)
 {
         return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
-                             0);
+                             0, t);
 }
-EXPORT_SYMBOL(xfrm6_rcv);
+EXPORT_SYMBOL(xfrm6_rcv_tnl);
 
+int xfrm6_rcv(struct sk_buff *skb)
+{
+        return xfrm6_rcv_tnl(skb, NULL);
+}
+EXPORT_SYMBOL(xfrm6_rcv);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                      xfrm_address_t *saddr, u8 proto)
 {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6cc97003e4a9..70a86adad875 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -36,7 +36,7 @@ static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
         int err;
 
         memset(&fl6, 0, sizeof(fl6));
-        fl6.flowi6_oif = oif;
+        fl6.flowi6_oif = l3mdev_master_ifindex_by_index(net, oif);
         fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
         memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
         if (saddr)
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 5743044cd660..e1c0bbe7996c 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -236,7 +236,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb)
         __be32 spi;
 
         spi = xfrm6_tunnel_spi_lookup(net, (const xfrm_address_t *)&iph->saddr);
-        return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi);
+        return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi, NULL);
 }
 
 static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 8d2f7c9b491d..ccc244406fb9 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -832,7 +832,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
         struct sock *sk = sock->sk;
         struct irda_sock *new, *self = irda_sk(sk);
         struct sock *newsk;
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         int err;
 
         err = irda_create(sock_net(sk), newsock, sk->sk_protocol, 0);
@@ -900,7 +900,6 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
         err = -EPERM; /* value does not seem to make sense. -arnd */
         if (!new->tsap) {
                 pr_debug("%s(), dup failed!\n", __func__);
-                kfree_skb(skb);
                 goto out;
         }
 
@@ -919,7 +918,6 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
         /* Clean up the original one to keep it in listen state */
         irttp_listen(self->tsap);
 
-        kfree_skb(skb);
         sk->sk_ack_backlog--;
 
         newsock->state = SS_CONNECTED;
@@ -927,6 +925,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
         irda_connect_response(new);
         err = 0;
 out:
+        kfree_skb(skb);
         release_sock(sk);
         return err;
 }
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 4a7ae32afa09..1138eaf5c682 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -185,8 +185,12 @@ struct iriap_cb *iriap_open(__u8 slsap_sel, int mode, void *priv,
 
         self->magic = IAS_MAGIC;
         self->mode = mode;
-        if (mode == IAS_CLIENT)
-                iriap_register_lsap(self, slsap_sel, mode);
+        if (mode == IAS_CLIENT) {
+                if (iriap_register_lsap(self, slsap_sel, mode)) {
+                        kfree(self);
+                        return NULL;
+                }
+        }
 
         self->confirm = callback;
         self->priv = priv;
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index cb39e05b166c..411693288648 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -13,6 +13,7 @@
 #include <linux/socket.h>
 #include <linux/uaccess.h>
 #include <linux/workqueue.h>
+#include <linux/syscalls.h>
 #include <net/kcm.h>
 #include <net/netns/generic.h>
 #include <net/sock.h>
@@ -2029,7 +2030,7 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (copy_to_user((void __user *)arg, &info,
                                          sizeof(info))) {
                                 err = -EFAULT;
-                                sock_release(newsock);
+                                sys_close(info.fd);
                         }
                 }
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 1e40dacaa137..a2ed3bda4ddc 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1855,6 +1855,9 @@ static __net_exit void l2tp_exit_net(struct net *net)
                 (void)l2tp_tunnel_delete(tunnel);
         }
         rcu_read_unlock_bh();
+
+        flush_workqueue(l2tp_wq);
+        rcu_barrier();
 }
 
 static struct pernet_operations l2tp_net_ops = {
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index d9560aa2dba3..232cb92033e8 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -856,7 +856,7 @@ static int pppol2tp_getname(struct socket *sock, struct sockaddr *uaddr,
         error = -ENOTCONN;
         if (sk == NULL)
                 goto end;
-        if (sk->sk_state != PPPOX_CONNECTED)
+        if (!(sk->sk_state & PPPOX_CONNECTED))
                 goto end;
 
         error = -EBADF;
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index a9aff6079c42..afa94687d5e1 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -261,10 +261,16 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
                 .timeout = timeout,
                 .ssn = start_seq_num,
         };
-
         int i, ret = -EOPNOTSUPP;
         u16 status = WLAN_STATUS_REQUEST_DECLINED;
 
+        if (tid >= IEEE80211_FIRST_TSPEC_TSID) {
+                ht_dbg(sta->sdata,
+                       "STA %pM requests BA session on unsupported tid %d\n",
+                       sta->sta.addr, tid);
+                goto end_no_lock;
+        }
+
         if (!sta->sta.ht_cap.ht_supported) {
                 ht_dbg(sta->sdata,
                        "STA %pM erroneously requests BA session on tid %d w/o QoS\n",
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 5650c46bf91a..45319cc01121 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -584,6 +584,9 @@ int ieee80211_start_tx_ba_session(struct ieee80211_sta *pubsta, u16 tid,
             ieee80211_hw_check(&local->hw, TX_AMPDU_SETUP_IN_HW))
                 return -EINVAL;
 
+        if (WARN_ON(tid >= IEEE80211_FIRST_TSPEC_TSID))
+                return -EINVAL;
+
         ht_dbg(sdata, "Open BA session requested for %pM tid %u\n",
                pubsta->addr, tid);
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 47e99ab8d97a..543b1d4fc33d 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -869,7 +869,7 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
 
         /* free all potentially still buffered bcast frames */
         local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps.bc_buf);
-        skb_queue_purge(&sdata->u.ap.ps.bc_buf);
+        ieee80211_purge_tx_queue(&local->hw, &sdata->u.ap.ps.bc_buf);
 
         mutex_lock(&local->mtx);
         ieee80211_vif_copy_chanctx_to_vlans(sdata, true);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 184473c257eb..ba5fc1f01e53 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -1094,7 +1094,7 @@ static inline u32 drv_get_expected_throughput(struct ieee80211_local *local,
 
         trace_drv_get_expected_throughput(sta);
         if (local->ops->get_expected_throughput)
-                ret = local->ops->get_expected_throughput(sta);
+                ret = local->ops->get_expected_throughput(&local->hw, sta);
         trace_drv_return_u32(local, ret);
 
         return ret;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index c66411df9863..42120d965263 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -881,20 +881,22 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
 
         netif_carrier_off(sdata->dev);
 
+        /* flush STAs and mpaths on this iface */
+        sta_info_flush(sdata);
+        mesh_path_flush_by_iface(sdata);
+
         /* stop the beacon */
         ifmsh->mesh_id_len = 0;
         sdata->vif.bss_conf.enable_beacon = false;
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+
+        /* remove beacon */
         bcn = rcu_dereference_protected(ifmsh->beacon,
                                         lockdep_is_held(&sdata->wdev.mtx));
         RCU_INIT_POINTER(ifmsh->beacon, NULL);
         kfree_rcu(bcn, rcu_head);
 
-        /* flush STAs and mpaths on this iface */
-        sta_info_flush(sdata);
-        mesh_path_flush_by_iface(sdata);
-
         /* free all potentially still buffered group-addressed frames */
         local->total_ps_buffered -= skb_queue_len(&ifmsh->ps.bc_buf);
         skb_queue_purge(&ifmsh->ps.bc_buf);
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 8f9c3bde835f..faccef977670 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -746,6 +746,7 @@ static void hwmp_perr_frame_process(struct ieee80211_sub_if_data *sdata,
                 sta = next_hop_deref_protected(mpath);
                 if (mpath->flags & MESH_PATH_ACTIVE &&
                     ether_addr_equal(ta, sta->sta.addr) &&
+                    !(mpath->flags & MESH_PATH_FIXED) &&
                     (!(mpath->flags & MESH_PATH_SN_VALID) ||
                     SN_GT(target_sn, mpath->sn)  || target_sn == 0)) {
                         mpath->flags &= ~MESH_PATH_ACTIVE;
@@ -1012,7 +1013,7 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
                 goto enddiscovery;
 
         spin_lock_bh(&mpath->state_lock);
-        if (mpath->flags & MESH_PATH_DELETED) {
+        if (mpath->flags & (MESH_PATH_DELETED | MESH_PATH_FIXED)) {
                 spin_unlock_bh(&mpath->state_lock);
                 goto enddiscovery;
         }
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 6db2ddfa0695..f0e6175a9821 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -826,7 +826,7 @@ void mesh_path_fix_nexthop(struct mesh_path *mpath, struct sta_info *next_hop)
         mpath->metric = 0;
         mpath->hop_count = 0;
         mpath->exp_time = 0;
-        mpath->flags |= MESH_PATH_FIXED;
+        mpath->flags = MESH_PATH_FIXED | MESH_PATH_SN_VALID;
         mesh_path_activate(mpath);
         spin_unlock_bh(&mpath->state_lock);
         mesh_path_tx_pending(mpath);
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 2e8a9024625a..9dce3b157908 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1268,7 +1268,7 @@ static void sta_ps_start(struct sta_info *sta)
         for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
                 struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
 
-                if (!txqi->tin.backlog_packets)
+                if (txqi->tin.backlog_packets)
                         set_bit(tid, &sta->txq_buffered_tids);
                 else
                         clear_bit(tid, &sta->txq_buffered_tids);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 76b737dcc36f..aa58df80ede0 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -1616,7 +1616,6 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
 
                 sta_info_recalc_tim(sta);
         } else {
-                unsigned long tids = sta->txq_buffered_tids & driver_release_tids;
                 int tid;
 
                 /*
@@ -1648,7 +1647,8 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
                         struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);
 
-                        if (!(tids & BIT(tid)) || txqi->tin.backlog_packets)
+                        if (!(driver_release_tids & BIT(tid)) ||
+                            txqi->tin.backlog_packets)
                                 continue;
 
                         sta_info_recalc_tim(sta);
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index c6d5c724e032..a2a68269675d 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -771,6 +771,13 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         clear_sta_flag(sta, WLAN_STA_SP);
 
                 acked = !!(info->flags & IEEE80211_TX_STAT_ACK);
+
+                /* mesh Peer Service Period support */
+                if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
+                    ieee80211_is_data_qos(fc))
+                        ieee80211_mpsp_trigger_process(
+                                ieee80211_get_qos_ctl(hdr), sta, true, acked);
+
                 if (!acked && test_sta_flag(sta, WLAN_STA_PS_STA)) {
                         /*
                          * The STA is in power save mode, so assume
@@ -781,13 +788,6 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
 
-                /* mesh Peer Service Period support */
-                if (ieee80211_vif_is_mesh(&sta->sdata->vif) &&
-                    ieee80211_is_data_qos(fc))
-                        ieee80211_mpsp_trigger_process(
-                                        ieee80211_get_qos_ctl(hdr),
-                                        sta, true, acked);
-
                 if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL) &&
                     (ieee80211_is_data(hdr->frame_control)) &&
                     (rates_idx != -1))
diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
index b5d28f14b9cf..afca7d103684 100644
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -333,10 +333,11 @@ ieee80211_tdls_chandef_vht_upgrade(struct ieee80211_sub_if_data *sdata,
         if (!uc.center_freq1)
                 return;
 
-        /* proceed to downgrade the chandef until usable or the same */
+        /* proceed to downgrade the chandef until usable or the same as AP BW */
         while (uc.width > max_width ||
-               !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
-                                              sdata->wdev.iftype))
+               (uc.width > sta->tdls_chandef.width &&
+                !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
+                                               sdata->wdev.iftype)))
                 ieee80211_chandef_downgrade(&uc);
 
         if (!cfg80211_chandef_identical(&uc, &sta->tdls_chandef)) {
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 91461c415525..18b285e06bc8 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -368,7 +368,7 @@ static void purge_old_ps_buffers(struct ieee80211_local *local)
                 skb = skb_dequeue(&ps->bc_buf);
                 if (skb) {
                         purged++;
-                        dev_kfree_skb(skb);
+                        ieee80211_free_txskb(&local->hw, skb);
                 }
                 total += skb_queue_len(&ps->bc_buf);
         }
@@ -451,7 +451,7 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (skb_queue_len(&ps->bc_buf) >= AP_MAX_BC_BUFFER) {
                 ps_dbg(tx->sdata,
                        "BC TX buffer full - dropping the oldest frame\n");
-                dev_kfree_skb(skb_dequeue(&ps->bc_buf));
+                ieee80211_free_txskb(&tx->local->hw, skb_dequeue(&ps->bc_buf));
         } else
                 tx->local->total_ps_buffered++;
 
@@ -796,6 +796,36 @@ static __le16 ieee80211_tx_next_seq(struct sta_info *sta, int tid)
         return ret;
 }
 
+static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
+                                          struct ieee80211_vif *vif,
+                                          struct ieee80211_sta *pubsta,
+                                          struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+        struct ieee80211_txq *txq = NULL;
+
+        if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ||
+            (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
+                return NULL;
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return NULL;
+
+        if (pubsta) {
+                u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
+
+                txq = pubsta->txq[tid];
+        } else if (vif) {
+                txq = vif->txq;
+        }
+
+        if (!txq)
+                return NULL;
+
+        return to_txq_info(txq);
+}
+
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 {
@@ -853,7 +883,8 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
         tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
         tx->sta->tx_stats.msdu[tid]++;
 
-        if (!tx->sta->sta.txq[0])
+        if (!ieee80211_get_txq(tx->local, info->control.vif, &tx->sta->sta,
+                               tx->skb))
                 hdr->seq_ctrl = ieee80211_tx_next_seq(tx->sta, tid);
 
         return TX_CONTINUE;
@@ -1243,36 +1274,6 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
         return TX_CONTINUE;
 }
 
-static struct txq_info *ieee80211_get_txq(struct ieee80211_local *local,
-                                          struct ieee80211_vif *vif,
-                                          struct ieee80211_sta *pubsta,
-                                          struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_txq *txq = NULL;
-
-        if ((info->flags & IEEE80211_TX_CTL_SEND_AFTER_DTIM) ||
-            (info->control.flags & IEEE80211_TX_CTRL_PS_RESPONSE))
-                return NULL;
-
-        if (!ieee80211_is_data(hdr->frame_control))
-                return NULL;
-
-        if (pubsta) {
-                u8 tid = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
-
-                txq = pubsta->txq[tid];
-        } else if (vif) {
-                txq = vif->txq;
-        }
-
-        if (!txq)
-                return NULL;
-
-        return to_txq_info(txq);
-}
-
 static void ieee80211_set_skb_enqueue_time(struct sk_buff *skb)
 {
         IEEE80211_SKB_CB(skb)->control.enqueue_time = codel_get_time();
@@ -1514,8 +1515,12 @@ out:
         spin_unlock_bh(&fq->lock);
 
         if (skb && skb_has_frag_list(skb) &&
-            !ieee80211_hw_check(&local->hw, TX_FRAG_LIST))
-                skb_linearize(skb);
+            !ieee80211_hw_check(&local->hw, TX_FRAG_LIST)) {
+                if (skb_linearize(skb)) {
+                        ieee80211_free_txskb(&local->hw, skb);
+                        return NULL;
+                }
+        }
 
         return skb;
 }
@@ -3264,7 +3269,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata,
 
         if (hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_QOS_DATA)) {
                 *ieee80211_get_qos_ctl(hdr) = tid;
-                if (!sta->sta.txq[0])
+                if (!ieee80211_get_txq(local, &sdata->vif, &sta->sta, skb))
                         hdr->seq_ctrl = ieee80211_tx_next_seq(sta, tid);
         } else {
                 info->flags |= IEEE80211_TX_CTL_ASSIGN_SEQ;
@@ -4275,7 +4280,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                         sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                 if (!ieee80211_tx_prepare(sdata, &tx, NULL, skb))
                         break;
-                dev_kfree_skb_any(skb);
+                ieee80211_free_txskb(hw, skb);
         }
 
         info = IEEE80211_SKB_CB(skb);
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index dd2c43abf9e2..9934b0c93c1e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1035,9 +1035,9 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
         if (IS_ERR(ct))
                 return (struct nf_conntrack_tuple_hash *)ct;
 
-        if (tmpl && nfct_synproxy(tmpl)) {
-                nfct_seqadj_ext_add(ct);
-                nfct_synproxy_ext_add(ct);
+        if (!nf_ct_add_synproxy(ct, tmpl)) {
+                nf_conntrack_free(ct);
+                return ERR_PTR(-ENOMEM);
         }
 
         timeout_ext = tmpl ? nf_ct_timeout_find(tmpl) : NULL;
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 9e3693128313..f8dbacf66795 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -574,7 +574,7 @@ static int exp_seq_show(struct seq_file *s, void *v)
         helper = rcu_dereference(nfct_help(expect->master)->helper);
         if (helper) {
                 seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name);
-                if (helper->expect_policy[expect->class].name)
+                if (helper->expect_policy[expect->class].name[0])
                         seq_printf(s, "/%s",
                                    helper->expect_policy[expect->class].name);
         }
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index bb77a97961bf..5c0db5c64734 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -1473,7 +1473,8 @@ static int process_rcf(struct sk_buff *skb, struct nf_conn *ct,
                                  "timeout to %u seconds for",
                                  info->timeout);
                         nf_ct_dump_tuple(&exp->tuple);
-                        mod_timer(&exp->timeout, jiffies + info->timeout * HZ);
+                        mod_timer_pending(&exp->timeout,
+                                          jiffies + info->timeout * HZ);
                 }
                 spin_unlock_bh(&nf_conntrack_expect_lock);
         }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 050bb3420a6b..fdfc71f416b7 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1894,6 +1894,8 @@ static int ctnetlink_new_conntrack(struct net *net, struct sock *ctnl,
 
                         if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
                                 return -EINVAL;
+                        if (otuple.dst.protonum != rtuple.dst.protonum)
+                                return -EINVAL;
 
                         ct = ctnetlink_create_conntrack(net, &zone, cda, &otuple,
                                                         &rtuple, u3);
@@ -2362,12 +2364,8 @@ ctnetlink_glue_attach_expect(const struct nlattr *attr, struct nf_conn *ct,
                 return PTR_ERR(exp);
 
         err = nf_ct_expect_related_report(exp, portid, report);
-        if (err < 0) {
-                nf_ct_expect_put(exp);
-                return err;
-        }
-
-        return 0;
+        nf_ct_expect_put(exp);
+        return err;
 }
 
 static void ctnetlink_glue_seqadj(struct sk_buff *skb, struct nf_conn *ct,
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 8d9db9d4702b..7d77217de6a3 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1383,7 +1383,7 @@ static int process_sip_response(struct sk_buff *skb, unsigned int protoff,
                 return NF_DROP;
         }
         cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-        if (!cseq) {
+        if (!cseq && *(*dptr + matchoff) != '0') {
                 nf_ct_helper_log(skb, ct, "cannot get cseq");
                 return NF_DROP;
         }
@@ -1446,7 +1446,7 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff,
                         return NF_DROP;
                 }
                 cseq = simple_strtoul(*dptr + matchoff, NULL, 10);
-                if (!cseq) {
+                if (!cseq && *(*dptr + matchoff) != '0') {
                         nf_ct_helper_log(skb, ct, "cannot get cseq");
                         return NF_DROP;
                 }
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 958a1455ca7f..9f267c3ffb39 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -205,6 +205,7 @@ static int ct_seq_show(struct seq_file *s, void *v)
         struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(hash);
         const struct nf_conntrack_l3proto *l3proto;
         const struct nf_conntrack_l4proto *l4proto;
+        struct net *net = seq_file_net(s);
         int ret = 0;
 
         NF_CT_ASSERT(ct);
@@ -215,6 +216,9 @@ static int ct_seq_show(struct seq_file *s, void *v)
         if (NF_CT_DIRECTION(hash))
                 goto release;
 
+        if (!net_eq(nf_ct_net(ct), net))
+                goto release;
+
         l3proto = __nf_ct_l3proto_find(nf_ct_l3num(ct));
         NF_CT_ASSERT(l3proto);
         l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct));
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index de31818417b8..ecee105bbada 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -441,7 +441,8 @@ nf_nat_setup_info(struct nf_conn *ct,
                         ct->status |= IPS_DST_NAT;
 
                 if (nfct_help(ct))
-                        nfct_seqadj_ext_add(ct);
+                        if (!nfct_seqadj_ext_add(ct))
+                                return NF_DROP;
         }
 
         if (maniptype == NF_NAT_MANIP_SRC) {
@@ -807,7 +808,7 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
         if (err < 0)
                 return err;
 
-        return nf_nat_setup_info(ct, &range, manip);
+        return nf_nat_setup_info(ct, &range, manip) == NF_DROP ? -ENOMEM : 0;
 }
 #else
 static int
diff --git a/net/netfilter/nf_tables_netdev.c b/net/netfilter/nf_tables_netdev.c
index 5eefe4a355c6..75d696f11045 100644
--- a/net/netfilter/nf_tables_netdev.c
+++ b/net/netfilter/nf_tables_netdev.c
@@ -30,7 +30,6 @@ nft_netdev_set_pktinfo_ipv4(struct nft_pktinfo *pkt,
         if (!iph)
                 return;
 
-        iph = ip_hdr(skb);
         if (iph->ihl < 5 || iph->version != 4)
                 return;
 
diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c
index 39eb1cc62e91..fa24a5b398b1 100644
--- a/net/netfilter/nf_tables_trace.c
+++ b/net/netfilter/nf_tables_trace.c
@@ -237,7 +237,7 @@ void nft_trace_notify(struct nft_traceinfo *info)
                 break;
         case NFT_TRACETYPE_POLICY:
                 if (nla_put_be32(skb, NFTA_TRACE_POLICY,
-                                 info->basechain->policy))
+                                 htonl(info->basechain->policy)))
                         goto nla_put_failure;
                 break;
         }
diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 1b4de4bd6958..d44d89b56127 100644
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -326,14 +326,14 @@ static int nfnl_acct_try_del(struct nf_acct *cur)
 {
         int ret = 0;
 
-        /* we want to avoid races with nfnl_acct_find_get. */
-        if (atomic_dec_and_test(&cur->refcnt)) {
+        /* We want to avoid races with nfnl_acct_put. So only when the current
+         * refcnt is 1, we decrease it to 0.
+         */
+        if (atomic_cmpxchg(&cur->refcnt, 1, 0) == 1) {
                 /* We are protected by nfnl mutex. */
                 list_del_rcu(&cur->head);
                 kfree_rcu(cur, rcu_head);
         } else {
-                /* still in use, restore reference counter. */
-                atomic_inc(&cur->refcnt);
                 ret = -EBUSY;
         }
         return ret;
@@ -343,12 +343,12 @@ static int nfnl_acct_del(struct net *net, struct sock *nfnl,
                          struct sk_buff *skb, const struct nlmsghdr *nlh,
                          const struct nlattr * const tb[])
 {
-        char *acct_name;
-        struct nf_acct *cur;
+        struct nf_acct *cur, *tmp;
         int ret = -ENOENT;
+        char *acct_name;
 
         if (!tb[NFACCT_NAME]) {
-                list_for_each_entry(cur, &net->nfnl_acct_list, head)
+                list_for_each_entry_safe(cur, tmp, &net->nfnl_acct_list, head)
                         nfnl_acct_try_del(cur);
 
                 return 0;
@@ -443,7 +443,7 @@ void nfnl_acct_update(const struct sk_buff *skb, struct nf_acct *nfacct)
 }
 EXPORT_SYMBOL_GPL(nfnl_acct_update);
 
-static void nfnl_overquota_report(struct nf_acct *nfacct)
+static void nfnl_overquota_report(struct net *net, struct nf_acct *nfacct)
 {
         int ret;
         struct sk_buff *skb;
@@ -458,11 +458,12 @@ static void nfnl_overquota_report(struct nf_acct *nfacct)
                 kfree_skb(skb);
                 return;
         }
-        netlink_broadcast(init_net.nfnl, skb, 0, NFNLGRP_ACCT_QUOTA,
+        netlink_broadcast(net->nfnl, skb, 0, NFNLGRP_ACCT_QUOTA,
                           GFP_ATOMIC);
 }
 
-int nfnl_acct_overquota(const struct sk_buff *skb, struct nf_acct *nfacct)
+int nfnl_acct_overquota(struct net *net, const struct sk_buff *skb,
+                        struct nf_acct *nfacct)
 {
         u64 now;
         u64 *quota;
@@ -480,7 +481,7 @@ int nfnl_acct_overquota(const struct sk_buff *skb, struct nf_acct *nfacct)
 
         if (now >= *quota &&
             !test_and_set_bit(NFACCT_OVERQUOTA_BIT, &nfacct->flags)) {
-                nfnl_overquota_report(nfacct);
+                nfnl_overquota_report(net, nfacct);
         }
 
         return ret;
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 4cdcd969b64c..139e0867e56e 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -98,31 +98,28 @@ static int cttimeout_new_timeout(struct net *net, struct sock *ctnl,
                 break;
         }
 
-        l4proto = nf_ct_l4proto_find_get(l3num, l4num);
-
-        /* This protocol is not supportted, skip. */
-        if (l4proto->l4proto != l4num) {
-                ret = -EOPNOTSUPP;
-                goto err_proto_put;
-        }
-
         if (matching) {
                 if (nlh->nlmsg_flags & NLM_F_REPLACE) {
                         /* You cannot replace one timeout policy by another of
                          * different kind, sorry.
                          */
                         if (matching->l3num != l3num ||
-                            matching->l4proto->l4proto != l4num) {
-                                ret = -EINVAL;
-                                goto err_proto_put;
-                        }
-
-                        ret = ctnl_timeout_parse_policy(&matching->data,
-                                                        l4proto, net,
-                                                        cda[CTA_TIMEOUT_DATA]);
-                        return ret;
+                            matching->l4proto->l4proto != l4num)
+                                return -EINVAL;
+
+                        return ctnl_timeout_parse_policy(&matching->data,
+                                                         matching->l4proto, net,
+                                                         cda[CTA_TIMEOUT_DATA]);
                 }
-                ret = -EBUSY;
+
+                return -EBUSY;
+        }
+
+        l4proto = nf_ct_l4proto_find_get(l3num, l4num);
+
+        /* This protocol is not supportted, skip. */
+        if (l4proto->l4proto != l4num) {
+                ret = -EOPNOTSUPP;
                 goto err_proto_put;
         }
 
@@ -305,7 +302,16 @@ static void ctnl_untimeout(struct net *net, struct ctnl_timeout *timeout)
         const struct hlist_nulls_node *nn;
         unsigned int last_hsize;
         spinlock_t *lock;
-        int i;
+        int i, cpu;
+
+        for_each_possible_cpu(cpu) {
+                struct ct_pcpu *pcpu = per_cpu_ptr(net->ct.pcpu_lists, cpu);
+
+                spin_lock_bh(&pcpu->lock);
+                hlist_nulls_for_each_entry(h, nn, &pcpu->unconfirmed, hnnode)
+                        untimeout(h, timeout);
+                spin_unlock_bh(&pcpu->lock);
+        }
 
         local_bh_disable();
 restart:
@@ -330,16 +336,16 @@ static int ctnl_timeout_try_del(struct net *net, struct ctnl_timeout *timeout)
 {
         int ret = 0;
 
-        /* we want to avoid races with nf_ct_timeout_find_get. */
-        if (atomic_dec_and_test(&timeout->refcnt)) {
+        /* We want to avoid races with ctnl_timeout_put. So only when the
+         * current refcnt is 1, we decrease it to 0.
+         */
+        if (atomic_cmpxchg(&timeout->refcnt, 1, 0) == 1) {
                 /* We are protected by nfnl mutex. */
                 list_del_rcu(&timeout->head);
                 nf_ct_l4proto_put(timeout->l4proto);
                 ctnl_untimeout(net, timeout);
                 kfree_rcu(timeout, rcu_head);
         } else {
-                /* still in use, restore reference counter. */
-                atomic_inc(&timeout->refcnt);
                 ret = -EBUSY;
         }
         return ret;
@@ -350,12 +356,13 @@ static int cttimeout_del_timeout(struct net *net, struct sock *ctnl,
                                  const struct nlmsghdr *nlh,
                                  const struct nlattr * const cda[])
 {
-        struct ctnl_timeout *cur;
+        struct ctnl_timeout *cur, *tmp;
         int ret = -ENOENT;
         char *name;
 
         if (!cda[CTA_TIMEOUT_NAME]) {
-                list_for_each_entry(cur, &net->nfct_timeout_list, head)
+                list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list,
+                                         head)
                         ctnl_timeout_try_del(net, cur);
 
                 return 0;
@@ -543,7 +550,9 @@ err:
 
 static void ctnl_timeout_put(struct ctnl_timeout *timeout)
 {
-        atomic_dec(&timeout->refcnt);
+        if (atomic_dec_and_test(&timeout->refcnt))
+                kfree_rcu(timeout, rcu_head);
+
         module_put(THIS_MODULE);
 }
 #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
@@ -591,7 +600,9 @@ static void __net_exit cttimeout_net_exit(struct net *net)
         list_for_each_entry_safe(cur, tmp, &net->nfct_timeout_list, head) {
                 list_del_rcu(&cur->head);
                 nf_ct_l4proto_put(cur->l4proto);
-                kfree_rcu(cur, rcu_head);
+
+                if (atomic_dec_and_test(&cur->refcnt))
+                        kfree_rcu(cur, rcu_head);
         }
 }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index cbcfdfb586a6..6577db524ef6 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -1147,6 +1147,7 @@ MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_ULOG);
 MODULE_ALIAS_NF_LOGGER(AF_INET, 1);
 MODULE_ALIAS_NF_LOGGER(AF_INET6, 1);
 MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 1);
+MODULE_ALIAS_NF_LOGGER(3, 1); /* NFPROTO_ARP */
 
 module_init(nfnetlink_log_init);
 module_exit(nfnetlink_log_fini);
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 5d36a0926b4a..f49f45081acb 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1145,10 +1145,8 @@ static int nfqnl_recv_verdict(struct net *net, struct sock *ctnl,
         struct nfnl_queue_net *q = nfnl_queue_pernet(net);
         int err;
 
-        queue = instance_lookup(q, queue_num);
-        if (!queue)
-                queue = verdict_instance_lookup(q, queue_num,
-                                                NETLINK_CB(skb).portid);
+        queue = verdict_instance_lookup(q, queue_num,
+                                        NETLINK_CB(skb).portid);
         if (IS_ERR(queue))
                 return PTR_ERR(queue);
 
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index ba7aed13e174..82c264e40278 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -59,6 +59,7 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
                            const struct nlattr * const tb[])
 {
         struct nft_exthdr *priv = nft_expr_priv(expr);
+        u32 offset, len;
 
         if (tb[NFTA_EXTHDR_DREG] == NULL ||
             tb[NFTA_EXTHDR_TYPE] == NULL ||
@@ -66,9 +67,15 @@ static int nft_exthdr_init(const struct nft_ctx *ctx,
             tb[NFTA_EXTHDR_LEN] == NULL)
                 return -EINVAL;
 
+        offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
+        len = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+
+        if (offset > U8_MAX || len > U8_MAX)
+                return -ERANGE;
+
         priv->type   = nla_get_u8(tb[NFTA_EXTHDR_TYPE]);
-        priv->offset = ntohl(nla_get_be32(tb[NFTA_EXTHDR_OFFSET]));
-        priv->len    = ntohl(nla_get_be32(tb[NFTA_EXTHDR_LEN]));
+        priv->offset = offset;
+        priv->len    = len;
         priv->dreg   = nft_parse_register(tb[NFTA_EXTHDR_DREG]);
 
         return nft_validate_register_store(ctx, priv->dreg, NULL,
diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 2863f3493038..8a6bc7630912 100644
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -291,10 +291,16 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
 }
 EXPORT_SYMBOL_GPL(nft_meta_get_init);
 
-static int nft_meta_set_init_pkttype(const struct nft_ctx *ctx)
+int nft_meta_set_validate(const struct nft_ctx *ctx,
+                          const struct nft_expr *expr,
+                          const struct nft_data **data)
 {
+        struct nft_meta *priv = nft_expr_priv(expr);
         unsigned int hooks;
 
+        if (priv->key != NFT_META_PKTTYPE)
+                return 0;
+
         switch (ctx->afi->family) {
         case NFPROTO_BRIDGE:
                 hooks = 1 << NF_BR_PRE_ROUTING;
@@ -308,6 +314,7 @@ static int nft_meta_set_init_pkttype(const struct nft_ctx *ctx)
 
         return nft_chain_validate_hooks(ctx->chain, hooks);
 }
+EXPORT_SYMBOL_GPL(nft_meta_set_validate);
 
 int nft_meta_set_init(const struct nft_ctx *ctx,
                       const struct nft_expr *expr,
@@ -327,15 +334,16 @@ int nft_meta_set_init(const struct nft_ctx *ctx,
                 len = sizeof(u8);
                 break;
         case NFT_META_PKTTYPE:
-                err = nft_meta_set_init_pkttype(ctx);
-                if (err)
-                        return err;
                 len = sizeof(u8);
                 break;
         default:
                 return -EOPNOTSUPP;
         }
 
+        err = nft_meta_set_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
+
         priv->sreg = nft_parse_register(tb[NFTA_META_SREG]);
         err = nft_validate_register_load(priv->sreg, len);
         if (err < 0)
@@ -407,6 +415,7 @@ static const struct nft_expr_ops nft_meta_set_ops = {
         .init           = nft_meta_set_init,
         .destroy        = nft_meta_set_destroy,
         .dump           = nft_meta_set_dump,
+        .validate       = nft_meta_set_validate,
 };
 
 static const struct nft_expr_ops *
diff --git a/net/netfilter/nft_rbtree.c b/net/netfilter/nft_rbtree.c
index 6473936d05c6..ffe9ae062d23 100644
--- a/net/netfilter/nft_rbtree.c
+++ b/net/netfilter/nft_rbtree.c
@@ -70,7 +70,6 @@ static bool nft_rbtree_lookup(const struct net *net, const struct nft_set *set,
                 } else if (d > 0)
                         parent = parent->rb_right;
                 else {
-found:
                         if (!nft_set_elem_active(&rbe->ext, genmask)) {
                                 parent = parent->rb_left;
                                 continue;
@@ -84,9 +83,12 @@ found:
                 }
         }
 
-        if (set->flags & NFT_SET_INTERVAL && interval != NULL) {
-                rbe = interval;
-                goto found;
+        if (set->flags & NFT_SET_INTERVAL && interval != NULL &&
+            nft_set_elem_active(&interval->ext, genmask) &&
+            !nft_rbtree_interval_end(interval)) {
+                spin_unlock_bh(&nft_rbtree_lock);
+                *ext = &interval->ext;
+                return true;
         }
 out:
         spin_unlock_bh(&nft_rbtree_lock);
diff --git a/net/netfilter/nft_reject.c b/net/netfilter/nft_reject.c
index 0522fc9bfb0a..c64de3f7379d 100644
--- a/net/netfilter/nft_reject.c
+++ b/net/netfilter/nft_reject.c
@@ -26,11 +26,27 @@ const struct nla_policy nft_reject_policy[NFTA_REJECT_MAX + 1] = {
 };
 EXPORT_SYMBOL_GPL(nft_reject_policy);
 
+int nft_reject_validate(const struct nft_ctx *ctx,
+                        const struct nft_expr *expr,
+                        const struct nft_data **data)
+{
+        return nft_chain_validate_hooks(ctx->chain,
+                                        (1 << NF_INET_LOCAL_IN) |
+                                        (1 << NF_INET_FORWARD) |
+                                        (1 << NF_INET_LOCAL_OUT));
+}
+EXPORT_SYMBOL_GPL(nft_reject_validate);
+
 int nft_reject_init(const struct nft_ctx *ctx,
                     const struct nft_expr *expr,
                     const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
+        int err;
+
+        err = nft_reject_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
diff --git a/net/netfilter/nft_reject_inet.c b/net/netfilter/nft_reject_inet.c
index 759ca5248a3d..e79d9ca2ffee 100644
--- a/net/netfilter/nft_reject_inet.c
+++ b/net/netfilter/nft_reject_inet.c
@@ -66,7 +66,11 @@ static int nft_reject_inet_init(const struct nft_ctx *ctx,
                                 const struct nlattr * const tb[])
 {
         struct nft_reject *priv = nft_expr_priv(expr);
-        int icmp_code;
+        int icmp_code, err;
+
+        err = nft_reject_validate(ctx, expr, NULL);
+        if (err < 0)
+                return err;
 
         if (tb[NFTA_REJECT_TYPE] == NULL)
                 return -EINVAL;
@@ -124,6 +128,7 @@ static const struct nft_expr_ops nft_reject_inet_ops = {
         .eval           = nft_reject_inet_eval,
         .init           = nft_reject_inet_init,
         .dump           = nft_reject_inet_dump,
+        .validate       = nft_reject_validate,
 };
 
 static struct nft_expr_type nft_reject_inet_type __read_mostly = {
diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c
index 7f4414d26a66..663c4c3c9072 100644
--- a/net/netfilter/xt_TPROXY.c
+++ b/net/netfilter/xt_TPROXY.c
@@ -127,6 +127,8 @@ nf_tproxy_get_sock_v4(struct net *net, struct sk_buff *skb, void *hp,
                                                     daddr, dport,
                                                     in->ifindex);
 
+                        if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+                                sk = NULL;
                         /* NOTE: we return listeners even if bound to
                          * 0.0.0.0, those are filtered out in
                          * xt_socket, since xt_TPROXY needs 0 bound
@@ -195,6 +197,8 @@ nf_tproxy_get_sock_v6(struct net *net, struct sk_buff *skb, int thoff, void *hp,
                                                    daddr, ntohs(dport),
                                                    in->ifindex);
 
+                        if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
+                                sk = NULL;
                         /* NOTE: we return listeners even if bound to
                          * 0.0.0.0, those are filtered out in
                          * xt_socket, since xt_TPROXY needs 0 bound
diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
index 3048a7e3a90a..cf327593852a 100644
--- a/net/netfilter/xt_nfacct.c
+++ b/net/netfilter/xt_nfacct.c
@@ -26,7 +26,7 @@ static bool nfacct_mt(const struct sk_buff *skb, struct xt_action_param *par)
 
         nfnl_acct_update(skb, info->nfacct);
 
-        overquota = nfnl_acct_overquota(skb, info->nfacct);
+        overquota = nfnl_acct_overquota(par->net, skb, info->nfacct);
 
         return overquota == NFACCT_UNDERQUOTA ? false : true;
 }
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index c644c78ed485..e054a748ff25 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -433,7 +433,6 @@ ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
         struct nf_conntrack_l4proto *l4proto;
         struct nf_conntrack_tuple tuple;
         struct nf_conntrack_tuple_hash *h;
-        enum ip_conntrack_info ctinfo;
         struct nf_conn *ct;
         unsigned int dataoff;
         u8 protonum;
@@ -458,13 +457,8 @@ ovs_ct_find_existing(struct net *net, const struct nf_conntrack_zone *zone,
 
         ct = nf_ct_tuplehash_to_ctrack(h);
 
-        ctinfo = ovs_ct_get_info(h);
-        if (ctinfo == IP_CT_NEW) {
-                /* This should not happen. */
-                WARN_ONCE(1, "ovs_ct_find_existing: new packet for %p\n", ct);
-        }
         skb->nfct = &ct->ct_general;
-        skb->nfctinfo = ctinfo;
+        skb->nfctinfo = ovs_ct_get_info(h);
         return ct;
 }
 
diff --git a/net/openvswitch/vport-geneve.c b/net/openvswitch/vport-geneve.c
index 1a1fcec88695..5aaf3babfc3f 100644
--- a/net/openvswitch/vport-geneve.c
+++ b/net/openvswitch/vport-geneve.c
@@ -93,7 +93,14 @@ static struct vport *geneve_tnl_create(const struct vport_parms *parms)
                 return ERR_CAST(dev);
         }
 
-        dev_change_flags(dev, dev->flags | IFF_UP);
+        err = dev_change_flags(dev, dev->flags | IFF_UP);
+        if (err < 0) {
+                rtnl_delete_link(dev);
+                rtnl_unlock();
+                ovs_vport_free(vport);
+                goto error;
+        }
+
         rtnl_unlock();
         return vport;
 error:
diff --git a/net/openvswitch/vport-gre.c b/net/openvswitch/vport-gre.c
index 7f8897f33a67..0e72d95b0e8f 100644
--- a/net/openvswitch/vport-gre.c
+++ b/net/openvswitch/vport-gre.c
@@ -54,6 +54,7 @@ static struct vport *gre_tnl_create(const struct vport_parms *parms)
         struct net *net = ovs_dp_get_net(parms->dp);
         struct net_device *dev;
         struct vport *vport;
+        int err;
 
         vport = ovs_vport_alloc(0, &ovs_gre_vport_ops, parms);
         if (IS_ERR(vport))
@@ -67,9 +68,15 @@ static struct vport *gre_tnl_create(const struct vport_parms *parms)
                 return ERR_CAST(dev);
         }
 
-        dev_change_flags(dev, dev->flags | IFF_UP);
-        rtnl_unlock();
+        err = dev_change_flags(dev, dev->flags | IFF_UP);
+        if (err < 0) {
+                rtnl_delete_link(dev);
+                rtnl_unlock();
+                ovs_vport_free(vport);
+                return ERR_PTR(err);
+        }
 
+        rtnl_unlock();
         return vport;
 }
 
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 434e04c3a189..95c36147a6e1 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -140,7 +140,7 @@ internal_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats)
 
 static void internal_set_rx_headroom(struct net_device *dev, int new_hr)
 {
-        dev->needed_headroom = new_hr;
+        dev->needed_headroom = new_hr < 0 ? 0 : new_hr;
 }
 
 static const struct net_device_ops internal_dev_netdev_ops = {
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index 5eb7694348b5..7eb955e453e6 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -130,7 +130,14 @@ static struct vport *vxlan_tnl_create(const struct vport_parms *parms)
                 return ERR_CAST(dev);
         }
 
-        dev_change_flags(dev, dev->flags | IFF_UP);
+        err = dev_change_flags(dev, dev->flags | IFF_UP);
+        if (err < 0) {
+                rtnl_delete_link(dev);
+                rtnl_unlock();
+                ovs_vport_free(vport);
+                goto error;
+        }
+
         rtnl_unlock();
         return vport;
 error:
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 1bb9e7ac9e14..ff83fb1ddd47 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -425,6 +425,7 @@ struct rxrpc_call {
         spinlock_t              lock;
         rwlock_t                state_lock;     /* lock for state transition */
         atomic_t                usage;
+        atomic_t                skb_count;      /* Outstanding packets on this call */
         atomic_t                sequence;       /* Tx data packet sequence counter */
         u32                     local_abort;    /* local abort code */
         u32                     remote_abort;   /* remote abort code */
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index 0b2832141bd0..9bae21e66d65 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -130,6 +130,7 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
                         call->state = RXRPC_CALL_SERVER_ACCEPTING;
                         list_add_tail(&call->accept_link, &rx->acceptq);
                         rxrpc_get_call(call);
+                        atomic_inc(&call->skb_count);
                         nsp = rxrpc_skb(notification);
                         nsp->call = call;
 
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index fc32aa5764a2..e60cf65c2232 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -460,6 +460,7 @@ static void rxrpc_insert_oos_packet(struct rxrpc_call *call,
         ASSERTCMP(sp->call, ==, NULL);
         sp->call = call;
         rxrpc_get_call(call);
+        atomic_inc(&call->skb_count);
 
         /* insert into the buffer in sequence order */
         spin_lock_bh(&call->lock);
@@ -734,6 +735,7 @@ all_acked:
                 skb->mark = RXRPC_SKB_MARK_FINAL_ACK;
                 sp->call = call;
                 rxrpc_get_call(call);
+                atomic_inc(&call->skb_count);
                 spin_lock_bh(&call->lock);
                 if (rxrpc_queue_rcv_skb(call, skb, true, true) < 0)
                         BUG();
@@ -793,6 +795,7 @@ static int rxrpc_post_message(struct rxrpc_call *call, u32 mark, u32 error,
                 sp->error = error;
                 sp->call = call;
                 rxrpc_get_call(call);
+                atomic_inc(&call->skb_count);
 
                 spin_lock_bh(&call->lock);
                 ret = rxrpc_queue_rcv_skb(call, skb, true, fatal);
@@ -834,6 +837,9 @@ void rxrpc_process_call(struct work_struct *work)
                 return;
         }
 
+        if (!call->conn)
+                goto skip_msg_init;
+
         /* there's a good chance we're going to have to send a message, so set
          * one up in advance */
         msg.msg_name    = &call->conn->params.peer->srx.transport;
@@ -856,6 +862,7 @@ void rxrpc_process_call(struct work_struct *work)
         memset(iov, 0, sizeof(iov));
         iov[0].iov_base = &whdr;
         iov[0].iov_len  = sizeof(whdr);
+skip_msg_init:
 
         /* deal with events of a final nature */
         if (test_bit(RXRPC_CALL_EV_RCVD_ERROR, &call->events)) {
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 91287c9d01bb..ae057e0740f3 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -275,6 +275,7 @@ error:
         list_del_init(&call->link);
         write_unlock_bh(&rxrpc_call_lock);
 
+        set_bit(RXRPC_CALL_RELEASED, &call->flags);
         call->state = RXRPC_CALL_DEAD;
         rxrpc_put_call(call);
         _leave(" = %d", ret);
@@ -287,6 +288,7 @@ error:
          */
 found_user_ID_now_present:
         write_unlock(&rx->call_lock);
+        set_bit(RXRPC_CALL_RELEASED, &call->flags);
         call->state = RXRPC_CALL_DEAD;
         rxrpc_put_call(call);
         _leave(" = -EEXIST [%p]", call);
@@ -491,15 +493,9 @@ void rxrpc_release_call(struct rxrpc_call *call)
                 spin_lock_bh(&call->lock);
                 while ((skb = skb_dequeue(&call->rx_queue)) ||
                        (skb = skb_dequeue(&call->rx_oos_queue))) {
-                        sp = rxrpc_skb(skb);
-                        if (sp->call) {
-                                ASSERTCMP(sp->call, ==, call);
-                                rxrpc_put_call(call);
-                                sp->call = NULL;
-                        }
-                        skb->destructor = NULL;
                         spin_unlock_bh(&call->lock);
 
+                        sp = rxrpc_skb(skb);
                         _debug("- zap %s %%%u #%u",
                                rxrpc_pkts[sp->hdr.type],
                                sp->hdr.serial, sp->hdr.seq);
@@ -605,6 +601,7 @@ void __rxrpc_put_call(struct rxrpc_call *call)
 
         if (atomic_dec_and_test(&call->usage)) {
                 _debug("call %d dead", call->debug_id);
+                WARN_ON(atomic_read(&call->skb_count) != 0);
                 ASSERTCMP(call->state, ==, RXRPC_CALL_DEAD);
                 rxrpc_queue_work(&call->destroyer);
         }
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 991a20d25093..70bb77818dea 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -55,9 +55,6 @@ int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
         if (test_bit(RXRPC_CALL_TERMINAL_MSG, &call->flags)) {
                 _debug("already terminated");
                 ASSERTCMP(call->state, >=, RXRPC_CALL_COMPLETE);
-                skb->destructor = NULL;
-                sp->call = NULL;
-                rxrpc_put_call(call);
                 rxrpc_free_skb(skb);
                 return 0;
         }
@@ -111,13 +108,7 @@ int rxrpc_queue_rcv_skb(struct rxrpc_call *call, struct sk_buff *skb,
         ret = 0;
 
 out:
-        /* release the socket buffer */
-        if (skb) {
-                skb->destructor = NULL;
-                sp->call = NULL;
-                rxrpc_put_call(call);
-                rxrpc_free_skb(skb);
-        }
+        rxrpc_free_skb(skb);
 
         _leave(" = %d", ret);
         return ret;
@@ -133,11 +124,15 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
         struct rxrpc_skb_priv *sp;
         bool terminal;
         int ret, ackbit, ack;
+        u32 serial;
+        u8 flags;
 
         _enter("{%u,%u},,{%u}", call->rx_data_post, call->rx_first_oos, seq);
 
         sp = rxrpc_skb(skb);
         ASSERTCMP(sp->call, ==, NULL);
+        flags = sp->hdr.flags;
+        serial = sp->hdr.serial;
 
         spin_lock(&call->lock);
 
@@ -200,8 +195,9 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
 
         sp->call = call;
         rxrpc_get_call(call);
-        terminal = ((sp->hdr.flags & RXRPC_LAST_PACKET) &&
-                    !(sp->hdr.flags & RXRPC_CLIENT_INITIATED));
+        atomic_inc(&call->skb_count);
+        terminal = ((flags & RXRPC_LAST_PACKET) &&
+                    !(flags & RXRPC_CLIENT_INITIATED));
         ret = rxrpc_queue_rcv_skb(call, skb, false, terminal);
         if (ret < 0) {
                 if (ret == -ENOMEM || ret == -ENOBUFS) {
@@ -213,12 +209,13 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
         }
 
         skb = NULL;
+        sp = NULL;
 
         _debug("post #%u", seq);
         ASSERTCMP(call->rx_data_post, ==, seq);
         call->rx_data_post++;
 
-        if (sp->hdr.flags & RXRPC_LAST_PACKET)
+        if (flags & RXRPC_LAST_PACKET)
                 set_bit(RXRPC_CALL_RCVD_LAST, &call->flags);
 
         /* if we've reached an out of sequence packet then we need to drain
@@ -234,7 +231,7 @@ static int rxrpc_fast_process_data(struct rxrpc_call *call,
 
         spin_unlock(&call->lock);
         atomic_inc(&call->ackr_not_idle);
-        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, sp->hdr.serial, false);
+        rxrpc_propose_ACK(call, RXRPC_ACK_DELAY, serial, false);
         _leave(" = 0 [posted]");
         return 0;
 
@@ -247,7 +244,7 @@ out:
 
 discard_and_ack:
         _debug("discard and ACK packet %p", skb);
-        __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
+        __rxrpc_propose_ACK(call, ack, serial, true);
 discard:
         spin_unlock(&call->lock);
         rxrpc_free_skb(skb);
@@ -255,7 +252,7 @@ discard:
         return 0;
 
 enqueue_and_ack:
-        __rxrpc_propose_ACK(call, ack, sp->hdr.serial, true);
+        __rxrpc_propose_ACK(call, ack, serial, true);
 enqueue_packet:
         _net("defer skb %p", skb);
         spin_unlock(&call->lock);
@@ -575,13 +572,13 @@ done:
  * post connection-level events to the connection
  * - this includes challenges, responses and some aborts
  */
-static bool rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
+static void rxrpc_post_packet_to_conn(struct rxrpc_connection *conn,
                                       struct sk_buff *skb)
 {
         _enter("%p,%p", conn, skb);
 
         skb_queue_tail(&conn->rx_queue, skb);
-        return rxrpc_queue_conn(conn);
+        rxrpc_queue_conn(conn);
 }
 
 /*
@@ -702,7 +699,6 @@ void rxrpc_data_ready(struct sock *sk)
 
         rcu_read_lock();
 
-retry_find_conn:
         conn = rxrpc_find_connection_rcu(local, skb);
         if (!conn)
                 goto cant_route_call;
@@ -710,8 +706,7 @@ retry_find_conn:
         if (sp->hdr.callNumber == 0) {
                 /* Connection-level packet */
                 _debug("CONN %p {%d}", conn, conn->debug_id);
-                if (!rxrpc_post_packet_to_conn(conn, skb))
-                        goto retry_find_conn;
+                rxrpc_post_packet_to_conn(conn, skb);
         } else {
                 /* Call-bound packets are routed by connection channel. */
                 unsigned int channel = sp->hdr.cid & RXRPC_CHANNELMASK;
@@ -749,6 +744,8 @@ cant_route_call:
         if (sp->hdr.type != RXRPC_PACKET_TYPE_ABORT) {
                 _debug("reject type %d",sp->hdr.type);
                 rxrpc_reject_packet(local, skb);
+        } else {
+                rxrpc_free_skb(skb);
         }
         _leave(" [no call]");
         return;
diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
index a3fa2ed85d63..9ed66d533002 100644
--- a/net/rxrpc/recvmsg.c
+++ b/net/rxrpc/recvmsg.c
@@ -203,6 +203,9 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
                 }
 
                 /* we transferred the whole data packet */
+                if (!(flags & MSG_PEEK))
+                        rxrpc_kernel_data_consumed(call, skb);
+
                 if (sp->hdr.flags & RXRPC_LAST_PACKET) {
                         _debug("last");
                         if (rxrpc_conn_is_client(call->conn)) {
@@ -360,28 +363,6 @@ wait_error:
 }
 
 /**
- * rxrpc_kernel_data_delivered - Record delivery of data message
- * @skb: Message holding data
- *
- * Record the delivery of a data message.  This permits RxRPC to keep its
- * tracking correct.  The socket buffer will be deleted.
- */
-void rxrpc_kernel_data_delivered(struct sk_buff *skb)
-{
-        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
-        struct rxrpc_call *call = sp->call;
-
-        ASSERTCMP(sp->hdr.seq, >=, call->rx_data_recv);
-        ASSERTCMP(sp->hdr.seq, <=, call->rx_data_recv + 1);
-        call->rx_data_recv = sp->hdr.seq;
-
-        ASSERTCMP(sp->hdr.seq, >, call->rx_data_eaten);
-        rxrpc_free_skb(skb);
-}
-
-EXPORT_SYMBOL(rxrpc_kernel_data_delivered);
-
-/**
  * rxrpc_kernel_is_data_last - Determine if data message is last one
  * @skb: Message holding data
  *
diff --git a/net/rxrpc/skbuff.c b/net/rxrpc/skbuff.c
index eee0cfd9ac8c..06c51d4b622d 100644
--- a/net/rxrpc/skbuff.c
+++ b/net/rxrpc/skbuff.c
@@ -98,11 +98,39 @@ static void rxrpc_hard_ACK_data(struct rxrpc_call *call,
         spin_unlock_bh(&call->lock);
 }
 
+/**
+ * rxrpc_kernel_data_consumed - Record consumption of data message
+ * @call: The call to which the message pertains.
+ * @skb: Message holding data
+ *
+ * Record the consumption of a data message and generate an ACK if appropriate.
+ * The call state is shifted if this was the final packet.  The caller must be
+ * in process context with no spinlocks held.
+ *
+ * TODO: Actually generate the ACK here rather than punting this to the
+ * workqueue.
+ */
+void rxrpc_kernel_data_consumed(struct rxrpc_call *call, struct sk_buff *skb)
+{
+        struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+
+        _enter("%d,%p{%u}", call->debug_id, skb, sp->hdr.seq);
+
+        ASSERTCMP(sp->call, ==, call);
+        ASSERTCMP(sp->hdr.type, ==, RXRPC_PACKET_TYPE_DATA);
+
+        /* TODO: Fix the sequence number tracking */
+        ASSERTCMP(sp->hdr.seq, >=, call->rx_data_recv);
+        ASSERTCMP(sp->hdr.seq, <=, call->rx_data_recv + 1);
+        ASSERTCMP(sp->hdr.seq, >, call->rx_data_eaten);
+
+        call->rx_data_recv = sp->hdr.seq;
+        rxrpc_hard_ACK_data(call, sp);
+}
+EXPORT_SYMBOL(rxrpc_kernel_data_consumed);
+
 /*
- * destroy a packet that has an RxRPC control buffer
- * - advance the hard-ACK state of the parent call (done here in case something
- *   in the kernel bypasses recvmsg() and steals the packet directly off of the
- *   socket receive queue)
+ * Destroy a packet that has an RxRPC control buffer
  */
 void rxrpc_packet_destructor(struct sk_buff *skb)
 {
@@ -112,9 +140,8 @@ void rxrpc_packet_destructor(struct sk_buff *skb)
         _enter("%p{%p}", skb, call);
 
         if (call) {
-                /* send the final ACK on a client call */
-                if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA)
-                        rxrpc_hard_ACK_data(call, sp);
+                if (atomic_dec_return(&call->skb_count) < 0)
+                        BUG();
                 rxrpc_put_call(call);
                 sp->call = NULL;
         }
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index e4a5f2607ffa..d09d0687594b 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -64,7 +64,6 @@ int __tcf_hash_release(struct tc_action *p, bool bind, bool strict)
                 if (p->tcfa_bindcnt <= 0 && p->tcfa_refcnt <= 0) {
                         if (p->ops->cleanup)
                                 p->ops->cleanup(p, bind);
-                        list_del(&p->list);
                         tcf_hash_destroy(p->hinfo, p);
                         ret = ACT_P_DELETED;
                 }
@@ -421,18 +420,19 @@ static struct tc_action_ops *tc_lookup_action(struct nlattr *kind)
         return res;
 }
 
-int tcf_action_exec(struct sk_buff *skb, const struct list_head *actions,
-                    struct tcf_result *res)
+int tcf_action_exec(struct sk_buff *skb, struct tc_action **actions,
+                    int nr_actions, struct tcf_result *res)
 {
-        const struct tc_action *a;
-        int ret = -1;
+        int ret = -1, i;
 
         if (skb->tc_verd & TC_NCLS) {
                 skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
                 ret = TC_ACT_OK;
                 goto exec_done;
         }
-        list_for_each_entry(a, actions, list) {
+        for (i = 0; i < nr_actions; i++) {
+                const struct tc_action *a = actions[i];
+
 repeat:
                 ret = a->ops->act(skb, a, res);
                 if (ret == TC_ACT_REPEAT)
@@ -754,16 +754,6 @@ err_out:
         return ERR_PTR(err);
 }
 
-static void cleanup_a(struct list_head *actions)
-{
-        struct tc_action *a, *tmp;
-
-        list_for_each_entry_safe(a, tmp, actions, list) {
-                list_del(&a->list);
-                kfree(a);
-        }
-}
-
 static int tca_action_flush(struct net *net, struct nlattr *nla,
                             struct nlmsghdr *n, u32 portid)
 {
@@ -905,7 +895,7 @@ tca_action_gd(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
                 return ret;
         }
 err:
-        cleanup_a(&actions);
+        tcf_action_destroy(&actions, 0);
         return ret;
 }
 
@@ -942,15 +932,9 @@ tcf_action_add(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
 
         ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
         if (ret)
-                goto done;
+                return ret;
 
-        /* dump then free all the actions after update; inserted policy
-         * stays intact
-         */
-        ret = tcf_add_notify(net, n, &actions, portid);
-        cleanup_a(&actions);
-done:
-        return ret;
+        return tcf_add_notify(net, n, &actions, portid);
 }
 
 static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 141a06eeb1e5..e87cd81315e1 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -53,7 +53,7 @@ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, const void *dval)
         u32 *tlv = (u32 *)(skbdata);
         u16 totlen = nla_total_size(dlen);      /*alignment + hdr */
         char *dptr = (char *)tlv + NLA_HDRLEN;
-        u32 htlv = attrtype << 16 | totlen;
+        u32 htlv = attrtype << 16 | dlen;
 
         *tlv = htonl(htlv);
         memset(dptr, 0, totlen - NLA_HDRLEN);
@@ -135,7 +135,7 @@ EXPORT_SYMBOL_GPL(ife_release_meta_gen);
 
 int ife_validate_meta_u32(void *val, int len)
 {
-        if (len == 4)
+        if (len == sizeof(u32))
                 return 0;
 
         return -EINVAL;
@@ -144,8 +144,8 @@ EXPORT_SYMBOL_GPL(ife_validate_meta_u32);
 
 int ife_validate_meta_u16(void *val, int len)
 {
-        /* length will include padding */
-        if (len == NLA_ALIGN(2))
+        /* length will not include padding */
+        if (len == sizeof(u16))
                 return 0;
 
         return -EINVAL;
@@ -652,12 +652,14 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                 u8 *tlvdata = (u8 *)tlv;
                 u16 mtype = tlv->type;
                 u16 mlen = tlv->len;
+                u16 alen;
 
                 mtype = ntohs(mtype);
                 mlen = ntohs(mlen);
+                alen = NLA_ALIGN(mlen);
 
-                if (find_decode_metaid(skb, ife, mtype, (mlen - 4),
-                                       (void *)(tlvdata + 4))) {
+                if (find_decode_metaid(skb, ife, mtype, (mlen - NLA_HDRLEN),
+                                       (void *)(tlvdata + NLA_HDRLEN))) {
                         /* abuse overlimits to count when we receive metadata
                          * but dont have an ops for it
                          */
@@ -666,8 +668,8 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
                         ife->tcf_qstats.overlimits++;
                 }
 
-                tlvdata += mlen;
-                ifehdrln -= mlen;
+                tlvdata += alen;
+                ifehdrln -= alen;
                 tlv = (struct meta_tlvhdr *)tlvdata;
         }
 
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index b3c7e975fc9e..8a3be1d99775 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -63,49 +63,8 @@ static int tcf_act_police_walker(struct net *net, struct sk_buff *skb,
                                  const struct tc_action_ops *ops)
 {
         struct tc_action_net *tn = net_generic(net, police_net_id);
-        struct tcf_hashinfo *hinfo = tn->hinfo;
-        int err = 0, index = -1, i = 0, s_i = 0, n_i = 0;
-        struct nlattr *nest;
-
-        spin_lock_bh(&hinfo->lock);
-
-        s_i = cb->args[0];
-
-        for (i = 0; i < (POL_TAB_MASK + 1); i++) {
-                struct hlist_head *head;
-                struct tc_action *p;
-
-                head = &hinfo->htab[tcf_hash(i, POL_TAB_MASK)];
-
-                hlist_for_each_entry_rcu(p, head, tcfa_head) {
-                        index++;
-                        if (index < s_i)
-                                continue;
-                        nest = nla_nest_start(skb, index);
-                        if (nest == NULL)
-                                goto nla_put_failure;
-                        if (type == RTM_DELACTION)
-                                err = tcf_action_dump_1(skb, p, 0, 1);
-                        else
-                                err = tcf_action_dump_1(skb, p, 0, 0);
-                        if (err < 0) {
-                                index--;
-                                nla_nest_cancel(skb, nest);
-                                goto done;
-                        }
-                        nla_nest_end(skb, nest);
-                        n_i++;
-                }
-        }
-done:
-        spin_unlock_bh(&hinfo->lock);
-        if (n_i)
-                cb->args[0] += n_i;
-        return n_i;
 
-nla_put_failure:
-        nla_nest_cancel(skb, nest);
-        goto done;
+        return tcf_generic_walker(tn, skb, cb, type, ops);
 }
 
 static const struct nla_policy police_policy[TCA_POLICE_MAX + 1] = {
@@ -125,6 +84,7 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
         struct tcf_police *police;
         struct qdisc_rate_table *R_tab = NULL, *P_tab = NULL;
         struct tc_action_net *tn = net_generic(net, police_net_id);
+        bool exists = false;
         int size;
 
         if (nla == NULL)
@@ -139,24 +99,24 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla,
         size = nla_len(tb[TCA_POLICE_TBF]);
         if (size != sizeof(*parm) && size != sizeof(struct tc_police_compat))
                 return -EINVAL;
+
         parm = nla_data(tb[TCA_POLICE_TBF]);
+        exists = tcf_hash_check(tn, parm->index, a, bind);
+        if (exists && bind)
+                return 0;
 
-        if (parm->index) {
-                if (tcf_hash_check(tn, parm->index, a, bind)) {
-                        if (ovr)
-                                goto override;
-                        /* not replacing */
-                        return -EEXIST;
-                }
-        } else {
+        if (!exists) {
                 ret = tcf_hash_create(tn, parm->index, NULL, a,
                                       &act_police_ops, bind, false);
                 if (ret)
                         return ret;
                 ret = ACT_P_CREATED;
+        } else {
+                tcf_hash_release(*a, bind);
+                if (!ovr)
+                        return -EEXIST;
         }
 
-override:
         police = to_police(*a);
         if (parm->rate.rate) {
                 err = -ENOMEM;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 843a716a4303..a7c5645373af 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -541,8 +541,12 @@ out:
 void tcf_exts_destroy(struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        tcf_action_destroy(&exts->actions, TCA_ACT_UNBIND);
-        INIT_LIST_HEAD(&exts->actions);
+        LIST_HEAD(actions);
+
+        tcf_exts_to_list(exts, &actions);
+        tcf_action_destroy(&actions, TCA_ACT_UNBIND);
+        kfree(exts->actions);
+        exts->nr_actions = 0;
 #endif
 }
 EXPORT_SYMBOL(tcf_exts_destroy);
@@ -554,7 +558,6 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
         {
                 struct tc_action *act;
 
-                INIT_LIST_HEAD(&exts->actions);
                 if (exts->police && tb[exts->police]) {
                         act = tcf_action_init_1(net, tb[exts->police], rate_tlv,
                                                 "police", ovr,
@@ -563,14 +566,20 @@ int tcf_exts_validate(struct net *net, struct tcf_proto *tp, struct nlattr **tb,
                                 return PTR_ERR(act);
 
                         act->type = exts->type = TCA_OLD_COMPAT;
-                        list_add(&act->list, &exts->actions);
+                        exts->actions[0] = act;
+                        exts->nr_actions = 1;
                 } else if (exts->action && tb[exts->action]) {
-                        int err;
+                        LIST_HEAD(actions);
+                        int err, i = 0;
+
                         err = tcf_action_init(net, tb[exts->action], rate_tlv,
                                               NULL, ovr,
-                                              TCA_ACT_BIND, &exts->actions);
+                                              TCA_ACT_BIND, &actions);
                         if (err)
                                 return err;
+                        list_for_each_entry(act, &actions, list)
+                                exts->actions[i++] = act;
+                        exts->nr_actions = i;
                 }
         }
 #else
@@ -587,37 +596,49 @@ void tcf_exts_change(struct tcf_proto *tp, struct tcf_exts *dst,
                      struct tcf_exts *src)
 {
 #ifdef CONFIG_NET_CLS_ACT
-        LIST_HEAD(tmp);
+        struct tcf_exts old = *dst;
+
         tcf_tree_lock(tp);
-        list_splice_init(&dst->actions, &tmp);
-        list_splice(&src->actions, &dst->actions);
+        dst->nr_actions = src->nr_actions;
+        dst->actions = src->actions;
         dst->type = src->type;
         tcf_tree_unlock(tp);
-        tcf_action_destroy(&tmp, TCA_ACT_UNBIND);
+
+        tcf_exts_destroy(&old);
 #endif
 }
 EXPORT_SYMBOL(tcf_exts_change);
 
-#define tcf_exts_first_act(ext)                                 \
-        list_first_entry_or_null(&(exts)->actions,              \
-                                 struct tc_action, list)
+#ifdef CONFIG_NET_CLS_ACT
+static struct tc_action *tcf_exts_first_act(struct tcf_exts *exts)
+{
+        if (exts->nr_actions == 0)
+                return NULL;
+        else
+                return exts->actions[0];
+}
+#endif
 
 int tcf_exts_dump(struct sk_buff *skb, struct tcf_exts *exts)
 {
 #ifdef CONFIG_NET_CLS_ACT
         struct nlattr *nest;
 
-        if (exts->action && !list_empty(&exts->actions)) {
+        if (exts->action && exts->nr_actions) {
                 /*
                  * again for backward compatible mode - we want
                  * to work with both old and new modes of entering
                  * tc data even if iproute2  was newer - jhs
                  */
                 if (exts->type != TCA_OLD_COMPAT) {
+                        LIST_HEAD(actions);
+
                         nest = nla_nest_start(skb, exts->action);
                         if (nest == NULL)
                                 goto nla_put_failure;
-                        if (tcf_action_dump(skb, &exts->actions, 0, 0) < 0)
+
+                        tcf_exts_to_list(exts, &actions);
+                        if (tcf_action_dump(skb, &actions, 0, 0) < 0)
                                 goto nla_put_failure;
                         nla_nest_end(skb, nest);
                 } else if (exts->police) {
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index e95b67cd5718..657c13362b19 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -643,18 +643,19 @@ struct Qdisc *qdisc_create_dflt(struct netdev_queue *dev_queue,
         struct Qdisc *sch;
 
         if (!try_module_get(ops->owner))
-                goto errout;
+                return NULL;
 
         sch = qdisc_alloc(dev_queue, ops);
-        if (IS_ERR(sch))
-                goto errout;
+        if (IS_ERR(sch)) {
+                module_put(ops->owner);
+                return NULL;
+        }
         sch->parent = parentid;
 
         if (!ops->init || ops->init(sch, NULL) == 0)
                 return sch;
 
         qdisc_destroy(sch);
-errout:
         return NULL;
 }
 EXPORT_SYMBOL(qdisc_create_dflt);
diff --git a/net/sctp/input.c b/net/sctp/input.c
index c182db7d691f..1555fb8c68e0 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -119,7 +119,13 @@ int sctp_rcv(struct sk_buff *skb)
                        skb_transport_offset(skb))
                 goto discard_it;
 
-        if (!pskb_may_pull(skb, sizeof(struct sctphdr)))
+        /* If the packet is fragmented and we need to do crc checking,
+         * it's better to just linearize it otherwise crc computing
+         * takes longer.
+         */
+        if ((!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) &&
+             skb_linearize(skb)) ||
+            !pskb_may_pull(skb, sizeof(struct sctphdr)))
                 goto discard_it;
 
         /* Pull up the IP header. */
@@ -790,27 +796,34 @@ struct sctp_hash_cmp_arg {
 static inline int sctp_hash_cmp(struct rhashtable_compare_arg *arg,
                                 const void *ptr)
 {
+        struct sctp_transport *t = (struct sctp_transport *)ptr;
         const struct sctp_hash_cmp_arg *x = arg->key;
-        const struct sctp_transport *t = ptr;
-        struct sctp_association *asoc = t->asoc;
-        const struct net *net = x->net;
+        struct sctp_association *asoc;
+        int err = 1;
 
         if (!sctp_cmp_addr_exact(&t->ipaddr, x->paddr))
-                return 1;
-        if (!net_eq(sock_net(asoc->base.sk), net))
-                return 1;
+                return err;
+        if (!sctp_transport_hold(t))
+                return err;
+
+        asoc = t->asoc;
+        if (!net_eq(sock_net(asoc->base.sk), x->net))
+                goto out;
         if (x->ep) {
                 if (x->ep != asoc->ep)
-                        return 1;
+                        goto out;
         } else {
                 if (x->laddr->v4.sin_port != htons(asoc->base.bind_addr.port))
-                        return 1;
+                        goto out;
                 if (!sctp_bind_addr_match(&asoc->base.bind_addr,
                                           x->laddr, sctp_sk(asoc->base.sk)))
-                        return 1;
+                        goto out;
         }
 
-        return 0;
+        err = 0;
+out:
+        sctp_transport_put(t);
+        return err;
 }
 
 static inline u32 sctp_hash_obj(const void *data, u32 len, u32 seed)
@@ -1177,9 +1190,6 @@ static struct sctp_association *__sctp_rcv_lookup_harder(struct net *net,
         if ((skb_shinfo(skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP)
                 return NULL;
 
-        if (skb_linearize(skb))
-                return NULL;
-
         ch = (sctp_chunkhdr_t *) skb->data;
 
         /* The code below will attempt to walk the chunk and extract
diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
index c30ddb0f3190..6437aa97cfd7 100644
--- a/net/sctp/inqueue.c
+++ b/net/sctp/inqueue.c
@@ -170,19 +170,6 @@ next_chunk:
 
                 chunk = list_entry(entry, struct sctp_chunk, list);
 
-                /* Linearize if it's not GSO */
-                if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) != SKB_GSO_SCTP &&
-                    skb_is_nonlinear(chunk->skb)) {
-                        if (skb_linearize(chunk->skb)) {
-                                __SCTP_INC_STATS(dev_net(chunk->skb->dev), SCTP_MIB_IN_PKT_DISCARDS);
-                                sctp_chunk_free(chunk);
-                                goto next_chunk;
-                        }
-
-                        /* Update sctp_hdr as it probably changed */
-                        chunk->sctp_hdr = sctp_hdr(chunk->skb);
-                }
-
                 if ((skb_shinfo(chunk->skb)->gso_type & SKB_GSO_SCTP) == SKB_GSO_SCTP) {
                         /* GSO-marked skbs but without frags, handle
                          * them normally
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 1f1682b9a6a8..31b7bc35895d 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -878,7 +878,7 @@ static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
                                         struct sctp_chunk *chunk,
                                         u16 chunk_len)
 {
-        size_t psize, pmtu;
+        size_t psize, pmtu, maxsize;
         sctp_xmit_t retval = SCTP_XMIT_OK;
 
         psize = packet->size;
@@ -906,6 +906,17 @@ static sctp_xmit_t sctp_packet_will_fit(struct sctp_packet *packet,
                         goto out;
                 }
 
+                /* Similarly, if this chunk was built before a PMTU
+                 * reduction, we have to fragment it at IP level now. So
+                 * if the packet already contains something, we need to
+                 * flush.
+                 */
+                maxsize = pmtu - packet->overhead;
+                if (packet->auth)
+                        maxsize -= WORD_ROUND(packet->auth->skb->len);
+                if (chunk_len > maxsize)
+                        retval = SCTP_XMIT_PMTU_FULL;
+
                 /* It is also okay to fragment if the chunk we are
                  * adding is a control chunk, but only if current packet
                  * is not a GSO one otherwise it causes fragmentation of
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 4cb5aedfe3ee..ef8ba77a5bea 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -293,6 +293,7 @@ static void *sctp_transport_seq_start(struct seq_file *seq, loff_t *pos)
                 return ERR_PTR(err);
         }
 
+        iter->start_fail = 0;
         return sctp_transport_get_idx(seq_file_net(seq), &iter->hti, *pos);
 }
 
diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
index f69edcf219e5..f3508aa75815 100644
--- a/net/sctp/sctp_diag.c
+++ b/net/sctp/sctp_diag.c
@@ -13,6 +13,7 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r,
 {
         union sctp_addr laddr, paddr;
         struct dst_entry *dst;
+        struct timer_list *t3_rtx = &asoc->peer.primary_path->T3_rtx_timer;
 
         laddr = list_entry(asoc->base.bind_addr.address_list.next,
                            struct sctp_sockaddr_entry, list)->a;
@@ -40,10 +41,15 @@ static void inet_diag_msg_sctpasoc_fill(struct inet_diag_msg *r,
         }
 
         r->idiag_state = asoc->state;
-        r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX;
-        r->idiag_retrans = asoc->rtx_data_chunks;
-        r->idiag_expires = jiffies_to_msecs(
-                asoc->timeouts[SCTP_EVENT_TIMEOUT_T3_RTX] - jiffies);
+        if (timer_pending(t3_rtx)) {
+                r->idiag_timer = SCTP_EVENT_TIMEOUT_T3_RTX;
+                r->idiag_retrans = asoc->rtx_data_chunks;
+                r->idiag_expires = jiffies_to_msecs(t3_rtx->expires - jiffies);
+        } else {
+                r->idiag_timer = 0;
+                r->idiag_retrans = 0;
+                r->idiag_expires = 0;
+        }
 }
 
 static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
@@ -350,7 +356,7 @@ static int sctp_ep_dump(struct sctp_endpoint *ep, void *p)
         if (cb->args[4] < cb->args[1])
                 goto next;
 
-        if ((r->idiag_states & ~TCPF_LISTEN) && !list_empty(&ep->asocs))
+        if (!(r->idiag_states & TCPF_LISTEN) && !list_empty(&ep->asocs))
                 goto next;
 
         if (r->sdiag_family != AF_UNSPEC &&
@@ -418,11 +424,13 @@ static int sctp_diag_dump_one(struct sk_buff *in_skb,
                 paddr.v4.sin_family = AF_INET;
         } else {
                 laddr.v6.sin6_port = req->id.idiag_sport;
-                memcpy(&laddr.v6.sin6_addr, req->id.idiag_src, 64);
+                memcpy(&laddr.v6.sin6_addr, req->id.idiag_src,
+                       sizeof(laddr.v6.sin6_addr));
                 laddr.v6.sin6_family = AF_INET6;
 
                 paddr.v6.sin6_port = req->id.idiag_dport;
-                memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst, 64);
+                memcpy(&paddr.v6.sin6_addr, req->id.idiag_dst,
+                       sizeof(paddr.v6.sin6_addr));
                 paddr.v6.sin6_family = AF_INET6;
         }
 
@@ -465,7 +473,7 @@ skip:
          * 3 : to mark if we have dumped the ep info of the current asoc
          * 4 : to work as a temporary variable to traversal list
          */
-        if (!(idiag_states & ~TCPF_LISTEN))
+        if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
                 goto done;
         sctp_for_each_transport(sctp_tsp_dump, net, cb->args[2], &commp);
 done:
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index 1bc4f71aaba8..d85b803da11d 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -702,14 +702,14 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
          */
         sctp_ulpevent_init(event, 0, skb->len + sizeof(struct sk_buff));
 
-        sctp_ulpevent_receive_data(event, asoc);
-
         /* And hold the chunk as we need it for getting the IP headers
          * later in recvmsg
          */
         sctp_chunk_hold(chunk);
         event->chunk = chunk;
 
+        sctp_ulpevent_receive_data(event, asoc);
+
         event->stream = ntohs(chunk->subh.data_hdr->stream);
         event->ssn = ntohs(chunk->subh.data_hdr->ssn);
         event->ppid = chunk->subh.data_hdr->ppid;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 23c8e7c39656..976c7812bbd5 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -340,12 +340,14 @@ gss_release_msg(struct gss_upcall_msg *gss_msg)
 }
 
 static struct gss_upcall_msg *
-__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid)
+__gss_find_upcall(struct rpc_pipe *pipe, kuid_t uid, const struct gss_auth *auth)
 {
         struct gss_upcall_msg *pos;
         list_for_each_entry(pos, &pipe->in_downcall, list) {
                 if (!uid_eq(pos->uid, uid))
                         continue;
+                if (auth && pos->auth->service != auth->service)
+                        continue;
                 atomic_inc(&pos->count);
                 dprintk("RPC:       %s found msg %p\n", __func__, pos);
                 return pos;
@@ -365,7 +367,7 @@ gss_add_msg(struct gss_upcall_msg *gss_msg)
         struct gss_upcall_msg *old;
 
         spin_lock(&pipe->lock);
-        old = __gss_find_upcall(pipe, gss_msg->uid);
+        old = __gss_find_upcall(pipe, gss_msg->uid, gss_msg->auth);
         if (old == NULL) {
                 atomic_inc(&gss_msg->count);
                 list_add(&gss_msg->list, &pipe->in_downcall);
@@ -714,7 +716,7 @@ gss_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         err = -ENOENT;
         /* Find a matching upcall */
         spin_lock(&pipe->lock);
-        gss_msg = __gss_find_upcall(pipe, uid);
+        gss_msg = __gss_find_upcall(pipe, uid, NULL);
         if (gss_msg == NULL) {
                 spin_unlock(&pipe->lock);
                 goto err_put_ctx;
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 1d281816f2bf..d8582028b346 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -569,9 +569,10 @@ gss_svc_searchbyctx(struct cache_detail *cd, struct xdr_netobj *handle)
         struct rsc *found;
 
         memset(&rsci, 0, sizeof(rsci));
-        rsci.handle.data = handle->data;
-        rsci.handle.len = handle->len;
+        if (dup_to_netobj(&rsci.handle, handle->data, handle->len))
+                return NULL;
         found = rsc_lookup(cd, &rsci);
+        rsc_free(&rsci);
         if (!found)
                 return NULL;
         if (cache_check(cd, &found->h, NULL))
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index cb49898a5a58..66f23b376fa0 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -453,7 +453,7 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args,
         struct rpc_xprt_switch *xps;
 
         if (args->bc_xprt && args->bc_xprt->xpt_bc_xps) {
-                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
                 xps = args->bc_xprt->xpt_bc_xps;
                 xprt_switch_get(xps);
         } else {
@@ -520,7 +520,7 @@ struct rpc_clnt *rpc_create(struct rpc_create_args *args)
         char servername[48];
 
         if (args->bc_xprt) {
-                WARN_ON(args->protocol != XPRT_TRANSPORT_BC_TCP);
+                WARN_ON_ONCE(!(args->protocol & XPRT_TRANSPORT_BC));
                 xprt = args->bc_xprt->xpt_bc_xprt;
                 if (xprt) {
                         xprt_get(xprt);
@@ -2638,6 +2638,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *clnt,
 {
         struct rpc_xprt_switch *xps;
         struct rpc_xprt *xprt;
+        unsigned long reconnect_timeout;
         unsigned char resvport;
         int ret = 0;
 
@@ -2649,6 +2650,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *clnt,
                 return -EAGAIN;
         }
         resvport = xprt->resvport;
+        reconnect_timeout = xprt->max_reconnect_timeout;
         rcu_read_unlock();
 
         xprt = xprt_create_transport(xprtargs);
@@ -2657,6 +2659,7 @@ int rpc_clnt_add_xprt(struct rpc_clnt *clnt,
                 goto out_put_switch;
         }
         xprt->resvport = resvport;
+        xprt->max_reconnect_timeout = reconnect_timeout;
 
         rpc_xprt_switch_set_roundrobin(xps);
         if (setup) {
@@ -2673,6 +2676,27 @@ out_put_switch:
 }
 EXPORT_SYMBOL_GPL(rpc_clnt_add_xprt);
 
+static int
+rpc_xprt_cap_max_reconnect_timeout(struct rpc_clnt *clnt,
+                struct rpc_xprt *xprt,
+                void *data)
+{
+        unsigned long timeout = *((unsigned long *)data);
+
+        if (timeout < xprt->max_reconnect_timeout)
+                xprt->max_reconnect_timeout = timeout;
+        return 0;
+}
+
+void
+rpc_cap_max_reconnect_timeout(struct rpc_clnt *clnt, unsigned long timeo)
+{
+        rpc_clnt_iterate_for_each_xprt(clnt,
+                        rpc_xprt_cap_max_reconnect_timeout,
+                        &timeo);
+}
+EXPORT_SYMBOL_GPL(rpc_cap_max_reconnect_timeout);
+
 #if IS_ENABLED(CONFIG_SUNRPC_DEBUG)
 static void rpc_show_header(void)
 {
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 8313960cac52..ea244b29138b 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -680,6 +680,20 @@ out:
         spin_unlock_bh(&xprt->transport_lock);
 }
 
+static bool
+xprt_has_timer(const struct rpc_xprt *xprt)
+{
+        return xprt->idle_timeout != 0;
+}
+
+static void
+xprt_schedule_autodisconnect(struct rpc_xprt *xprt)
+        __must_hold(&xprt->transport_lock)
+{
+        if (list_empty(&xprt->recv) && xprt_has_timer(xprt))
+                mod_timer(&xprt->timer, xprt->last_used + xprt->idle_timeout);
+}
+
 static void
 xprt_init_autodisconnect(unsigned long data)
 {
@@ -688,6 +702,8 @@ xprt_init_autodisconnect(unsigned long data)
         spin_lock(&xprt->transport_lock);
         if (!list_empty(&xprt->recv))
                 goto out_abort;
+        /* Reset xprt->last_used to avoid connect/autodisconnect cycling */
+        xprt->last_used = jiffies;
         if (test_and_set_bit(XPRT_LOCKED, &xprt->state))
                 goto out_abort;
         spin_unlock(&xprt->transport_lock);
@@ -725,6 +741,7 @@ void xprt_unlock_connect(struct rpc_xprt *xprt, void *cookie)
                 goto out;
         xprt->snd_task =NULL;
         xprt->ops->release_xprt(xprt, NULL);
+        xprt_schedule_autodisconnect(xprt);
 out:
         spin_unlock_bh(&xprt->transport_lock);
         wake_up_bit(&xprt->state, XPRT_LOCKED);
@@ -888,11 +905,6 @@ static void xprt_timer(struct rpc_task *task)
         spin_unlock_bh(&xprt->transport_lock);
 }
 
-static inline int xprt_has_timer(struct rpc_xprt *xprt)
-{
-        return xprt->idle_timeout != 0;
-}
-
 /**
  * xprt_prepare_transmit - reserve the transport before sending a request
  * @task: RPC task about to send a request
@@ -1280,9 +1292,7 @@ void xprt_release(struct rpc_task *task)
         if (!list_empty(&req->rq_list))
                 list_del(&req->rq_list);
         xprt->last_used = jiffies;
-        if (list_empty(&xprt->recv) && xprt_has_timer(xprt))
-                mod_timer(&xprt->timer,
-                                xprt->last_used + xprt->idle_timeout);
+        xprt_schedule_autodisconnect(xprt);
         spin_unlock_bh(&xprt->transport_lock);
         if (req->rq_buffer)
                 xprt->ops->buf_free(req->rq_buffer);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 536d0be3f61b..799cce6cbe45 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -51,6 +51,7 @@
 #include <linux/slab.h>
 #include <linux/prefetch.h>
 #include <linux/sunrpc/addr.h>
+#include <linux/sunrpc/svc_rdma.h>
 #include <asm/bitops.h>
 #include <linux/module.h> /* try_module_get()/module_put() */
 
@@ -923,7 +924,7 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt)
         }
 
         INIT_LIST_HEAD(&buf->rb_recv_bufs);
-        for (i = 0; i < buf->rb_max_requests; i++) {
+        for (i = 0; i < buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS; i++) {
                 struct rpcrdma_rep *rep;
 
                 rep = rpcrdma_create_rep(r_xprt);
@@ -1018,6 +1019,7 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
                 rep = rpcrdma_buffer_get_rep_locked(buf);
                 rpcrdma_destroy_rep(ia, rep);
         }
+        buf->rb_send_count = 0;
 
         spin_lock(&buf->rb_reqslock);
         while (!list_empty(&buf->rb_allreqs)) {
@@ -1032,6 +1034,7 @@ rpcrdma_buffer_destroy(struct rpcrdma_buffer *buf)
                 spin_lock(&buf->rb_reqslock);
         }
         spin_unlock(&buf->rb_reqslock);
+        buf->rb_recv_count = 0;
 
         rpcrdma_destroy_mrs(buf);
 }
@@ -1074,8 +1077,27 @@ rpcrdma_put_mw(struct rpcrdma_xprt *r_xprt, struct rpcrdma_mw *mw)
         spin_unlock(&buf->rb_mwlock);
 }
 
+static struct rpcrdma_rep *
+rpcrdma_buffer_get_rep(struct rpcrdma_buffer *buffers)
+{
+        /* If an RPC previously completed without a reply (say, a
+         * credential problem or a soft timeout occurs) then hold off
+         * on supplying more Receive buffers until the number of new
+         * pending RPCs catches up to the number of posted Receives.
+         */
+        if (unlikely(buffers->rb_send_count < buffers->rb_recv_count))
+                return NULL;
+
+        if (unlikely(list_empty(&buffers->rb_recv_bufs)))
+                return NULL;
+        buffers->rb_recv_count++;
+        return rpcrdma_buffer_get_rep_locked(buffers);
+}
+
 /*
  * Get a set of request/reply buffers.
+ *
+ * Reply buffer (if available) is attached to send buffer upon return.
  */
 struct rpcrdma_req *
 rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
@@ -1085,21 +1107,15 @@ rpcrdma_buffer_get(struct rpcrdma_buffer *buffers)
         spin_lock(&buffers->rb_lock);
         if (list_empty(&buffers->rb_send_bufs))
                 goto out_reqbuf;
+        buffers->rb_send_count++;
         req = rpcrdma_buffer_get_req_locked(buffers);
-        if (list_empty(&buffers->rb_recv_bufs))
-                goto out_repbuf;
-        req->rl_reply = rpcrdma_buffer_get_rep_locked(buffers);
+        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
         spin_unlock(&buffers->rb_lock);
         return req;
 
 out_reqbuf:
         spin_unlock(&buffers->rb_lock);
-        pr_warn("rpcrdma: out of request buffers (%p)\n", buffers);
-        return NULL;
-out_repbuf:
-        list_add(&req->rl_free, &buffers->rb_send_bufs);
-        spin_unlock(&buffers->rb_lock);
-        pr_warn("rpcrdma: out of reply buffers (%p)\n", buffers);
+        pr_warn("RPC:       %s: out of request buffers\n", __func__);
         return NULL;
 }
 
@@ -1117,9 +1133,12 @@ rpcrdma_buffer_put(struct rpcrdma_req *req)
         req->rl_reply = NULL;
 
         spin_lock(&buffers->rb_lock);
+        buffers->rb_send_count--;
         list_add_tail(&req->rl_free, &buffers->rb_send_bufs);
-        if (rep)
+        if (rep) {
+                buffers->rb_recv_count--;
                 list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
+        }
         spin_unlock(&buffers->rb_lock);
 }
 
@@ -1133,8 +1152,7 @@ rpcrdma_recv_buffer_get(struct rpcrdma_req *req)
         struct rpcrdma_buffer *buffers = req->rl_buffer;
 
         spin_lock(&buffers->rb_lock);
-        if (!list_empty(&buffers->rb_recv_bufs))
-                req->rl_reply = rpcrdma_buffer_get_rep_locked(buffers);
+        req->rl_reply = rpcrdma_buffer_get_rep(buffers);
         spin_unlock(&buffers->rb_lock);
 }
 
@@ -1148,6 +1166,7 @@ rpcrdma_recv_buffer_put(struct rpcrdma_rep *rep)
         struct rpcrdma_buffer *buffers = &rep->rr_rxprt->rx_buf;
 
         spin_lock(&buffers->rb_lock);
+        buffers->rb_recv_count--;
         list_add_tail(&rep->rr_list, &buffers->rb_recv_bufs);
         spin_unlock(&buffers->rb_lock);
 }
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 670fad57153a..a71b0f5897d8 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -321,6 +321,7 @@ struct rpcrdma_buffer {
         char                    *rb_pool;
 
         spinlock_t              rb_lock;        /* protect buf lists */
+        int                     rb_send_count, rb_recv_count;
         struct list_head        rb_send_bufs;
         struct list_head        rb_recv_bufs;
         u32                     rb_max_requests;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 111767ab124a..bf168838a029 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -177,7 +177,6 @@ static struct ctl_table sunrpc_table[] = {
  * increase over time if the server is down or not responding.
  */
 #define XS_TCP_INIT_REEST_TO    (3U * HZ)
-#define XS_TCP_MAX_REEST_TO     (5U * 60 * HZ)
 
 /*
  * TCP idle timeout; client drops the transport socket if it is idle
@@ -1075,7 +1074,7 @@ static void xs_udp_data_receive(struct sock_xprt *transport)
                 skb = skb_recv_datagram(sk, 0, 1, &err);
                 if (skb != NULL) {
                         xs_udp_data_read_skb(&transport->xprt, sk, skb);
-                        skb_free_datagram(sk, skb);
+                        skb_free_datagram_locked(sk, skb);
                         continue;
                 }
                 if (!test_and_clear_bit(XPRT_SOCK_DATA_READY, &transport->sock_state))
@@ -2173,6 +2172,8 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 write_unlock_bh(&sk->sk_callback_lock);
         }
         xs_udp_do_set_buffer_size(xprt);
+
+        xprt->stat.connect_start = jiffies;
 }
 
 static void xs_udp_setup_socket(struct work_struct *work)
@@ -2236,6 +2237,7 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 unsigned int keepcnt = xprt->timeout->to_retries + 1;
                 unsigned int opt_on = 1;
                 unsigned int timeo;
+                unsigned int addr_pref = IPV6_PREFER_SRC_PUBLIC;
 
                 /* TCP Keepalive options */
                 kernel_setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE,
@@ -2247,6 +2249,16 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 kernel_setsockopt(sock, SOL_TCP, TCP_KEEPCNT,
                                 (char *)&keepcnt, sizeof(keepcnt));
 
+                /* Avoid temporary address, they are bad for long-lived
+                 * connections such as NFS mounts.
+                 * RFC4941, section 3.6 suggests that:
+                 *    Individual applications, which have specific
+                 *    knowledge about the normal duration of connections,
+                 *    MAY override this as appropriate.
+                 */
+                kernel_setsockopt(sock, SOL_IPV6, IPV6_ADDR_PREFERENCES,
+                                (char *)&addr_pref, sizeof(addr_pref));
+
                 /* TCP user timeout (see RFC5482) */
                 timeo = jiffies_to_msecs(xprt->timeout->to_initval) *
                         (xprt->timeout->to_retries + 1);
@@ -2295,6 +2307,10 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
                 /* SYN_SENT! */
                 if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
                         xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+                break;
+        case -EADDRNOTAVAIL:
+                /* Source port number is unavailable. Try a new one! */
+                transport->srcport = 0;
         }
 out:
         return ret;
@@ -2369,6 +2385,25 @@ out:
         xprt_wake_pending_tasks(xprt, status);
 }
 
+static unsigned long xs_reconnect_delay(const struct rpc_xprt *xprt)
+{
+        unsigned long start, now = jiffies;
+
+        start = xprt->stat.connect_start + xprt->reestablish_timeout;
+        if (time_after(start, now))
+                return start - now;
+        return 0;
+}
+
+static void xs_reconnect_backoff(struct rpc_xprt *xprt)
+{
+        xprt->reestablish_timeout <<= 1;
+        if (xprt->reestablish_timeout > xprt->max_reconnect_timeout)
+                xprt->reestablish_timeout = xprt->max_reconnect_timeout;
+        if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
+                xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
+}
+
 /**
  * xs_connect - connect a socket to a remote endpoint
  * @xprt: pointer to transport structure
@@ -2386,6 +2421,7 @@ out:
 static void xs_connect(struct rpc_xprt *xprt, struct rpc_task *task)
 {
         struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt);
+        unsigned long delay = 0;
 
         WARN_ON_ONCE(!xprt_lock_connect(xprt, task, transport));
 
@@ -2397,19 +2433,15 @@ static void xs_connect(struct rpc_xprt *xprt, struct rpc_task *task)
                 /* Start by resetting any existing state */
                 xs_reset_transport(transport);
 
-                queue_delayed_work(xprtiod_workqueue,
-                                   &transport->connect_worker,
-                                   xprt->reestablish_timeout);
-                xprt->reestablish_timeout <<= 1;
-                if (xprt->reestablish_timeout < XS_TCP_INIT_REEST_TO)
-                        xprt->reestablish_timeout = XS_TCP_INIT_REEST_TO;
-                if (xprt->reestablish_timeout > XS_TCP_MAX_REEST_TO)
-                        xprt->reestablish_timeout = XS_TCP_MAX_REEST_TO;
-        } else {
+                delay = xs_reconnect_delay(xprt);
+                xs_reconnect_backoff(xprt);
+
+        } else
                 dprintk("RPC:       xs_connect scheduled xprt %p\n", xprt);
-                queue_delayed_work(xprtiod_workqueue,
-                                   &transport->connect_worker, 0);
-        }
+
+        queue_delayed_work(xprtiod_workqueue,
+                        &transport->connect_worker,
+                        delay);
 }
 
 /**
@@ -2961,6 +2993,8 @@ static struct rpc_xprt *xs_setup_tcp(struct xprt_create *args)
         xprt->ops = &xs_tcp_ops;
         xprt->timeout = &xs_tcp_default_timeout;
 
+        xprt->max_reconnect_timeout = xprt->timeout->to_maxval;
+
         INIT_WORK(&transport->recv_worker, xs_tcp_data_receive_workfn);
         INIT_DELAYED_WORK(&transport->connect_worker, xs_tcp_setup_socket);
 
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index b62caa1c770c..ed97a5876ebe 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -728,12 +728,13 @@ int tipc_nl_add_monitor_peer(struct net *net, struct tipc_nl_msg *msg,
                              u32 bearer_id, u32 *prev_node)
 {
         struct tipc_monitor *mon = tipc_monitor(net, bearer_id);
-        struct tipc_peer *peer = mon->self;
+        struct tipc_peer *peer;
 
         if (!mon)
                 return -EINVAL;
 
         read_lock_bh(&mon->lock);
+        peer = mon->self;
         do {
                 if (*prev_node) {
                         if (peer->addr == *prev_node)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 6b626a64b517..a04fe9be1c60 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -62,6 +62,8 @@ static void publ_to_item(struct distr_item *i, struct publication *p)
 
 /**
  * named_prepare_buf - allocate & initialize a publication message
+ *
+ * The buffer returned is of size INT_H_SIZE + payload size
  */
 static struct sk_buff *named_prepare_buf(struct net *net, u32 type, u32 size,
                                          u32 dest)
@@ -141,9 +143,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
         struct publication *publ;
         struct sk_buff *skb = NULL;
         struct distr_item *item = NULL;
-        uint msg_dsz = (tipc_node_get_mtu(net, dnode, 0) / ITEM_SIZE) *
-                        ITEM_SIZE;
-        uint msg_rem = msg_dsz;
+        u32 msg_dsz = ((tipc_node_get_mtu(net, dnode, 0) - INT_H_SIZE) /
+                        ITEM_SIZE) * ITEM_SIZE;
+        u32 msg_rem = msg_dsz;
 
         list_for_each_entry(publ, pls, local_list) {
                 /* Prepare next buffer: */
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index c49b8df438cb..f9f5f3c3dab5 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2180,7 +2180,8 @@ restart:
                                               TIPC_CONN_MSG, SHORT_H_SIZE,
                                               0, dnode, onode, dport, oport,
                                               TIPC_CONN_SHUTDOWN);
-                        tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
+                        if (skb)
+                                tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
                 }
                 tsk->connected = 0;
                 sock->state = SS_DISCONNECTING;
diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index b016c011970b..ae7e14cae085 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -396,10 +396,13 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b,
         tuncfg.encap_destroy = NULL;
         setup_udp_tunnel_sock(net, ub->ubsock, &tuncfg);
 
-        if (enable_mcast(ub, remote))
+        err = enable_mcast(ub, remote);
+        if (err)
                 goto err;
         return 0;
 err:
+        if (ub->ubsock)
+                udp_tunnel_sock_release(ub->ubsock);
         kfree(ub);
         return err;
 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index f1dffe84f0d5..8309687a56b0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -661,11 +661,11 @@ static int unix_set_peek_off(struct sock *sk, int val)
 {
         struct unix_sock *u = unix_sk(sk);
 
-        if (mutex_lock_interruptible(&u->readlock))
+        if (mutex_lock_interruptible(&u->iolock))
                 return -EINTR;
 
         sk->sk_peek_off = val;
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
 
         return 0;
 }
@@ -779,7 +779,8 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
         spin_lock_init(&u->lock);
         atomic_long_set(&u->inflight, 0);
         INIT_LIST_HEAD(&u->link);
-        mutex_init(&u->readlock); /* single task reading lock */
+        mutex_init(&u->iolock); /* single task reading lock */
+        mutex_init(&u->bindlock); /* single task binding lock */
         init_waitqueue_head(&u->peer_wait);
         init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
         unix_insert_socket(unix_sockets_unbound(sk), sk);
@@ -848,7 +849,7 @@ static int unix_autobind(struct socket *sock)
         int err;
         unsigned int retries = 0;
 
-        err = mutex_lock_interruptible(&u->readlock);
+        err = mutex_lock_interruptible(&u->bindlock);
         if (err)
                 return err;
 
@@ -895,7 +896,7 @@ retry:
         spin_unlock(&unix_table_lock);
         err = 0;
 
-out:    mutex_unlock(&u->readlock);
+out:    mutex_unlock(&u->bindlock);
         return err;
 }
 
@@ -954,20 +955,32 @@ fail:
         return NULL;
 }
 
-static int unix_mknod(struct dentry *dentry, const struct path *path, umode_t mode,
-                      struct path *res)
+static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
 {
-        int err;
+        struct dentry *dentry;
+        struct path path;
+        int err = 0;
+        /*
+         * Get the parent directory, calculate the hash for last
+         * component.
+         */
+        dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
+        err = PTR_ERR(dentry);
+        if (IS_ERR(dentry))
+                return err;
 
-        err = security_path_mknod(path, dentry, mode, 0);
+        /*
+         * All right, let's create it.
+         */
+        err = security_path_mknod(&path, dentry, mode, 0);
         if (!err) {
-                err = vfs_mknod(d_inode(path->dentry), dentry, mode, 0);
+                err = vfs_mknod(d_inode(path.dentry), dentry, mode, 0);
                 if (!err) {
-                        res->mnt = mntget(path->mnt);
+                        res->mnt = mntget(path.mnt);
                         res->dentry = dget(dentry);
                 }
         }
-
+        done_path_create(&path, dentry);
         return err;
 }
 
@@ -978,12 +991,10 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct unix_sock *u = unix_sk(sk);
         struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
         char *sun_path = sunaddr->sun_path;
-        int err, name_err;
+        int err;
         unsigned int hash;
         struct unix_address *addr;
         struct hlist_head *list;
-        struct path path;
-        struct dentry *dentry;
 
         err = -EINVAL;
         if (sunaddr->sun_family != AF_UNIX)
@@ -999,34 +1010,14 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 goto out;
         addr_len = err;
 
-        name_err = 0;
-        dentry = NULL;
-        if (sun_path[0]) {
-                /* Get the parent directory, calculate the hash for last
-                 * component.
-                 */
-                dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
-
-                if (IS_ERR(dentry)) {
-                        /* delay report until after 'already bound' check */
-                        name_err = PTR_ERR(dentry);
-                        dentry = NULL;
-                }
-        }
-
-        err = mutex_lock_interruptible(&u->readlock);
+        err = mutex_lock_interruptible(&u->bindlock);
         if (err)
-                goto out_path;
+                goto out;
 
         err = -EINVAL;
         if (u->addr)
                 goto out_up;
 
-        if (name_err) {
-                err = name_err == -EEXIST ? -EADDRINUSE : name_err;
-                goto out_up;
-        }
-
         err = -ENOMEM;
         addr = kmalloc(sizeof(*addr)+addr_len, GFP_KERNEL);
         if (!addr)
@@ -1037,11 +1028,11 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         addr->hash = hash ^ sk->sk_type;
         atomic_set(&addr->refcnt, 1);
 
-        if (dentry) {
-                struct path u_path;
+        if (sun_path[0]) {
+                struct path path;
                 umode_t mode = S_IFSOCK |
                        (SOCK_INODE(sock)->i_mode & ~current_umask());
-                err = unix_mknod(dentry, &path, mode, &u_path);
+                err = unix_mknod(sun_path, mode, &path);
                 if (err) {
                         if (err == -EEXIST)
                                 err = -EADDRINUSE;
@@ -1049,9 +1040,9 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                         goto out_up;
                 }
                 addr->hash = UNIX_HASH_SIZE;
-                hash = d_real_inode(dentry)->i_ino & (UNIX_HASH_SIZE - 1);
+                hash = d_real_inode(path.dentry)->i_ino & (UNIX_HASH_SIZE - 1);
                 spin_lock(&unix_table_lock);
-                u->path = u_path;
+                u->path = path;
                 list = &unix_socket_table[hash];
         } else {
                 spin_lock(&unix_table_lock);
@@ -1073,11 +1064,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 out_unlock:
         spin_unlock(&unix_table_lock);
 out_up:
-        mutex_unlock(&u->readlock);
-out_path:
-        if (dentry)
-                done_path_create(&path, dentry);
-
+        mutex_unlock(&u->bindlock);
 out:
         return err;
 }
@@ -1969,17 +1956,17 @@ static ssize_t unix_stream_sendpage(struct socket *socket, struct page *page,
         if (false) {
 alloc_skb:
                 unix_state_unlock(other);
-                mutex_unlock(&unix_sk(other)->readlock);
+                mutex_unlock(&unix_sk(other)->iolock);
                 newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
                                               &err, 0);
                 if (!newskb)
                         goto err;
         }
 
-        /* we must acquire readlock as we modify already present
+        /* we must acquire iolock as we modify already present
          * skbs in the sk_receive_queue and mess with skb->len
          */
-        err = mutex_lock_interruptible(&unix_sk(other)->readlock);
+        err = mutex_lock_interruptible(&unix_sk(other)->iolock);
         if (err) {
                 err = flags & MSG_DONTWAIT ? -EAGAIN : -ERESTARTSYS;
                 goto err;
@@ -2046,7 +2033,7 @@ alloc_skb:
         }
 
         unix_state_unlock(other);
-        mutex_unlock(&unix_sk(other)->readlock);
+        mutex_unlock(&unix_sk(other)->iolock);
 
         other->sk_data_ready(other);
         scm_destroy(&scm);
@@ -2055,7 +2042,7 @@ alloc_skb:
 err_state_unlock:
         unix_state_unlock(other);
 err_unlock:
-        mutex_unlock(&unix_sk(other)->readlock);
+        mutex_unlock(&unix_sk(other)->iolock);
 err:
         kfree_skb(newskb);
         if (send_sigpipe && !(flags & MSG_NOSIGNAL))
@@ -2123,7 +2110,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
         timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 
         do {
-                mutex_lock(&u->readlock);
+                mutex_lock(&u->iolock);
 
                 skip = sk_peek_offset(sk, flags);
                 skb = __skb_try_recv_datagram(sk, flags, &peeked, &skip, &err,
@@ -2131,14 +2118,14 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
                 if (skb)
                         break;
 
-                mutex_unlock(&u->readlock);
+                mutex_unlock(&u->iolock);
 
                 if (err != -EAGAIN)
                         break;
         } while (timeo &&
                  !__skb_wait_for_more_packets(sk, &err, &timeo, last));
 
-        if (!skb) { /* implies readlock unlocked */
+        if (!skb) { /* implies iolock unlocked */
                 unix_state_lock(sk);
                 /* Signal EOF on disconnected non-blocking SEQPACKET socket. */
                 if (sk->sk_type == SOCK_SEQPACKET && err == -EAGAIN &&
@@ -2203,7 +2190,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,
 
 out_free:
         skb_free_datagram(sk, skb);
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
 out:
         return err;
 }
@@ -2298,7 +2285,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state)
         /* Lock the socket to prevent queue disordering
          * while sleeps in memcpy_tomsg
          */
-        mutex_lock(&u->readlock);
+        mutex_lock(&u->iolock);
 
         if (flags & MSG_PEEK)
                 skip = sk_peek_offset(sk, flags);
@@ -2340,7 +2327,7 @@ again:
                                 break;
                         }
 
-                        mutex_unlock(&u->readlock);
+                        mutex_unlock(&u->iolock);
 
                         timeo = unix_stream_data_wait(sk, timeo, last,
                                                       last_len);
@@ -2351,7 +2338,7 @@ again:
                                 goto out;
                         }
 
-                        mutex_lock(&u->readlock);
+                        mutex_lock(&u->iolock);
                         goto redo;
 unlock:
                         unix_state_unlock(sk);
@@ -2454,7 +2441,7 @@ unlock:
                 }
         } while (size);
 
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
         if (state->msg)
                 scm_recv(sock, state->msg, &scm, flags);
         else
@@ -2495,9 +2482,9 @@ static ssize_t skb_unix_socket_splice(struct sock *sk,
         int ret;
         struct unix_sock *u = unix_sk(sk);
 
-        mutex_unlock(&u->readlock);
+        mutex_unlock(&u->iolock);
         ret = splice_to_pipe(pipe, spd);
-        mutex_lock(&u->readlock);
+        mutex_lock(&u->iolock);
 
         return ret;
 }
diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
index 699dfabdbccd..936d7eee62d0 100644
--- a/net/vmw_vsock/virtio_transport.c
+++ b/net/vmw_vsock/virtio_transport.c
@@ -87,9 +87,6 @@ virtio_transport_send_pkt_work(struct work_struct *work)
 
         vq = vsock->vqs[VSOCK_VQ_TX];
 
-        /* Avoid unnecessary interrupts while we're processing the ring */
-        virtqueue_disable_cb(vq);
-
         for (;;) {
                 struct virtio_vsock_pkt *pkt;
                 struct scatterlist hdr, buf, *sgs[2];
@@ -99,7 +96,6 @@ virtio_transport_send_pkt_work(struct work_struct *work)
                 spin_lock_bh(&vsock->send_pkt_list_lock);
                 if (list_empty(&vsock->send_pkt_list)) {
                         spin_unlock_bh(&vsock->send_pkt_list_lock);
-                        virtqueue_enable_cb(vq);
                         break;
                 }
 
@@ -118,13 +114,13 @@ virtio_transport_send_pkt_work(struct work_struct *work)
                 }
 
                 ret = virtqueue_add_sgs(vq, sgs, out_sg, in_sg, pkt, GFP_KERNEL);
+                /* Usually this means that there is no more space available in
+                 * the vq
+                 */
                 if (ret < 0) {
                         spin_lock_bh(&vsock->send_pkt_list_lock);
                         list_add(&pkt->list, &vsock->send_pkt_list);
                         spin_unlock_bh(&vsock->send_pkt_list_lock);
-
-                        if (!virtqueue_enable_cb(vq) && ret == -ENOSPC)
-                                continue; /* retry now that we have more space */
                         break;
                 }
 
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index b0e11b6dc994..0f506220a3bd 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -513,6 +513,7 @@ static bool cfg80211_chandef_dfs_available(struct wiphy *wiphy,
                 r = cfg80211_get_chans_dfs_available(wiphy,
                                                      chandef->center_freq2,
                                                      width);
+                break;
         default:
                 WARN_ON(chandef->center_freq2);
                 break;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 46417f9cce68..4809f4d2cdcc 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5380,6 +5380,7 @@ static int nl80211_parse_mesh_config(struct genl_info *info,
 {
         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
         u32 mask = 0;
+        u16 ht_opmode;
 
 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
 do {                                                                        \
@@ -5471,9 +5472,36 @@ do {									    \
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
                                   nl80211_check_s32);
-        FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
-                                  mask, NL80211_MESHCONF_HT_OPMODE,
-                                  nl80211_check_u16);
+        /*
+         * Check HT operation mode based on
+         * IEEE 802.11 2012 8.4.2.59 HT Operation element.
+         */
+        if (tb[NL80211_MESHCONF_HT_OPMODE]) {
+                ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
+
+                if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
+                                  IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
+                                  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+                        return -EINVAL;
+
+                if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
+                    (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+                        return -EINVAL;
+
+                switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+                case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+                        if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
+                                return -EINVAL;
+                        break;
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+                case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+                        if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
+                                return -EINVAL;
+                        break;
+                }
+                cfg->ht_opmode = ht_opmode;
+        }
         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
                                   1, 65535, mask,
                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
@@ -6950,7 +6978,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
 
                 params.n_counter_offsets_presp = len / sizeof(u16);
                 if (rdev->wiphy.max_num_csa_counters &&
-                    (params.n_counter_offsets_beacon >
+                    (params.n_counter_offsets_presp >
                      rdev->wiphy.max_num_csa_counters))
                         return -EINVAL;
 
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index dbb2738e356a..6250b1cfcde5 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -958,29 +958,8 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
                         return private(dev, iwr, cmd, info, handler);
         }
         /* Old driver API : call driver ioctl handler */
-        if (dev->netdev_ops->ndo_do_ioctl) {
-#ifdef CONFIG_COMPAT
-                if (info->flags & IW_REQUEST_FLAG_COMPAT) {
-                        int ret = 0;
-                        struct iwreq iwr_lcl;
-                        struct compat_iw_point *iwp_compat = (void *) &iwr->u.data;
-
-                        memcpy(&iwr_lcl, iwr, sizeof(struct iwreq));
-                        iwr_lcl.u.data.pointer = compat_ptr(iwp_compat->pointer);
-                        iwr_lcl.u.data.length = iwp_compat->length;
-                        iwr_lcl.u.data.flags = iwp_compat->flags;
-
-                        ret = dev->netdev_ops->ndo_do_ioctl(dev, (void *) &iwr_lcl, cmd);
-
-                        iwp_compat->pointer = ptr_to_compat(iwr_lcl.u.data.pointer);
-                        iwp_compat->length = iwr_lcl.u.data.length;
-                        iwp_compat->flags = iwr_lcl.u.data.flags;
-
-                        return ret;
-                } else
-#endif
-                        return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
-        }
+        if (dev->netdev_ops->ndo_do_ioctl)
+                return dev->netdev_ops->ndo_do_ioctl(dev, ifr, cmd);
         return -EOPNOTSUPP;
 }
 
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 1c4ad477ce93..6e3f0254d8a1 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -207,15 +207,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
         family = XFRM_SPI_SKB_CB(skb)->family;
 
         /* if tunnel is present override skb->mark value with tunnel i_key */
-        if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
-                switch (family) {
-                case AF_INET:
+        switch (family) {
+        case AF_INET:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
                         mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
-                        break;
-                case AF_INET6:
+                break;
+        case AF_INET6:
+                if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
                         mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
-                        break;
-                }
+                break;
         }
 
         /* Allocate new secpath or COW existing one. */
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b5e665b3cfb0..45f9cf97ea25 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -626,6 +626,10 @@ static void xfrm_hash_rebuild(struct work_struct *work)
 
         /* re-insert all policies by order of creation */
         list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+                if (xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) {
+                        /* skip socket policies */
+                        continue;
+                }
                 newpos = NULL;
                 chain = policy_hash_bysel(net, &policy->selector,
                                           policy->family,
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 9895a8c56d8c..a30f898dc1c5 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -332,6 +332,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
 {
         tasklet_hrtimer_cancel(&x->mtimer);
         del_timer_sync(&x->rtimer);
+        kfree(x->aead);
         kfree(x->aalg);
         kfree(x->ealg);
         kfree(x->calg);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index d516845e16e3..08892091cfe3 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -581,9 +581,12 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
         if (err)
                 goto error;
 
-        if (attrs[XFRMA_SEC_CTX] &&
-            security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
-                goto error;
+        if (attrs[XFRMA_SEC_CTX]) {
+                err = security_xfrm_state_alloc(x,
+                                                nla_data(attrs[XFRMA_SEC_CTX]));
+                if (err)
+                        goto error;
+        }
 
         if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
                                                attrs[XFRMA_REPLAY_ESN_VAL])))
@@ -896,7 +899,8 @@ static int xfrm_dump_sa_done(struct netlink_callback *cb)
         struct sock *sk = cb->skb->sk;
         struct net *net = sock_net(sk);
 
-        xfrm_state_walk_done(walk, net);
+        if (cb->args[0])
+                xfrm_state_walk_done(walk, net);
         return 0;
 }
 
@@ -921,8 +925,6 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
                 u8 proto = 0;
                 int err;
 
-                cb->args[0] = 1;
-
                 err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
                                   xfrma_policy);
                 if (err < 0)
@@ -939,6 +941,7 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
                         proto = nla_get_u8(attrs[XFRMA_PROTO]);
 
                 xfrm_state_walk_init(walk, proto, filter);
+                cb->args[0] = 1;
         }
 
         (void) xfrm_state_walk(net, walk, dump_one_state, &info);
@@ -2051,9 +2054,6 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
         if (up->hard) {
                 xfrm_policy_delete(xp, p->dir);
                 xfrm_audit_policy_delete(xp, 1, true);
-        } else {
-                // reset the timers here?
-                WARN(1, "Don't know what to do with soft policy expire\n");
         }
         km_policy_expired(xp, p->dir, up->hard, nlh->nlmsg_pid);
 
@@ -2117,7 +2117,7 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         err = verify_newpolicy_info(&ua->policy);
         if (err)
-                goto bad_policy;
+                goto free_state;
 
         /*   build an XP */
         xp = xfrm_policy_construct(net, &ua->policy, attrs, &err);
@@ -2149,8 +2149,6 @@ static int xfrm_add_acquire(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         return 0;
 
-bad_policy:
-        WARN(1, "BAD policy passed\n");
 free_state:
         kfree(x);
 nomem:
diff --git a/samples/bpf/bpf_helpers.h b/samples/bpf/bpf_helpers.h
index 217c8d507f2e..7927a090fa0d 100644
--- a/samples/bpf/bpf_helpers.h
+++ b/samples/bpf/bpf_helpers.h
@@ -72,8 +72,8 @@ static int (*bpf_l3_csum_replace)(void *ctx, int off, int from, int to, int flag
         (void *) BPF_FUNC_l3_csum_replace;
 static int (*bpf_l4_csum_replace)(void *ctx, int off, int from, int to, int flags) =
         (void *) BPF_FUNC_l4_csum_replace;
-static int (*bpf_skb_in_cgroup)(void *ctx, void *map, int index) =
-        (void *) BPF_FUNC_skb_in_cgroup;
+static int (*bpf_skb_under_cgroup)(void *ctx, void *map, int index) =
+        (void *) BPF_FUNC_skb_under_cgroup;
 
 #if defined(__x86_64__)
 
diff --git a/samples/bpf/test_cgrp2_tc_kern.c b/samples/bpf/test_cgrp2_tc_kern.c
index 2732c37c8d5b..10ff73404e3a 100644
--- a/samples/bpf/test_cgrp2_tc_kern.c
+++ b/samples/bpf/test_cgrp2_tc_kern.c
@@ -57,7 +57,7 @@ int handle_egress(struct __sk_buff *skb)
                 bpf_trace_printk(dont_care_msg, sizeof(dont_care_msg),
                                  eth->h_proto, ip6h->nexthdr);
                 return TC_ACT_OK;
-        } else if (bpf_skb_in_cgroup(skb, &test_cgrp2_array_pin, 0) != 1) {
+        } else if (bpf_skb_under_cgroup(skb, &test_cgrp2_array_pin, 0) != 1) {
                 bpf_trace_printk(pass_msg, sizeof(pass_msg));
                 return TC_ACT_OK;
         } else {
diff --git a/samples/bpf/test_maps.c b/samples/bpf/test_maps.c
index 47bf0858f9e4..cce2b59751eb 100644
--- a/samples/bpf/test_maps.c
+++ b/samples/bpf/test_maps.c
@@ -68,7 +68,16 @@ static void test_hashmap_sanity(int i, void *data)
         assert(bpf_update_elem(map_fd, &key, &value, BPF_NOEXIST) == -1 &&
                errno == E2BIG);
 
+        /* update existing element, thought the map is full */
+        key = 1;
+        assert(bpf_update_elem(map_fd, &key, &value, BPF_EXIST) == 0);
+        key = 2;
+        assert(bpf_update_elem(map_fd, &key, &value, BPF_ANY) == 0);
+        key = 1;
+        assert(bpf_update_elem(map_fd, &key, &value, BPF_ANY) == 0);
+
         /* check that key = 0 doesn't exist */
+        key = 0;
         assert(bpf_delete_elem(map_fd, &key) == -1 && errno == ENOENT);
 
         /* iterate over two elements */
@@ -413,10 +422,12 @@ static void do_work(int fn, void *data)
 
         for (i = fn; i < MAP_SIZE; i += TASKS) {
                 key = value = i;
-                if (do_update)
+                if (do_update) {
                         assert(bpf_update_elem(map_fd, &key, &value, BPF_NOEXIST) == 0);
-                else
+                        assert(bpf_update_elem(map_fd, &key, &value, BPF_EXIST) == 0);
+                } else {
                         assert(bpf_delete_elem(map_fd, &key) == 0);
+                }
         }
 }
 
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 15b196fc2f49..179219845dfc 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -108,16 +108,20 @@ as-option = $(call try-run,\
 as-instr = $(call try-run,\
         printf "%b\n" "$(1)" | $(CC) $(KBUILD_AFLAGS) -c -x assembler -o "$$TMP" -,$(2),$(3))
 
+# Do not attempt to build with gcc plugins during cc-option tests.
+# (And this uses delayed resolution so the flags will be up to date.)
+CC_OPTION_CFLAGS = $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
+
 # cc-option
 # Usage: cflags-y += $(call cc-option,-march=winchip-c6,-march=i586)
 
 cc-option = $(call try-run,\
-        $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",$(1),$(2))
+        $(CC) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",$(1),$(2))
 
 # cc-option-yn
 # Usage: flag := $(call cc-option-yn,-march=winchip-c6)
 cc-option-yn = $(call try-run,\
-        $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",y,n)
+        $(CC) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) $(1) -c -x c /dev/null -o "$$TMP",y,n)
 
 # cc-option-align
 # Prefix align with either -falign or -malign
@@ -127,7 +131,7 @@ cc-option-align = $(subst -functions=0,,\
 # cc-disable-warning
 # Usage: cflags-y += $(call cc-disable-warning,unused-but-set-variable)
 cc-disable-warning = $(call try-run,\
-        $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
+        $(CC) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
 
 # cc-name
 # Expands to either gcc or clang
diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index 5e22b60589c1..61f0e6db909b 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -19,25 +19,42 @@ ifdef CONFIG_GCC_PLUGINS
     endif
   endif
 
-  GCC_PLUGINS_CFLAGS := $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y))
+  GCC_PLUGINS_CFLAGS := $(strip $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y))
 
-  export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGIN SANCOV_PLUGIN
+  export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGIN GCC_PLUGIN_SUBDIR SANCOV_PLUGIN
 
+  ifneq ($(PLUGINCC),)
+    # SANCOV_PLUGIN can be only in CFLAGS_KCOV because avoid duplication.
+    GCC_PLUGINS_CFLAGS := $(filter-out $(SANCOV_PLUGIN), $(GCC_PLUGINS_CFLAGS))
+  endif
+
+  KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
+  GCC_PLUGIN := $(gcc-plugin-y)
+  GCC_PLUGIN_SUBDIR := $(gcc-plugin-subdir-y)
+endif
+
+# If plugins aren't supported, abort the build before hard-to-read compiler
+# errors start getting spewed by the main build.
+PHONY += gcc-plugins-check
+gcc-plugins-check: FORCE
+ifdef CONFIG_GCC_PLUGINS
   ifeq ($(PLUGINCC),)
     ifneq ($(GCC_PLUGINS_CFLAGS),)
       ifeq ($(call cc-ifversion, -ge, 0405, y), y)
-        PLUGINCC := $(shell $(CONFIG_SHELL) -x $(srctree)/scripts/gcc-plugin.sh "$(__PLUGINCC)" "$(HOSTCXX)" "$(CC)")
-        $(warning warning: your gcc installation does not support plugins, perhaps the necessary headers are missing?)
+        $(Q)$(srctree)/scripts/gcc-plugin.sh --show-error "$(__PLUGINCC)" "$(HOSTCXX)" "$(CC)" || true
+        @echo "Cannot use CONFIG_GCC_PLUGINS: your gcc installation does not support plugins, perhaps the necessary headers are missing?" >&2 && exit 1
       else
-        $(warning warning: your gcc version does not support plugins, you should upgrade it to gcc 4.5 at least)
+        @echo "Cannot use CONFIG_GCC_PLUGINS: your gcc version does not support plugins, you should upgrade it to at least gcc 4.5" >&2 && exit 1
       endif
     endif
-  else
-    # SANCOV_PLUGIN can be only in CFLAGS_KCOV because avoid duplication.
-    GCC_PLUGINS_CFLAGS := $(filter-out $(SANCOV_PLUGIN), $(GCC_PLUGINS_CFLAGS))
   endif
+endif
+        @:
 
-  KBUILD_CFLAGS += $(GCC_PLUGINS_CFLAGS)
-  GCC_PLUGIN := $(gcc-plugin-y)
-
+# Actually do the build, if requested.
+PHONY += gcc-plugins
+gcc-plugins: scripts_basic gcc-plugins-check
+ifdef CONFIG_GCC_PLUGINS
+        $(Q)$(MAKE) $(build)=scripts/gcc-plugins
 endif
+        @:
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 4de3cc42fc50..206a6b346a8d 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3570,15 +3570,6 @@ sub process {
                         }
                 }
 
-# check for uses of DEFINE_PCI_DEVICE_TABLE
-                if ($line =~ /\bDEFINE_PCI_DEVICE_TABLE\s*\(\s*(\w+)\s*\)\s*=/) {
-                        if (WARN("DEFINE_PCI_DEVICE_TABLE",
-                                 "Prefer struct pci_device_id over deprecated DEFINE_PCI_DEVICE_TABLE\n" . $herecurr) &&
-                            $fix) {
-                                $fixed[$fixlinenr] =~ s/\b(?:static\s+|)DEFINE_PCI_DEVICE_TABLE\s*\(\s*(\w+)\s*\)\s*=\s*/static const struct pci_device_id $1\[\] = /;
-                        }
-                }
-
 # check for new typedefs, only function parameters and sparse annotations
 # make sense.
                 if ($line =~ /\btypedef\s/ &&
diff --git a/scripts/faddr2line b/scripts/faddr2line
new file mode 100755
index 000000000000..450b33257339
--- /dev/null
+++ b/scripts/faddr2line
@@ -0,0 +1,177 @@
+#!/bin/bash
+#
+# Translate stack dump function offsets.
+#
+# addr2line doesn't work with KASLR addresses.  This works similarly to
+# addr2line, but instead takes the 'func+0x123' format as input:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux meminfo_proc_show+0x5/0x568
+#   meminfo_proc_show+0x5/0x568:
+#   meminfo_proc_show at fs/proc/meminfo.c:27
+#
+# If the address is part of an inlined function, the full inline call chain is
+# printed:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux native_write_msr+0x6/0x27
+#   native_write_msr+0x6/0x27:
+#   arch_static_branch at arch/x86/include/asm/msr.h:121
+#    (inlined by) static_key_false at include/linux/jump_label.h:125
+#    (inlined by) native_write_msr at arch/x86/include/asm/msr.h:125
+#
+# The function size after the '/' in the input is optional, but recommended.
+# It's used to help disambiguate any duplicate symbol names, which can occur
+# rarely.  If the size is omitted for a duplicate symbol then it's possible for
+# multiple code sites to be printed:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux raw_ioctl+0x5
+#   raw_ioctl+0x5/0x20:
+#   raw_ioctl at drivers/char/raw.c:122
+#
+#   raw_ioctl+0x5/0xb1:
+#   raw_ioctl at net/ipv4/raw.c:876
+#
+# Multiple addresses can be specified on a single command line:
+#
+#   $ ./scripts/faddr2line ~/k/vmlinux type_show+0x10/45 free_reserved_area+0x90
+#   type_show+0x10/0x2d:
+#   type_show at drivers/video/backlight/backlight.c:213
+#
+#   free_reserved_area+0x90/0x123:
+#   free_reserved_area at mm/page_alloc.c:6429 (discriminator 2)
+
+
+set -o errexit
+set -o nounset
+
+command -v awk >/dev/null 2>&1 || die "awk isn't installed"
+command -v readelf >/dev/null 2>&1 || die "readelf isn't installed"
+command -v addr2line >/dev/null 2>&1 || die "addr2line isn't installed"
+
+usage() {
+        echo "usage: faddr2line <object file> <func+offset> <func+offset>..." >&2
+        exit 1
+}
+
+warn() {
+        echo "$1" >&2
+}
+
+die() {
+        echo "ERROR: $1" >&2
+        exit 1
+}
+
+# Try to figure out the source directory prefix so we can remove it from the
+# addr2line output.  HACK ALERT: This assumes that start_kernel() is in
+# kernel/init.c!  This only works for vmlinux.  Otherwise it falls back to
+# printing the absolute path.
+find_dir_prefix() {
+        local objfile=$1
+
+        local start_kernel_addr=$(readelf -sW $objfile | awk '$8 == "start_kernel" {printf "0x%s", $2}')
+        [[ -z $start_kernel_addr ]] && return
+
+        local file_line=$(addr2line -e $objfile $start_kernel_addr)
+        [[ -z $file_line ]] && return
+
+        local prefix=${file_line%init/main.c:*}
+        if [[ -z $prefix ]] || [[ $prefix = $file_line ]]; then
+                return
+        fi
+
+        DIR_PREFIX=$prefix
+        return 0
+}
+
+__faddr2line() {
+        local objfile=$1
+        local func_addr=$2
+        local dir_prefix=$3
+        local print_warnings=$4
+
+        local func=${func_addr%+*}
+        local offset=${func_addr#*+}
+        offset=${offset%/*}
+        local size=
+        [[ $func_addr =~ "/" ]] && size=${func_addr#*/}
+
+        if [[ -z $func ]] || [[ -z $offset ]] || [[ $func = $func_addr ]]; then
+                warn "bad func+offset $func_addr"
+                DONE=1
+                return
+        fi
+
+        # Go through each of the object's symbols which match the func name.
+        # In rare cases there might be duplicates.
+        while read symbol; do
+                local fields=($symbol)
+                local sym_base=0x${fields[1]}
+                local sym_size=${fields[2]}
+                local sym_type=${fields[3]}
+
+                # calculate the address
+                local addr=$(($sym_base + $offset))
+                if [[ -z $addr ]] || [[ $addr = 0 ]]; then
+                        warn "bad address: $sym_base + $offset"
+                        DONE=1
+                        return
+                fi
+                local hexaddr=0x$(printf %x $addr)
+
+                # weed out non-function symbols
+                if [[ $sym_type != "FUNC" ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to non-function symbol"
+                        continue
+                fi
+
+                # if the user provided a size, make sure it matches the symbol's size
+                if [[ -n $size ]] && [[ $size -ne $sym_size ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to size mismatch ($size != $sym_size)"
+                        continue;
+                fi
+
+                # make sure the provided offset is within the symbol's range
+                if [[ $offset -gt $sym_size ]]; then
+                        [[ $print_warnings = 1 ]] &&
+                                echo "skipping $func address at $hexaddr due to size mismatch ($offset > $sym_size)"
+                        continue
+                fi
+
+                # separate multiple entries with a blank line
+                [[ $FIRST = 0 ]] && echo
+                FIRST=0
+
+                local hexsize=0x$(printf %x $sym_size)
+                echo "$func+$offset/$hexsize:"
+                addr2line -fpie $objfile $hexaddr | sed "s; $dir_prefix\(\./\)*; ;"
+                DONE=1
+
+        done < <(readelf -sW $objfile | awk -v f=$func '$8 == f {print}')
+}
+
+[[ $# -lt 2 ]] && usage
+
+objfile=$1
+[[ ! -f $objfile ]] && die "can't find objfile $objfile"
+shift
+
+DIR_PREFIX=supercalifragilisticexpialidocious
+find_dir_prefix $objfile
+
+FIRST=1
+while [[ $# -gt 0 ]]; do
+        func_addr=$1
+        shift
+
+        # print any matches found
+        DONE=0
+        __faddr2line $objfile $func_addr $DIR_PREFIX 0
+
+        # if no match was found, print warnings
+        if [[ $DONE = 0 ]]; then
+                __faddr2line $objfile $func_addr $DIR_PREFIX 1
+                warn "no match for $func_addr"
+        fi
+done
diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
index fb9207565471..b65224bfb847 100755
--- a/scripts/gcc-plugin.sh
+++ b/scripts/gcc-plugin.sh
@@ -1,5 +1,12 @@
 #!/bin/sh
 srctree=$(dirname "$0")
+
+SHOW_ERROR=
+if [ "$1" = "--show-error" ] ; then
+        SHOW_ERROR=1
+        shift || true
+fi
+
 gccplugins_dir=$($3 -print-file-name=plugin)
 plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/gcc-plugins -I"${gccplugins_dir}"/include 2>&1 <<EOF
 #include "gcc-common.h"
@@ -13,6 +20,9 @@ EOF
 
 if [ $? -ne 0 ]
 then
+        if [ -n "$SHOW_ERROR" ] ; then
+                echo "${plugincc}" >&2
+        fi
         exit 1
 fi
 
@@ -48,4 +58,8 @@ then
         echo "$2"
         exit 0
 fi
+
+if [ -n "$SHOW_ERROR" ] ; then
+        echo "${plugincc}" >&2
+fi
 exit 1
diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile
index 88c8ec47232b..8b29dc17c73c 100644
--- a/scripts/gcc-plugins/Makefile
+++ b/scripts/gcc-plugins/Makefile
@@ -12,16 +12,18 @@ else
   export HOST_EXTRACXXFLAGS
 endif
 
-export GCCPLUGINS_DIR HOSTLIBS
-
 ifneq ($(CFLAGS_KCOV), $(SANCOV_PLUGIN))
   GCC_PLUGIN := $(filter-out $(SANCOV_PLUGIN), $(GCC_PLUGIN))
 endif
 
-$(HOSTLIBS)-y := $(GCC_PLUGIN)
+export HOSTLIBS
+
+$(HOSTLIBS)-y := $(foreach p,$(GCC_PLUGIN),$(if $(findstring /,$(p)),,$(p)))
 always := $($(HOSTLIBS)-y)
 
-cyc_complexity_plugin-objs := cyc_complexity_plugin.o
-sancov_plugin-objs := sancov_plugin.o
+$(foreach p,$($(HOSTLIBS)-y:%.so=%),$(eval $(p)-objs := $(p).o))
+
+subdir-y := $(GCC_PLUGIN_SUBDIR)
+subdir-  += $(GCC_PLUGIN_SUBDIR)
 
 clean-files += *.so
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 122fcdaf42c8..aed4511f0304 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -432,7 +432,7 @@ foreach my $file (@ARGV) {
             die "$P: file '${file}' not found\n";
         }
     }
-    if ($from_filename || vcs_file_exists($file)) {
+    if ($from_filename || ($file ne "&STDIN" && vcs_file_exists($file))) {
         $file =~ s/^\Q${cur_path}\E//;  #strip any absolute path
         $file =~ s/^\Q${lk_path}\E//;   #or the path to the lk tree
         push(@files, $file);
@@ -2136,9 +2136,11 @@ sub vcs_file_exists {
 
     my $cmd = $VCS_cmds{"file_exists_cmd"};
     $cmd =~ s/(\$\w+)/$1/eeg;           # interpolate $cmd
-
+    $cmd .= " 2>&1";
     $exists = &{$VCS_cmds{"execute_cmd"}}($cmd);
 
+    return 0 if ($? != 0);
+
     return $exists;
 }
 
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index e1c09e2f9be7..8ea9fd2b6573 100755
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -332,7 +332,9 @@ if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then
         (cd $objtree; find tools/objtool -type f -executable) >> "$objtree/debian/hdrobjfiles"
 fi
 (cd $objtree; find arch/$SRCARCH/include Module.symvers include scripts -type f) >> "$objtree/debian/hdrobjfiles"
-(cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+if grep -q '^CONFIG_GCC_PLUGINS=y' $KCONFIG_CONFIG ; then
+        (cd $objtree; find scripts/gcc-plugins -name \*.so -o -name gcc-common.h) >> "$objtree/debian/hdrobjfiles"
+fi
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
 mkdir -p "$destdir"
 (cd $srctree; tar -c -f - -T -) < "$objtree/debian/hdrsrcfiles" | (cd $destdir; tar -xf -)
diff --git a/scripts/tags.sh b/scripts/tags.sh
index ed7eef24ef89..b3775a9604ea 100755
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -206,7 +206,6 @@ regex_c=(
         '/\<DEFINE_PER_CPU_SHARED_ALIGNED([^,]*, *\([[:alnum:]_]*\)/\1/v/'
         '/\<DECLARE_WAIT_QUEUE_HEAD(\([[:alnum:]_]*\)/\1/v/'
         '/\<DECLARE_\(TASKLET\|WORK\|DELAYED_WORK\)(\([[:alnum:]_]*\)/\2/v/'
-        '/\<DEFINE_PCI_DEVICE_TABLE(\([[:alnum:]_]*\)/\1/v/'
         '/\(^\s\)OFFSET(\([[:alnum:]_]*\)/\2/v/'
         '/\(^\s\)DEFINE(\([[:alnum:]_]*\)/\2/v/'
         '/\<DEFINE_HASHTABLE(\([[:alnum:]_]*\)/\1/v/'
diff --git a/security/Kconfig b/security/Kconfig
index 176758cdfa57..118f4549404e 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -118,6 +118,46 @@ config LSM_MMAP_MIN_ADDR
           this low address space will need the permission specific to the
           systems running LSM.
 
+config HAVE_HARDENED_USERCOPY_ALLOCATOR
+        bool
+        help
+          The heap allocator implements __check_heap_object() for
+          validating memory ranges against heap object sizes in
+          support of CONFIG_HARDENED_USERCOPY.
+
+config HAVE_ARCH_HARDENED_USERCOPY
+        bool
+        help
+          The architecture supports CONFIG_HARDENED_USERCOPY by
+          calling check_object_size() just before performing the
+          userspace copies in the low level implementation of
+          copy_to_user() and copy_from_user().
+
+config HARDENED_USERCOPY
+        bool "Harden memory copies between kernel and userspace"
+        depends on HAVE_ARCH_HARDENED_USERCOPY
+        depends on HAVE_HARDENED_USERCOPY_ALLOCATOR
+        select BUG
+        help
+          This option checks for obviously wrong memory regions when
+          copying memory to/from the kernel (via copy_to_user() and
+          copy_from_user() functions) by rejecting memory ranges that
+          are larger than the specified heap object, span multiple
+          separately allocates pages, are not on the process stack,
+          or are part of the kernel text. This kills entire classes
+          of heap overflow exploits and similar kernel memory exposures.
+
+config HARDENED_USERCOPY_PAGESPAN
+        bool "Refuse to copy allocations that span multiple pages"
+        depends on HARDENED_USERCOPY
+        depends on EXPERT
+        help
+          When a multi-page allocation is done without __GFP_COMP,
+          hardened usercopy will reject attempts to copy it. There are,
+          however, several cases of this in the kernel that have not all
+          been removed. This config is intended to be used only while
+          trying to find such users.
+
 source security/selinux/Kconfig
 source security/smack/Kconfig
 source security/tomoyo/Kconfig
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 5adbfc32242f..17a06105ccb6 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -29,6 +29,7 @@
 #include <linux/rcupdate.h>
 #include <linux/scatterlist.h>
 #include <linux/ctype.h>
+#include <crypto/aes.h>
 #include <crypto/hash.h>
 #include <crypto/sha.h>
 #include <crypto/skcipher.h>
@@ -478,6 +479,7 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
         struct crypto_skcipher *tfm;
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
+        u8 iv[AES_BLOCK_SIZE];
         unsigned int padlen;
         char pad[16];
         int ret;
@@ -500,8 +502,8 @@ static int derived_key_encrypt(struct encrypted_key_payload *epayload,
         sg_init_table(sg_out, 1);
         sg_set_buf(sg_out, epayload->encrypted_data, encrypted_datalen);
 
-        skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
-                                   epayload->iv);
+        memcpy(iv, epayload->iv, sizeof(iv));
+        skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
         ret = crypto_skcipher_encrypt(req);
         tfm = crypto_skcipher_reqtfm(req);
         skcipher_request_free(req);
@@ -581,6 +583,7 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
         struct crypto_skcipher *tfm;
         struct skcipher_request *req;
         unsigned int encrypted_datalen;
+        u8 iv[AES_BLOCK_SIZE];
         char pad[16];
         int ret;
 
@@ -599,8 +602,8 @@ static int derived_key_decrypt(struct encrypted_key_payload *epayload,
                    epayload->decrypted_datalen);
         sg_set_buf(&sg_out[1], pad, sizeof pad);
 
-        skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen,
-                                   epayload->iv);
+        memcpy(iv, epayload->iv, sizeof(iv));
+        skcipher_request_set_crypt(req, sg_in, sg_out, encrypted_datalen, iv);
         ret = crypto_skcipher_decrypt(req);
         tfm = crypto_skcipher_reqtfm(req);
         skcipher_request_free(req);
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index 795437b10082..b450a27588c8 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
                 return -EBUSY;
         }
         list_add_tail(&rmidi->list, &snd_rawmidi_devices);
+        mutex_unlock(&register_mutex);
         err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
                                   rmidi->card, rmidi->device,
                                   &snd_rawmidi_f_ops, rmidi, &rmidi->dev);
         if (err < 0) {
                 rmidi_err(rmidi, "unable to register\n");
+                mutex_lock(&register_mutex);
                 list_del(&rmidi->list);
                 mutex_unlock(&register_mutex);
                 return err;
@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
         if (rmidi->ops && rmidi->ops->dev_register &&
             (err = rmidi->ops->dev_register(rmidi)) < 0) {
                 snd_unregister_device(&rmidi->dev);
+                mutex_lock(&register_mutex);
                 list_del(&rmidi->list);
                 mutex_unlock(&register_mutex);
                 return err;
@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(struct snd_device *device)
                 }
         }
 #endif /* CONFIG_SND_OSSEMUL */
-        mutex_unlock(&register_mutex);
         sprintf(name, "midi%d", rmidi->device);
         entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
         if (entry) {
diff --git a/sound/core/timer.c b/sound/core/timer.c
index 9a6157ea6881..fc144f43faa6 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -35,6 +35,9 @@
 #include <sound/initval.h>
 #include <linux/kmod.h>
 
+/* internal flags */
+#define SNDRV_TIMER_IFLG_PAUSED         0x00010000
+
 #if IS_ENABLED(CONFIG_SND_HRTIMER)
 #define DEFAULT_TIMER_LIMIT 4
 #else
@@ -294,8 +297,21 @@ int snd_timer_open(struct snd_timer_instance **ti,
                 get_device(&timer->card->card_dev);
         timeri->slave_class = tid->dev_sclass;
         timeri->slave_id = slave_id;
-        if (list_empty(&timer->open_list_head) && timer->hw.open)
-                timer->hw.open(timer);
+
+        if (list_empty(&timer->open_list_head) && timer->hw.open) {
+                int err = timer->hw.open(timer);
+                if (err) {
+                        kfree(timeri->owner);
+                        kfree(timeri);
+
+                        if (timer->card)
+                                put_device(&timer->card->card_dev);
+                        module_put(timer->module);
+                        mutex_unlock(&register_mutex);
+                        return err;
+                }
+        }
+
         list_add_tail(&timeri->open_list, &timer->open_list_head);
         snd_timer_check_master(timeri);
         mutex_unlock(&register_mutex);
@@ -526,6 +542,10 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop)
                 }
         }
         timeri->flags &= ~(SNDRV_TIMER_IFLG_RUNNING | SNDRV_TIMER_IFLG_START);
+        if (stop)
+                timeri->flags &= ~SNDRV_TIMER_IFLG_PAUSED;
+        else
+                timeri->flags |= SNDRV_TIMER_IFLG_PAUSED;
         snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP :
                           SNDRV_TIMER_EVENT_CONTINUE);
  unlock:
@@ -587,6 +607,10 @@ int snd_timer_stop(struct snd_timer_instance *timeri)
  */
 int snd_timer_continue(struct snd_timer_instance *timeri)
 {
+        /* timer can continue only after pause */
+        if (!(timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return -EINVAL;
+
         if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
                 return snd_timer_start_slave(timeri, false);
         else
@@ -813,6 +837,7 @@ int snd_timer_new(struct snd_card *card, char *id, struct snd_timer_id *tid,
         timer->tmr_subdevice = tid->subdevice;
         if (id)
                 strlcpy(timer->id, id, sizeof(timer->id));
+        timer->sticks = 1;
         INIT_LIST_HEAD(&timer->device_list);
         INIT_LIST_HEAD(&timer->open_list_head);
         INIT_LIST_HEAD(&timer->active_list_head);
@@ -1817,6 +1842,9 @@ static int snd_timer_user_continue(struct file *file)
         tu = file->private_data;
         if (!tu->timeri)
                 return -EBADFD;
+        /* start timer instead of continue if it's not used before */
+        if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+                return snd_timer_user_start(file);
         tu->timeri->lost = 0;
         return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
 }
@@ -1958,6 +1986,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                 tu->qused--;
                 spin_unlock_irq(&tu->qlock);
 
+                mutex_lock(&tu->ioctl_lock);
                 if (tu->tread) {
                         if (copy_to_user(buffer, &tu->tqueue[qhead],
                                          sizeof(struct snd_timer_tread)))
@@ -1967,6 +1996,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer,
                                          sizeof(struct snd_timer_read)))
                                 err = -EFAULT;
                 }
+                mutex_unlock(&tu->ioctl_lock);
 
                 spin_lock_irq(&tu->qlock);
                 if (err < 0)
diff --git a/sound/firewire/fireworks/fireworks.h b/sound/firewire/fireworks/fireworks.h
index 03ed35237e2b..d73c12b8753d 100644
--- a/sound/firewire/fireworks/fireworks.h
+++ b/sound/firewire/fireworks/fireworks.h
@@ -108,7 +108,6 @@ struct snd_efw {
         u8 *resp_buf;
         u8 *pull_ptr;
         u8 *push_ptr;
-        unsigned int resp_queues;
 };
 
 int snd_efw_transaction_cmd(struct fw_unit *unit,
diff --git a/sound/firewire/fireworks/fireworks_hwdep.c b/sound/firewire/fireworks/fireworks_hwdep.c
index 33df8655fe81..2e1d9a23920c 100644
--- a/sound/firewire/fireworks/fireworks_hwdep.c
+++ b/sound/firewire/fireworks/fireworks_hwdep.c
@@ -25,6 +25,7 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
 {
         unsigned int length, till_end, type;
         struct snd_efw_transaction *t;
+        u8 *pull_ptr;
         long count = 0;
 
         if (remained < sizeof(type) + sizeof(struct snd_efw_transaction))
@@ -38,8 +39,17 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
         buf += sizeof(type);
 
         /* write into buffer as many responses as possible */
-        while (efw->resp_queues > 0) {
-                t = (struct snd_efw_transaction *)(efw->pull_ptr);
+        spin_lock_irq(&efw->lock);
+
+        /*
+         * When another task reaches here during this task's access to user
+         * space, it picks up current position in buffer and can read the same
+         * series of responses.
+         */
+        pull_ptr = efw->pull_ptr;
+
+        while (efw->push_ptr != pull_ptr) {
+                t = (struct snd_efw_transaction *)(pull_ptr);
                 length = be32_to_cpu(t->length) * sizeof(__be32);
 
                 /* confirm enough space for this response */
@@ -49,26 +59,39 @@ hwdep_read_resp_buf(struct snd_efw *efw, char __user *buf, long remained,
                 /* copy from ring buffer to user buffer */
                 while (length > 0) {
                         till_end = snd_efw_resp_buf_size -
-                                (unsigned int)(efw->pull_ptr - efw->resp_buf);
+                                (unsigned int)(pull_ptr - efw->resp_buf);
                         till_end = min_t(unsigned int, length, till_end);
 
-                        if (copy_to_user(buf, efw->pull_ptr, till_end))
+                        spin_unlock_irq(&efw->lock);
+
+                        if (copy_to_user(buf, pull_ptr, till_end))
                                 return -EFAULT;
 
-                        efw->pull_ptr += till_end;
-                        if (efw->pull_ptr >= efw->resp_buf +
-                                             snd_efw_resp_buf_size)
-                                efw->pull_ptr -= snd_efw_resp_buf_size;
+                        spin_lock_irq(&efw->lock);
+
+                        pull_ptr += till_end;
+                        if (pull_ptr >= efw->resp_buf + snd_efw_resp_buf_size)
+                                pull_ptr -= snd_efw_resp_buf_size;
 
                         length -= till_end;
                         buf += till_end;
                         count += till_end;
                         remained -= till_end;
                 }
-
-                efw->resp_queues--;
         }
 
+        /*
+         * All of tasks can read from the buffer nearly simultaneously, but the
+         * last position for each task is different depending on the length of
+         * given buffer. Here, for simplicity, a position of buffer is set by
+         * the latest task. It's better for a listening application to allow one
+         * thread to read from the buffer. Unless, each task can read different
+         * sequence of responses depending on variation of buffer length.
+         */
+        efw->pull_ptr = pull_ptr;
+
+        spin_unlock_irq(&efw->lock);
+
         return count;
 }
 
@@ -76,14 +99,17 @@ static long
 hwdep_read_locked(struct snd_efw *efw, char __user *buf, long count,
                   loff_t *offset)
 {
-        union snd_firewire_event event;
+        union snd_firewire_event event = {
+                .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
+        };
 
-        memset(&event, 0, sizeof(event));
+        spin_lock_irq(&efw->lock);
 
-        event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
         event.lock_status.status = (efw->dev_lock_count > 0);
         efw->dev_lock_changed = false;
 
+        spin_unlock_irq(&efw->lock);
+
         count = min_t(long, count, sizeof(event.lock_status));
 
         if (copy_to_user(buf, &event, count))
@@ -98,10 +124,15 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
 {
         struct snd_efw *efw = hwdep->private_data;
         DEFINE_WAIT(wait);
+        bool dev_lock_changed;
+        bool queued;
 
         spin_lock_irq(&efw->lock);
 
-        while ((!efw->dev_lock_changed) && (efw->resp_queues == 0)) {
+        dev_lock_changed = efw->dev_lock_changed;
+        queued = efw->push_ptr != efw->pull_ptr;
+
+        while (!dev_lock_changed && !queued) {
                 prepare_to_wait(&efw->hwdep_wait, &wait, TASK_INTERRUPTIBLE);
                 spin_unlock_irq(&efw->lock);
                 schedule();
@@ -109,15 +140,17 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                 if (signal_pending(current))
                         return -ERESTARTSYS;
                 spin_lock_irq(&efw->lock);
+                dev_lock_changed = efw->dev_lock_changed;
+                queued = efw->push_ptr != efw->pull_ptr;
         }
 
-        if (efw->dev_lock_changed)
+        spin_unlock_irq(&efw->lock);
+
+        if (dev_lock_changed)
                 count = hwdep_read_locked(efw, buf, count, offset);
-        else if (efw->resp_queues > 0)
+        else if (queued)
                 count = hwdep_read_resp_buf(efw, buf, count, offset);
 
-        spin_unlock_irq(&efw->lock);
-
         return count;
 }
 
@@ -160,7 +193,7 @@ hwdep_poll(struct snd_hwdep *hwdep, struct file *file, poll_table *wait)
         poll_wait(file, &efw->hwdep_wait, wait);
 
         spin_lock_irq(&efw->lock);
-        if (efw->dev_lock_changed || (efw->resp_queues > 0))
+        if (efw->dev_lock_changed || efw->pull_ptr != efw->push_ptr)
                 events = POLLIN | POLLRDNORM;
         else
                 events = 0;
diff --git a/sound/firewire/fireworks/fireworks_proc.c b/sound/firewire/fireworks/fireworks_proc.c
index 0639dcb13f7d..beb0a0ffee57 100644
--- a/sound/firewire/fireworks/fireworks_proc.c
+++ b/sound/firewire/fireworks/fireworks_proc.c
@@ -188,8 +188,8 @@ proc_read_queues_state(struct snd_info_entry *entry,
         else
                 consumed = (unsigned int)(efw->push_ptr - efw->pull_ptr);
 
-        snd_iprintf(buffer, "%d %d/%d\n",
-                    efw->resp_queues, consumed, snd_efw_resp_buf_size);
+        snd_iprintf(buffer, "%d/%d\n",
+                    consumed, snd_efw_resp_buf_size);
 }
 
 static void
diff --git a/sound/firewire/fireworks/fireworks_transaction.c b/sound/firewire/fireworks/fireworks_transaction.c
index f550808d1784..36a08ba51ec7 100644
--- a/sound/firewire/fireworks/fireworks_transaction.c
+++ b/sound/firewire/fireworks/fireworks_transaction.c
@@ -121,11 +121,11 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
         size_t capacity, till_end;
         struct snd_efw_transaction *t;
 
-        spin_lock_irq(&efw->lock);
-
         t = (struct snd_efw_transaction *)data;
         length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
 
+        spin_lock_irq(&efw->lock);
+
         if (efw->push_ptr < efw->pull_ptr)
                 capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
         else
@@ -155,7 +155,6 @@ copy_resp_to_buf(struct snd_efw *efw, void *data, size_t length, int *rcode)
         }
 
         /* for hwdep */
-        efw->resp_queues++;
         wake_up(&efw->hwdep_wait);
 
         *rcode = RCODE_COMPLETE;
diff --git a/sound/firewire/tascam/tascam-hwdep.c b/sound/firewire/tascam/tascam-hwdep.c
index 131267c3a042..106406cbfaa3 100644
--- a/sound/firewire/tascam/tascam-hwdep.c
+++ b/sound/firewire/tascam/tascam-hwdep.c
@@ -16,31 +16,14 @@
 
 #include "tascam.h"
 
-static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf,
-                              long count)
-{
-        union snd_firewire_event event;
-
-        memset(&event, 0, sizeof(event));
-
-        event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
-        event.lock_status.status = (tscm->dev_lock_count > 0);
-        tscm->dev_lock_changed = false;
-
-        count = min_t(long, count, sizeof(event.lock_status));
-
-        if (copy_to_user(buf, &event, count))
-                return -EFAULT;
-
-        return count;
-}
-
 static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                        loff_t *offset)
 {
         struct snd_tscm *tscm = hwdep->private_data;
         DEFINE_WAIT(wait);
-        union snd_firewire_event event;
+        union snd_firewire_event event = {
+                .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
+        };
 
         spin_lock_irq(&tscm->lock);
 
@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
                 spin_lock_irq(&tscm->lock);
         }
 
-        memset(&event, 0, sizeof(event));
-        count = hwdep_read_locked(tscm, buf, count);
+        event.lock_status.status = (tscm->dev_lock_count > 0);
+        tscm->dev_lock_changed = false;
+
         spin_unlock_irq(&tscm->lock);
 
+        count = min_t(long, count, sizeof(event.lock_status));
+
+        if (copy_to_user(buf, &event, count))
+                return -EFAULT;
+
         return count;
 }
 
diff --git a/sound/hda/ext/hdac_ext_controller.c b/sound/hda/ext/hdac_ext_controller.c
index 860f8cad6602..261469188566 100644
--- a/sound/hda/ext/hdac_ext_controller.c
+++ b/sound/hda/ext/hdac_ext_controller.c
@@ -29,81 +29,6 @@
  */
 #define HDAC_MAX_CAPS 10
 
-/**
- * snd_hdac_ext_bus_parse_capabilities - parse capablity structure
- * @ebus: the pointer to extended bus object
- *
- * Returns 0 if successful, or a negative error code.
- */
-int snd_hdac_ext_bus_parse_capabilities(struct hdac_ext_bus *ebus)
-{
-        unsigned int cur_cap;
-        unsigned int offset;
-        struct hdac_bus *bus = &ebus->bus;
-        unsigned int counter = 0;
-
-        offset = snd_hdac_chip_readl(bus, LLCH);
-
-        /* Lets walk the linked capabilities list */
-        do {
-                cur_cap = _snd_hdac_chip_read(l, bus, offset);
-
-                dev_dbg(bus->dev, "Capability version: 0x%x\n",
-                                ((cur_cap & AZX_CAP_HDR_VER_MASK) >> AZX_CAP_HDR_VER_OFF));
-
-                dev_dbg(bus->dev, "HDA capability ID: 0x%x\n",
-                                (cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF);
-
-                switch ((cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF) {
-                case AZX_ML_CAP_ID:
-                        dev_dbg(bus->dev, "Found ML capability\n");
-                        ebus->mlcap = bus->remap_addr + offset;
-                        break;
-
-                case AZX_GTS_CAP_ID:
-                        dev_dbg(bus->dev, "Found GTS capability offset=%x\n", offset);
-                        ebus->gtscap = bus->remap_addr + offset;
-                        break;
-
-                case AZX_PP_CAP_ID:
-                        /* PP capability found, the Audio DSP is present */
-                        dev_dbg(bus->dev, "Found PP capability offset=%x\n", offset);
-                        ebus->ppcap = bus->remap_addr + offset;
-                        break;
-
-                case AZX_SPB_CAP_ID:
-                        /* SPIB capability found, handler function */
-                        dev_dbg(bus->dev, "Found SPB capability\n");
-                        ebus->spbcap = bus->remap_addr + offset;
-                        break;
-
-                case AZX_DRSM_CAP_ID:
-                        /* DMA resume  capability found, handler function */
-                        dev_dbg(bus->dev, "Found DRSM capability\n");
-                        ebus->drsmcap = bus->remap_addr + offset;
-                        break;
-
-                default:
-                        dev_dbg(bus->dev, "Unknown capability %d\n", cur_cap);
-                        break;
-                }
-
-                counter++;
-
-                if (counter > HDAC_MAX_CAPS) {
-                        dev_err(bus->dev, "We exceeded HDAC Ext capablities!!!\n");
-                        break;
-                }
-
-                /* read the offset of next capabiity */
-                offset = cur_cap & AZX_CAP_HDR_NXT_PTR_MASK;
-
-        } while (offset);
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_parse_capabilities);
-
 /*
  * processing pipe helpers - these helpers are useful for dealing with HDA
  * new capability of processing pipelines
@@ -118,15 +43,15 @@ void snd_hdac_ext_bus_ppcap_enable(struct hdac_ext_bus *ebus, bool enable)
 {
         struct hdac_bus *bus = &ebus->bus;
 
-        if (!ebus->ppcap) {
+        if (!bus->ppcap) {
                 dev_err(bus->dev, "Address of PP capability is NULL");
                 return;
         }
 
         if (enable)
-                snd_hdac_updatel(ebus->ppcap, AZX_REG_PP_PPCTL, 0, AZX_PPCTL_GPROCEN);
+                snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, 0, AZX_PPCTL_GPROCEN);
         else
-                snd_hdac_updatel(ebus->ppcap, AZX_REG_PP_PPCTL, AZX_PPCTL_GPROCEN, 0);
+                snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, AZX_PPCTL_GPROCEN, 0);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_ppcap_enable);
 
@@ -139,15 +64,15 @@ void snd_hdac_ext_bus_ppcap_int_enable(struct hdac_ext_bus *ebus, bool enable)
 {
         struct hdac_bus *bus = &ebus->bus;
 
-        if (!ebus->ppcap) {
+        if (!bus->ppcap) {
                 dev_err(bus->dev, "Address of PP capability is NULL\n");
                 return;
         }
 
         if (enable)
-                snd_hdac_updatel(ebus->ppcap, AZX_REG_PP_PPCTL, 0, AZX_PPCTL_PIE);
+                snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, 0, AZX_PPCTL_PIE);
         else
-                snd_hdac_updatel(ebus->ppcap, AZX_REG_PP_PPCTL, AZX_PPCTL_PIE, 0);
+                snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, AZX_PPCTL_PIE, 0);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_bus_ppcap_int_enable);
 
@@ -171,7 +96,7 @@ int snd_hdac_ext_bus_get_ml_capabilities(struct hdac_ext_bus *ebus)
         struct hdac_ext_link *hlink;
         struct hdac_bus *bus = &ebus->bus;
 
-        link_count = readl(ebus->mlcap + AZX_REG_ML_MLCD) + 1;
+        link_count = readl(bus->mlcap + AZX_REG_ML_MLCD) + 1;
 
         dev_dbg(bus->dev, "In %s Link count: %d\n", __func__, link_count);
 
@@ -181,7 +106,7 @@ int snd_hdac_ext_bus_get_ml_capabilities(struct hdac_ext_bus *ebus)
                         return -ENOMEM;
                 hlink->index = idx;
                 hlink->bus = bus;
-                hlink->ml_addr = ebus->mlcap + AZX_ML_BASE +
+                hlink->ml_addr = bus->mlcap + AZX_ML_BASE +
                                         (AZX_ML_INTERVAL * idx);
                 hlink->lcaps  = readl(hlink->ml_addr + AZX_REG_ML_LCAP);
                 hlink->lsdiid = readw(hlink->ml_addr + AZX_REG_ML_LSDIID);
diff --git a/sound/hda/ext/hdac_ext_stream.c b/sound/hda/ext/hdac_ext_stream.c
index 626f3bb24c55..2441273adcef 100644
--- a/sound/hda/ext/hdac_ext_stream.c
+++ b/sound/hda/ext/hdac_ext_stream.c
@@ -40,27 +40,27 @@ void snd_hdac_ext_stream_init(struct hdac_ext_bus *ebus,
 {
         struct hdac_bus *bus = &ebus->bus;
 
-        if (ebus->ppcap) {
-                stream->pphc_addr = ebus->ppcap + AZX_PPHC_BASE +
+        if (bus->ppcap) {
+                stream->pphc_addr = bus->ppcap + AZX_PPHC_BASE +
                                 AZX_PPHC_INTERVAL * idx;
 
-                stream->pplc_addr = ebus->ppcap + AZX_PPLC_BASE +
+                stream->pplc_addr = bus->ppcap + AZX_PPLC_BASE +
                                 AZX_PPLC_MULTI * ebus->num_streams +
                                 AZX_PPLC_INTERVAL * idx;
         }
 
-        if (ebus->spbcap) {
-                stream->spib_addr = ebus->spbcap + AZX_SPB_BASE +
+        if (bus->spbcap) {
+                stream->spib_addr = bus->spbcap + AZX_SPB_BASE +
                                         AZX_SPB_INTERVAL * idx +
                                         AZX_SPB_SPIB;
 
-                stream->fifo_addr = ebus->spbcap + AZX_SPB_BASE +
+                stream->fifo_addr = bus->spbcap + AZX_SPB_BASE +
                                         AZX_SPB_INTERVAL * idx +
                                         AZX_SPB_MAXFIFO;
         }
 
-        if (ebus->drsmcap)
-                stream->dpibr_addr = ebus->drsmcap + AZX_DRSM_BASE +
+        if (bus->drsmcap)
+                stream->dpibr_addr = bus->drsmcap + AZX_DRSM_BASE +
                                         AZX_DRSM_INTERVAL * idx;
 
         stream->decoupled = false;
@@ -131,10 +131,10 @@ void snd_hdac_ext_stream_decouple(struct hdac_ext_bus *ebus,
 
         spin_lock_irq(&bus->reg_lock);
         if (decouple)
-                snd_hdac_updatel(ebus->ppcap, AZX_REG_PP_PPCTL, 0,
+                snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL, 0,
                                 AZX_PPCTL_PROCEN(hstream->index));
         else
-                snd_hdac_updatel(ebus->ppcap, AZX_REG_PP_PPCTL,
+                snd_hdac_updatel(bus->ppcap, AZX_REG_PP_PPCTL,
                                         AZX_PPCTL_PROCEN(hstream->index), 0);
         stream->decoupled = decouple;
         spin_unlock_irq(&bus->reg_lock);
@@ -255,7 +255,7 @@ hdac_ext_link_stream_assign(struct hdac_ext_bus *ebus,
         struct hdac_stream *stream = NULL;
         struct hdac_bus *hbus = &ebus->bus;
 
-        if (!ebus->ppcap) {
+        if (!hbus->ppcap) {
                 dev_err(hbus->dev, "stream type not supported\n");
                 return NULL;
         }
@@ -296,7 +296,7 @@ hdac_ext_host_stream_assign(struct hdac_ext_bus *ebus,
         struct hdac_stream *stream = NULL;
         struct hdac_bus *hbus = &ebus->bus;
 
-        if (!ebus->ppcap) {
+        if (!hbus->ppcap) {
                 dev_err(hbus->dev, "stream type not supported\n");
                 return NULL;
         }
@@ -423,21 +423,21 @@ void snd_hdac_ext_stream_spbcap_enable(struct hdac_ext_bus *ebus,
         u32 register_mask = 0;
         struct hdac_bus *bus = &ebus->bus;
 
-        if (!ebus->spbcap) {
+        if (!bus->spbcap) {
                 dev_err(bus->dev, "Address of SPB capability is NULL");
                 return;
         }
 
         mask |= (1 << index);
 
-        register_mask = readl(ebus->spbcap + AZX_REG_SPB_SPBFCCTL);
+        register_mask = readl(bus->spbcap + AZX_REG_SPB_SPBFCCTL);
 
         mask |= register_mask;
 
         if (enable)
-                snd_hdac_updatel(ebus->spbcap, AZX_REG_SPB_SPBFCCTL, 0, mask);
+                snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, 0, mask);
         else
-                snd_hdac_updatel(ebus->spbcap, AZX_REG_SPB_SPBFCCTL, mask, 0);
+                snd_hdac_updatel(bus->spbcap, AZX_REG_SPB_SPBFCCTL, mask, 0);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_stream_spbcap_enable);
 
@@ -452,7 +452,7 @@ int snd_hdac_ext_stream_set_spib(struct hdac_ext_bus *ebus,
 {
         struct hdac_bus *bus = &ebus->bus;
 
-        if (!ebus->spbcap) {
+        if (!bus->spbcap) {
                 dev_err(bus->dev, "Address of SPB capability is NULL");
                 return -EINVAL;
         }
@@ -475,7 +475,7 @@ int snd_hdac_ext_stream_get_spbmaxfifo(struct hdac_ext_bus *ebus,
 {
         struct hdac_bus *bus = &ebus->bus;
 
-        if (!ebus->spbcap) {
+        if (!bus->spbcap) {
                 dev_err(bus->dev, "Address of SPB capability is NULL");
                 return -EINVAL;
         }
@@ -515,21 +515,21 @@ void snd_hdac_ext_stream_drsm_enable(struct hdac_ext_bus *ebus,
         u32 register_mask = 0;
         struct hdac_bus *bus = &ebus->bus;
 
-        if (!ebus->drsmcap) {
+        if (!bus->drsmcap) {
                 dev_err(bus->dev, "Address of DRSM capability is NULL");
                 return;
         }
 
         mask |= (1 << index);
 
-        register_mask = readl(ebus->drsmcap + AZX_REG_SPB_SPBFCCTL);
+        register_mask = readl(bus->drsmcap + AZX_REG_SPB_SPBFCCTL);
 
         mask |= register_mask;
 
         if (enable)
-                snd_hdac_updatel(ebus->drsmcap, AZX_REG_DRSM_CTL, 0, mask);
+                snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, 0, mask);
         else
-                snd_hdac_updatel(ebus->drsmcap, AZX_REG_DRSM_CTL, mask, 0);
+                snd_hdac_updatel(bus->drsmcap, AZX_REG_DRSM_CTL, mask, 0);
 }
 EXPORT_SYMBOL_GPL(snd_hdac_ext_stream_drsm_enable);
 
@@ -544,7 +544,7 @@ int snd_hdac_ext_stream_set_dpibr(struct hdac_ext_bus *ebus,
 {
         struct hdac_bus *bus = &ebus->bus;
 
-        if (!ebus->drsmcap) {
+        if (!bus->drsmcap) {
                 dev_err(bus->dev, "Address of DRSM capability is NULL");
                 return -EINVAL;
         }
diff --git a/sound/hda/hdac_controller.c b/sound/hda/hdac_controller.c
index 9fee464e5d49..043065867656 100644
--- a/sound/hda/hdac_controller.c
+++ b/sound/hda/hdac_controller.c
@@ -255,6 +255,81 @@ int snd_hdac_bus_get_response(struct hdac_bus *bus, unsigned int addr,
 }
 EXPORT_SYMBOL_GPL(snd_hdac_bus_get_response);
 
+#define HDAC_MAX_CAPS 10
+/**
+ * snd_hdac_bus_parse_capabilities - parse capability structure
+ * @bus: the pointer to bus object
+ *
+ * Returns 0 if successful, or a negative error code.
+ */
+int snd_hdac_bus_parse_capabilities(struct hdac_bus *bus)
+{
+        unsigned int cur_cap;
+        unsigned int offset;
+        unsigned int counter = 0;
+
+        offset = snd_hdac_chip_readl(bus, LLCH);
+
+        /* Lets walk the linked capabilities list */
+        do {
+                cur_cap = _snd_hdac_chip_read(l, bus, offset);
+
+                dev_dbg(bus->dev, "Capability version: 0x%x\n",
+                        (cur_cap & AZX_CAP_HDR_VER_MASK) >> AZX_CAP_HDR_VER_OFF);
+
+                dev_dbg(bus->dev, "HDA capability ID: 0x%x\n",
+                        (cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF);
+
+                switch ((cur_cap & AZX_CAP_HDR_ID_MASK) >> AZX_CAP_HDR_ID_OFF) {
+                case AZX_ML_CAP_ID:
+                        dev_dbg(bus->dev, "Found ML capability\n");
+                        bus->mlcap = bus->remap_addr + offset;
+                        break;
+
+                case AZX_GTS_CAP_ID:
+                        dev_dbg(bus->dev, "Found GTS capability offset=%x\n", offset);
+                        bus->gtscap = bus->remap_addr + offset;
+                        break;
+
+                case AZX_PP_CAP_ID:
+                        /* PP capability found, the Audio DSP is present */
+                        dev_dbg(bus->dev, "Found PP capability offset=%x\n", offset);
+                        bus->ppcap = bus->remap_addr + offset;
+                        break;
+
+                case AZX_SPB_CAP_ID:
+                        /* SPIB capability found, handler function */
+                        dev_dbg(bus->dev, "Found SPB capability\n");
+                        bus->spbcap = bus->remap_addr + offset;
+                        break;
+
+                case AZX_DRSM_CAP_ID:
+                        /* DMA resume  capability found, handler function */
+                        dev_dbg(bus->dev, "Found DRSM capability\n");
+                        bus->drsmcap = bus->remap_addr + offset;
+                        break;
+
+                default:
+                        dev_dbg(bus->dev, "Unknown capability %d\n", cur_cap);
+                        break;
+                }
+
+                counter++;
+
+                if (counter > HDAC_MAX_CAPS) {
+                        dev_err(bus->dev, "We exceeded HDAC capabilities!!!\n");
+                        break;
+                }
+
+                /* read the offset of next capability */
+                offset = cur_cap & AZX_CAP_HDR_NXT_PTR_MASK;
+
+        } while (offset);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(snd_hdac_bus_parse_capabilities);
+
 /*
  * Lowlevel interface
  */
diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
index 27de8015717d..2ad3b447483f 100644
--- a/sound/pci/hda/hda_controller.c
+++ b/sound/pci/hda/hda_controller.c
@@ -27,6 +27,12 @@
 #include <linux/module.h>
 #include <linux/pm_runtime.h>
 #include <linux/slab.h>
+
+#ifdef CONFIG_X86
+/* for art-tsc conversion */
+#include <asm/tsc.h>
+#endif
+
 #include <sound/core.h>
 #include <sound/initval.h>
 #include "hda_controller.h"
@@ -337,12 +343,173 @@ static snd_pcm_uframes_t azx_pcm_pointer(struct snd_pcm_substream *substream)
                                azx_get_position(chip, azx_dev));
 }
 
+/*
+ * azx_scale64: Scale base by mult/div while not overflowing sanely
+ *
+ * Derived from scale64_check_overflow in kernel/time/timekeeping.c
+ *
+ * The tmestamps for a 48Khz stream can overflow after (2^64/10^9)/48K which
+ * is about 384307 ie ~4.5 days.
+ *
+ * This scales the calculation so that overflow will happen but after 2^64 /
+ * 48000 secs, which is pretty large!
+ *
+ * In caln below:
+ *      base may overflow, but since there isn’t any additional division
+ *      performed on base it’s OK
+ *      rem can’t overflow because both are 32-bit values
+ */
+
+#ifdef CONFIG_X86
+static u64 azx_scale64(u64 base, u32 num, u32 den)
+{
+        u64 rem;
+
+        rem = do_div(base, den);
+
+        base *= num;
+        rem *= num;
+
+        do_div(rem, den);
+
+        return base + rem;
+}
+
+static int azx_get_sync_time(ktime_t *device,
+                struct system_counterval_t *system, void *ctx)
+{
+        struct snd_pcm_substream *substream = ctx;
+        struct azx_dev *azx_dev = get_azx_dev(substream);
+        struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
+        struct azx *chip = apcm->chip;
+        struct snd_pcm_runtime *runtime;
+        u64 ll_counter, ll_counter_l, ll_counter_h;
+        u64 tsc_counter, tsc_counter_l, tsc_counter_h;
+        u32 wallclk_ctr, wallclk_cycles;
+        bool direction;
+        u32 dma_select;
+        u32 timeout = 200;
+        u32 retry_count = 0;
+
+        runtime = substream->runtime;
+
+        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
+                direction = 1;
+        else
+                direction = 0;
+
+        /* 0th stream tag is not used, so DMA ch 0 is for 1st stream tag */
+        do {
+                timeout = 100;
+                dma_select = (direction << GTSCC_CDMAS_DMA_DIR_SHIFT) |
+                                        (azx_dev->core.stream_tag - 1);
+                snd_hdac_chip_writel(azx_bus(chip), GTSCC, dma_select);
+
+                /* Enable the capture */
+                snd_hdac_chip_updatel(azx_bus(chip), GTSCC, 0, GTSCC_TSCCI_MASK);
+
+                while (timeout) {
+                        if (snd_hdac_chip_readl(azx_bus(chip), GTSCC) &
+                                                GTSCC_TSCCD_MASK)
+                                break;
+
+                        timeout--;
+                }
+
+                if (!timeout) {
+                        dev_err(chip->card->dev, "GTSCC capture Timedout!\n");
+                        return -EIO;
+                }
+
+                /* Read wall clock counter */
+                wallclk_ctr = snd_hdac_chip_readl(azx_bus(chip), WALFCC);
+
+                /* Read TSC counter */
+                tsc_counter_l = snd_hdac_chip_readl(azx_bus(chip), TSCCL);
+                tsc_counter_h = snd_hdac_chip_readl(azx_bus(chip), TSCCU);
+
+                /* Read Link counter */
+                ll_counter_l = snd_hdac_chip_readl(azx_bus(chip), LLPCL);
+                ll_counter_h = snd_hdac_chip_readl(azx_bus(chip), LLPCU);
+
+                /* Ack: registers read done */
+                snd_hdac_chip_writel(azx_bus(chip), GTSCC, GTSCC_TSCCD_SHIFT);
+
+                tsc_counter = (tsc_counter_h << TSCCU_CCU_SHIFT) |
+                                                tsc_counter_l;
+
+                ll_counter = (ll_counter_h << LLPC_CCU_SHIFT) | ll_counter_l;
+                wallclk_cycles = wallclk_ctr & WALFCC_CIF_MASK;
+
+                /*
+                 * An error occurs near frame "rollover". The clocks in
+                 * frame value indicates whether this error may have
+                 * occurred. Here we use the value of 10 i.e.,
+                 * HDA_MAX_CYCLE_OFFSET
+                 */
+                if (wallclk_cycles < HDA_MAX_CYCLE_VALUE - HDA_MAX_CYCLE_OFFSET
+                                        && wallclk_cycles > HDA_MAX_CYCLE_OFFSET)
+                        break;
+
+                /*
+                 * Sleep before we read again, else we may again get
+                 * value near to MAX_CYCLE. Try to sleep for different
+                 * amount of time so we dont hit the same number again
+                 */
+                udelay(retry_count++);
+
+        } while (retry_count != HDA_MAX_CYCLE_READ_RETRY);
+
+        if (retry_count == HDA_MAX_CYCLE_READ_RETRY) {
+                dev_err_ratelimited(chip->card->dev,
+                        "Error in WALFCC cycle count\n");
+                return -EIO;
+        }
+
+        *device = ns_to_ktime(azx_scale64(ll_counter,
+                                NSEC_PER_SEC, runtime->rate));
+        *device = ktime_add_ns(*device, (wallclk_cycles * NSEC_PER_SEC) /
+                               ((HDA_MAX_CYCLE_VALUE + 1) * runtime->rate));
+
+        *system = convert_art_to_tsc(tsc_counter);
+
+        return 0;
+}
+
+#else
+static int azx_get_sync_time(ktime_t *device,
+                struct system_counterval_t *system, void *ctx)
+{
+        return -ENXIO;
+}
+#endif
+
+static int azx_get_crosststamp(struct snd_pcm_substream *substream,
+                              struct system_device_crosststamp *xtstamp)
+{
+        return get_device_system_crosststamp(azx_get_sync_time,
+                                        substream, NULL, xtstamp);
+}
+
+static inline bool is_link_time_supported(struct snd_pcm_runtime *runtime,
+                                struct snd_pcm_audio_tstamp_config *ts)
+{
+        if (runtime->hw.info & SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME)
+                if (ts->type_requested == SNDRV_PCM_AUDIO_TSTAMP_TYPE_LINK_SYNCHRONIZED)
+                        return true;
+
+        return false;
+}
+
 static int azx_get_time_info(struct snd_pcm_substream *substream,
                         struct timespec *system_ts, struct timespec *audio_ts,
                         struct snd_pcm_audio_tstamp_config *audio_tstamp_config,
                         struct snd_pcm_audio_tstamp_report *audio_tstamp_report)
 {
         struct azx_dev *azx_dev = get_azx_dev(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct system_device_crosststamp xtstamp;
+        int ret;
         u64 nsec;
 
         if ((substream->runtime->hw.info & SNDRV_PCM_INFO_HAS_LINK_ATIME) &&
@@ -361,8 +528,37 @@ static int azx_get_time_info(struct snd_pcm_substream *substream,
                 audio_tstamp_report->accuracy_report = 1; /* rest of structure is valid */
                 audio_tstamp_report->accuracy = 42; /* 24 MHz WallClock == 42ns resolution */
 
-        } else
+        } else if (is_link_time_supported(runtime, audio_tstamp_config)) {
+
+                ret = azx_get_crosststamp(substream, &xtstamp);
+                if (ret)
+                        return ret;
+
+                switch (runtime->tstamp_type) {
+                case SNDRV_PCM_TSTAMP_TYPE_MONOTONIC:
+                        return -EINVAL;
+
+                case SNDRV_PCM_TSTAMP_TYPE_MONOTONIC_RAW:
+                        *system_ts = ktime_to_timespec(xtstamp.sys_monoraw);
+                        break;
+
+                default:
+                        *system_ts = ktime_to_timespec(xtstamp.sys_realtime);
+                        break;
+
+                }
+
+                *audio_ts = ktime_to_timespec(xtstamp.device);
+
+                audio_tstamp_report->actual_type =
+                        SNDRV_PCM_AUDIO_TSTAMP_TYPE_LINK_SYNCHRONIZED;
+                audio_tstamp_report->accuracy_report = 1;
+                /* 24 MHz WallClock == 42ns resolution */
+                audio_tstamp_report->accuracy = 42;
+
+        } else {
                 audio_tstamp_report->actual_type = SNDRV_PCM_AUDIO_TSTAMP_TYPE_DEFAULT;
+        }
 
         return 0;
 }
@@ -412,6 +608,11 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
                 goto unlock;
         }
         runtime->private_data = azx_dev;
+
+        if (chip->gts_present)
+                azx_pcm_hw.info = azx_pcm_hw.info |
+                        SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME;
+
         runtime->hw = azx_pcm_hw;
         runtime->hw.channels_min = hinfo->channels_min;
         runtime->hw.channels_max = hinfo->channels_max;
diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
index ec63bbf1ec6d..a50e0532622a 100644
--- a/sound/pci/hda/hda_controller.h
+++ b/sound/pci/hda/hda_controller.h
@@ -159,6 +159,9 @@ struct azx {
         unsigned int region_requested:1;
         unsigned int disabled:1; /* disabled by vga_switcheroo */
 
+        /* GTS present */
+        unsigned int gts_present:1;
+
 #ifdef CONFIG_SND_HDA_DSP_LOADER
         struct azx_dev saved_azx_dev;
 #endif
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 89dacf9b4e6c..c3469f756ec2 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -54,6 +54,7 @@
 /* for snoop control */
 #include <asm/pgtable.h>
 #include <asm/cacheflush.h>
+#include <asm/cpufeature.h>
 #endif
 #include <sound/core.h>
 #include <sound/initval.h>
@@ -906,20 +907,23 @@ static int azx_resume(struct device *dev)
         struct snd_card *card = dev_get_drvdata(dev);
         struct azx *chip;
         struct hda_intel *hda;
+        struct hdac_bus *bus;
 
         if (!card)
                 return 0;
 
         chip = card->private_data;
         hda = container_of(chip, struct hda_intel, chip);
+        bus = azx_bus(chip);
         if (chip->disabled || hda->init_failed || !chip->running)
                 return 0;
 
-        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL
-                && hda->need_i915_power) {
-                snd_hdac_display_power(azx_bus(chip), true);
-                snd_hdac_i915_set_bclk(azx_bus(chip));
+        if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
+                snd_hdac_display_power(bus, true);
+                if (hda->need_i915_power)
+                        snd_hdac_i915_set_bclk(bus);
         }
+
         if (chip->msi)
                 if (pci_enable_msi(pci) < 0)
                         chip->msi = 0;
@@ -929,6 +933,11 @@ static int azx_resume(struct device *dev)
 
         hda_intel_init_chip(chip, true);
 
+        /* power down again for link-controlled chips */
+        if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) &&
+            !hda->need_i915_power)
+                snd_hdac_display_power(bus, false);
+
         snd_power_change_state(card, SNDRV_CTL_POWER_D0);
 
         trace_azx_resume(chip);
@@ -1008,6 +1017,7 @@ static int azx_runtime_resume(struct device *dev)
 
         chip = card->private_data;
         hda = container_of(chip, struct hda_intel, chip);
+        bus = azx_bus(chip);
         if (chip->disabled || hda->init_failed)
                 return 0;
 
@@ -1015,15 +1025,9 @@ static int azx_runtime_resume(struct device *dev)
                 return 0;
 
         if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) {
-                bus = azx_bus(chip);
-                if (hda->need_i915_power) {
-                        snd_hdac_display_power(bus, true);
+                snd_hdac_display_power(bus, true);
+                if (hda->need_i915_power)
                         snd_hdac_i915_set_bclk(bus);
-                } else {
-                        /* toggle codec wakeup bit for STATESTS read */
-                        snd_hdac_set_codec_wakeup(bus, true);
-                        snd_hdac_set_codec_wakeup(bus, false);
-                }
         }
 
         /* Read STATESTS before controller reset */
@@ -1043,6 +1047,11 @@ static int azx_runtime_resume(struct device *dev)
         azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) &
                         ~STATESTS_INT_MASK);
 
+        /* power down again for link-controlled chips */
+        if ((chip->driver_caps & AZX_DCAPS_I915_POWERWELL) &&
+            !hda->need_i915_power)
+                snd_hdac_display_power(bus, false);
+
         trace_azx_runtime_resume(chip);
         return 0;
 }
@@ -1655,6 +1664,22 @@ static int azx_first_init(struct azx *chip)
                 return -ENXIO;
         }
 
+        if (IS_SKL_PLUS(pci))
+                snd_hdac_bus_parse_capabilities(bus);
+
+        /*
+         * Some Intel CPUs has always running timer (ART) feature and
+         * controller may have Global time sync reporting capability, so
+         * check both of these before declaring synchronized time reporting
+         * capability SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME
+         */
+        chip->gts_present = false;
+
+#ifdef CONFIG_X86
+        if (bus->ppcap && boot_cpu_has(X86_FEATURE_ART))
+                chip->gts_present = true;
+#endif
+
         if (chip->msi) {
                 if (chip->driver_caps & AZX_DCAPS_NO_MSI64) {
                         dev_dbg(card->dev, "Disabling 64bit MSI\n");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 574b1b48996f..575cefd8cc4a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4828,7 +4828,7 @@ enum {
         ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
         ALC292_FIXUP_TPT440_DOCK,
         ALC292_FIXUP_TPT440,
-        ALC283_FIXUP_BXBT2807_MIC,
+        ALC283_FIXUP_HEADSET_MIC,
         ALC255_FIXUP_DELL_WMI_MIC_MUTE_LED,
         ALC282_FIXUP_ASPIRE_V5_PINS,
         ALC280_FIXUP_HP_GPIO4,
@@ -4855,6 +4855,7 @@ enum {
         ALC221_FIXUP_HP_FRONT_MIC,
         ALC292_FIXUP_TPT460,
         ALC298_FIXUP_SPK_VOLUME,
+        ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -5321,7 +5322,7 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC292_FIXUP_TPT440_DOCK,
         },
-        [ALC283_FIXUP_BXBT2807_MIC] = {
+        [ALC283_FIXUP_HEADSET_MIC] = {
                 .type = HDA_FIXUP_PINS,
                 .v.pins = (const struct hda_pintbl[]) {
                         { 0x19, 0x04a110f0 },
@@ -5516,6 +5517,15 @@ static const struct hda_fixup alc269_fixups[] = {
                 .chained = true,
                 .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
         },
+        [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
+                .type = HDA_FIXUP_PINS,
+                .v.pins = (const struct hda_pintbl[]) {
+                        { 0x1b, 0x90170151 },
+                        { }
+                },
+                .chained = true,
+                .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+        },
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -5560,6 +5570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x06df, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
         SND_PCI_QUIRK(0x1028, 0x06e0, "Dell", ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK),
         SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+        SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
         SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
         SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
@@ -5651,7 +5662,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
         SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
         SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
-        SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC),
+        SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
+        SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
         SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
@@ -5894,6 +5906,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
                 {0x12, 0x90a60170},
                 {0x14, 0x90170120},
                 {0x21, 0x02211030}),
+        SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+                {0x12, 0x90a60180},
+                {0x14, 0x90170120},
+                {0x21, 0x02211030}),
         SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
                 ALC256_STANDARD_PINS),
         SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
diff --git a/sound/soc/amd/acp-pcm-dma.c b/sound/soc/amd/acp-pcm-dma.c
index d1fb035f44db..504c7cd7f58a 100644
--- a/sound/soc/amd/acp-pcm-dma.c
+++ b/sound/soc/amd/acp-pcm-dma.c
@@ -897,7 +897,7 @@ static int acp_dma_close(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static struct snd_pcm_ops acp_dma_ops = {
+static const struct snd_pcm_ops acp_dma_ops = {
         .open = acp_dma_open,
         .close = acp_dma_close,
         .ioctl = snd_pcm_lib_ioctl,
diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c
index 6d9b8b44e2da..89ac5f5a93eb 100644
--- a/sound/soc/atmel/atmel-classd.c
+++ b/sound/soc/atmel/atmel-classd.c
@@ -308,9 +308,11 @@ static struct regmap *atmel_classd_codec_get_remap(struct device *dev)
 
 static struct snd_soc_codec_driver soc_codec_dev_classd = {
         .probe          = atmel_classd_codec_probe,
-        .controls       = atmel_classd_snd_controls,
-        .num_controls   = ARRAY_SIZE(atmel_classd_snd_controls),
         .get_regmap     = atmel_classd_codec_get_remap,
+        .component_driver = {
+                .controls               = atmel_classd_snd_controls,
+                .num_controls           = ARRAY_SIZE(atmel_classd_snd_controls),
+        },
 };
 
 /* codec dai component */
diff --git a/sound/soc/atmel/atmel-pcm-pdc.c b/sound/soc/atmel/atmel-pcm-pdc.c
index da861b44413f..91b7069c3499 100644
--- a/sound/soc/atmel/atmel-pcm-pdc.c
+++ b/sound/soc/atmel/atmel-pcm-pdc.c
@@ -381,7 +381,7 @@ static int atmel_pcm_close(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static struct snd_pcm_ops atmel_pcm_ops = {
+static const struct snd_pcm_ops atmel_pcm_ops = {
         .open           = atmel_pcm_open,
         .close          = atmel_pcm_close,
         .ioctl          = snd_pcm_lib_ioctl,
diff --git a/sound/soc/atmel/atmel-pdmic.c b/sound/soc/atmel/atmel-pdmic.c
index 5f56da60c92f..c917df7715d1 100644
--- a/sound/soc/atmel/atmel-pdmic.c
+++ b/sound/soc/atmel/atmel-pdmic.c
@@ -80,7 +80,7 @@ static struct atmel_pdmic_pdata *atmel_pdmic_dt_init(struct device *dev)
 
         if (pdata->mic_max_freq < pdata->mic_min_freq) {
                 dev_err(dev,
-                        "mic-max-freq should not less than mic-min-freq\n");
+                        "mic-max-freq should not be less than mic-min-freq\n");
                 return ERR_PTR(-EINVAL);
         }
 
@@ -115,8 +115,10 @@ static int atmel_pdmic_cpu_dai_startup(struct snd_pcm_substream *substream,
                 return ret;
 
         ret =  clk_prepare_enable(dd->pclk);
-        if (ret)
+        if (ret) {
+                clk_disable_unprepare(dd->gclk);
                 return ret;
+        }
 
         /* Clear all bits in the Control Register(PDMIC_CR) */
         regmap_write(dd->regmap, PDMIC_CR, 0);
@@ -283,7 +285,7 @@ static const DECLARE_TLV_DB_RANGE(mic_gain_tlv,
         8, ARRAY_SIZE(mic_gain_table)-1, TLV_DB_SCALE_ITEM(-6500, 100, 0),
 );
 
-int pdmic_get_mic_volsw(struct snd_kcontrol *kcontrol,
+static int pdmic_get_mic_volsw(struct snd_kcontrol *kcontrol,
         struct snd_ctl_elem_value *ucontrol)
 {
         struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
@@ -357,8 +359,10 @@ static int atmel_pdmic_codec_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver soc_codec_dev_pdmic = {
         .probe          = atmel_pdmic_codec_probe,
-        .controls       = atmel_pdmic_snd_controls,
-        .num_controls   = ARRAY_SIZE(atmel_pdmic_snd_controls),
+        .component_driver = {
+                .controls               = atmel_pdmic_snd_controls,
+                .num_controls           = ARRAY_SIZE(atmel_pdmic_snd_controls),
+        },
 };
 
 /* codec dai component */
@@ -596,7 +600,7 @@ static int atmel_pdmic_probe(struct platform_device *pdev)
         dd->irq = platform_get_irq(pdev, 0);
         if (dd->irq < 0) {
                 ret = dd->irq;
-                dev_err(dev, "failed to could not get irq: %d\n", ret);
+                dev_err(dev, "failed to get irq: %d\n", ret);
                 return ret;
         }
 
@@ -614,7 +618,7 @@ static int atmel_pdmic_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        /* The gclk clock frequency must always be tree times
+        /* The gclk clock frequency must always be three times
          * lower than the pclk clock frequency
          */
         ret = clk_set_rate(dd->gclk, clk_get_rate(dd->pclk)/3);
@@ -649,7 +653,7 @@ static int atmel_pdmic_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        /* Get the minimal and maximal sample rate that micphone supports */
+        /* Get the minimal and maximal sample rate that the microphone supports */
         atmel_pdmic_get_sample_rate(dd, &rate_min, &rate_max);
 
         /* register cpu dai */
diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
index 54c09acd3fed..16e459aedffe 100644
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -299,8 +299,9 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream,
         clk_enable(ssc_p->ssc->clk);
         ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
 
-        /* Reset the SSC to keep it at a clean status */
-        ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
+        /* Reset the SSC unless initialized to keep it in a clean state */
+        if (!ssc_p->initialized)
+                ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 dir = 0;
diff --git a/sound/soc/codecs/88pm860x-codec.c b/sound/soc/codecs/88pm860x-codec.c
index e8bed6b0c9db..b013a4c62b63 100644
--- a/sound/soc/codecs/88pm860x-codec.c
+++ b/sound/soc/codecs/88pm860x-codec.c
@@ -1361,12 +1361,14 @@ static struct snd_soc_codec_driver soc_codec_dev_pm860x = {
         .set_bias_level = pm860x_set_bias_level,
         .get_regmap     = pm860x_get_regmap,
 
-        .controls = pm860x_snd_controls,
-        .num_controls = ARRAY_SIZE(pm860x_snd_controls),
-        .dapm_widgets = pm860x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(pm860x_dapm_widgets),
-        .dapm_routes = pm860x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(pm860x_dapm_routes),
+        .component_driver = {
+                .controls               = pm860x_snd_controls,
+                .num_controls           = ARRAY_SIZE(pm860x_snd_controls),
+                .dapm_widgets           = pm860x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(pm860x_dapm_widgets),
+                .dapm_routes            = pm860x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(pm860x_dapm_routes),
+        },
 };
 
 static int pm860x_codec_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 1cd6ab344d67..c67667bb970f 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -92,6 +92,7 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_MAX9877 if I2C
         select SND_SOC_MC13783 if MFD_MC13XXX
         select SND_SOC_ML26124 if I2C
+        select SND_SOC_NAU8810 if I2C
         select SND_SOC_NAU8825 if I2C
         select SND_SOC_HDMI_CODEC
         select SND_SOC_PCM1681 if I2C
@@ -112,6 +113,8 @@ config SND_SOC_ALL_CODECS
         select SND_SOC_RT5645 if I2C
         select SND_SOC_RT5651 if I2C
         select SND_SOC_RT5659 if I2C
+        select SND_SOC_RT5660 if I2C
+        select SND_SOC_RT5663 if I2C
         select SND_SOC_RT5670 if I2C
         select SND_SOC_RT5677 if I2C && SPI_MASTER
         select SND_SOC_SGTL5000 if I2C
@@ -645,6 +648,8 @@ config SND_SOC_RL6231
         default y if SND_SOC_RT5645=y
         default y if SND_SOC_RT5651=y
         default y if SND_SOC_RT5659=y
+        default y if SND_SOC_RT5660=y
+        default y if SND_SOC_RT5663=y
         default y if SND_SOC_RT5670=y
         default y if SND_SOC_RT5677=y
         default m if SND_SOC_RT5514=m
@@ -653,6 +658,8 @@ config SND_SOC_RL6231
         default m if SND_SOC_RT5645=m
         default m if SND_SOC_RT5651=m
         default m if SND_SOC_RT5659=m
+        default m if SND_SOC_RT5660=m
+        default m if SND_SOC_RT5663=m
         default m if SND_SOC_RT5670=m
         default m if SND_SOC_RT5677=m
 
@@ -665,6 +672,7 @@ config SND_SOC_RL6347A
 
 config SND_SOC_RT286
         tristate
+        select SND_SOC_RT5663
         depends on I2C
 
 config SND_SOC_RT298
@@ -697,6 +705,12 @@ config SND_SOC_RT5651
 config SND_SOC_RT5659
         tristate
 
+config SND_SOC_RT5660
+        tristate
+
+config SND_SOC_RT5663
+        tristate
+
 config SND_SOC_RT5670
         tristate
 
@@ -1064,6 +1078,10 @@ config SND_SOC_MC13783
 config SND_SOC_ML26124
         tristate
 
+config SND_SOC_NAU8810
+        tristate "Nuvoton Technology Corporation NAU88C10 CODEC"
+        depends on I2C
+
 config SND_SOC_NAU8825
         tristate
 
diff --git a/sound/soc/codecs/Makefile b/sound/soc/codecs/Makefile
index 58036af2c7d9..958cd4912fbc 100644
--- a/sound/soc/codecs/Makefile
+++ b/sound/soc/codecs/Makefile
@@ -86,6 +86,7 @@ snd-soc-max9850-objs := max9850.o
 snd-soc-max9860-objs := max9860.o
 snd-soc-mc13783-objs := mc13783.o
 snd-soc-ml26124-objs := ml26124.o
+snd-soc-nau8810-objs := nau8810.o
 snd-soc-nau8825-objs := nau8825.o
 snd-soc-hdmi-codec-objs := hdmi-codec.o
 snd-soc-pcm1681-objs := pcm1681.o
@@ -112,6 +113,8 @@ snd-soc-rt5640-objs := rt5640.o
 snd-soc-rt5645-objs := rt5645.o
 snd-soc-rt5651-objs := rt5651.o
 snd-soc-rt5659-objs := rt5659.o
+snd-soc-rt5660-objs := rt5660.o
+snd-soc-rt5663-objs := rt5663.o
 snd-soc-rt5670-objs := rt5670.o
 snd-soc-rt5677-objs := rt5677.o
 snd-soc-rt5677-spi-objs := rt5677-spi.o
@@ -307,6 +310,7 @@ obj-$(CONFIG_SND_SOC_MAX9850)	+= snd-soc-max9850.o
 obj-$(CONFIG_SND_SOC_MAX9860)   += snd-soc-max9860.o
 obj-$(CONFIG_SND_SOC_MC13783)   += snd-soc-mc13783.o
 obj-$(CONFIG_SND_SOC_ML26124)   += snd-soc-ml26124.o
+obj-$(CONFIG_SND_SOC_NAU8810)   += snd-soc-nau8810.o
 obj-$(CONFIG_SND_SOC_NAU8825)   += snd-soc-nau8825.o
 obj-$(CONFIG_SND_SOC_HDMI_CODEC)        += snd-soc-hdmi-codec.o
 obj-$(CONFIG_SND_SOC_PCM1681)   += snd-soc-pcm1681.o
@@ -333,6 +337,8 @@ obj-$(CONFIG_SND_SOC_RT5640)	+= snd-soc-rt5640.o
 obj-$(CONFIG_SND_SOC_RT5645)    += snd-soc-rt5645.o
 obj-$(CONFIG_SND_SOC_RT5651)    += snd-soc-rt5651.o
 obj-$(CONFIG_SND_SOC_RT5659)    += snd-soc-rt5659.o
+obj-$(CONFIG_SND_SOC_RT5660)    += snd-soc-rt5660.o
+obj-$(CONFIG_SND_SOC_RT5663)    += snd-soc-rt5663.o
 obj-$(CONFIG_SND_SOC_RT5670)    += snd-soc-rt5670.o
 obj-$(CONFIG_SND_SOC_RT5677)    += snd-soc-rt5677.o
 obj-$(CONFIG_SND_SOC_RT5677_SPI)        += snd-soc-rt5677-spi.o
diff --git a/sound/soc/codecs/ab8500-codec.c b/sound/soc/codecs/ab8500-codec.c
index 2fc89155f14a..935ff7cb71c5 100644
--- a/sound/soc/codecs/ab8500-codec.c
+++ b/sound/soc/codecs/ab8500-codec.c
@@ -2408,28 +2408,28 @@ static void ab8500_codec_of_probe(struct device *dev, struct device_node *np,
 {
         u32 value;
 
-        if (of_get_property(np, "stericsson,amic1-type-single-ended", NULL))
+        if (of_property_read_bool(np, "stericsson,amic1-type-single-ended"))
                 codec->amics.mic1_type = AMIC_TYPE_SINGLE_ENDED;
         else
                 codec->amics.mic1_type = AMIC_TYPE_DIFFERENTIAL;
 
-        if (of_get_property(np, "stericsson,amic2-type-single-ended", NULL))
+        if (of_property_read_bool(np, "stericsson,amic2-type-single-ended"))
                 codec->amics.mic2_type = AMIC_TYPE_SINGLE_ENDED;
         else
                 codec->amics.mic2_type = AMIC_TYPE_DIFFERENTIAL;
 
         /* Has a non-standard Vamic been requested? */
-        if (of_get_property(np, "stericsson,amic1a-bias-vamic2", NULL))
+        if (of_property_read_bool(np, "stericsson,amic1a-bias-vamic2"))
                 codec->amics.mic1a_micbias = AMIC_MICBIAS_VAMIC2;
         else
                 codec->amics.mic1a_micbias = AMIC_MICBIAS_VAMIC1;
 
-        if (of_get_property(np, "stericsson,amic1b-bias-vamic2", NULL))
+        if (of_property_read_bool(np, "stericsson,amic1b-bias-vamic2"))
                 codec->amics.mic1b_micbias = AMIC_MICBIAS_VAMIC2;
         else
                 codec->amics.mic1b_micbias = AMIC_MICBIAS_VAMIC1;
 
-        if (of_get_property(np, "stericsson,amic2-bias-vamic1", NULL))
+        if (of_property_read_bool(np, "stericsson,amic2-bias-vamic1"))
                 codec->amics.mic2_micbias = AMIC_MICBIAS_VAMIC1;
         else
                 codec->amics.mic2_micbias = AMIC_MICBIAS_VAMIC2;
@@ -2525,12 +2525,14 @@ static int ab8500_codec_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver ab8500_codec_driver = {
         .probe =                ab8500_codec_probe,
-        .controls =             ab8500_ctrls,
-        .num_controls =         ARRAY_SIZE(ab8500_ctrls),
-        .dapm_widgets =         ab8500_dapm_widgets,
-        .num_dapm_widgets =     ARRAY_SIZE(ab8500_dapm_widgets),
-        .dapm_routes =          ab8500_dapm_routes,
-        .num_dapm_routes =      ARRAY_SIZE(ab8500_dapm_routes),
+        .component_driver = {
+                .controls =             ab8500_ctrls,
+                .num_controls =         ARRAY_SIZE(ab8500_ctrls),
+                .dapm_widgets =         ab8500_dapm_widgets,
+                .num_dapm_widgets =     ARRAY_SIZE(ab8500_dapm_widgets),
+                .dapm_routes =          ab8500_dapm_routes,
+                .num_dapm_routes =      ARRAY_SIZE(ab8500_dapm_routes),
+        },
 };
 
 static int ab8500_codec_driver_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/ac97.c b/sound/soc/codecs/ac97.c
index 5b3224c63943..f7f04c6be01e 100644
--- a/sound/soc/codecs/ac97.c
+++ b/sound/soc/codecs/ac97.c
@@ -117,10 +117,12 @@ static struct snd_soc_codec_driver soc_codec_dev_ac97 = {
         .suspend =      ac97_soc_suspend,
         .resume =       ac97_soc_resume,
 
-        .dapm_widgets = ac97_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ac97_widgets),
-        .dapm_routes = ac97_routes,
-        .num_dapm_routes = ARRAY_SIZE(ac97_routes),
+        .component_driver = {
+                .dapm_widgets           = ac97_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ac97_widgets),
+                .dapm_routes            = ac97_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ac97_routes),
+        },
 };
 
 static int ac97_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/ad1836.c b/sound/soc/codecs/ad1836.c
index e2ce6c4d7ece..a478239aadac 100644
--- a/sound/soc/codecs/ad1836.c
+++ b/sound/soc/codecs/ad1836.c
@@ -327,12 +327,14 @@ static struct snd_soc_codec_driver soc_codec_dev_ad1836 = {
         .suspend = ad1836_suspend,
         .resume = ad1836_resume,
 
-        .controls = ad183x_controls,
-        .num_controls = ARRAY_SIZE(ad183x_controls),
-        .dapm_widgets = ad183x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ad183x_dapm_widgets),
-        .dapm_routes = ad183x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(ad183x_dapm_routes),
+        .component_driver = {
+                .controls               = ad183x_controls,
+                .num_controls           = ARRAY_SIZE(ad183x_controls),
+                .dapm_widgets           = ad183x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ad183x_dapm_widgets),
+                .dapm_routes            = ad183x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ad183x_dapm_routes),
+        },
 };
 
 static const struct reg_default ad1836_reg_defaults[] = {
diff --git a/sound/soc/codecs/ad193x.c b/sound/soc/codecs/ad193x.c
index 3a3f3f2343d7..d643557d89a7 100644
--- a/sound/soc/codecs/ad193x.c
+++ b/sound/soc/codecs/ad193x.c
@@ -410,12 +410,14 @@ static int ad193x_codec_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver soc_codec_dev_ad193x = {
         .probe = ad193x_codec_probe,
-        .controls = ad193x_snd_controls,
-        .num_controls = ARRAY_SIZE(ad193x_snd_controls),
-        .dapm_widgets = ad193x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ad193x_dapm_widgets),
-        .dapm_routes = audio_paths,
-        .num_dapm_routes = ARRAY_SIZE(audio_paths),
+        .component_driver = {
+                .controls               = ad193x_snd_controls,
+                .num_controls           = ARRAY_SIZE(ad193x_snd_controls),
+                .dapm_widgets           = ad193x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ad193x_dapm_widgets),
+                .dapm_routes            = audio_paths,
+                .num_dapm_routes        = ARRAY_SIZE(audio_paths),
+        },
 };
 
 const struct regmap_config ad193x_regmap_config = {
diff --git a/sound/soc/codecs/ad1980.c b/sound/soc/codecs/ad1980.c
index 9ef20dbccbe3..b7c1b9f4bf5f 100644
--- a/sound/soc/codecs/ad1980.c
+++ b/sound/soc/codecs/ad1980.c
@@ -299,12 +299,14 @@ static struct snd_soc_codec_driver soc_codec_dev_ad1980 = {
         .probe =        ad1980_soc_probe,
         .remove =       ad1980_soc_remove,
 
-        .controls = ad1980_snd_ac97_controls,
-        .num_controls = ARRAY_SIZE(ad1980_snd_ac97_controls),
-        .dapm_widgets = ad1980_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ad1980_dapm_widgets),
-        .dapm_routes = ad1980_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(ad1980_dapm_routes),
+        .component_driver = {
+                .controls               = ad1980_snd_ac97_controls,
+                .num_controls           = ARRAY_SIZE(ad1980_snd_ac97_controls),
+                .dapm_widgets           = ad1980_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ad1980_dapm_widgets),
+                .dapm_routes            = ad1980_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ad1980_dapm_routes),
+        },
 };
 
 static int ad1980_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/ad73311.c b/sound/soc/codecs/ad73311.c
index a9400aef60b5..3e358a49442d 100644
--- a/sound/soc/codecs/ad73311.c
+++ b/sound/soc/codecs/ad73311.c
@@ -55,10 +55,12 @@ static struct snd_soc_dai_driver ad73311_dai = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_ad73311 = {
-        .dapm_widgets = ad73311_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ad73311_dapm_widgets),
-        .dapm_routes = ad73311_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(ad73311_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = ad73311_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ad73311_dapm_widgets),
+                .dapm_routes            = ad73311_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ad73311_dapm_routes),
+        },
 };
 
 static int ad73311_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/adau1373.c b/sound/soc/codecs/adau1373.c
index 1556b360fa15..8fa9045571ff 100644
--- a/sound/soc/codecs/adau1373.c
+++ b/sound/soc/codecs/adau1373.c
@@ -1466,12 +1466,14 @@ static struct snd_soc_codec_driver adau1373_codec_driver = {
 
         .set_pll = adau1373_set_pll,
 
-        .controls = adau1373_controls,
-        .num_controls = ARRAY_SIZE(adau1373_controls),
-        .dapm_widgets = adau1373_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(adau1373_dapm_widgets),
-        .dapm_routes = adau1373_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(adau1373_dapm_routes),
+        .component_driver = {
+                .controls               = adau1373_controls,
+                .num_controls           = ARRAY_SIZE(adau1373_controls),
+                .dapm_widgets           = adau1373_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(adau1373_dapm_widgets),
+                .dapm_routes            = adau1373_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(adau1373_dapm_routes),
+        },
 };
 
 static int adau1373_i2c_probe(struct i2c_client *client,
diff --git a/sound/soc/codecs/adau1701.c b/sound/soc/codecs/adau1701.c
index de53c0d7bf10..3bad1bc8c00a 100644
--- a/sound/soc/codecs/adau1701.c
+++ b/sound/soc/codecs/adau1701.c
@@ -765,13 +765,14 @@ static struct snd_soc_codec_driver adau1701_codec_drv = {
         .set_bias_level         = adau1701_set_bias_level,
         .idle_bias_off          = true,
 
-        .controls               = adau1701_controls,
-        .num_controls           = ARRAY_SIZE(adau1701_controls),
-        .dapm_widgets           = adau1701_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(adau1701_dapm_widgets),
-        .dapm_routes            = adau1701_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(adau1701_dapm_routes),
-
+        .component_driver = {
+                .controls               = adau1701_controls,
+                .num_controls           = ARRAY_SIZE(adau1701_controls),
+                .dapm_widgets           = adau1701_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(adau1701_dapm_widgets),
+                .dapm_routes            = adau1701_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(adau1701_dapm_routes),
+        },
         .set_sysclk             = adau1701_set_sysclk,
 };
 
diff --git a/sound/soc/codecs/adau1761.c b/sound/soc/codecs/adau1761.c
index b95d29dbd13d..3bc3cc559dde 100644
--- a/sound/soc/codecs/adau1761.c
+++ b/sound/soc/codecs/adau1761.c
@@ -719,12 +719,14 @@ static const struct snd_soc_codec_driver adau1761_codec_driver = {
         .set_bias_level = adau1761_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = adau1761_controls,
-        .num_controls = ARRAY_SIZE(adau1761_controls),
-        .dapm_widgets = adau1x61_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(adau1x61_dapm_widgets),
-        .dapm_routes = adau1x61_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(adau1x61_dapm_routes),
+        .component_driver = {
+                .controls               = adau1761_controls,
+                .num_controls           = ARRAY_SIZE(adau1761_controls),
+                .dapm_widgets           = adau1x61_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(adau1x61_dapm_widgets),
+                .dapm_routes            = adau1x61_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(adau1x61_dapm_routes),
+        },
 };
 
 #define ADAU1761_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE | \
diff --git a/sound/soc/codecs/adau1781.c b/sound/soc/codecs/adau1781.c
index bc1bb56dae63..546071c6c0d0 100644
--- a/sound/soc/codecs/adau1781.c
+++ b/sound/soc/codecs/adau1781.c
@@ -432,12 +432,14 @@ static const struct snd_soc_codec_driver adau1781_codec_driver = {
         .set_bias_level = adau1781_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = adau1781_controls,
-        .num_controls = ARRAY_SIZE(adau1781_controls),
-        .dapm_widgets = adau1781_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(adau1781_dapm_widgets),
-        .dapm_routes = adau1781_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(adau1781_dapm_routes),
+        .component_driver = {
+                .controls               = adau1781_controls,
+                .num_controls           = ARRAY_SIZE(adau1781_controls),
+                .dapm_widgets           = adau1781_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(adau1781_dapm_widgets),
+                .dapm_routes            = adau1781_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(adau1781_dapm_routes),
+        },
 };
 
 #define ADAU1781_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE | \
diff --git a/sound/soc/codecs/adau1977.c b/sound/soc/codecs/adau1977.c
index 9bdd15f408c1..b319db6a69f8 100644
--- a/sound/soc/codecs/adau1977.c
+++ b/sound/soc/codecs/adau1977.c
@@ -873,12 +873,14 @@ static struct snd_soc_codec_driver adau1977_codec_driver = {
         .set_sysclk = adau1977_set_sysclk,
         .idle_bias_off = true,
 
-        .controls = adau1977_snd_controls,
-        .num_controls = ARRAY_SIZE(adau1977_snd_controls),
-        .dapm_widgets = adau1977_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(adau1977_dapm_widgets),
-        .dapm_routes = adau1977_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(adau1977_dapm_routes),
+        .component_driver = {
+                .controls               = adau1977_snd_controls,
+                .num_controls           = ARRAY_SIZE(adau1977_snd_controls),
+                .dapm_widgets           = adau1977_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(adau1977_dapm_widgets),
+                .dapm_routes            = adau1977_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(adau1977_dapm_routes),
+        },
 };
 
 static int adau1977_setup_micbias(struct adau1977 *adau1977)
diff --git a/sound/soc/codecs/adau7002.c b/sound/soc/codecs/adau7002.c
index 9df72c6adcca..6384c5491de8 100644
--- a/sound/soc/codecs/adau7002.c
+++ b/sound/soc/codecs/adau7002.c
@@ -39,10 +39,12 @@ static struct snd_soc_dai_driver adau7002_dai = {
 };
 
 static const struct snd_soc_codec_driver adau7002_codec_driver = {
-        .dapm_widgets = adau7002_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(adau7002_widgets),
-        .dapm_routes = adau7002_routes,
-        .num_dapm_routes = ARRAY_SIZE(adau7002_routes),
+        .component_driver = {
+                .dapm_widgets           = adau7002_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(adau7002_widgets),
+                .dapm_routes            = adau7002_routes,
+                .num_dapm_routes        = ARRAY_SIZE(adau7002_routes),
+        },
 };
 
 static int adau7002_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
index acff8d62059c..6e793ebb5883 100644
--- a/sound/soc/codecs/adav80x.c
+++ b/sound/soc/codecs/adav80x.c
@@ -834,12 +834,14 @@ static struct snd_soc_codec_driver adav80x_codec_driver = {
         .set_pll = adav80x_set_pll,
         .set_sysclk = adav80x_set_sysclk,
 
-        .controls = adav80x_controls,
-        .num_controls = ARRAY_SIZE(adav80x_controls),
-        .dapm_widgets = adav80x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(adav80x_dapm_widgets),
-        .dapm_routes = adav80x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(adav80x_dapm_routes),
+        .component_driver = {
+                .controls               = adav80x_controls,
+                .num_controls           = ARRAY_SIZE(adav80x_controls),
+                .dapm_widgets           = adav80x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(adav80x_dapm_widgets),
+                .dapm_routes            = adav80x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(adav80x_dapm_routes),
+        },
 };
 
 int adav80x_bus_probe(struct device *dev, struct regmap *regmap)
diff --git a/sound/soc/codecs/ads117x.c b/sound/soc/codecs/ads117x.c
index c5be1bdc2c9a..90c756d183b4 100644
--- a/sound/soc/codecs/ads117x.c
+++ b/sound/soc/codecs/ads117x.c
@@ -59,10 +59,12 @@ static struct snd_soc_dai_driver ads117x_dai = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_ads117x = {
-        .dapm_widgets = ads117x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ads117x_dapm_widgets),
-        .dapm_routes = ads117x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(ads117x_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = ads117x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ads117x_dapm_widgets),
+                .dapm_routes            = ads117x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ads117x_dapm_routes),
+        },
 };
 
 static int ads117x_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/ak4104.c b/sound/soc/codecs/ak4104.c
index 595d02d7602c..1a9d233c94d0 100644
--- a/sound/soc/codecs/ak4104.c
+++ b/sound/soc/codecs/ak4104.c
@@ -163,7 +163,10 @@ static struct snd_soc_dai_driver ak4104_dai = {
                 .stream_name = "Playback",
                 .channels_min = 2,
                 .channels_max = 2,
-                .rates = SNDRV_PCM_RATE_8000_192000,
+                .rates = SNDRV_PCM_RATE_22050 | SNDRV_PCM_RATE_32000 |
+                         SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |
+                         SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000 |
+                         SNDRV_PCM_RATE_176400 | SNDRV_PCM_RATE_192000,
                 .formats = SNDRV_PCM_FMTBIT_S16_LE  |
                            SNDRV_PCM_FMTBIT_S24_3LE |
                            SNDRV_PCM_FMTBIT_S24_LE
@@ -245,10 +248,12 @@ static struct snd_soc_codec_driver soc_codec_device_ak4104 = {
         .suspend = ak4104_soc_suspend,
         .resume = ak4104_soc_resume,
 
-        .dapm_widgets = ak4104_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ak4104_dapm_widgets),
-        .dapm_routes = ak4104_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(ak4104_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = ak4104_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak4104_dapm_widgets),
+                .dapm_routes            = ak4104_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ak4104_dapm_routes),
+        }
 };
 
 static const struct regmap_config ak4104_regmap = {
diff --git a/sound/soc/codecs/ak4535.c b/sound/soc/codecs/ak4535.c
index 54428c64387b..66cfffde9a12 100644
--- a/sound/soc/codecs/ak4535.c
+++ b/sound/soc/codecs/ak4535.c
@@ -395,12 +395,14 @@ static struct snd_soc_codec_driver soc_codec_dev_ak4535 = {
         .set_bias_level = ak4535_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = ak4535_snd_controls,
-        .num_controls = ARRAY_SIZE(ak4535_snd_controls),
-        .dapm_widgets = ak4535_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ak4535_dapm_widgets),
-        .dapm_routes = ak4535_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(ak4535_audio_map),
+        .component_driver = {
+                .controls               = ak4535_snd_controls,
+                .num_controls           = ARRAY_SIZE(ak4535_snd_controls),
+                .dapm_widgets           = ak4535_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak4535_dapm_widgets),
+                .dapm_routes            = ak4535_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(ak4535_audio_map),
+        },
 };
 
 static int ak4535_i2c_probe(struct i2c_client *i2c,
diff --git a/sound/soc/codecs/ak4554.c b/sound/soc/codecs/ak4554.c
index 298dedc05140..b92c548b9d29 100644
--- a/sound/soc/codecs/ak4554.c
+++ b/sound/soc/codecs/ak4554.c
@@ -65,10 +65,12 @@ static struct snd_soc_dai_driver ak4554_dai = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_ak4554 = {
-        .dapm_widgets = ak4554_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ak4554_dapm_widgets),
-        .dapm_routes = ak4554_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(ak4554_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = ak4554_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak4554_dapm_widgets),
+                .dapm_routes            = ak4554_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ak4554_dapm_routes),
+        },
 };
 
 static int ak4554_soc_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/ak4613.c b/sound/soc/codecs/ak4613.c
index 97798d250f08..e819dd8c82fd 100644
--- a/sound/soc/codecs/ak4613.c
+++ b/sound/soc/codecs/ak4613.c
@@ -458,12 +458,14 @@ static struct snd_soc_codec_driver soc_codec_dev_ak4613 = {
         .suspend                = ak4613_suspend,
         .resume                 = ak4613_resume,
         .set_bias_level         = ak4613_set_bias_level,
-        .controls               = ak4613_snd_controls,
-        .num_controls           = ARRAY_SIZE(ak4613_snd_controls),
-        .dapm_widgets           = ak4613_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(ak4613_dapm_widgets),
-        .dapm_routes            = ak4613_intercon,
-        .num_dapm_routes        = ARRAY_SIZE(ak4613_intercon),
+        .component_driver = {
+                .controls               = ak4613_snd_controls,
+                .num_controls           = ARRAY_SIZE(ak4613_snd_controls),
+                .dapm_widgets           = ak4613_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak4613_dapm_widgets),
+                .dapm_routes            = ak4613_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(ak4613_intercon),
+        },
 };
 
 static void ak4613_parse_of(struct ak4613_priv *priv,
diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
index b14176f8d884..c91717d08513 100644
--- a/sound/soc/codecs/ak4641.c
+++ b/sound/soc/codecs/ak4641.c
@@ -505,12 +505,14 @@ static struct snd_soc_dai_driver ak4641_dai[] = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_ak4641 = {
-        .controls               = ak4641_snd_controls,
-        .num_controls           = ARRAY_SIZE(ak4641_snd_controls),
-        .dapm_widgets           = ak4641_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(ak4641_dapm_widgets),
-        .dapm_routes            = ak4641_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(ak4641_audio_map),
+        .component_driver = {
+                .controls               = ak4641_snd_controls,
+                .num_controls           = ARRAY_SIZE(ak4641_snd_controls),
+                .dapm_widgets           = ak4641_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak4641_dapm_widgets),
+                .dapm_routes            = ak4641_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(ak4641_audio_map),
+        },
         .set_bias_level         = ak4641_set_bias_level,
         .suspend_bias_off       = true,
 };
diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
index cc941d66ec3d..2609f95b7d19 100644
--- a/sound/soc/codecs/ak4642.c
+++ b/sound/soc/codecs/ak4642.c
@@ -555,12 +555,14 @@ static struct snd_soc_codec_driver soc_codec_dev_ak4642 = {
         .suspend                = ak4642_suspend,
         .resume                 = ak4642_resume,
         .set_bias_level         = ak4642_set_bias_level,
-        .controls               = ak4642_snd_controls,
-        .num_controls           = ARRAY_SIZE(ak4642_snd_controls),
-        .dapm_widgets           = ak4642_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(ak4642_dapm_widgets),
-        .dapm_routes            = ak4642_intercon,
-        .num_dapm_routes        = ARRAY_SIZE(ak4642_intercon),
+        .component_driver = {
+                .controls               = ak4642_snd_controls,
+                .num_controls           = ARRAY_SIZE(ak4642_snd_controls),
+                .dapm_widgets           = ak4642_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak4642_dapm_widgets),
+                .dapm_routes            = ak4642_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(ak4642_intercon),
+        },
 };
 
 static const struct regmap_config ak4642_regmap = {
diff --git a/sound/soc/codecs/ak4671.c b/sound/soc/codecs/ak4671.c
index c73a9f6914b6..6088afaabf62 100644
--- a/sound/soc/codecs/ak4671.c
+++ b/sound/soc/codecs/ak4671.c
@@ -612,12 +612,14 @@ static struct snd_soc_dai_driver ak4671_dai = {
 
 static struct snd_soc_codec_driver soc_codec_dev_ak4671 = {
         .set_bias_level = ak4671_set_bias_level,
-        .controls = ak4671_snd_controls,
-        .num_controls = ARRAY_SIZE(ak4671_snd_controls),
-        .dapm_widgets = ak4671_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ak4671_dapm_widgets),
-        .dapm_routes = ak4671_intercon,
-        .num_dapm_routes = ARRAY_SIZE(ak4671_intercon),
+        .component_driver = {
+                .controls               = ak4671_snd_controls,
+                .num_controls           = ARRAY_SIZE(ak4671_snd_controls),
+                .dapm_widgets           = ak4671_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak4671_dapm_widgets),
+                .dapm_routes            = ak4671_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(ak4671_intercon),
+        },
 };
 
 static const struct regmap_config ak4671_regmap = {
diff --git a/sound/soc/codecs/ak5386.c b/sound/soc/codecs/ak5386.c
index afa95360826d..0ef2df223336 100644
--- a/sound/soc/codecs/ak5386.c
+++ b/sound/soc/codecs/ak5386.c
@@ -74,10 +74,12 @@ static struct snd_soc_codec_driver soc_codec_ak5386 = {
         .remove = ak5386_soc_remove,
         .suspend = ak5386_soc_suspend,
         .resume = ak5386_soc_resume,
-        .dapm_widgets = ak5386_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ak5386_dapm_widgets),
-        .dapm_routes = ak5386_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(ak5386_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = ak5386_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ak5386_dapm_widgets),
+                .dapm_routes            = ak5386_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ak5386_dapm_routes),
+        },
 };
 
 static int ak5386_set_dai_fmt(struct snd_soc_dai *codec_dai,
diff --git a/sound/soc/codecs/alc5632.c b/sound/soc/codecs/alc5632.c
index 4d3ba33eb6f9..adb80d8719bd 100644
--- a/sound/soc/codecs/alc5632.c
+++ b/sound/soc/codecs/alc5632.c
@@ -1072,12 +1072,14 @@ static const struct snd_soc_codec_driver soc_codec_device_alc5632 = {
         .set_bias_level = alc5632_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = alc5632_snd_controls,
-        .num_controls = ARRAY_SIZE(alc5632_snd_controls),
-        .dapm_widgets = alc5632_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(alc5632_dapm_widgets),
-        .dapm_routes = alc5632_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(alc5632_dapm_routes),
+        .component_driver = {
+                .controls               = alc5632_snd_controls,
+                .num_controls           = ARRAY_SIZE(alc5632_snd_controls),
+                .dapm_widgets           = alc5632_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(alc5632_dapm_widgets),
+                .dapm_routes            = alc5632_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(alc5632_dapm_routes),
+        },
 };
 
 static const struct regmap_config alc5632_regmap = {
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index ecfdbfcae366..846ca079845f 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -109,7 +109,7 @@ static int arizona_spk_ev(struct snd_soc_dapm_widget *w,
                 break;
         }
 
-        return 0;
+        return arizona_out_ev(w, kcontrol, event);
 }
 
 static irqreturn_t arizona_thermal_warn(int irq, void *data)
@@ -159,12 +159,14 @@ static irqreturn_t arizona_thermal_shutdown(int irq, void *data)
 static const struct snd_soc_dapm_widget arizona_spkl =
         SND_SOC_DAPM_PGA_E("OUT4L", SND_SOC_NOPM,
                            ARIZONA_OUT4L_ENA_SHIFT, 0, NULL, 0, arizona_spk_ev,
-                           SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU);
+                           SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+                           SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD);
 
 static const struct snd_soc_dapm_widget arizona_spkr =
         SND_SOC_DAPM_PGA_E("OUT4R", SND_SOC_NOPM,
                            ARIZONA_OUT4R_ENA_SHIFT, 0, NULL, 0, arizona_spk_ev,
-                           SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU);
+                           SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+                           SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMD);
 
 int arizona_init_spk(struct snd_soc_codec *codec)
 {
@@ -864,6 +866,7 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
 {
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
         struct arizona_priv *priv = snd_soc_codec_get_drvdata(codec);
+        struct arizona *arizona = priv->arizona;
 
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
@@ -877,6 +880,18 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
                         priv->out_up_pending++;
                         priv->out_up_delay += 17;
                         break;
+                case ARIZONA_OUT4L_ENA_SHIFT:
+                case ARIZONA_OUT4R_ENA_SHIFT:
+                        priv->out_up_pending++;
+                        switch (arizona->type) {
+                        case WM5102:
+                        case WM8997:
+                                break;
+                        default:
+                                priv->out_up_delay += 10;
+                                break;
+                        }
+                        break;
                 default:
                         break;
                 }
@@ -889,8 +904,12 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
                 case ARIZONA_OUT2R_ENA_SHIFT:
                 case ARIZONA_OUT3L_ENA_SHIFT:
                 case ARIZONA_OUT3R_ENA_SHIFT:
+                case ARIZONA_OUT4L_ENA_SHIFT:
+                case ARIZONA_OUT4R_ENA_SHIFT:
                         priv->out_up_pending--;
-                        if (!priv->out_up_pending) {
+                        if (!priv->out_up_pending && priv->out_up_delay) {
+                                dev_dbg(codec->dev, "Power up delay: %d\n",
+                                        priv->out_up_delay);
                                 msleep(priv->out_up_delay);
                                 priv->out_up_delay = 0;
                         }
@@ -911,6 +930,21 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
                         priv->out_down_pending++;
                         priv->out_down_delay++;
                         break;
+                case ARIZONA_OUT4L_ENA_SHIFT:
+                case ARIZONA_OUT4R_ENA_SHIFT:
+                        priv->out_down_pending++;
+                        switch (arizona->type) {
+                        case WM5102:
+                        case WM8997:
+                                break;
+                        case WM8998:
+                        case WM1814:
+                                priv->out_down_delay += 5;
+                                break;
+                        default:
+                                priv->out_down_delay++;
+                                break;
+                        }
                 default:
                         break;
                 }
@@ -923,8 +957,12 @@ int arizona_out_ev(struct snd_soc_dapm_widget *w,
                 case ARIZONA_OUT2R_ENA_SHIFT:
                 case ARIZONA_OUT3L_ENA_SHIFT:
                 case ARIZONA_OUT3R_ENA_SHIFT:
+                case ARIZONA_OUT4L_ENA_SHIFT:
+                case ARIZONA_OUT4R_ENA_SHIFT:
                         priv->out_down_pending--;
-                        if (!priv->out_down_pending) {
+                        if (!priv->out_down_pending && priv->out_down_delay) {
+                                dev_dbg(codec->dev, "Power down delay: %d\n",
+                                        priv->out_down_delay);
                                 msleep(priv->out_down_delay);
                                 priv->out_down_delay = 0;
                         }
@@ -1920,8 +1958,8 @@ static struct {
 
 struct arizona_fll_cfg {
         int n;
-        int theta;
-        int lambda;
+        unsigned int theta;
+        unsigned int lambda;
         int refdiv;
         int outdiv;
         int fratio;
@@ -2188,13 +2226,13 @@ static void arizona_apply_fll(struct arizona *arizona, unsigned int base,
                                  ARIZONA_FLL1_CTRL_UPD | cfg->n);
 }
 
-static int arizona_is_enabled_fll(struct arizona_fll *fll)
+static int arizona_is_enabled_fll(struct arizona_fll *fll, int base)
 {
         struct arizona *arizona = fll->arizona;
         unsigned int reg;
         int ret;
 
-        ret = regmap_read(arizona->regmap, fll->base + 1, &reg);
+        ret = regmap_read(arizona->regmap, base + 1, &reg);
         if (ret != 0) {
                 arizona_fll_err(fll, "Failed to read current state: %d\n",
                                 ret);
@@ -2208,21 +2246,24 @@ static int arizona_enable_fll(struct arizona_fll *fll)
 {
         struct arizona *arizona = fll->arizona;
         bool use_sync = false;
-        int already_enabled = arizona_is_enabled_fll(fll);
+        int already_enabled = arizona_is_enabled_fll(fll, fll->base);
+        int sync_enabled = arizona_is_enabled_fll(fll, fll->base + 0x10);
         struct arizona_fll_cfg cfg;
         int i;
         unsigned int val;
 
         if (already_enabled < 0)
                 return already_enabled;
+        if (sync_enabled < 0)
+                return sync_enabled;
 
         if (already_enabled) {
                 /* Facilitate smooth refclk across the transition */
-                regmap_update_bits_async(fll->arizona->regmap, fll->base + 0x9,
-                                         ARIZONA_FLL1_GAIN_MASK, 0);
                 regmap_update_bits(fll->arizona->regmap, fll->base + 1,
                                    ARIZONA_FLL1_FREERUN, ARIZONA_FLL1_FREERUN);
                 udelay(32);
+                regmap_update_bits_async(fll->arizona->regmap, fll->base + 0x9,
+                                         ARIZONA_FLL1_GAIN_MASK, 0);
         }
 
         /*
@@ -2233,6 +2274,10 @@ static int arizona_enable_fll(struct arizona_fll *fll)
             fll->ref_src != fll->sync_src) {
                 arizona_calc_fll(fll, &cfg, fll->ref_freq, false);
 
+                /* Ref path hardcodes lambda to 65536 when sync is on */
+                if (fll->sync_src >= 0 && cfg.lambda)
+                        cfg.theta = (cfg.theta * (1 << 16)) / cfg.lambda;
+
                 arizona_apply_fll(arizona, fll->base, &cfg, fll->ref_src,
                                   false);
                 if (fll->sync_src >= 0) {
@@ -2255,6 +2300,9 @@ static int arizona_enable_fll(struct arizona_fll *fll)
                 return -EINVAL;
         }
 
+        if (already_enabled && !!sync_enabled != use_sync)
+                arizona_fll_warn(fll, "Synchroniser changed on active FLL\n");
+
         /*
          * Increase the bandwidth if we're not using a low frequency
          * sync source.
@@ -2268,14 +2316,14 @@ static int arizona_enable_fll(struct arizona_fll *fll)
                                          ARIZONA_FLL1_SYNC_BW);
 
         if (!already_enabled)
-                pm_runtime_get(arizona->dev);
+                pm_runtime_get_sync(arizona->dev);
 
-        regmap_update_bits_async(arizona->regmap, fll->base + 1,
-                                 ARIZONA_FLL1_ENA, ARIZONA_FLL1_ENA);
         if (use_sync)
                 regmap_update_bits_async(arizona->regmap, fll->base + 0x11,
                                          ARIZONA_FLL1_SYNC_ENA,
                                          ARIZONA_FLL1_SYNC_ENA);
+        regmap_update_bits_async(arizona->regmap, fll->base + 1,
+                                 ARIZONA_FLL1_ENA, ARIZONA_FLL1_ENA);
 
         if (already_enabled)
                 regmap_update_bits_async(arizona->regmap, fll->base + 1,
diff --git a/sound/soc/codecs/arizona.h b/sound/soc/codecs/arizona.h
index 69da1ef3a17c..850aa338ba29 100644
--- a/sound/soc/codecs/arizona.h
+++ b/sound/soc/codecs/arizona.h
@@ -190,20 +190,21 @@ extern unsigned int arizona_mixer_values[ARIZONA_NUM_MIXER_INPUTS];
 
 #define ARIZONA_DSP_ROUTES(name) \
         { name, NULL, name " Preloader"}, \
-        { name " Preloader", NULL, name " Aux 1" }, \
-        { name " Preloader", NULL, name " Aux 2" }, \
-        { name " Preloader", NULL, name " Aux 3" }, \
-        { name " Preloader", NULL, name " Aux 4" }, \
-        { name " Preloader", NULL, name " Aux 5" }, \
-        { name " Preloader", NULL, name " Aux 6" }, \
+        { name " Preloader", NULL, "SYSCLK" }, \
+        { name, NULL, name " Aux 1" }, \
+        { name, NULL, name " Aux 2" }, \
+        { name, NULL, name " Aux 3" }, \
+        { name, NULL, name " Aux 4" }, \
+        { name, NULL, name " Aux 5" }, \
+        { name, NULL, name " Aux 6" }, \
         ARIZONA_MIXER_INPUT_ROUTES(name " Aux 1"), \
         ARIZONA_MIXER_INPUT_ROUTES(name " Aux 2"), \
         ARIZONA_MIXER_INPUT_ROUTES(name " Aux 3"), \
         ARIZONA_MIXER_INPUT_ROUTES(name " Aux 4"), \
         ARIZONA_MIXER_INPUT_ROUTES(name " Aux 5"), \
         ARIZONA_MIXER_INPUT_ROUTES(name " Aux 6"), \
-        ARIZONA_MIXER_ROUTES(name " Preloader", name "L"), \
-        ARIZONA_MIXER_ROUTES(name " Preloader", name "R")
+        ARIZONA_MIXER_ROUTES(name, name "L"), \
+        ARIZONA_MIXER_ROUTES(name, name "R")
 
 #define ARIZONA_EQ_CONTROL(xname, xbase)                      \
 {       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname,   \
diff --git a/sound/soc/codecs/bt-sco.c b/sound/soc/codecs/bt-sco.c
index 2a8d0ee141d4..8014e697d540 100644
--- a/sound/soc/codecs/bt-sco.c
+++ b/sound/soc/codecs/bt-sco.c
@@ -63,10 +63,12 @@ static struct snd_soc_dai_driver bt_sco_dai[] = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_bt_sco = {
-        .dapm_widgets = bt_sco_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(bt_sco_widgets),
-        .dapm_routes = bt_sco_routes,
-        .num_dapm_routes = ARRAY_SIZE(bt_sco_routes),
+        .component_driver = {
+                .dapm_widgets           = bt_sco_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(bt_sco_widgets),
+                .dapm_routes            = bt_sco_routes,
+                .num_dapm_routes        = ARRAY_SIZE(bt_sco_routes),
+        },
 };
 
 static int bt_sco_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/cq93vc.c b/sound/soc/codecs/cq93vc.c
index 1c895a53001d..7a2d9a2ee427 100644
--- a/sound/soc/codecs/cq93vc.c
+++ b/sound/soc/codecs/cq93vc.c
@@ -131,8 +131,10 @@ static struct regmap *cq93vc_get_regmap(struct device *dev)
 static struct snd_soc_codec_driver soc_codec_dev_cq93vc = {
         .set_bias_level = cq93vc_set_bias_level,
         .get_regmap = cq93vc_get_regmap,
-        .controls = cq93vc_snd_controls,
-        .num_controls = ARRAY_SIZE(cq93vc_snd_controls),
+        .component_driver = {
+                .controls = cq93vc_snd_controls,
+                .num_controls = ARRAY_SIZE(cq93vc_snd_controls),
+        },
 };
 
 static int cq93vc_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/cs35l32.c b/sound/soc/codecs/cs35l32.c
index 287d13740be4..7e9806206648 100644
--- a/sound/soc/codecs/cs35l32.c
+++ b/sound/soc/codecs/cs35l32.c
@@ -231,13 +231,14 @@ static int cs35l32_codec_set_sysclk(struct snd_soc_codec *codec,
 static const struct snd_soc_codec_driver soc_codec_dev_cs35l32 = {
         .set_sysclk = cs35l32_codec_set_sysclk,
 
-        .dapm_widgets = cs35l32_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs35l32_dapm_widgets),
-        .dapm_routes = cs35l32_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(cs35l32_audio_map),
-
-        .controls = cs35l32_snd_controls,
-        .num_controls = ARRAY_SIZE(cs35l32_snd_controls),
+        .component_driver = {
+                .controls               = cs35l32_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs35l32_snd_controls),
+                .dapm_widgets           = cs35l32_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs35l32_dapm_widgets),
+                .dapm_routes            = cs35l32_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(cs35l32_audio_map),
+        },
 };
 
 /* Current and threshold powerup sequence Pg37 in datasheet */
diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c
index 6f9c1addcd7f..6df29fa30fb9 100644
--- a/sound/soc/codecs/cs35l33.c
+++ b/sound/soc/codecs/cs35l33.c
@@ -837,13 +837,14 @@ static struct snd_soc_codec_driver soc_codec_dev_cs35l33 = {
         .set_bias_level = cs35l33_set_bias_level,
         .set_sysclk = cs35l33_codec_set_sysclk,
 
-        .dapm_widgets = cs35l33_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs35l33_dapm_widgets),
-        .dapm_routes = cs35l33_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(cs35l33_audio_map),
-        .controls = cs35l33_snd_controls,
-        .num_controls = ARRAY_SIZE(cs35l33_snd_controls),
-
+        .component_driver = {
+                .controls               = cs35l33_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs35l33_snd_controls),
+                .dapm_widgets           = cs35l33_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs35l33_dapm_widgets),
+                .dapm_routes            = cs35l33_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(cs35l33_audio_map),
+        },
         .idle_bias_off = true,
 };
 
diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
index 55db19ddc5ff..fd966bb851cb 100644
--- a/sound/soc/codecs/cs4265.c
+++ b/sound/soc/codecs/cs4265.c
@@ -547,13 +547,14 @@ static struct snd_soc_dai_driver cs4265_dai[] = {
 static const struct snd_soc_codec_driver soc_codec_cs4265 = {
         .set_bias_level = cs4265_set_bias_level,
 
-        .dapm_widgets = cs4265_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs4265_dapm_widgets),
-        .dapm_routes = cs4265_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(cs4265_audio_map),
-
-        .controls = cs4265_snd_controls,
-        .num_controls = ARRAY_SIZE(cs4265_snd_controls),
+        .component_driver = {
+                .controls               = cs4265_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs4265_snd_controls),
+                .dapm_widgets           = cs4265_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs4265_dapm_widgets),
+                .dapm_routes            = cs4265_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(cs4265_audio_map),
+        },
 };
 
 static const struct regmap_config cs4265_regmap = {
diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
index e07807d96b68..18baea2f7d65 100644
--- a/sound/soc/codecs/cs4270.c
+++ b/sound/soc/codecs/cs4270.c
@@ -617,12 +617,14 @@ static const struct snd_soc_codec_driver soc_codec_device_cs4270 = {
         .suspend =              cs4270_soc_suspend,
         .resume =               cs4270_soc_resume,
 
-        .controls =             cs4270_snd_controls,
-        .num_controls =         ARRAY_SIZE(cs4270_snd_controls),
-        .dapm_widgets =         cs4270_dapm_widgets,
-        .num_dapm_widgets =     ARRAY_SIZE(cs4270_dapm_widgets),
-        .dapm_routes =          cs4270_dapm_routes,
-        .num_dapm_routes =      ARRAY_SIZE(cs4270_dapm_routes),
+        .component_driver = {
+                .controls =             cs4270_snd_controls,
+                .num_controls =         ARRAY_SIZE(cs4270_snd_controls),
+                .dapm_widgets =         cs4270_dapm_widgets,
+                .num_dapm_widgets =     ARRAY_SIZE(cs4270_dapm_widgets),
+                .dapm_routes =          cs4270_dapm_routes,
+                .num_dapm_routes =      ARRAY_SIZE(cs4270_dapm_routes),
+        },
 };
 
 /*
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 0c0010b25421..8c0f3b89b5bc 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -645,12 +645,14 @@ static struct snd_soc_codec_driver soc_codec_dev_cs4271 = {
         .suspend                = cs4271_soc_suspend,
         .resume                 = cs4271_soc_resume,
 
-        .controls               = cs4271_snd_controls,
-        .num_controls           = ARRAY_SIZE(cs4271_snd_controls),
-        .dapm_widgets           = cs4271_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(cs4271_dapm_widgets),
-        .dapm_routes            = cs4271_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(cs4271_dapm_routes),
+        .component_driver = {
+                .controls               = cs4271_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs4271_snd_controls),
+                .dapm_widgets           = cs4271_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs4271_dapm_widgets),
+                .dapm_routes            = cs4271_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(cs4271_dapm_routes),
+        },
 };
 
 static int cs4271_common_probe(struct device *dev,
diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c
index 35488f14e237..96cfe38943cd 100644
--- a/sound/soc/codecs/cs42l51.c
+++ b/sound/soc/codecs/cs42l51.c
@@ -507,12 +507,14 @@ static int cs42l51_codec_probe(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_device_cs42l51 = {
         .probe = cs42l51_codec_probe,
 
-        .controls = cs42l51_snd_controls,
-        .num_controls = ARRAY_SIZE(cs42l51_snd_controls),
-        .dapm_widgets = cs42l51_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs42l51_dapm_widgets),
-        .dapm_routes = cs42l51_routes,
-        .num_dapm_routes = ARRAY_SIZE(cs42l51_routes),
+        .component_driver = {
+                .controls               = cs42l51_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs42l51_snd_controls),
+                .dapm_widgets           = cs42l51_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs42l51_dapm_widgets),
+                .dapm_routes            = cs42l51_routes,
+                .num_dapm_routes        = ARRAY_SIZE(cs42l51_routes),
+        },
 };
 
 const struct regmap_config cs42l51_regmap = {
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index 47b97fcefb0b..0d9c4a57301b 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -1056,13 +1056,14 @@ static const struct snd_soc_codec_driver soc_codec_dev_cs42l52 = {
         .set_bias_level = cs42l52_set_bias_level,
         .suspend_bias_off = true,
 
-        .dapm_widgets = cs42l52_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs42l52_dapm_widgets),
-        .dapm_routes = cs42l52_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(cs42l52_audio_map),
-
-        .controls = cs42l52_snd_controls,
-        .num_controls = ARRAY_SIZE(cs42l52_snd_controls),
+        .component_driver = {
+                .controls               = cs42l52_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs42l52_snd_controls),
+                .dapm_widgets           = cs42l52_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs42l52_dapm_widgets),
+                .dapm_routes            = cs42l52_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(cs42l52_audio_map),
+        },
 };
 
 /* Current and threshold powerup sequence Pg37 */
diff --git a/sound/soc/codecs/cs42l56.c b/sound/soc/codecs/cs42l56.c
index eec1ff853b98..54c1768bc818 100644
--- a/sound/soc/codecs/cs42l56.c
+++ b/sound/soc/codecs/cs42l56.c
@@ -1121,13 +1121,14 @@ static const struct snd_soc_codec_driver soc_codec_dev_cs42l56 = {
         .set_bias_level = cs42l56_set_bias_level,
         .suspend_bias_off = true,
 
-        .dapm_widgets = cs42l56_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs42l56_dapm_widgets),
-        .dapm_routes = cs42l56_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(cs42l56_audio_map),
-
-        .controls = cs42l56_snd_controls,
-        .num_controls = ARRAY_SIZE(cs42l56_snd_controls),
+        .component_driver = {
+                .controls               = cs42l56_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs42l56_snd_controls),
+                .dapm_widgets           = cs42l56_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs42l56_dapm_widgets),
+                .dapm_routes            = cs42l56_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(cs42l56_audio_map),
+        },
 };
 
 static const struct regmap_config cs42l56_regmap = {
diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c
index 42a8fd4e1f9b..71ba5605495f 100644
--- a/sound/soc/codecs/cs42l73.c
+++ b/sound/soc/codecs/cs42l73.c
@@ -794,7 +794,7 @@ struct cs42l73_mclk_div {
         u8 mmcc;
 };
 
-static struct cs42l73_mclk_div cs42l73_mclk_coeffs[] = {
+static const struct cs42l73_mclk_div cs42l73_mclk_coeffs[] = {
         /* MCLK, Sample Rate, xMMCC[5:0] */
         {5644800, 11025, 0x30},
         {5644800, 22050, 0x20},
@@ -844,7 +844,7 @@ struct cs42l73_mclkx_div {
         u8 mclkdiv;
 };
 
-static struct cs42l73_mclkx_div cs42l73_mclkx_coeffs[] = {
+static const struct cs42l73_mclkx_div cs42l73_mclkx_coeffs[] = {
         {5644800,  1, 0},       /* 5644800 */
         {6000000,  1, 0},       /* 6000000 */
         {6144000,  1, 0},       /* 6144000 */
@@ -1257,13 +1257,14 @@ static const struct snd_soc_codec_driver soc_codec_dev_cs42l73 = {
         .set_bias_level = cs42l73_set_bias_level,
         .suspend_bias_off = true,
 
-        .dapm_widgets = cs42l73_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs42l73_dapm_widgets),
-        .dapm_routes = cs42l73_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(cs42l73_audio_map),
-
-        .controls = cs42l73_snd_controls,
-        .num_controls = ARRAY_SIZE(cs42l73_snd_controls),
+        .component_driver = {
+                .controls               = cs42l73_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs42l73_snd_controls),
+                .dapm_widgets           = cs42l73_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs42l73_dapm_widgets),
+                .dapm_routes            = cs42l73_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(cs42l73_audio_map),
+        },
 };
 
 static const struct regmap_config cs42l73_regmap = {
diff --git a/sound/soc/codecs/cs42xx8.c b/sound/soc/codecs/cs42xx8.c
index 1179101b2b05..b4d87379d2bc 100644
--- a/sound/soc/codecs/cs42xx8.c
+++ b/sound/soc/codecs/cs42xx8.c
@@ -411,12 +411,14 @@ static const struct snd_soc_codec_driver cs42xx8_driver = {
         .probe = cs42xx8_codec_probe,
         .idle_bias_off = true,
 
-        .controls = cs42xx8_snd_controls,
-        .num_controls = ARRAY_SIZE(cs42xx8_snd_controls),
-        .dapm_widgets = cs42xx8_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs42xx8_dapm_widgets),
-        .dapm_routes = cs42xx8_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(cs42xx8_dapm_routes),
+        .component_driver = {
+                .controls               = cs42xx8_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs42xx8_snd_controls),
+                .dapm_widgets           = cs42xx8_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs42xx8_dapm_widgets),
+                .dapm_routes            = cs42xx8_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(cs42xx8_dapm_routes),
+        },
 };
 
 const struct cs42xx8_driver_data cs42448_data = {
diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
index 0ac8fc5ed4ae..231ca935cdf3 100644
--- a/sound/soc/codecs/cs4349.c
+++ b/sound/soc/codecs/cs4349.c
@@ -256,13 +256,14 @@ static struct snd_soc_dai_driver cs4349_dai = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_cs4349 = {
-        .controls               = cs4349_snd_controls,
-        .num_controls           = ARRAY_SIZE(cs4349_snd_controls),
-
-        .dapm_widgets           = cs4349_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(cs4349_dapm_widgets),
-        .dapm_routes            = cs4349_routes,
-        .num_dapm_routes        = ARRAY_SIZE(cs4349_routes),
+        .component_driver = {
+                .controls               = cs4349_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs4349_snd_controls),
+                .dapm_widgets           = cs4349_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs4349_dapm_widgets),
+                .dapm_routes            = cs4349_routes,
+                .num_dapm_routes        = ARRAY_SIZE(cs4349_routes),
+        },
 };
 
 static const struct regmap_config cs4349_regmap = {
diff --git a/sound/soc/codecs/cs47l24.c b/sound/soc/codecs/cs47l24.c
index 954a4f5d3338..5b22564f037c 100644
--- a/sound/soc/codecs/cs47l24.c
+++ b/sound/soc/codecs/cs47l24.c
@@ -746,6 +746,16 @@ static const struct snd_soc_dapm_route cs47l24_dapm_routes[] = {
         { "IN2L", NULL, "SYSCLK" },
         { "IN2R", NULL, "SYSCLK" },
 
+        { "ASRC1L", NULL, "SYSCLK" },
+        { "ASRC1R", NULL, "SYSCLK" },
+        { "ASRC2L", NULL, "SYSCLK" },
+        { "ASRC2R", NULL, "SYSCLK" },
+
+        { "ASRC1L", NULL, "ASYNCCLK" },
+        { "ASRC1R", NULL, "ASYNCCLK" },
+        { "ASRC2L", NULL, "ASYNCCLK" },
+        { "ASRC2R", NULL, "ASYNCCLK" },
+
         { "MICBIAS1", NULL, "MICVDD" },
         { "MICBIAS2", NULL, "MICVDD" },
 
@@ -804,7 +814,6 @@ static const struct snd_soc_dapm_route cs47l24_dapm_routes[] = {
         { "AIF3 Capture", NULL, "SYSCLK" },
 
         { "Voice Control DSP", NULL, "DSP3" },
-        { "Voice Control DSP", NULL, "SYSCLK" },
 
         { "IN1L PGA", NULL, "IN1L" },
         { "IN1R PGA", NULL, "IN1R" },
@@ -813,7 +822,6 @@ static const struct snd_soc_dapm_route cs47l24_dapm_routes[] = {
         { "IN2R PGA", NULL, "IN2R" },
 
         { "Audio Trace DSP", NULL, "DSP2" },
-        { "Audio Trace DSP", NULL, "SYSCLK" },
 
         ARIZONA_MIXER_ROUTES("OUT1L", "HPOUT1L"),
         ARIZONA_MIXER_ROUTES("OUT1R", "HPOUT1R"),
@@ -1190,12 +1198,14 @@ static struct snd_soc_codec_driver soc_codec_dev_cs47l24 = {
         .set_sysclk = arizona_set_sysclk,
         .set_pll = cs47l24_set_fll,
 
-        .controls = cs47l24_snd_controls,
-        .num_controls = ARRAY_SIZE(cs47l24_snd_controls),
-        .dapm_widgets = cs47l24_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs47l24_dapm_widgets),
-        .dapm_routes = cs47l24_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(cs47l24_dapm_routes),
+        .component_driver = {
+                .controls               = cs47l24_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs47l24_snd_controls),
+                .dapm_widgets           = cs47l24_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs47l24_dapm_widgets),
+                .dapm_routes            = cs47l24_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(cs47l24_dapm_routes),
+        },
 };
 
 static struct snd_compr_ops cs47l24_compr_ops = {
diff --git a/sound/soc/codecs/cs53l30.c b/sound/soc/codecs/cs53l30.c
index 2c0d9c430a8c..cb47fb595ff4 100644
--- a/sound/soc/codecs/cs53l30.c
+++ b/sound/soc/codecs/cs53l30.c
@@ -466,7 +466,7 @@ struct cs53l30_mclk_div {
         u8 mclk_int_scale;
 };
 
-static struct cs53l30_mclk_div cs53l30_mclk_coeffs[] = {
+static const struct cs53l30_mclk_div cs53l30_mclk_coeffs[] = {
         /* NOTE: Enable MCLK_INT_SCALE to save power. */
 
         /* MCLK, Sample Rate, asp_rate, internal_fs_ratio, mclk_int_scale */
@@ -511,7 +511,7 @@ struct cs53l30_mclkx_div {
         u8 mclkdiv;
 };
 
-static struct cs53l30_mclkx_div cs53l30_mclkx_coeffs[] = {
+static const struct cs53l30_mclkx_div cs53l30_mclkx_coeffs[] = {
         {5644800,  1, CS53L30_MCLK_DIV_BY_1},
         {6000000,  1, CS53L30_MCLK_DIV_BY_1},
         {6144000,  1, CS53L30_MCLK_DIV_BY_1},
@@ -897,13 +897,14 @@ static struct snd_soc_codec_driver cs53l30_driver = {
         .set_bias_level = cs53l30_set_bias_level,
         .idle_bias_off = true,
 
-        .dapm_widgets = cs53l30_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cs53l30_dapm_widgets),
-        .dapm_routes = cs53l30_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(cs53l30_dapm_routes),
-
-        .controls = cs53l30_snd_controls,
-        .num_controls = ARRAY_SIZE(cs53l30_snd_controls),
+        .component_driver = {
+                .controls               = cs53l30_snd_controls,
+                .num_controls           = ARRAY_SIZE(cs53l30_snd_controls),
+                .dapm_widgets           = cs53l30_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cs53l30_dapm_widgets),
+                .dapm_routes            = cs53l30_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(cs53l30_dapm_routes),
+        },
 };
 
 static struct regmap_config cs53l30_regmap = {
@@ -999,8 +1000,8 @@ static int cs53l30_i2c_probe(struct i2c_client *client,
         /* Check if MCLK provided */
         cs53l30->mclk = devm_clk_get(dev, "mclk");
         if (IS_ERR(cs53l30->mclk)) {
-                if (PTR_ERR(cs53l30->mclk) == -EPROBE_DEFER) {
-                        ret = -EPROBE_DEFER;
+                if (PTR_ERR(cs53l30->mclk) != -ENOENT) {
+                        ret = PTR_ERR(cs53l30->mclk);
                         goto error;
                 }
                 /* Otherwise mark the mclk pointer to NULL */
diff --git a/sound/soc/codecs/cx20442.c b/sound/soc/codecs/cx20442.c
index fb3885fe0afb..2c12471e42a6 100644
--- a/sound/soc/codecs/cx20442.c
+++ b/sound/soc/codecs/cx20442.c
@@ -407,10 +407,12 @@ static struct snd_soc_codec_driver cx20442_codec_dev = {
         .reg_word_size = sizeof(u8),
         .read = cx20442_read_reg_cache,
         .write = cx20442_write,
-        .dapm_widgets = cx20442_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(cx20442_dapm_widgets),
-        .dapm_routes = cx20442_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(cx20442_audio_map),
+        .component_driver = {
+                .dapm_widgets           = cx20442_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(cx20442_dapm_widgets),
+                .dapm_routes            = cx20442_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(cx20442_audio_map),
+        },
 };
 
 static int cx20442_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/da7210.c b/sound/soc/codecs/da7210.c
index af23a61b7b28..17053dfc94cf 100644
--- a/sound/soc/codecs/da7210.c
+++ b/sound/soc/codecs/da7210.c
@@ -1167,13 +1167,14 @@ static int da7210_probe(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_dev_da7210 = {
         .probe                  = da7210_probe,
 
-        .controls               = da7210_snd_controls,
-        .num_controls           = ARRAY_SIZE(da7210_snd_controls),
-
-        .dapm_widgets           = da7210_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(da7210_dapm_widgets),
-        .dapm_routes            = da7210_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(da7210_audio_map),
+        .component_driver = {
+                .controls               = da7210_snd_controls,
+                .num_controls           = ARRAY_SIZE(da7210_snd_controls),
+                .dapm_widgets           = da7210_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(da7210_dapm_widgets),
+                .dapm_routes            = da7210_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(da7210_audio_map),
+        },
 };
 
 #if IS_ENABLED(CONFIG_I2C)
diff --git a/sound/soc/codecs/da7213.c b/sound/soc/codecs/da7213.c
index e5527bc570ae..12da55882c06 100644
--- a/sound/soc/codecs/da7213.c
+++ b/sound/soc/codecs/da7213.c
@@ -750,11 +750,18 @@ static int da7213_dai_event(struct snd_soc_dapm_widget *w,
                 snd_soc_update_bits(codec, DA7213_PC_COUNT,
                                     DA7213_PC_FREERUN_MASK, 0);
 
-                /* Slave mode, if SRM not enabled no need for status checks */
+                /* If SRM not enabled then nothing more to do */
                 pll_ctrl = snd_soc_read(codec, DA7213_PLL_CTRL);
                 if (!(pll_ctrl & DA7213_PLL_SRM_EN))
                         return 0;
 
+                /* Assist 32KHz mode PLL lock */
+                if (pll_ctrl & DA7213_PLL_32K_MODE) {
+                        snd_soc_write(codec, 0xF0, 0x8B);
+                        snd_soc_write(codec, 0xF2, 0x03);
+                        snd_soc_write(codec, 0xF0, 0x00);
+                }
+
                 /* Check SRM has locked */
                 do {
                         pll_status = snd_soc_read(codec, DA7213_PLL_STATUS);
@@ -771,6 +778,14 @@ static int da7213_dai_event(struct snd_soc_dapm_widget *w,
 
                 return 0;
         case SND_SOC_DAPM_POST_PMD:
+                /* Revert 32KHz PLL lock udpates if applied previously */
+                pll_ctrl = snd_soc_read(codec, DA7213_PLL_CTRL);
+                if (pll_ctrl & DA7213_PLL_32K_MODE) {
+                        snd_soc_write(codec, 0xF0, 0x8B);
+                        snd_soc_write(codec, 0xF2, 0x01);
+                        snd_soc_write(codec, 0xF0, 0x00);
+                }
+
                 /* PC free-running */
                 snd_soc_update_bits(codec, DA7213_PC_COUNT,
                                     DA7213_PC_FREERUN_MASK,
@@ -1247,8 +1262,8 @@ static int da7213_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
                 return -EINVAL;
         }
 
-        /* By default only 32 BCLK per WCLK is supported */
-        dai_clk_mode |= DA7213_DAI_BCLKS_PER_WCLK_32;
+        /* By default only 64 BCLK per WCLK is supported */
+        dai_clk_mode |= DA7213_DAI_BCLKS_PER_WCLK_64;
 
         snd_soc_write(codec, DA7213_DAI_CLK_MODE, dai_clk_mode);
         snd_soc_update_bits(codec, DA7213_DAI_CTRL, DA7213_DAI_FORMAT_MASK,
@@ -1297,10 +1312,13 @@ static int da7213_set_dai_sysclk(struct snd_soc_dai *codec_dai,
 
         switch (clk_id) {
         case DA7213_CLKSRC_MCLK:
-                da7213->mclk_squarer_en = false;
+                snd_soc_update_bits(codec, DA7213_PLL_CTRL,
+                                    DA7213_PLL_MCLK_SQR_EN, 0);
                 break;
         case DA7213_CLKSRC_MCLK_SQR:
-                da7213->mclk_squarer_en = true;
+                snd_soc_update_bits(codec, DA7213_PLL_CTRL,
+                                    DA7213_PLL_MCLK_SQR_EN,
+                                    DA7213_PLL_MCLK_SQR_EN);
                 break;
         default:
                 dev_err(codec_dai->dev, "Unknown clock source %d\n", clk_id);
@@ -1324,7 +1342,7 @@ static int da7213_set_dai_sysclk(struct snd_soc_dai *codec_dai,
         return 0;
 }
 
-/* Supported PLL input frequencies are 5MHz - 54MHz. */
+/* Supported PLL input frequencies are 32KHz, 5MHz - 54MHz. */
 static int da7213_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
                               int source, unsigned int fref, unsigned int fout)
 {
@@ -1336,22 +1354,26 @@ static int da7213_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
         u32 freq_ref;
         u64 frac_div;
 
-        /* Reset PLL configuration */
-        snd_soc_write(codec, DA7213_PLL_CTRL, 0);
-
-        pll_ctrl = 0;
-
         /* Workout input divider based on MCLK rate */
         if (da7213->mclk_rate == 32768) {
+                if (!da7213->master) {
+                        dev_err(codec->dev,
+                                "32KHz only valid if codec is clock master\n");
+                        return -EINVAL;
+                }
+
                 /* 32KHz PLL Mode */
                 indiv_bits = DA7213_PLL_INDIV_9_TO_18_MHZ;
                 indiv = DA7213_PLL_INDIV_9_TO_18_MHZ_VAL;
+                source = DA7213_SYSCLK_PLL_32KHZ;
                 freq_ref = 3750000;
-                pll_ctrl |= DA7213_PLL_32K_MODE;
+
         } else {
-                /* 5 - 54MHz MCLK */
                 if (da7213->mclk_rate < 5000000) {
-                        goto pll_err;
+                        dev_err(codec->dev,
+                                "PLL input clock %d below valid range\n",
+                                da7213->mclk_rate);
+                        return -EINVAL;
                 } else if (da7213->mclk_rate <= 9000000) {
                         indiv_bits = DA7213_PLL_INDIV_5_TO_9_MHZ;
                         indiv = DA7213_PLL_INDIV_5_TO_9_MHZ_VAL;
@@ -1365,32 +1387,44 @@ static int da7213_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
                         indiv_bits = DA7213_PLL_INDIV_36_TO_54_MHZ;
                         indiv = DA7213_PLL_INDIV_36_TO_54_MHZ_VAL;
                 } else {
-                        goto pll_err;
+                        dev_err(codec->dev,
+                                "PLL input clock %d above valid range\n",
+                                da7213->mclk_rate);
+                        return -EINVAL;
                 }
                 freq_ref = (da7213->mclk_rate / indiv);
         }
 
-        pll_ctrl |= indiv_bits;
+        pll_ctrl = indiv_bits;
 
-        /* PLL Bypass mode */
-        if (source == DA7213_SYSCLK_MCLK) {
-                snd_soc_write(codec, DA7213_PLL_CTRL, pll_ctrl);
+        /* Configure PLL */
+        switch (source) {
+        case DA7213_SYSCLK_MCLK:
+                snd_soc_update_bits(codec, DA7213_PLL_CTRL,
+                                    DA7213_PLL_INDIV_MASK |
+                                    DA7213_PLL_MODE_MASK, pll_ctrl);
                 return 0;
-        }
+        case DA7213_SYSCLK_PLL:
+                break;
+        case DA7213_SYSCLK_PLL_SRM:
+                pll_ctrl |= DA7213_PLL_SRM_EN;
+                fout = DA7213_PLL_FREQ_OUT_94310400;
+                break;
+        case DA7213_SYSCLK_PLL_32KHZ:
+                if (da7213->mclk_rate != 32768) {
+                        dev_err(codec->dev,
+                                "32KHz mode only valid with 32KHz MCLK\n");
+                        return -EINVAL;
+                }
 
-        /*
-         * If Codec is slave and SRM enabled,
-         * freq_out is (98304000 + 90316800)/2 = 94310400
-         */
-        if (!da7213->master && da7213->srm_en) {
+                pll_ctrl |= DA7213_PLL_32K_MODE | DA7213_PLL_SRM_EN;
                 fout = DA7213_PLL_FREQ_OUT_94310400;
-                pll_ctrl |= DA7213_PLL_SRM_EN;
+                break;
+        default:
+                dev_err(codec->dev, "Invalid PLL config\n");
+                return -EINVAL;
         }
 
-        /* Enable MCLK squarer if required */
-        if (da7213->mclk_squarer_en)
-                pll_ctrl |= DA7213_PLL_MCLK_SQR_EN;
-
         /* Calculate dividers for PLL */
         pll_integer = fout / freq_ref;
         frac_div = (u64)(fout % freq_ref) * 8192ULL;
@@ -1405,14 +1439,19 @@ static int da7213_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
 
         /* Enable PLL */
         pll_ctrl |= DA7213_PLL_EN;
-        snd_soc_write(codec, DA7213_PLL_CTRL, pll_ctrl);
+        snd_soc_update_bits(codec, DA7213_PLL_CTRL,
+                            DA7213_PLL_INDIV_MASK | DA7213_PLL_MODE_MASK,
+                            pll_ctrl);
+
+        /* Assist 32KHz mode PLL lock */
+        if (source == DA7213_SYSCLK_PLL_32KHZ) {
+                snd_soc_write(codec, 0xF0, 0x8B);
+                snd_soc_write(codec, 0xF1, 0x03);
+                snd_soc_write(codec, 0xF1, 0x01);
+                snd_soc_write(codec, 0xF0, 0x00);
+        }
 
         return 0;
-
-pll_err:
-        dev_err(codec_dai->dev, "Unsupported PLL input frequency %d\n",
-                da7213->mclk_rate);
-        return -EINVAL;
 }
 
 /* DAI operations */
@@ -1454,11 +1493,10 @@ static int da7213_set_bias_level(struct snd_soc_codec *codec,
 
         switch (level) {
         case SND_SOC_BIAS_ON:
-        case SND_SOC_BIAS_PREPARE:
                 break;
-        case SND_SOC_BIAS_STANDBY:
-                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
-                        /* MCLK */
+        case SND_SOC_BIAS_PREPARE:
+                /* Enable MCLK for transition to ON state */
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_STANDBY) {
                         if (da7213->mclk) {
                                 ret = clk_prepare_enable(da7213->mclk);
                                 if (ret) {
@@ -1467,21 +1505,24 @@ static int da7213_set_bias_level(struct snd_soc_codec *codec,
                                         return ret;
                                 }
                         }
-
+                }
+                break;
+        case SND_SOC_BIAS_STANDBY:
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
                         /* Enable VMID reference & master bias */
                         snd_soc_update_bits(codec, DA7213_REFERENCES,
                                             DA7213_VMID_EN | DA7213_BIAS_EN,
                                             DA7213_VMID_EN | DA7213_BIAS_EN);
+                } else {
+                        /* Remove MCLK */
+                        if (da7213->mclk)
+                                clk_disable_unprepare(da7213->mclk);
                 }
                 break;
         case SND_SOC_BIAS_OFF:
                 /* Disable VMID reference & master bias */
                 snd_soc_update_bits(codec, DA7213_REFERENCES,
                                     DA7213_VMID_EN | DA7213_BIAS_EN, 0);
-
-                /* MCLK */
-                if (da7213->mclk)
-                        clk_disable_unprepare(da7213->mclk);
                 break;
         }
         return 0;
@@ -1605,9 +1646,6 @@ static int da7213_probe(struct snd_soc_codec *codec)
                             DA7213_ALC_CALIB_MODE_MAN, 0);
         da7213->alc_calib_auto = true;
 
-        /* Default to using SRM for slave mode */
-        da7213->srm_en = true;
-
         /* Default PC counter to free-running */
         snd_soc_update_bits(codec, DA7213_PC_COUNT, DA7213_PC_FREERUN_MASK,
                             DA7213_PC_FREERUN_MASK);
@@ -1740,13 +1778,14 @@ static struct snd_soc_codec_driver soc_codec_dev_da7213 = {
         .probe                  = da7213_probe,
         .set_bias_level         = da7213_set_bias_level,
 
-        .controls               = da7213_snd_controls,
-        .num_controls           = ARRAY_SIZE(da7213_snd_controls),
-
-        .dapm_widgets           = da7213_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(da7213_dapm_widgets),
-        .dapm_routes            = da7213_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(da7213_audio_map),
+        .component_driver = {
+                .controls               = da7213_snd_controls,
+                .num_controls           = ARRAY_SIZE(da7213_snd_controls),
+                .dapm_widgets           = da7213_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(da7213_dapm_widgets),
+                .dapm_routes            = da7213_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(da7213_audio_map),
+        },
 };
 
 static const struct regmap_config da7213_regmap_config = {
diff --git a/sound/soc/codecs/da7213.h b/sound/soc/codecs/da7213.h
index fbb7a356a501..16ef56f77cd4 100644
--- a/sound/soc/codecs/da7213.h
+++ b/sound/soc/codecs/da7213.h
@@ -172,6 +172,7 @@
 #define DA7213_PLL_32K_MODE                                     (0x1 << 5)
 #define DA7213_PLL_SRM_EN                                       (0x1 << 6)
 #define DA7213_PLL_EN                                           (0x1 << 7)
+#define DA7213_PLL_MODE_MASK                                    (0x7 << 5)
 
 /* DA7213_DAI_CLK_MODE = 0x28 */
 #define DA7213_DAI_BCLKS_PER_WCLK_32                            (0x0 << 0)
@@ -499,8 +500,6 @@
 #define DA7213_ALC_AVG_ITERATIONS       5
 
 /* PLL related */
-#define DA7213_SYSCLK_MCLK                      0
-#define DA7213_SYSCLK_PLL                       1
 #define DA7213_PLL_FREQ_OUT_90316800            90316800
 #define DA7213_PLL_FREQ_OUT_98304000            98304000
 #define DA7213_PLL_FREQ_OUT_94310400            94310400
@@ -515,6 +514,13 @@ enum da7213_clk_src {
         DA7213_CLKSRC_MCLK_SQR,
 };
 
+enum da7213_sys_clk {
+        DA7213_SYSCLK_MCLK = 0,
+        DA7213_SYSCLK_PLL,
+        DA7213_SYSCLK_PLL_SRM,
+        DA7213_SYSCLK_PLL_32KHZ
+};
+
 /* Codec private data */
 struct da7213_priv {
         struct regmap *regmap;
@@ -522,8 +528,6 @@ struct da7213_priv {
         unsigned int mclk_rate;
         int clk_src;
         bool master;
-        bool mclk_squarer_en;
-        bool srm_en;
         bool alc_calib_auto;
         bool alc_en;
         struct da7213_platform_data *pdata;
diff --git a/sound/soc/codecs/da7218.c b/sound/soc/codecs/da7218.c
index 99ce23e113bf..c69e97654fc6 100644
--- a/sound/soc/codecs/da7218.c
+++ b/sound/soc/codecs/da7218.c
@@ -1819,7 +1819,7 @@ static int da7218_set_dai_sysclk(struct snd_soc_dai *codec_dai,
         if (da7218->mclk_rate == freq)
                 return 0;
 
-        if (((freq < 2000000) && (freq != 32768)) || (freq > 54000000)) {
+        if ((freq < 2000000) || (freq > 54000000)) {
                 dev_err(codec_dai->dev, "Unsupported MCLK value %d\n",
                         freq);
                 return -EINVAL;
@@ -1866,11 +1866,8 @@ static int da7218_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
         u32 freq_ref;
         u64 frac_div;
 
-        /* Verify 32KHz, 2MHz - 54MHz MCLK provided, and set input divider */
-        if (da7218->mclk_rate == 32768) {
-                indiv_bits = DA7218_PLL_INDIV_9_TO_18_MHZ;
-                indiv = DA7218_PLL_INDIV_9_TO_18_MHZ_VAL;
-        } else if (da7218->mclk_rate < 2000000) {
+        /* Verify 2MHz - 54MHz MCLK provided, and set input divider */
+        if (da7218->mclk_rate < 2000000) {
                 dev_err(codec->dev, "PLL input clock %d below valid range\n",
                         da7218->mclk_rate);
                 return -EINVAL;
@@ -1911,9 +1908,6 @@ static int da7218_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
         case DA7218_SYSCLK_PLL_SRM:
                 pll_ctrl |= DA7218_PLL_MODE_SRM;
                 break;
-        case DA7218_SYSCLK_PLL_32KHZ:
-                pll_ctrl |= DA7218_PLL_MODE_32KHZ;
-                break;
         default:
                 dev_err(codec->dev, "Invalid PLL config\n");
                 return -EINVAL;
@@ -2589,20 +2583,22 @@ static int da7218_set_bias_level(struct snd_soc_codec *codec,
 
         switch (level) {
         case SND_SOC_BIAS_ON:
-        case SND_SOC_BIAS_PREPARE:
                 break;
-        case SND_SOC_BIAS_STANDBY:
-                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
-                        /* MCLK */
+        case SND_SOC_BIAS_PREPARE:
+                /* Enable MCLK for transition to ON state */
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_STANDBY) {
                         if (da7218->mclk) {
                                 ret = clk_prepare_enable(da7218->mclk);
                                 if (ret) {
-                                        dev_err(codec->dev,
-                                                "Failed to enable mclk\n");
+                                        dev_err(codec->dev, "Failed to enable mclk\n");
                                         return ret;
                                 }
                         }
+                }
 
+                break;
+        case SND_SOC_BIAS_STANDBY:
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
                         /* Master bias */
                         snd_soc_update_bits(codec, DA7218_REFERENCES,
                                             DA7218_BIAS_EN_MASK,
@@ -2612,6 +2608,10 @@ static int da7218_set_bias_level(struct snd_soc_codec *codec,
                         snd_soc_update_bits(codec, DA7218_LDO_CTRL,
                                             DA7218_LDO_EN_MASK,
                                             DA7218_LDO_EN_MASK);
+                } else {
+                        /* Remove MCLK */
+                        if (da7218->mclk)
+                                clk_disable_unprepare(da7218->mclk);
                 }
                 break;
         case SND_SOC_BIAS_OFF:
@@ -2625,10 +2625,6 @@ static int da7218_set_bias_level(struct snd_soc_codec *codec,
                         snd_soc_update_bits(codec, DA7218_REFERENCES,
                                             DA7218_BIAS_EN_MASK, 0);
                 }
-
-                /* MCLK */
-                if (da7218->mclk)
-                        clk_disable_unprepare(da7218->mclk);
                 break;
         }
 
@@ -3045,13 +3041,14 @@ static struct snd_soc_codec_driver soc_codec_dev_da7218 = {
         .resume                 = da7218_resume,
         .set_bias_level         = da7218_set_bias_level,
 
-        .controls               = da7218_snd_controls,
-        .num_controls           = ARRAY_SIZE(da7218_snd_controls),
-
-        .dapm_widgets           = da7218_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(da7218_dapm_widgets),
-        .dapm_routes            = da7218_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(da7218_audio_map),
+        .component_driver = {
+                .controls               = da7218_snd_controls,
+                .num_controls           = ARRAY_SIZE(da7218_snd_controls),
+                .dapm_widgets           = da7218_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(da7218_dapm_widgets),
+                .dapm_routes            = da7218_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(da7218_audio_map),
+        },
 };
 
 
diff --git a/sound/soc/codecs/da7218.h b/sound/soc/codecs/da7218.h
index 477cd37723cf..4f7ec21069a4 100644
--- a/sound/soc/codecs/da7218.h
+++ b/sound/soc/codecs/da7218.h
@@ -888,7 +888,6 @@
 #define DA7218_PLL_MODE_BYPASS          (0x0 << 6)
 #define DA7218_PLL_MODE_NORMAL          (0x1 << 6)
 #define DA7218_PLL_MODE_SRM             (0x2 << 6)
-#define DA7218_PLL_MODE_32KHZ           (0x3 << 6)
 
 /* DA7218_PLL_FRAC_TOP = 0x92 */
 #define DA7218_PLL_FBDIV_FRAC_TOP_SHIFT 0
@@ -1371,7 +1370,6 @@ enum da7218_sys_clk {
         DA7218_SYSCLK_MCLK = 0,
         DA7218_SYSCLK_PLL,
         DA7218_SYSCLK_PLL_SRM,
-        DA7218_SYSCLK_PLL_32KHZ
 };
 
 enum da7218_dev_id {
diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
index f0057cd223a4..2b8914dd5990 100644
--- a/sound/soc/codecs/da7219-aad.c
+++ b/sound/soc/codecs/da7219-aad.c
@@ -13,6 +13,7 @@
 
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/clk.h>
 #include <linux/i2c.h>
 #include <linux/property.h>
 #include <linux/pm_wakeirq.h>
@@ -114,13 +115,38 @@ static void da7219_aad_hptest_work(struct work_struct *work)
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
 
         u16 tonegen_freq_hptest;
-        u8 accdet_cfg8;
-        int report = 0;
+        u8 pll_srm_sts, gain_ramp_ctrl, accdet_cfg8;
+        int report = 0, ret = 0;
 
         /* Lock DAPM and any Kcontrols that are affected by this test */
         snd_soc_dapm_mutex_lock(dapm);
         mutex_lock(&da7219->lock);
 
+        /* Ensure MCLK is available for HP test procedure */
+        if (da7219->mclk) {
+                ret = clk_prepare_enable(da7219->mclk);
+                if (ret) {
+                        dev_err(codec->dev, "Failed to enable mclk - %d\n", ret);
+                        mutex_unlock(&da7219->lock);
+                        snd_soc_dapm_mutex_unlock(dapm);
+                        return;
+                }
+        }
+
+        /*
+         * If MCLK not present, then we're using the internal oscillator and
+         * require different frequency settings to achieve the same result.
+         */
+        pll_srm_sts = snd_soc_read(codec, DA7219_PLL_SRM_STS);
+        if (pll_srm_sts & DA7219_PLL_SRM_STS_MCLK)
+                tonegen_freq_hptest = cpu_to_le16(DA7219_AAD_HPTEST_RAMP_FREQ);
+        else
+                tonegen_freq_hptest = cpu_to_le16(DA7219_AAD_HPTEST_RAMP_FREQ_INT_OSC);
+
+        /* Ensure gain ramping at fastest rate */
+        gain_ramp_ctrl = snd_soc_read(codec, DA7219_GAIN_RAMP_CTRL);
+        snd_soc_write(codec, DA7219_GAIN_RAMP_CTRL, DA7219_GAIN_RAMP_RATE_X8);
+
         /* Bypass cache so it saves current settings */
         regcache_cache_bypass(da7219->regmap, true);
 
@@ -183,9 +209,15 @@ static void da7219_aad_hptest_work(struct work_struct *work)
         snd_soc_write(codec, DA7219_HP_R_CTRL,
                       DA7219_HP_R_AMP_OE_MASK | DA7219_HP_R_AMP_EN_MASK);
 
+        /*
+         * If we're running from the internal oscillator then give audio paths
+         * time to settle before running test.
+         */
+        if (!(pll_srm_sts & DA7219_PLL_SRM_STS_MCLK))
+                msleep(DA7219_AAD_HPTEST_INT_OSC_PATH_DELAY);
+
         /* Configure & start Tone Generator */
         snd_soc_write(codec, DA7219_TONE_GEN_ON_PER, DA7219_BEEP_ON_PER_MASK);
-        tonegen_freq_hptest = cpu_to_le16(DA7219_AAD_HPTEST_RAMP_FREQ);
         regmap_raw_write(da7219->regmap, DA7219_TONE_GEN_FREQ1_L,
                          &tonegen_freq_hptest, sizeof(tonegen_freq_hptest));
         snd_soc_update_bits(codec, DA7219_TONE_GEN_CFG2,
@@ -244,12 +276,26 @@ static void da7219_aad_hptest_work(struct work_struct *work)
         snd_soc_update_bits(codec, DA7219_ACCDET_CONFIG_8,
                             DA7219_HPTEST_EN_MASK, 0);
 
+        /*
+         * If we're running from the internal oscillator then give audio paths
+         * time to settle before allowing headphones to be driven as required.
+         */
+        if (!(pll_srm_sts & DA7219_PLL_SRM_STS_MCLK))
+                msleep(DA7219_AAD_HPTEST_INT_OSC_PATH_DELAY);
+
+        /* Restore gain ramping rate */
+        snd_soc_write(codec, DA7219_GAIN_RAMP_CTRL, gain_ramp_ctrl);
+
         /* Drive Headphones/lineout */
         snd_soc_update_bits(codec, DA7219_HP_L_CTRL, DA7219_HP_L_AMP_OE_MASK,
                             DA7219_HP_L_AMP_OE_MASK);
         snd_soc_update_bits(codec, DA7219_HP_R_CTRL, DA7219_HP_R_AMP_OE_MASK,
                             DA7219_HP_R_AMP_OE_MASK);
 
+        /* Remove MCLK, if previously enabled */
+        if (da7219->mclk)
+                clk_disable_unprepare(da7219->mclk);
+
         mutex_unlock(&da7219->lock);
         snd_soc_dapm_mutex_unlock(dapm);
 
@@ -751,6 +797,62 @@ static void da7219_aad_handle_pdata(struct snd_soc_codec *codec)
 
 
 /*
+ * Suspend/Resume
+ */
+
+void da7219_aad_suspend(struct snd_soc_codec *codec)
+{
+        struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
+        struct da7219_aad_priv *da7219_aad = da7219->aad;
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+        u8 micbias_ctrl;
+
+        if (da7219_aad->jack) {
+                /* Disable jack detection during suspend */
+                snd_soc_update_bits(codec, DA7219_ACCDET_CONFIG_1,
+                                    DA7219_ACCDET_EN_MASK, 0);
+
+                /*
+                 * If we have a 4-pole jack inserted, then micbias will be
+                 * enabled. We can disable micbias here, and keep a note to
+                 * re-enable it on resume. If jack removal occurred during
+                 * suspend then this will be dealt with through the IRQ handler.
+                 */
+                if (da7219_aad->jack_inserted) {
+                        micbias_ctrl = snd_soc_read(codec, DA7219_MICBIAS_CTRL);
+                        if (micbias_ctrl & DA7219_MICBIAS1_EN_MASK) {
+                                snd_soc_dapm_disable_pin(dapm, "Mic Bias");
+                                snd_soc_dapm_sync(dapm);
+                                da7219_aad->micbias_resume_enable = true;
+                        }
+                }
+        }
+}
+
+void da7219_aad_resume(struct snd_soc_codec *codec)
+{
+        struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
+        struct da7219_aad_priv *da7219_aad = da7219->aad;
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+
+        if (da7219_aad->jack) {
+                /* Re-enable micbias if previously enabled for 4-pole jack */
+                if (da7219_aad->jack_inserted &&
+                    da7219_aad->micbias_resume_enable) {
+                        snd_soc_dapm_force_enable_pin(dapm, "Mic Bias");
+                        snd_soc_dapm_sync(dapm);
+                        da7219_aad->micbias_resume_enable = false;
+                }
+
+                /* Re-enable jack detection */
+                snd_soc_update_bits(codec, DA7219_ACCDET_CONFIG_1,
+                                    DA7219_ACCDET_EN_MASK,
+                                    DA7219_ACCDET_EN_MASK);
+        }
+}
+
+
+/*
  * Init/Exit
  */
 
diff --git a/sound/soc/codecs/da7219-aad.h b/sound/soc/codecs/da7219-aad.h
index 4fccf677cd06..117a3d7ccd31 100644
--- a/sound/soc/codecs/da7219-aad.h
+++ b/sound/soc/codecs/da7219-aad.h
@@ -176,8 +176,10 @@
 #define DA7219_AAD_MICBIAS_CHK_DELAY    10
 #define DA7219_AAD_MICBIAS_CHK_RETRIES  5
 
-#define DA7219_AAD_HPTEST_RAMP_FREQ     0x28
-#define DA7219_AAD_HPTEST_PERIOD        65
+#define DA7219_AAD_HPTEST_RAMP_FREQ             0x28
+#define DA7219_AAD_HPTEST_RAMP_FREQ_INT_OSC     0x4D
+#define DA7219_AAD_HPTEST_PERIOD                65
+#define DA7219_AAD_HPTEST_INT_OSC_PATH_DELAY    20
 
 enum da7219_aad_event_regs {
         DA7219_AAD_IRQ_REG_A = 0,
@@ -199,12 +201,17 @@ struct da7219_aad_priv {
         struct work_struct hptest_work;
 
         struct snd_soc_jack *jack;
+        bool micbias_resume_enable;
         bool jack_inserted;
 };
 
 /* AAD control */
 void da7219_aad_jack_det(struct snd_soc_codec *codec, struct snd_soc_jack *jack);
 
+/* Suspend/Resume */
+void da7219_aad_suspend(struct snd_soc_codec *codec);
+void da7219_aad_resume(struct snd_soc_codec *codec);
+
 /* Init/Exit */
 int da7219_aad_init(struct snd_soc_codec *codec);
 void da7219_aad_exit(struct snd_soc_codec *codec);
diff --git a/sound/soc/codecs/da7219.c b/sound/soc/codecs/da7219.c
index 50ea94317cb3..1152aa5e7c39 100644
--- a/sound/soc/codecs/da7219.c
+++ b/sound/soc/codecs/da7219.c
@@ -801,7 +801,7 @@ static int da7219_dai_event(struct snd_soc_dapm_widget *w,
                                 ++i;
                                 msleep(50);
                         }
-                } while ((i < DA7219_SRM_CHECK_RETRIES) & (!srm_lock));
+                } while ((i < DA7219_SRM_CHECK_RETRIES) && (!srm_lock));
 
                 if (!srm_lock)
                         dev_warn(codec->dev, "SRM failed to lock\n");
@@ -1482,6 +1482,8 @@ static struct da7219_pdata *da7219_fw_to_pdata(struct snd_soc_codec *codec)
         if (!pdata)
                 return NULL;
 
+        pdata->wakeup_source = device_property_read_bool(dev, "wakeup-source");
+
         if (device_property_read_u32(dev, "dlg,micbias-lvl", &of_val32) >= 0)
                 pdata->micbias_lvl = da7219_fw_micbias_lvl(dev, of_val32);
         else
@@ -1508,11 +1510,10 @@ static int da7219_set_bias_level(struct snd_soc_codec *codec,
 
         switch (level) {
         case SND_SOC_BIAS_ON:
-        case SND_SOC_BIAS_PREPARE:
                 break;
-        case SND_SOC_BIAS_STANDBY:
-                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
-                        /* MCLK */
+        case SND_SOC_BIAS_PREPARE:
+                /* Enable MCLK for transition to ON state */
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_STANDBY) {
                         if (da7219->mclk) {
                                 ret = clk_prepare_enable(da7219->mclk);
                                 if (ret) {
@@ -1521,22 +1522,28 @@ static int da7219_set_bias_level(struct snd_soc_codec *codec,
                                         return ret;
                                 }
                         }
+                }
 
+                break;
+        case SND_SOC_BIAS_STANDBY:
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF)
                         /* Master bias */
                         snd_soc_update_bits(codec, DA7219_REFERENCES,
                                             DA7219_BIAS_EN_MASK,
                                             DA7219_BIAS_EN_MASK);
+
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_PREPARE) {
+                        /* Remove MCLK */
+                        if (da7219->mclk)
+                                clk_disable_unprepare(da7219->mclk);
                 }
                 break;
         case SND_SOC_BIAS_OFF:
-                /* Only disable master bias if jack detection not active */
-                if (!da7219->aad->jack)
+                /* Only disable master bias if we're not a wake-up source */
+                if (!da7219->wakeup_source)
                         snd_soc_update_bits(codec, DA7219_REFERENCES,
                                             DA7219_BIAS_EN_MASK, 0);
 
-                /* MCLK */
-                if (da7219->mclk)
-                        clk_disable_unprepare(da7219->mclk);
                 break;
         }
 
@@ -1599,6 +1606,8 @@ static void da7219_handle_pdata(struct snd_soc_codec *codec)
         if (pdata) {
                 u8 micbias_lvl = 0;
 
+                da7219->wakeup_source = pdata->wakeup_source;
+
                 /* Mic Bias voltages */
                 switch (pdata->micbias_lvl) {
                 case DA7219_MICBIAS_1_6V:
@@ -1733,11 +1742,11 @@ static int da7219_suspend(struct snd_soc_codec *codec)
 {
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
 
-        snd_soc_codec_force_bias_level(codec, SND_SOC_BIAS_OFF);
+        /* Suspend AAD if we're not a wake-up source */
+        if (!da7219->wakeup_source)
+                da7219_aad_suspend(codec);
 
-        /* Put device into standby mode if jack detection disabled */
-        if (!da7219->aad->jack)
-                snd_soc_write(codec, DA7219_SYSTEM_ACTIVE, 0);
+        snd_soc_codec_force_bias_level(codec, SND_SOC_BIAS_OFF);
 
         return 0;
 }
@@ -1746,13 +1755,12 @@ static int da7219_resume(struct snd_soc_codec *codec)
 {
         struct da7219_priv *da7219 = snd_soc_codec_get_drvdata(codec);
 
-        /* Put device into active mode if previously pushed to standby */
-        if (!da7219->aad->jack)
-                snd_soc_write(codec, DA7219_SYSTEM_ACTIVE,
-                              DA7219_SYSTEM_ACTIVE_MASK);
-
         snd_soc_codec_force_bias_level(codec, SND_SOC_BIAS_STANDBY);
 
+        /* Resume AAD if previously suspended */
+        if (!da7219->wakeup_source)
+                da7219_aad_resume(codec);
+
         return 0;
 }
 #else
@@ -1767,13 +1775,14 @@ static struct snd_soc_codec_driver soc_codec_dev_da7219 = {
         .resume                 = da7219_resume,
         .set_bias_level         = da7219_set_bias_level,
 
-        .controls               = da7219_snd_controls,
-        .num_controls           = ARRAY_SIZE(da7219_snd_controls),
-
-        .dapm_widgets           = da7219_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(da7219_dapm_widgets),
-        .dapm_routes            = da7219_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(da7219_audio_map),
+        .component_driver = {
+                .controls               = da7219_snd_controls,
+                .num_controls           = ARRAY_SIZE(da7219_snd_controls),
+                .dapm_widgets           = da7219_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(da7219_dapm_widgets),
+                .dapm_routes            = da7219_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(da7219_audio_map),
+        },
 };
 
 
@@ -1921,7 +1930,8 @@ static int da7219_i2c_probe(struct i2c_client *i2c,
                             const struct i2c_device_id *id)
 {
         struct da7219_priv *da7219;
-        int ret;
+        unsigned int system_active, system_status;
+        int i, ret;
 
         da7219 = devm_kzalloc(&i2c->dev, sizeof(struct da7219_priv),
                               GFP_KERNEL);
@@ -1937,6 +1947,37 @@ static int da7219_i2c_probe(struct i2c_client *i2c,
                 return ret;
         }
 
+        regcache_cache_bypass(da7219->regmap, true);
+
+        /* Disable audio paths if still active from previous start */
+        regmap_read(da7219->regmap, DA7219_SYSTEM_ACTIVE, &system_active);
+        if (system_active) {
+                regmap_write(da7219->regmap, DA7219_GAIN_RAMP_CTRL,
+                             DA7219_GAIN_RAMP_RATE_NOMINAL);
+                regmap_write(da7219->regmap, DA7219_SYSTEM_MODES_INPUT, 0x00);
+                regmap_write(da7219->regmap, DA7219_SYSTEM_MODES_OUTPUT, 0x01);
+
+                for (i = 0; i < DA7219_SYS_STAT_CHECK_RETRIES; ++i) {
+                        regmap_read(da7219->regmap, DA7219_SYSTEM_STATUS,
+                                    &system_status);
+                        if (!system_status)
+                                break;
+
+                        msleep(DA7219_SYS_STAT_CHECK_DELAY);
+                }
+        }
+
+        /* Soft reset codec */
+        regmap_write_bits(da7219->regmap, DA7219_ACCDET_CONFIG_1,
+                          DA7219_ACCDET_EN_MASK, 0);
+        regmap_write_bits(da7219->regmap, DA7219_CIF_CTRL,
+                          DA7219_CIF_REG_SOFT_RESET_MASK,
+                          DA7219_CIF_REG_SOFT_RESET_MASK);
+        regmap_write_bits(da7219->regmap, DA7219_SYSTEM_ACTIVE,
+                          DA7219_SYSTEM_ACTIVE_MASK, 0);
+
+        regcache_cache_bypass(da7219->regmap, false);
+
         ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_da7219,
                                      &da7219_dai, 1);
         if (ret < 0) {
diff --git a/sound/soc/codecs/da7219.h b/sound/soc/codecs/da7219.h
index ff2a2f02ce40..66d3bad86739 100644
--- a/sound/soc/codecs/da7219.h
+++ b/sound/soc/codecs/da7219.h
@@ -224,6 +224,7 @@
 #define DA7219_PLL_SRM_STATE_MASK       (0xF << 0)
 #define DA7219_PLL_SRM_STATUS_SHIFT     4
 #define DA7219_PLL_SRM_STATUS_MASK      (0xF << 4)
+#define DA7219_PLL_SRM_STS_MCLK         (0x1 << 4)
 #define DA7219_PLL_SRM_STS_SRM_LOCK     (0x1 << 7)
 
 /* DA7219_DIG_ROUTING_DAI = 0x2A */
@@ -576,6 +577,8 @@
 /* DA7219_GAIN_RAMP_CTRL = 0x92 */
 #define DA7219_GAIN_RAMP_RATE_SHIFT     0
 #define DA7219_GAIN_RAMP_RATE_MASK      (0x3 << 0)
+#define DA7219_GAIN_RAMP_RATE_X8        (0x0 << 0)
+#define DA7219_GAIN_RAMP_RATE_NOMINAL   (0x1 << 0)
 #define DA7219_GAIN_RAMP_RATE_MAX       4
 
 /* DA7219_PC_COUNT = 0x94 */
@@ -770,6 +773,10 @@
 /* SRM */
 #define DA7219_SRM_CHECK_RETRIES        8
 
+/* System Controller */
+#define DA7219_SYS_STAT_CHECK_RETRIES   6
+#define DA7219_SYS_STAT_CHECK_DELAY     50
+
 enum da7219_clk_src {
         DA7219_CLKSRC_MCLK = 0,
         DA7219_CLKSRC_MCLK_SQR,
@@ -796,6 +803,7 @@ struct da7219_priv {
         struct da7219_aad_priv *aad;
         struct da7219_pdata *pdata;
 
+        bool wakeup_source;
         struct regulator_bulk_data supplies[DA7219_NUM_SUPPLIES];
         struct regmap *regmap;
         struct mutex lock;
diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
index 461506a4ca6a..c1cc1c1c28f2 100644
--- a/sound/soc/codecs/da732x.c
+++ b/sound/soc/codecs/da732x.c
@@ -1501,12 +1501,14 @@ static int da732x_set_bias_level(struct snd_soc_codec *codec,
 
 static struct snd_soc_codec_driver soc_codec_dev_da732x = {
         .set_bias_level         = da732x_set_bias_level,
-        .controls               = da732x_snd_controls,
-        .num_controls           = ARRAY_SIZE(da732x_snd_controls),
-        .dapm_widgets           = da732x_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(da732x_dapm_widgets),
-        .dapm_routes            = da732x_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(da732x_dapm_routes),
+        .component_driver = {
+                .controls               = da732x_snd_controls,
+                .num_controls           = ARRAY_SIZE(da732x_snd_controls),
+                .dapm_widgets           = da732x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(da732x_dapm_widgets),
+                .dapm_routes            = da732x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(da732x_dapm_routes),
+        },
         .set_pll                = da732x_set_dai_pll,
 };
 
diff --git a/sound/soc/codecs/da9055.c b/sound/soc/codecs/da9055.c
index 0b2ede8db978..4efb5f897a0c 100644
--- a/sound/soc/codecs/da9055.c
+++ b/sound/soc/codecs/da9055.c
@@ -1455,13 +1455,14 @@ static struct snd_soc_codec_driver soc_codec_dev_da9055 = {
         .probe                  = da9055_probe,
         .set_bias_level         = da9055_set_bias_level,
 
-        .controls               = da9055_snd_controls,
-        .num_controls           = ARRAY_SIZE(da9055_snd_controls),
-
-        .dapm_widgets           = da9055_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(da9055_dapm_widgets),
-        .dapm_routes            = da9055_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(da9055_audio_map),
+        .component_driver = {
+                .controls               = da9055_snd_controls,
+                .num_controls           = ARRAY_SIZE(da9055_snd_controls),
+                .dapm_widgets           = da9055_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(da9055_dapm_widgets),
+                .dapm_routes            = da9055_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(da9055_audio_map),
+        },
 };
 
 static const struct regmap_config da9055_regmap_config = {
diff --git a/sound/soc/codecs/dmic.c b/sound/soc/codecs/dmic.c
index fde53251c047..c82b9dc41e9a 100644
--- a/sound/soc/codecs/dmic.c
+++ b/sound/soc/codecs/dmic.c
@@ -51,10 +51,12 @@ static const struct snd_soc_dapm_route intercon[] = {
 };
 
 static struct snd_soc_codec_driver soc_dmic = {
-        .dapm_widgets = dmic_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(dmic_dapm_widgets),
-        .dapm_routes = intercon,
-        .num_dapm_routes = ARRAY_SIZE(intercon),
+        .component_driver = {
+                .dapm_widgets           = dmic_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(dmic_dapm_widgets),
+                .dapm_routes            = intercon,
+                .num_dapm_routes        = ARRAY_SIZE(intercon),
+        },
 };
 
 static int dmic_dev_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index 2086d7107622..37722194b107 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -823,12 +823,14 @@ static struct snd_soc_codec_driver es8328_codec_driver = {
         .set_bias_level   = es8328_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls         = es8328_snd_controls,
-        .num_controls     = ARRAY_SIZE(es8328_snd_controls),
-        .dapm_widgets     = es8328_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(es8328_dapm_widgets),
-        .dapm_routes      = es8328_dapm_routes,
-        .num_dapm_routes  = ARRAY_SIZE(es8328_dapm_routes),
+        .component_driver = {
+                .controls               = es8328_snd_controls,
+                .num_controls           = ARRAY_SIZE(es8328_snd_controls),
+                .dapm_widgets           = es8328_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(es8328_dapm_widgets),
+                .dapm_routes            = es8328_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(es8328_dapm_routes),
+        },
 };
 
 int es8328_probe(struct device *dev, struct regmap *regmap)
diff --git a/sound/soc/codecs/gtm601.c b/sound/soc/codecs/gtm601.c
index 0b80052996d3..926b1a4e37d4 100644
--- a/sound/soc/codecs/gtm601.c
+++ b/sound/soc/codecs/gtm601.c
@@ -52,10 +52,12 @@ static struct snd_soc_dai_driver gtm601_dai = {
 };
 
 static const struct snd_soc_codec_driver soc_codec_dev_gtm601 = {
-        .dapm_widgets = gtm601_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(gtm601_dapm_widgets),
-        .dapm_routes = gtm601_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(gtm601_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = gtm601_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(gtm601_dapm_widgets),
+                .dapm_routes            = gtm601_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(gtm601_dapm_routes),
+        },
 };
 
 static int gtm601_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/hdac_hdmi.c b/sound/soc/codecs/hdac_hdmi.c
index 4e181b270d95..c602c4960924 100644
--- a/sound/soc/codecs/hdac_hdmi.c
+++ b/sound/soc/codecs/hdac_hdmi.c
@@ -614,7 +614,7 @@ static int hdac_hdmi_pcm_open(struct snd_pcm_substream *substream,
                         (!pin->eld.eld_valid)) {
 
                 dev_warn(&hdac->hdac.dev,
-                        "Failed: montior present? %d ELD valid?: %d for pin: %d\n",
+                        "Failed: monitor present? %d ELD valid?: %d for pin: %d\n",
                         pin->eld.monitor_present, pin->eld.eld_valid, pin->nid);
 
                 return 0;
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index f27d115626db..b904492d7744 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -24,6 +24,15 @@
 
 #include <drm/drm_crtc.h> /* This is only to get MAX_ELD_BYTES */
 
+struct hdmi_device {
+        struct device *dev;
+        struct list_head list;
+        int cnt;
+};
+#define pos_to_hdmi_device(pos) container_of((pos), struct hdmi_device, list)
+LIST_HEAD(hdmi_device_list);
+
+#define DAI_NAME_SIZE 16
 struct hdmi_codec_priv {
         struct hdmi_codec_pdata hcd;
         struct snd_soc_dai_driver *daidrv;
@@ -320,7 +329,6 @@ static const struct snd_soc_dai_ops hdmi_dai_ops = {
                          SNDRV_PCM_FMTBIT_S32_LE | SNDRV_PCM_FMTBIT_S32_BE)
 
 static struct snd_soc_dai_driver hdmi_i2s_dai = {
-        .name = "i2s-hifi",
         .id = DAI_ID_I2S,
         .playback = {
                 .stream_name = "Playback",
@@ -334,7 +342,6 @@ static struct snd_soc_dai_driver hdmi_i2s_dai = {
 };
 
 static const struct snd_soc_dai_driver hdmi_spdif_dai = {
-        .name = "spdif-hifi",
         .id = DAI_ID_SPDIF,
         .playback = {
                 .stream_name = "Playback",
@@ -346,13 +353,37 @@ static const struct snd_soc_dai_driver hdmi_spdif_dai = {
         .ops = &hdmi_dai_ops,
 };
 
+static char hdmi_dai_name[][DAI_NAME_SIZE] = {
+        "hdmi-hifi.0",
+        "hdmi-hifi.1",
+        "hdmi-hifi.2",
+        "hdmi-hifi.3",
+};
+
+static int hdmi_of_xlate_dai_name(struct snd_soc_component *component,
+                                  struct of_phandle_args *args,
+                                  const char **dai_name)
+{
+        int id = args->args[0];
+
+        if (id < ARRAY_SIZE(hdmi_dai_name)) {
+                *dai_name = hdmi_dai_name[id];
+                return 0;
+        }
+
+        return -EAGAIN;
+}
+
 static struct snd_soc_codec_driver hdmi_codec = {
-        .controls = hdmi_controls,
-        .num_controls = ARRAY_SIZE(hdmi_controls),
-        .dapm_widgets = hdmi_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(hdmi_widgets),
-        .dapm_routes = hdmi_routes,
-        .num_dapm_routes = ARRAY_SIZE(hdmi_routes),
+        .component_driver = {
+                .controls               = hdmi_controls,
+                .num_controls           = ARRAY_SIZE(hdmi_controls),
+                .dapm_widgets           = hdmi_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(hdmi_widgets),
+                .dapm_routes            = hdmi_routes,
+                .num_dapm_routes        = ARRAY_SIZE(hdmi_routes),
+                .of_xlate_dai_name      = hdmi_of_xlate_dai_name,
+        },
 };
 
 static int hdmi_codec_probe(struct platform_device *pdev)
@@ -360,6 +391,8 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         struct hdmi_codec_pdata *hcd = pdev->dev.platform_data;
         struct device *dev = &pdev->dev;
         struct hdmi_codec_priv *hcp;
+        struct hdmi_device *hd;
+        struct list_head *pos;
         int dai_count, i = 0;
         int ret;
 
@@ -381,6 +414,31 @@ static int hdmi_codec_probe(struct platform_device *pdev)
         if (!hcp)
                 return -ENOMEM;
 
+        hd = NULL;
+        list_for_each(pos, &hdmi_device_list) {
+                struct hdmi_device *tmp = pos_to_hdmi_device(pos);
+
+                if (tmp->dev == dev->parent) {
+                        hd = tmp;
+                        break;
+                }
+        }
+
+        if (!hd) {
+                hd = devm_kzalloc(dev, sizeof(*hd), GFP_KERNEL);
+                if (!hd)
+                        return -ENOMEM;
+
+                hd->dev = dev->parent;
+
+                list_add_tail(&hd->list, &hdmi_device_list);
+        }
+
+        if (hd->cnt >= ARRAY_SIZE(hdmi_dai_name)) {
+                dev_err(dev, "too many hdmi codec are deteced\n");
+                return -EINVAL;
+        }
+
         hcp->hcd = *hcd;
         mutex_init(&hcp->current_stream_lock);
 
@@ -393,11 +451,14 @@ static int hdmi_codec_probe(struct platform_device *pdev)
                 hcp->daidrv[i] = hdmi_i2s_dai;
                 hcp->daidrv[i].playback.channels_max =
                         hcd->max_i2s_channels;
+                hcp->daidrv[i].name = hdmi_dai_name[hd->cnt++];
                 i++;
         }
 
-        if (hcd->spdif)
+        if (hcd->spdif) {
                 hcp->daidrv[i] = hdmi_spdif_dai;
+                hcp->daidrv[i].name = hdmi_dai_name[hd->cnt++];
+        }
 
         ret = snd_soc_register_codec(dev, &hdmi_codec, hcp->daidrv,
                                      dai_count);
diff --git a/sound/soc/codecs/inno_rk3036.c b/sound/soc/codecs/inno_rk3036.c
index 9b6e8840a1b5..b918ba5c8ce5 100644
--- a/sound/soc/codecs/inno_rk3036.c
+++ b/sound/soc/codecs/inno_rk3036.c
@@ -380,12 +380,14 @@ static struct snd_soc_codec_driver rk3036_codec_driver = {
         .probe                  = rk3036_codec_probe,
         .remove                 = rk3036_codec_remove,
         .set_bias_level         = rk3036_codec_set_bias_level,
-        .controls               = rk3036_codec_dapm_controls,
-        .num_controls           = ARRAY_SIZE(rk3036_codec_dapm_controls),
-        .dapm_routes            = rk3036_codec_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(rk3036_codec_dapm_routes),
-        .dapm_widgets           = rk3036_codec_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(rk3036_codec_dapm_widgets),
+        .component_driver = {
+                .controls               = rk3036_codec_dapm_controls,
+                .num_controls           = ARRAY_SIZE(rk3036_codec_dapm_controls),
+                .dapm_routes            = rk3036_codec_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rk3036_codec_dapm_routes),
+                .dapm_widgets           = rk3036_codec_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rk3036_codec_dapm_widgets),
+        },
 };
 
 static const struct regmap_config rk3036_codec_regmap_config = {
diff --git a/sound/soc/codecs/isabelle.c b/sound/soc/codecs/isabelle.c
index be448373d39a..a4b0eded984a 100644
--- a/sound/soc/codecs/isabelle.c
+++ b/sound/soc/codecs/isabelle.c
@@ -1089,12 +1089,14 @@ static struct snd_soc_dai_driver isabelle_dai[] = {
 
 static struct snd_soc_codec_driver soc_codec_dev_isabelle = {
         .set_bias_level = isabelle_set_bias_level,
-        .controls = isabelle_snd_controls,
-        .num_controls = ARRAY_SIZE(isabelle_snd_controls),
-        .dapm_widgets = isabelle_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(isabelle_dapm_widgets),
-        .dapm_routes = isabelle_intercon,
-        .num_dapm_routes = ARRAY_SIZE(isabelle_intercon),
+        .component_driver = {
+                .controls               = isabelle_snd_controls,
+                .num_controls           = ARRAY_SIZE(isabelle_snd_controls),
+                .dapm_widgets           = isabelle_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(isabelle_dapm_widgets),
+                .dapm_routes            = isabelle_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(isabelle_intercon),
+        },
         .idle_bias_off = true,
 };
 
diff --git a/sound/soc/codecs/jz4740.c b/sound/soc/codecs/jz4740.c
index 1f5ab99956ed..0290fab383da 100644
--- a/sound/soc/codecs/jz4740.c
+++ b/sound/soc/codecs/jz4740.c
@@ -298,12 +298,14 @@ static struct snd_soc_codec_driver soc_codec_dev_jz4740_codec = {
         .set_bias_level = jz4740_codec_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = jz4740_codec_controls,
-        .num_controls = ARRAY_SIZE(jz4740_codec_controls),
-        .dapm_widgets = jz4740_codec_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(jz4740_codec_dapm_widgets),
-        .dapm_routes = jz4740_codec_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(jz4740_codec_dapm_routes),
+        .component_driver = {
+                .controls               = jz4740_codec_controls,
+                .num_controls           = ARRAY_SIZE(jz4740_codec_controls),
+                .dapm_widgets           = jz4740_codec_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(jz4740_codec_dapm_widgets),
+                .dapm_routes            = jz4740_codec_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(jz4740_codec_dapm_routes),
+        },
 };
 
 static const struct regmap_config jz4740_codec_regmap_config = {
diff --git a/sound/soc/codecs/l3.c b/sound/soc/codecs/l3.c
index 5353af58862c..a10ea3c716c6 100644
--- a/sound/soc/codecs/l3.c
+++ b/sound/soc/codecs/l3.c
@@ -20,6 +20,8 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/gpio.h>
 
 #include <sound/l3.h>
 
@@ -32,11 +34,11 @@ static void sendbyte(struct l3_pins *adap, unsigned int byte)
         int i;
 
         for (i = 0; i < 8; i++) {
-                adap->setclk(0);
+                adap->setclk(adap, 0);
                 udelay(adap->data_hold);
-                adap->setdat(byte & 1);
+                adap->setdat(adap, byte & 1);
                 udelay(adap->data_setup);
-                adap->setclk(1);
+                adap->setclk(adap, 1);
                 udelay(adap->clock_high);
                 byte >>= 1;
         }
@@ -55,10 +57,10 @@ static void sendbytes(struct l3_pins *adap, const u8 *buf,
         for (i = 0; i < len; i++) {
                 if (i) {
                         udelay(adap->mode_hold);
-                        adap->setmode(0);
+                        adap->setmode(adap, 0);
                         udelay(adap->mode);
                 }
-                adap->setmode(1);
+                adap->setmode(adap, 1);
                 udelay(adap->mode_setup);
                 sendbyte(adap, buf[i]);
         }
@@ -66,26 +68,71 @@ static void sendbytes(struct l3_pins *adap, const u8 *buf,
 
 int l3_write(struct l3_pins *adap, u8 addr, u8 *data, int len)
 {
-        adap->setclk(1);
-        adap->setdat(1);
-        adap->setmode(1);
+        adap->setclk(adap, 1);
+        adap->setdat(adap, 1);
+        adap->setmode(adap, 1);
         udelay(adap->mode);
 
-        adap->setmode(0);
+        adap->setmode(adap, 0);
         udelay(adap->mode_setup);
         sendbyte(adap, addr);
         udelay(adap->mode_hold);
 
         sendbytes(adap, data, len);
 
-        adap->setclk(1);
-        adap->setdat(1);
-        adap->setmode(0);
+        adap->setclk(adap, 1);
+        adap->setdat(adap, 1);
+        adap->setmode(adap, 0);
 
         return len;
 }
 EXPORT_SYMBOL_GPL(l3_write);
 
+
+static void l3_set_clk(struct l3_pins *adap, int val)
+{
+        gpio_set_value(adap->gpio_clk, val);
+}
+
+static void l3_set_data(struct l3_pins *adap, int val)
+{
+        gpio_set_value(adap->gpio_data, val);
+}
+
+static void l3_set_mode(struct l3_pins *adap, int val)
+{
+        gpio_set_value(adap->gpio_mode, val);
+}
+
+int l3_set_gpio_ops(struct device *dev, struct l3_pins *adap)
+{
+        int ret;
+
+        if (!adap->use_gpios)
+                return -EINVAL;
+
+        ret = devm_gpio_request_one(dev, adap->gpio_data,
+                                GPIOF_OUT_INIT_LOW, "l3_data");
+        if (ret < 0)
+                return ret;
+        adap->setdat = l3_set_data;
+
+        ret = devm_gpio_request_one(dev, adap->gpio_clk,
+                                GPIOF_OUT_INIT_LOW, "l3_clk");
+        if (ret < 0)
+                return ret;
+        adap->setclk = l3_set_clk;
+
+        ret = devm_gpio_request_one(dev, adap->gpio_mode,
+                                GPIOF_OUT_INIT_LOW, "l3_mode");
+        if (ret < 0)
+                return ret;
+        adap->setmode = l3_set_mode;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(l3_set_gpio_ops);
+
 MODULE_DESCRIPTION("L3 bit-banging driver");
 MODULE_AUTHOR("Christian Pellegrin <chripell@evolware.org>");
 MODULE_LICENSE("GPL");
diff --git a/sound/soc/codecs/lm49453.c b/sound/soc/codecs/lm49453.c
index 9af5640e3446..8d413c2677cc 100644
--- a/sound/soc/codecs/lm49453.c
+++ b/sound/soc/codecs/lm49453.c
@@ -1391,12 +1391,14 @@ static struct snd_soc_dai_driver lm49453_dai[] = {
 
 static struct snd_soc_codec_driver soc_codec_dev_lm49453 = {
         .set_bias_level = lm49453_set_bias_level,
-        .controls = lm49453_snd_controls,
-        .num_controls = ARRAY_SIZE(lm49453_snd_controls),
-        .dapm_widgets = lm49453_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(lm49453_dapm_widgets),
-        .dapm_routes = lm49453_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(lm49453_audio_map),
+        .component_driver = {
+                .controls               = lm49453_snd_controls,
+                .num_controls           = ARRAY_SIZE(lm49453_snd_controls),
+                .dapm_widgets           = lm49453_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(lm49453_dapm_widgets),
+                .dapm_routes            = lm49453_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(lm49453_audio_map),
+        },
         .idle_bias_off = true,
 };
 
diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
index fc22804cabc5..72f77455582e 100644
--- a/sound/soc/codecs/max98088.c
+++ b/sound/soc/codecs/max98088.c
@@ -1704,12 +1704,14 @@ static struct snd_soc_codec_driver soc_codec_dev_max98088 = {
         .set_bias_level = max98088_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = max98088_snd_controls,
-        .num_controls = ARRAY_SIZE(max98088_snd_controls),
-        .dapm_widgets = max98088_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(max98088_dapm_widgets),
-        .dapm_routes = max98088_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(max98088_audio_map),
+        .component_driver = {
+                .controls               = max98088_snd_controls,
+                .num_controls           = ARRAY_SIZE(max98088_snd_controls),
+                .dapm_widgets           = max98088_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max98088_dapm_widgets),
+                .dapm_routes            = max98088_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(max98088_audio_map),
+        },
 };
 
 static int max98088_i2c_probe(struct i2c_client *i2c,
diff --git a/sound/soc/codecs/max98095.c b/sound/soc/codecs/max98095.c
index 3577003f39cf..6f8a757876ed 100644
--- a/sound/soc/codecs/max98095.c
+++ b/sound/soc/codecs/max98095.c
@@ -2108,12 +2108,14 @@ static struct snd_soc_codec_driver soc_codec_dev_max98095 = {
         .suspend = max98095_suspend,
         .resume  = max98095_resume,
         .set_bias_level = max98095_set_bias_level,
-        .controls = max98095_snd_controls,
-        .num_controls = ARRAY_SIZE(max98095_snd_controls),
-        .dapm_widgets     = max98095_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(max98095_dapm_widgets),
-        .dapm_routes     = max98095_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(max98095_audio_map),
+        .component_driver = {
+                .controls               = max98095_snd_controls,
+                .num_controls           = ARRAY_SIZE(max98095_snd_controls),
+                .dapm_widgets           = max98095_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max98095_dapm_widgets),
+                .dapm_routes            = max98095_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(max98095_audio_map),
+        },
 };
 
 static int max98095_i2c_probe(struct i2c_client *i2c,
diff --git a/sound/soc/codecs/max98357a.c b/sound/soc/codecs/max98357a.c
index 5b1dfb1518fb..6a6b68a4cb52 100644
--- a/sound/soc/codecs/max98357a.c
+++ b/sound/soc/codecs/max98357a.c
@@ -74,10 +74,12 @@ static int max98357a_codec_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver max98357a_codec_driver = {
         .probe                  = max98357a_codec_probe,
-        .dapm_widgets           = max98357a_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(max98357a_dapm_widgets),
-        .dapm_routes            = max98357a_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(max98357a_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = max98357a_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max98357a_dapm_widgets),
+                .dapm_routes            = max98357a_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(max98357a_dapm_routes),
+        },
 };
 
 static const struct snd_soc_dai_ops max98357a_dai_ops = {
diff --git a/sound/soc/codecs/max98371.c b/sound/soc/codecs/max98371.c
index cf0a39bb631a..781be9ba8dba 100644
--- a/sound/soc/codecs/max98371.c
+++ b/sound/soc/codecs/max98371.c
@@ -412,6 +412,7 @@ static int max98371_i2c_remove(struct i2c_client *client)
 
 static const struct i2c_device_id max98371_i2c_id[] = {
         { "max98371", 0 },
+        { }
 };
 
 MODULE_DEVICE_TABLE(i2c, max98371_i2c_id);
@@ -425,7 +426,6 @@ MODULE_DEVICE_TABLE(of, max98371_of_match);
 static struct i2c_driver max98371_i2c_driver = {
         .driver = {
                 .name = "max98371",
-                .owner = THIS_MODULE,
                 .pm = NULL,
                 .of_match_table = of_match_ptr(max98371_of_match),
         },
diff --git a/sound/soc/codecs/max9850.c b/sound/soc/codecs/max9850.c
index c14a79d026a1..0610840733d1 100644
--- a/sound/soc/codecs/max9850.c
+++ b/sound/soc/codecs/max9850.c
@@ -306,12 +306,14 @@ static struct snd_soc_codec_driver soc_codec_dev_max9850 = {
         .set_bias_level = max9850_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = max9850_controls,
-        .num_controls = ARRAY_SIZE(max9850_controls),
-        .dapm_widgets = max9850_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(max9850_dapm_widgets),
-        .dapm_routes = max9850_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(max9850_dapm_routes),
+        .component_driver = {
+                .controls               = max9850_controls,
+                .num_controls           = ARRAY_SIZE(max9850_controls),
+                .dapm_widgets           = max9850_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max9850_dapm_widgets),
+                .dapm_routes            = max9850_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(max9850_dapm_routes),
+        },
 };
 
 static int max9850_i2c_probe(struct i2c_client *i2c,
diff --git a/sound/soc/codecs/max9860.c b/sound/soc/codecs/max9860.c
index 68074c92a7c0..499bdbfd0a2d 100644
--- a/sound/soc/codecs/max9860.c
+++ b/sound/soc/codecs/max9860.c
@@ -538,12 +538,14 @@ static struct snd_soc_codec_driver max9860_codec_driver = {
         .set_bias_level = max9860_set_bias_level,
         .idle_bias_off = true,
 
-        .controls = max9860_controls,
-        .num_controls = ARRAY_SIZE(max9860_controls),
-        .dapm_widgets = max9860_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(max9860_dapm_widgets),
-        .dapm_routes = max9860_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(max9860_dapm_routes),
+        .component_driver = {
+                .controls               = max9860_controls,
+                .num_controls           = ARRAY_SIZE(max9860_controls),
+                .dapm_widgets           = max9860_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max9860_dapm_widgets),
+                .dapm_routes            = max9860_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(max9860_dapm_routes),
+        },
 };
 
 #ifdef CONFIG_PM
diff --git a/sound/soc/codecs/max9867.c b/sound/soc/codecs/max9867.c
index 2a22fddeb6af..42e2e407e287 100644
--- a/sound/soc/codecs/max9867.c
+++ b/sound/soc/codecs/max9867.c
@@ -38,11 +38,10 @@ static DECLARE_TLV_DB_SCALE(max9860_capture_tlv, -600, 200, 0);
 static DECLARE_TLV_DB_SCALE(max9860_mic_tlv, 2000, 100, 1);
 static DECLARE_TLV_DB_SCALE(max9860_adc_left_tlv, -1200, 100, 1);
 static DECLARE_TLV_DB_SCALE(max9860_adc_right_tlv, -1200, 100, 1);
-static const unsigned int max98088_micboost_tlv[] = {
-        TLV_DB_RANGE_HEAD(2),
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(max98088_micboost_tlv,
         0, 1, TLV_DB_SCALE_ITEM(0, 2000, 0),
         2, 2, TLV_DB_SCALE_ITEM(3000, 0, 0),
-};
+);
 
 static const struct snd_kcontrol_new max9867_snd_controls[] = {
         SOC_DOUBLE_R("Master Playback Volume", MAX9867_LEFTVOL,
@@ -417,12 +416,14 @@ static int max9867_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver max9867_codec = {
         .probe = max9867_probe,
-        .controls = max9867_snd_controls,
-        .num_controls = ARRAY_SIZE(max9867_snd_controls),
-        .dapm_routes = max9867_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(max9867_audio_map),
-        .dapm_widgets = max9867_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(max9867_dapm_widgets),
+        .component_driver = {
+                .controls               = max9867_snd_controls,
+                .num_controls           = ARRAY_SIZE(max9867_snd_controls),
+                .dapm_routes            = max9867_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(max9867_audio_map),
+                .dapm_widgets           = max9867_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max9867_dapm_widgets),
+        },
 };
 
 static bool max9867_volatile_register(struct device *dev, unsigned int reg)
diff --git a/sound/soc/codecs/max98925.c b/sound/soc/codecs/max98925.c
index 5990de317999..327eaa25c9bd 100644
--- a/sound/soc/codecs/max98925.c
+++ b/sound/soc/codecs/max98925.c
@@ -540,12 +540,14 @@ static int max98925_probe(struct snd_soc_codec *codec)
 
 static const struct snd_soc_codec_driver soc_codec_dev_max98925 = {
         .probe            = max98925_probe,
-        .controls = max98925_snd_controls,
-        .num_controls = ARRAY_SIZE(max98925_snd_controls),
-        .dapm_routes = max98925_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(max98925_audio_map),
-        .dapm_widgets = max98925_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(max98925_dapm_widgets),
+        .component_driver = {
+                .controls               = max98925_snd_controls,
+                .num_controls           = ARRAY_SIZE(max98925_snd_controls),
+                .dapm_routes            = max98925_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(max98925_audio_map),
+                .dapm_widgets           = max98925_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max98925_dapm_widgets),
+        },
 };
 
 static const struct regmap_config max98925_regmap = {
diff --git a/sound/soc/codecs/max98926.c b/sound/soc/codecs/max98926.c
index 8d14adae5cc5..1eff7e0b092e 100644
--- a/sound/soc/codecs/max98926.c
+++ b/sound/soc/codecs/max98926.c
@@ -347,7 +347,7 @@ static int max98926_dai_set_fmt(struct snd_soc_dai *codec_dai,
                 max98926_set_sense_data(max98926);
                 break;
         default:
-                dev_err(codec->dev, "DAI clock mode unsupported");
+                dev_err(codec->dev, "DAI clock mode unsupported\n");
                 return -EINVAL;
         }
 
@@ -364,7 +364,7 @@ static int max98926_dai_set_fmt(struct snd_soc_dai *codec_dai,
                 invert = MAX98926_DAI_BCI_MASK | MAX98926_DAI_WCI_MASK;
                 break;
         default:
-                dev_err(codec->dev, "DAI invert mode unsupported");
+                dev_err(codec->dev, "DAI invert mode unsupported\n");
                 return -EINVAL;
         }
 
@@ -408,7 +408,7 @@ static int max98926_dai_hw_params(struct snd_pcm_substream *substream,
                 max98926->ch_size = 32;
                 break;
         default:
-                dev_dbg(codec->dev, "format unsupported %d",
+                dev_dbg(codec->dev, "format unsupported %d\n",
                         params_format(params));
                 return -EINVAL;
         }
@@ -498,12 +498,14 @@ static int max98926_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver soc_codec_dev_max98926 = {
         .probe  = max98926_probe,
-        .controls = max98926_snd_controls,
-        .num_controls = ARRAY_SIZE(max98926_snd_controls),
-        .dapm_routes = max98926_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(max98926_audio_map),
-        .dapm_widgets = max98926_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(max98926_dapm_widgets),
+        .component_driver = {
+                .controls               = max98926_snd_controls,
+                .num_controls           = ARRAY_SIZE(max98926_snd_controls),
+                .dapm_routes            = max98926_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(max98926_audio_map),
+                .dapm_widgets           = max98926_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(max98926_dapm_widgets),
+        },
 };
 
 static const struct regmap_config max98926_regmap = {
diff --git a/sound/soc/codecs/mc13783.c b/sound/soc/codecs/mc13783.c
index 3e770cbe7f0f..90562703dcfd 100644
--- a/sound/soc/codecs/mc13783.c
+++ b/sound/soc/codecs/mc13783.c
@@ -737,12 +737,14 @@ static struct snd_soc_codec_driver soc_codec_dev_mc13783 = {
         .probe          = mc13783_probe,
         .remove         = mc13783_remove,
         .get_regmap     = mc13783_get_regmap,
-        .controls       = mc13783_control_list,
-        .num_controls   = ARRAY_SIZE(mc13783_control_list),
-        .dapm_widgets   = mc13783_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(mc13783_dapm_widgets),
-        .dapm_routes    = mc13783_routes,
-        .num_dapm_routes = ARRAY_SIZE(mc13783_routes),
+        .component_driver = {
+                .controls               = mc13783_control_list,
+                .num_controls           = ARRAY_SIZE(mc13783_control_list),
+                .dapm_widgets           = mc13783_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(mc13783_dapm_widgets),
+                .dapm_routes            = mc13783_routes,
+                .num_dapm_routes        = ARRAY_SIZE(mc13783_routes),
+        },
 };
 
 static int __init mc13783_codec_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/ml26124.c b/sound/soc/codecs/ml26124.c
index f561c78b9e0e..69e5e18880c5 100644
--- a/sound/soc/codecs/ml26124.c
+++ b/sound/soc/codecs/ml26124.c
@@ -541,12 +541,14 @@ static struct snd_soc_codec_driver soc_codec_dev_ml26124 = {
         .probe =        ml26124_probe,
         .set_bias_level = ml26124_set_bias_level,
         .suspend_bias_off = true,
-        .dapm_widgets = ml26124_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ml26124_dapm_widgets),
-        .dapm_routes = ml26124_intercon,
-        .num_dapm_routes = ARRAY_SIZE(ml26124_intercon),
-        .controls = ml26124_snd_controls,
-        .num_controls = ARRAY_SIZE(ml26124_snd_controls),
+        .component_driver = {
+                .controls               = ml26124_snd_controls,
+                .num_controls           = ARRAY_SIZE(ml26124_snd_controls),
+                .dapm_widgets           = ml26124_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ml26124_dapm_widgets),
+                .dapm_routes            = ml26124_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(ml26124_intercon),
+        },
 };
 
 static const struct regmap_config ml26124_i2c_regmap = {
diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
new file mode 100644
index 000000000000..e45518629968
--- /dev/null
+++ b/sound/soc/codecs/nau8810.c
@@ -0,0 +1,884 @@
+/*
+ * nau8810.c  --  NAU8810 ALSA Soc Audio driver
+ *
+ * Copyright 2016 Nuvoton Technology Corp.
+ *
+ * Author: David Lin <ctlin0@nuvoton.com>
+ *
+ * Based on WM8974.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/pm.h>
+#include <linux/i2c.h>
+#include <linux/regmap.h>
+#include <linux/slab.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/initval.h>
+#include <sound/tlv.h>
+
+#include "nau8810.h"
+
+#define NAU_PLL_FREQ_MAX 100000000
+#define NAU_PLL_FREQ_MIN 90000000
+#define NAU_PLL_REF_MAX 33000000
+#define NAU_PLL_REF_MIN 8000000
+#define NAU_PLL_OPTOP_MIN 6
+
+
+static const int nau8810_mclk_scaler[] = { 10, 15, 20, 30, 40, 60, 80, 120 };
+
+static const struct reg_default nau8810_reg_defaults[] = {
+        { NAU8810_REG_POWER1, 0x0000 },
+        { NAU8810_REG_POWER2, 0x0000 },
+        { NAU8810_REG_POWER3, 0x0000 },
+        { NAU8810_REG_IFACE, 0x0050 },
+        { NAU8810_REG_COMP, 0x0000 },
+        { NAU8810_REG_CLOCK, 0x0140 },
+        { NAU8810_REG_SMPLR, 0x0000 },
+        { NAU8810_REG_DAC, 0x0000 },
+        { NAU8810_REG_DACGAIN, 0x00FF },
+        { NAU8810_REG_ADC, 0x0100 },
+        { NAU8810_REG_ADCGAIN, 0x00FF },
+        { NAU8810_REG_EQ1, 0x012C },
+        { NAU8810_REG_EQ2, 0x002C },
+        { NAU8810_REG_EQ3, 0x002C },
+        { NAU8810_REG_EQ4, 0x002C },
+        { NAU8810_REG_EQ5, 0x002C },
+        { NAU8810_REG_DACLIM1, 0x0032 },
+        { NAU8810_REG_DACLIM2, 0x0000 },
+        { NAU8810_REG_NOTCH1, 0x0000 },
+        { NAU8810_REG_NOTCH2, 0x0000 },
+        { NAU8810_REG_NOTCH3, 0x0000 },
+        { NAU8810_REG_NOTCH4, 0x0000 },
+        { NAU8810_REG_ALC1, 0x0038 },
+        { NAU8810_REG_ALC2, 0x000B },
+        { NAU8810_REG_ALC3, 0x0032 },
+        { NAU8810_REG_NOISEGATE, 0x0000 },
+        { NAU8810_REG_PLLN, 0x0008 },
+        { NAU8810_REG_PLLK1, 0x000C },
+        { NAU8810_REG_PLLK2, 0x0093 },
+        { NAU8810_REG_PLLK3, 0x00E9 },
+        { NAU8810_REG_ATTEN, 0x0000 },
+        { NAU8810_REG_INPUT_SIGNAL, 0x0003 },
+        { NAU8810_REG_PGAGAIN, 0x0010 },
+        { NAU8810_REG_ADCBOOST, 0x0100 },
+        { NAU8810_REG_OUTPUT, 0x0002 },
+        { NAU8810_REG_SPKMIX, 0x0001 },
+        { NAU8810_REG_SPKGAIN, 0x0039 },
+        { NAU8810_REG_MONOMIX, 0x0001 },
+        { NAU8810_REG_POWER4, 0x0000 },
+        { NAU8810_REG_TSLOTCTL1, 0x0000 },
+        { NAU8810_REG_TSLOTCTL2, 0x0020 },
+        { NAU8810_REG_DEVICE_REVID, 0x0000 },
+        { NAU8810_REG_I2C_DEVICEID, 0x001A },
+        { NAU8810_REG_ADDITIONID, 0x00CA },
+        { NAU8810_REG_RESERVE, 0x0124 },
+        { NAU8810_REG_OUTCTL, 0x0001 },
+        { NAU8810_REG_ALC1ENHAN1, 0x0010 },
+        { NAU8810_REG_ALC1ENHAN2, 0x0000 },
+        { NAU8810_REG_MISCCTL, 0x0000 },
+        { NAU8810_REG_OUTTIEOFF, 0x0000 },
+        { NAU8810_REG_AGCP2POUT, 0x0000 },
+        { NAU8810_REG_AGCPOUT, 0x0000 },
+        { NAU8810_REG_AMTCTL, 0x0000 },
+        { NAU8810_REG_OUTTIEOFFMAN, 0x0000 },
+};
+
+static bool nau8810_readable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8810_REG_RESET ... NAU8810_REG_SMPLR:
+        case NAU8810_REG_DAC ... NAU8810_REG_DACGAIN:
+        case NAU8810_REG_ADC ... NAU8810_REG_ADCGAIN:
+        case NAU8810_REG_EQ1 ... NAU8810_REG_EQ5:
+        case NAU8810_REG_DACLIM1 ... NAU8810_REG_DACLIM2:
+        case NAU8810_REG_NOTCH1 ... NAU8810_REG_NOTCH4:
+        case NAU8810_REG_ALC1 ... NAU8810_REG_ATTEN:
+        case NAU8810_REG_INPUT_SIGNAL ... NAU8810_REG_PGAGAIN:
+        case NAU8810_REG_ADCBOOST:
+        case NAU8810_REG_OUTPUT ... NAU8810_REG_SPKMIX:
+        case NAU8810_REG_SPKGAIN:
+        case NAU8810_REG_MONOMIX:
+        case NAU8810_REG_POWER4 ... NAU8810_REG_TSLOTCTL2:
+        case NAU8810_REG_DEVICE_REVID ... NAU8810_REG_RESERVE:
+        case NAU8810_REG_OUTCTL ... NAU8810_REG_ALC1ENHAN2:
+        case NAU8810_REG_MISCCTL:
+        case NAU8810_REG_OUTTIEOFF ... NAU8810_REG_OUTTIEOFFMAN:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool nau8810_writeable_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8810_REG_RESET ... NAU8810_REG_SMPLR:
+        case NAU8810_REG_DAC ... NAU8810_REG_DACGAIN:
+        case NAU8810_REG_ADC ... NAU8810_REG_ADCGAIN:
+        case NAU8810_REG_EQ1 ... NAU8810_REG_EQ5:
+        case NAU8810_REG_DACLIM1 ... NAU8810_REG_DACLIM2:
+        case NAU8810_REG_NOTCH1 ... NAU8810_REG_NOTCH4:
+        case NAU8810_REG_ALC1 ... NAU8810_REG_ATTEN:
+        case NAU8810_REG_INPUT_SIGNAL ... NAU8810_REG_PGAGAIN:
+        case NAU8810_REG_ADCBOOST:
+        case NAU8810_REG_OUTPUT ... NAU8810_REG_SPKMIX:
+        case NAU8810_REG_SPKGAIN:
+        case NAU8810_REG_MONOMIX:
+        case NAU8810_REG_POWER4 ... NAU8810_REG_TSLOTCTL2:
+        case NAU8810_REG_OUTCTL ... NAU8810_REG_ALC1ENHAN2:
+        case NAU8810_REG_MISCCTL:
+        case NAU8810_REG_OUTTIEOFF ... NAU8810_REG_OUTTIEOFFMAN:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool nau8810_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case NAU8810_REG_RESET:
+        case NAU8810_REG_DEVICE_REVID ... NAU8810_REG_RESERVE:
+                return true;
+        default:
+                return false;
+        }
+}
+
+/* The EQ parameters get function is to get the 5 band equalizer control.
+ * The regmap raw read can't work here because regmap doesn't provide
+ * value format for value width of 9 bits. Therefore, the driver reads data
+ * from cache and makes value format according to the endianness of
+ * bytes type control element.
+ */
+static int nau8810_eq_get(struct snd_kcontrol *kcontrol,
+        struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+        struct soc_bytes_ext *params = (void *)kcontrol->private_value;
+        int i, reg, reg_val;
+        u16 *val;
+
+        val = (u16 *)ucontrol->value.bytes.data;
+        reg = NAU8810_REG_EQ1;
+        for (i = 0; i < params->max / sizeof(u16); i++) {
+                regmap_read(nau8810->regmap, reg + i, &reg_val);
+                /* conversion of 16-bit integers between native CPU format
+                 * and big endian format
+                 */
+                reg_val = cpu_to_be16(reg_val);
+                memcpy(val + i, &reg_val, sizeof(reg_val));
+        }
+
+        return 0;
+}
+
+/* The EQ parameters put function is to make configuration of 5 band equalizer
+ * control. These configuration includes central frequency, equalizer gain,
+ * cut-off frequency, bandwidth control, and equalizer path.
+ * The regmap raw write can't work here because regmap doesn't provide
+ * register and value format for register with address 7 bits and value 9 bits.
+ * Therefore, the driver makes value format according to the endianness of
+ * bytes type control element and writes data to codec.
+ */
+static int nau8810_eq_put(struct snd_kcontrol *kcontrol,
+        struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+        struct soc_bytes_ext *params = (void *)kcontrol->private_value;
+        void *data;
+        u16 *val, value;
+        int i, reg, ret;
+
+        data = kmemdup(ucontrol->value.bytes.data,
+                params->max, GFP_KERNEL | GFP_DMA);
+        if (!data)
+                return -ENOMEM;
+
+        val = (u16 *)data;
+        reg = NAU8810_REG_EQ1;
+        for (i = 0; i < params->max / sizeof(u16); i++) {
+                /* conversion of 16-bit integers between native CPU format
+                 * and big endian format
+                 */
+                value = be16_to_cpu(*(val + i));
+                ret = regmap_write(nau8810->regmap, reg + i, value);
+                if (ret) {
+                        dev_err(codec->dev, "EQ configuration fail, register: %x ret: %d\n",
+                                reg + i, ret);
+                        kfree(data);
+                        return ret;
+                }
+        }
+        kfree(data);
+
+        return 0;
+}
+
+static const char * const nau8810_companding[] = {
+        "Off", "NC", "u-law", "A-law" };
+
+static const struct soc_enum nau8810_companding_adc_enum =
+        SOC_ENUM_SINGLE(NAU8810_REG_COMP, NAU8810_ADCCM_SFT,
+                ARRAY_SIZE(nau8810_companding), nau8810_companding);
+
+static const struct soc_enum nau8810_companding_dac_enum =
+        SOC_ENUM_SINGLE(NAU8810_REG_COMP, NAU8810_DACCM_SFT,
+                ARRAY_SIZE(nau8810_companding), nau8810_companding);
+
+static const char * const nau8810_deemp[] = {
+        "None", "32kHz", "44.1kHz", "48kHz" };
+
+static const struct soc_enum nau8810_deemp_enum =
+        SOC_ENUM_SINGLE(NAU8810_REG_DAC, NAU8810_DEEMP_SFT,
+                ARRAY_SIZE(nau8810_deemp), nau8810_deemp);
+
+static const char * const nau8810_eqmode[] = {"Capture", "Playback" };
+
+static const struct soc_enum nau8810_eqmode_enum =
+        SOC_ENUM_SINGLE(NAU8810_REG_EQ1, NAU8810_EQM_SFT,
+                ARRAY_SIZE(nau8810_eqmode), nau8810_eqmode);
+
+static const char * const nau8810_alc[] = {"Normal", "Limiter" };
+
+static const struct soc_enum nau8810_alc_enum =
+        SOC_ENUM_SINGLE(NAU8810_REG_ALC3, NAU8810_ALCM_SFT,
+                ARRAY_SIZE(nau8810_alc), nau8810_alc);
+
+static const DECLARE_TLV_DB_SCALE(digital_tlv, -12750, 50, 1);
+static const DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
+static const DECLARE_TLV_DB_SCALE(inpga_tlv, -1200, 75, 0);
+static const DECLARE_TLV_DB_SCALE(spk_tlv, -5700, 100, 0);
+
+static const struct snd_kcontrol_new nau8810_snd_controls[] = {
+        SOC_ENUM("ADC Companding", nau8810_companding_adc_enum),
+        SOC_ENUM("DAC Companding", nau8810_companding_dac_enum),
+        SOC_ENUM("DAC De-emphasis", nau8810_deemp_enum),
+
+        SOC_ENUM("EQ Function", nau8810_eqmode_enum),
+        SND_SOC_BYTES_EXT("EQ Parameters", 10,
+                  nau8810_eq_get, nau8810_eq_put),
+
+        SOC_SINGLE("DAC Inversion Switch", NAU8810_REG_DAC,
+                NAU8810_DACPL_SFT, 1, 0),
+        SOC_SINGLE_TLV("Playback Volume", NAU8810_REG_DACGAIN,
+                NAU8810_DACGAIN_SFT, 0xff, 0, digital_tlv),
+
+        SOC_SINGLE("High Pass Filter Switch", NAU8810_REG_ADC,
+                NAU8810_HPFEN_SFT, 1, 0),
+        SOC_SINGLE("High Pass Cut Off", NAU8810_REG_ADC,
+                NAU8810_HPF_SFT, 0x7, 0),
+
+        SOC_SINGLE("ADC Inversion Switch", NAU8810_REG_ADC,
+                NAU8810_ADCPL_SFT, 1, 0),
+        SOC_SINGLE_TLV("Capture Volume", NAU8810_REG_ADCGAIN,
+                NAU8810_ADCGAIN_SFT, 0xff, 0, digital_tlv),
+
+        SOC_SINGLE_TLV("EQ1 Volume", NAU8810_REG_EQ1,
+                NAU8810_EQ1GC_SFT, 0x18, 1, eq_tlv),
+        SOC_SINGLE_TLV("EQ2 Volume", NAU8810_REG_EQ2,
+                NAU8810_EQ2GC_SFT, 0x18, 1, eq_tlv),
+        SOC_SINGLE_TLV("EQ3 Volume", NAU8810_REG_EQ3,
+                NAU8810_EQ3GC_SFT, 0x18, 1, eq_tlv),
+        SOC_SINGLE_TLV("EQ4 Volume", NAU8810_REG_EQ4,
+                NAU8810_EQ4GC_SFT, 0x18, 1, eq_tlv),
+        SOC_SINGLE_TLV("EQ5 Volume", NAU8810_REG_EQ5,
+                NAU8810_EQ5GC_SFT, 0x18, 1, eq_tlv),
+
+        SOC_SINGLE("DAC Limiter Switch", NAU8810_REG_DACLIM1,
+                NAU8810_DACLIMEN_SFT, 1, 0),
+        SOC_SINGLE("DAC Limiter Decay", NAU8810_REG_DACLIM1,
+                NAU8810_DACLIMDCY_SFT, 0xf, 0),
+        SOC_SINGLE("DAC Limiter Attack", NAU8810_REG_DACLIM1,
+                NAU8810_DACLIMATK_SFT, 0xf, 0),
+        SOC_SINGLE("DAC Limiter Threshold", NAU8810_REG_DACLIM2,
+                NAU8810_DACLIMTHL_SFT, 0x7, 0),
+        SOC_SINGLE("DAC Limiter Boost", NAU8810_REG_DACLIM2,
+                NAU8810_DACLIMBST_SFT, 0xf, 0),
+
+        SOC_ENUM("ALC Mode", nau8810_alc_enum),
+        SOC_SINGLE("ALC Enable Switch", NAU8810_REG_ALC1,
+                NAU8810_ALCEN_SFT, 1, 0),
+        SOC_SINGLE("ALC Max Volume", NAU8810_REG_ALC1,
+                NAU8810_ALCMXGAIN_SFT, 0x7, 0),
+        SOC_SINGLE("ALC Min Volume", NAU8810_REG_ALC1,
+                NAU8810_ALCMINGAIN_SFT, 0x7, 0),
+        SOC_SINGLE("ALC ZC Switch", NAU8810_REG_ALC2,
+                NAU8810_ALCZC_SFT, 1, 0),
+        SOC_SINGLE("ALC Hold", NAU8810_REG_ALC2,
+                NAU8810_ALCHT_SFT, 0xf, 0),
+        SOC_SINGLE("ALC Target", NAU8810_REG_ALC2,
+                NAU8810_ALCSL_SFT, 0xf, 0),
+        SOC_SINGLE("ALC Decay", NAU8810_REG_ALC3,
+                NAU8810_ALCDCY_SFT, 0xf, 0),
+        SOC_SINGLE("ALC Attack", NAU8810_REG_ALC3,
+                NAU8810_ALCATK_SFT, 0xf, 0),
+        SOC_SINGLE("ALC Noise Gate Switch", NAU8810_REG_NOISEGATE,
+                NAU8810_ALCNEN_SFT, 1, 0),
+        SOC_SINGLE("ALC Noise Gate Threshold", NAU8810_REG_NOISEGATE,
+                NAU8810_ALCNTH_SFT, 0x7, 0),
+
+        SOC_SINGLE("PGA ZC Switch", NAU8810_REG_PGAGAIN,
+                NAU8810_PGAZC_SFT, 1, 0),
+        SOC_SINGLE_TLV("PGA Volume", NAU8810_REG_PGAGAIN,
+                NAU8810_PGAGAIN_SFT, 0x3f, 0, inpga_tlv),
+
+        SOC_SINGLE("Speaker ZC Switch", NAU8810_REG_SPKGAIN,
+                NAU8810_SPKZC_SFT, 1, 0),
+        SOC_SINGLE("Speaker Mute Switch", NAU8810_REG_SPKGAIN,
+                NAU8810_SPKMT_SFT, 1, 0),
+        SOC_SINGLE_TLV("Speaker Volume", NAU8810_REG_SPKGAIN,
+                NAU8810_SPKGAIN_SFT, 0x3f, 0, spk_tlv),
+
+        SOC_SINGLE("Capture Boost(+20dB)", NAU8810_REG_ADCBOOST,
+                NAU8810_PGABST_SFT, 1, 0),
+        SOC_SINGLE("Mono Mute Switch", NAU8810_REG_MONOMIX,
+                NAU8810_MOUTMXMT_SFT, 1, 0),
+
+        SOC_SINGLE("DAC Oversampling Rate(128x) Switch", NAU8810_REG_DAC,
+                NAU8810_DACOS_SFT, 1, 0),
+        SOC_SINGLE("ADC Oversampling Rate(128x) Switch", NAU8810_REG_ADC,
+                NAU8810_ADCOS_SFT, 1, 0),
+};
+
+/* Speaker Output Mixer */
+static const struct snd_kcontrol_new nau8810_speaker_mixer_controls[] = {
+        SOC_DAPM_SINGLE("Line Bypass Switch", NAU8810_REG_SPKMIX,
+                NAU8810_BYPSPK_SFT, 1, 0),
+        SOC_DAPM_SINGLE("PCM Playback Switch", NAU8810_REG_SPKMIX,
+                NAU8810_DACSPK_SFT, 1, 0),
+};
+
+/* Mono Output Mixer */
+static const struct snd_kcontrol_new nau8810_mono_mixer_controls[] = {
+        SOC_DAPM_SINGLE("Line Bypass Switch", NAU8810_REG_MONOMIX,
+                NAU8810_BYPMOUT_SFT, 1, 0),
+        SOC_DAPM_SINGLE("PCM Playback Switch", NAU8810_REG_MONOMIX,
+                NAU8810_DACMOUT_SFT, 1, 0),
+};
+
+/* PGA Mute */
+static const struct snd_kcontrol_new nau8810_inpga_mute[] = {
+        SOC_DAPM_SINGLE("PGA Mute Switch", NAU8810_REG_PGAGAIN,
+                NAU8810_PGAMT_SFT, 1, 0),
+};
+
+/* Input PGA */
+static const struct snd_kcontrol_new nau8810_inpga[] = {
+        SOC_DAPM_SINGLE("MicN Switch", NAU8810_REG_INPUT_SIGNAL,
+                NAU8810_NMICPGA_SFT, 1, 0),
+        SOC_DAPM_SINGLE("MicP Switch", NAU8810_REG_INPUT_SIGNAL,
+                NAU8810_PMICPGA_SFT, 1, 0),
+};
+
+/* Mic Input boost vol */
+static const struct snd_kcontrol_new nau8810_mic_boost_controls =
+        SOC_DAPM_SINGLE("Mic Volume", NAU8810_REG_ADCBOOST,
+                NAU8810_PMICBSTGAIN_SFT, 0x7, 0);
+
+/* Loopback Switch */
+static const struct snd_kcontrol_new nau8810_loopback =
+        SOC_DAPM_SINGLE("Switch", NAU8810_REG_COMP,
+                NAU8810_ADDAP_SFT, 1, 0);
+
+static int check_mclk_select_pll(struct snd_soc_dapm_widget *source,
+                         struct snd_soc_dapm_widget *sink)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(source->dapm);
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+        unsigned int value;
+
+        regmap_read(nau8810->regmap, NAU8810_REG_CLOCK, &value);
+        return (value & NAU8810_CLKM_MASK);
+}
+
+static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
+        SND_SOC_DAPM_MIXER("Speaker Mixer", NAU8810_REG_POWER3,
+                NAU8810_SPKMX_EN_SFT, 0, &nau8810_speaker_mixer_controls[0],
+                ARRAY_SIZE(nau8810_speaker_mixer_controls)),
+        SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
+                NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
+                ARRAY_SIZE(nau8810_mono_mixer_controls)),
+        SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
+                NAU8810_DAC_EN_SFT, 0),
+        SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
+                NAU8810_ADC_EN_SFT, 0),
+        SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
+                NAU8810_NSPK_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("SpkP Out", NAU8810_REG_POWER3,
+                NAU8810_PSPK_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("Mono Out", NAU8810_REG_POWER3,
+                NAU8810_MOUT_EN_SFT, 0, NULL, 0),
+
+        SND_SOC_DAPM_MIXER("Input PGA", NAU8810_REG_POWER2,
+                NAU8810_PGA_EN_SFT, 0, nau8810_inpga,
+                ARRAY_SIZE(nau8810_inpga)),
+        SND_SOC_DAPM_MIXER("Input Boost Stage", NAU8810_REG_POWER2,
+                NAU8810_BST_EN_SFT, 0, nau8810_inpga_mute,
+                ARRAY_SIZE(nau8810_inpga_mute)),
+
+        SND_SOC_DAPM_SUPPLY("Mic Bias", NAU8810_REG_POWER1,
+                NAU8810_MICBIAS_EN_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("PLL", NAU8810_REG_POWER1,
+                NAU8810_PLL_EN_SFT, 0, NULL, 0),
+
+        SND_SOC_DAPM_SWITCH("Digital Loopback", SND_SOC_NOPM, 0, 0,
+                &nau8810_loopback),
+
+        SND_SOC_DAPM_INPUT("MICN"),
+        SND_SOC_DAPM_INPUT("MICP"),
+        SND_SOC_DAPM_OUTPUT("MONOOUT"),
+        SND_SOC_DAPM_OUTPUT("SPKOUTP"),
+        SND_SOC_DAPM_OUTPUT("SPKOUTN"),
+};
+
+static const struct snd_soc_dapm_route nau8810_dapm_routes[] = {
+        {"DAC", NULL, "PLL", check_mclk_select_pll},
+
+        /* Mono output mixer */
+        {"Mono Mixer", "PCM Playback Switch", "DAC"},
+        {"Mono Mixer", "Line Bypass Switch", "Input Boost Stage"},
+
+        /* Speaker output mixer */
+        {"Speaker Mixer", "PCM Playback Switch", "DAC"},
+        {"Speaker Mixer", "Line Bypass Switch", "Input Boost Stage"},
+
+        /* Outputs */
+        {"Mono Out", NULL, "Mono Mixer"},
+        {"MONOOUT", NULL, "Mono Out"},
+        {"SpkN Out", NULL, "Speaker Mixer"},
+        {"SpkP Out", NULL, "Speaker Mixer"},
+        {"SPKOUTN", NULL, "SpkN Out"},
+        {"SPKOUTP", NULL, "SpkP Out"},
+
+        /* Input Boost Stage */
+        {"ADC", NULL, "Input Boost Stage"},
+        {"ADC", NULL, "PLL", check_mclk_select_pll},
+        {"Input Boost Stage", NULL, "Input PGA"},
+        {"Input Boost Stage", NULL, "MICP"},
+
+        /* Input PGA */
+        {"Input PGA", NULL, "Mic Bias"},
+        {"Input PGA", "MicN Switch", "MICN"},
+        {"Input PGA", "MicP Switch", "MICP"},
+
+        /* Digital Looptack */
+        {"Digital Loopback", "Switch", "ADC"},
+        {"DAC", NULL, "Digital Loopback"},
+};
+
+static int nau8810_set_sysclk(struct snd_soc_dai *dai,
+                                 int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+
+        nau8810->clk_id = clk_id;
+        nau8810->sysclk = freq;
+        dev_dbg(nau8810->dev, "master sysclk %dHz, source %s\n",
+                freq, clk_id == NAU8810_SCLK_PLL ? "PLL" : "MCLK");
+
+        return 0;
+}
+
+static int nau88l0_calc_pll(unsigned int pll_in,
+        unsigned int fs, struct nau8810_pll *pll_param)
+{
+        u64 f2, f2_max, pll_ratio;
+        int i, scal_sel;
+
+        if (pll_in > NAU_PLL_REF_MAX || pll_in < NAU_PLL_REF_MIN)
+                return -EINVAL;
+
+        f2_max = 0;
+        scal_sel = ARRAY_SIZE(nau8810_mclk_scaler);
+        for (i = 0; i < ARRAY_SIZE(nau8810_mclk_scaler); i++) {
+                f2 = 256 * fs * 4 * nau8810_mclk_scaler[i] / 10;
+                if (f2 > NAU_PLL_FREQ_MIN && f2 < NAU_PLL_FREQ_MAX &&
+                        f2_max < f2) {
+                        f2_max = f2;
+                        scal_sel = i;
+                }
+        }
+        if (ARRAY_SIZE(nau8810_mclk_scaler) == scal_sel)
+                return -EINVAL;
+        pll_param->mclk_scaler = scal_sel;
+        f2 = f2_max;
+
+        /* Calculate the PLL 4-bit integer input and the PLL 24-bit fractional
+         * input; round up the 24+4bit.
+         */
+        pll_ratio = div_u64(f2 << 28, pll_in);
+        pll_param->pre_factor = 0;
+        if (((pll_ratio >> 28) & 0xF) < NAU_PLL_OPTOP_MIN) {
+                pll_ratio <<= 1;
+                pll_param->pre_factor = 1;
+        }
+        pll_param->pll_int = (pll_ratio >> 28) & 0xF;
+        pll_param->pll_frac = ((pll_ratio & 0xFFFFFFF) >> 4);
+
+        return 0;
+}
+
+static int nau8810_set_pll(struct snd_soc_dai *codec_dai, int pll_id,
+        int source, unsigned int freq_in, unsigned int freq_out)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+        struct regmap *map = nau8810->regmap;
+        struct nau8810_pll *pll_param = &nau8810->pll;
+        int ret, fs;
+
+        fs = freq_out / 256;
+        ret = nau88l0_calc_pll(freq_in, fs, pll_param);
+        if (ret < 0) {
+                dev_err(nau8810->dev, "Unsupported input clock %d\n", freq_in);
+                return ret;
+        }
+        dev_info(nau8810->dev, "pll_int=%x pll_frac=%x mclk_scaler=%x pre_factor=%x\n",
+                pll_param->pll_int, pll_param->pll_frac, pll_param->mclk_scaler,
+                pll_param->pre_factor);
+
+        regmap_update_bits(map, NAU8810_REG_PLLN,
+                NAU8810_PLLMCLK_DIV2 | NAU8810_PLLN_MASK,
+                (pll_param->pre_factor ? NAU8810_PLLMCLK_DIV2 : 0) |
+                pll_param->pll_int);
+        regmap_write(map, NAU8810_REG_PLLK1,
+                (pll_param->pll_frac >> NAU8810_PLLK1_SFT) &
+                NAU8810_PLLK1_MASK);
+        regmap_write(map, NAU8810_REG_PLLK2,
+                (pll_param->pll_frac >> NAU8810_PLLK2_SFT) &
+                NAU8810_PLLK2_MASK);
+        regmap_write(map, NAU8810_REG_PLLK3,
+                pll_param->pll_frac & NAU8810_PLLK3_MASK);
+        regmap_update_bits(map, NAU8810_REG_CLOCK, NAU8810_MCLKSEL_MASK,
+                pll_param->mclk_scaler << NAU8810_MCLKSEL_SFT);
+        regmap_update_bits(map, NAU8810_REG_CLOCK,
+                NAU8810_CLKM_MASK, NAU8810_CLKM_PLL);
+
+        return 0;
+}
+
+static int nau8810_set_dai_fmt(struct snd_soc_dai *codec_dai,
+                unsigned int fmt)
+{
+        struct snd_soc_codec *codec = codec_dai->codec;
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+        u16 ctrl1_val = 0, ctrl2_val = 0;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                ctrl2_val |= NAU8810_CLKIO_MASTER;
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                ctrl1_val |= NAU8810_AIFMT_I2S;
+                break;
+        case SND_SOC_DAIFMT_RIGHT_J:
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                ctrl1_val |= NAU8810_AIFMT_LEFT;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                ctrl1_val |= NAU8810_AIFMT_PCM_A;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_IF:
+                ctrl1_val |= NAU8810_BCLKP_IB | NAU8810_FSP_IF;
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                ctrl1_val |= NAU8810_BCLKP_IB;
+                break;
+        case SND_SOC_DAIFMT_NB_IF:
+                ctrl1_val |= NAU8810_FSP_IF;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        regmap_update_bits(nau8810->regmap, NAU8810_REG_IFACE,
+                NAU8810_AIFMT_MASK | NAU8810_FSP_IF |
+                NAU8810_BCLKP_IB, ctrl1_val);
+        regmap_update_bits(nau8810->regmap, NAU8810_REG_CLOCK,
+                NAU8810_CLKIO_MASK, ctrl2_val);
+
+        return 0;
+}
+
+static int nau8810_mclk_clkdiv(struct nau8810 *nau8810, int rate)
+{
+        int i, sclk, imclk = rate * 256, div = 0;
+
+        if (!nau8810->sysclk) {
+                dev_err(nau8810->dev, "Make mclk div configuration fail because of invalid system clock\n");
+                return -EINVAL;
+        }
+
+        /* Configure the master clock prescaler div to make system
+         * clock to approximate the internal master clock (IMCLK);
+         * and large or equal to IMCLK.
+         */
+        for (i = 1; i < ARRAY_SIZE(nau8810_mclk_scaler); i++) {
+                sclk = (nau8810->sysclk * 10) /
+                        nau8810_mclk_scaler[i];
+                if (sclk < imclk)
+                        break;
+                div = i;
+        }
+        dev_dbg(nau8810->dev,
+                "master clock prescaler %x for fs %d\n", div, rate);
+
+        /* master clock from MCLK and disable PLL */
+        regmap_update_bits(nau8810->regmap, NAU8810_REG_CLOCK,
+                NAU8810_MCLKSEL_MASK, (div << NAU8810_MCLKSEL_SFT));
+        regmap_update_bits(nau8810->regmap, NAU8810_REG_CLOCK,
+                NAU8810_CLKM_MASK, NAU8810_CLKM_MCLK);
+
+        return 0;
+}
+
+static int nau8810_pcm_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+        int val_len = 0, val_rate = 0, ret = 0;
+
+        switch (params_width(params)) {
+        case 16:
+                break;
+        case 20:
+                val_len |= NAU8810_WLEN_20;
+                break;
+        case 24:
+                val_len |= NAU8810_WLEN_24;
+                break;
+        case 32:
+                val_len |= NAU8810_WLEN_32;
+                break;
+        }
+
+        switch (params_rate(params)) {
+        case 8000:
+                val_rate |= NAU8810_SMPLR_8K;
+                break;
+        case 11025:
+                val_rate |= NAU8810_SMPLR_12K;
+                break;
+        case 16000:
+                val_rate |= NAU8810_SMPLR_16K;
+                break;
+        case 22050:
+                val_rate |= NAU8810_SMPLR_24K;
+                break;
+        case 32000:
+                val_rate |= NAU8810_SMPLR_32K;
+                break;
+        case 44100:
+        case 48000:
+                break;
+        }
+
+        regmap_update_bits(nau8810->regmap, NAU8810_REG_IFACE,
+                NAU8810_WLEN_MASK, val_len);
+        regmap_update_bits(nau8810->regmap, NAU8810_REG_SMPLR,
+                NAU8810_SMPLR_MASK, val_rate);
+
+        /* If the master clock is from MCLK, provide the runtime FS for driver
+         * to get the master clock prescaler configuration.
+         */
+        if (nau8810->clk_id == NAU8810_SCLK_MCLK) {
+                ret = nau8810_mclk_clkdiv(nau8810, params_rate(params));
+                if (ret < 0)
+                        dev_err(nau8810->dev, "MCLK div configuration fail\n");
+        }
+
+        return ret;
+}
+
+static int nau8810_set_bias_level(struct snd_soc_codec *codec,
+        enum snd_soc_bias_level level)
+{
+        struct nau8810 *nau8810 = snd_soc_codec_get_drvdata(codec);
+        struct regmap *map = nau8810->regmap;
+
+        switch (level) {
+        case SND_SOC_BIAS_ON:
+        case SND_SOC_BIAS_PREPARE:
+                regmap_update_bits(map, NAU8810_REG_POWER1,
+                        NAU8810_REFIMP_MASK, NAU8810_REFIMP_80K);
+                break;
+
+        case SND_SOC_BIAS_STANDBY:
+                regmap_update_bits(map, NAU8810_REG_POWER1,
+                        NAU8810_IOBUF_EN | NAU8810_ABIAS_EN,
+                        NAU8810_IOBUF_EN | NAU8810_ABIAS_EN);
+
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
+                        regcache_sync(map);
+                        regmap_update_bits(map, NAU8810_REG_POWER1,
+                                NAU8810_REFIMP_MASK, NAU8810_REFIMP_3K);
+                        mdelay(100);
+                }
+                regmap_update_bits(map, NAU8810_REG_POWER1,
+                        NAU8810_REFIMP_MASK, NAU8810_REFIMP_300K);
+                break;
+
+        case SND_SOC_BIAS_OFF:
+                regmap_write(map, NAU8810_REG_POWER1, 0);
+                regmap_write(map, NAU8810_REG_POWER2, 0);
+                regmap_write(map, NAU8810_REG_POWER3, 0);
+                break;
+        }
+
+        return 0;
+}
+
+
+#define NAU8810_RATES (SNDRV_PCM_RATE_8000_48000)
+
+#define NAU8810_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \
+        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+static const struct snd_soc_dai_ops nau8810_ops = {
+        .hw_params = nau8810_pcm_hw_params,
+        .set_fmt = nau8810_set_dai_fmt,
+        .set_sysclk = nau8810_set_sysclk,
+        .set_pll = nau8810_set_pll,
+};
+
+static struct snd_soc_dai_driver nau8810_dai = {
+        .name = "nau8810-hifi",
+        .playback = {
+                .stream_name = "Playback",
+                .channels_min = 1,
+                .channels_max = 2,   /* Only 1 channel of data */
+                .rates = NAU8810_RATES,
+                .formats = NAU8810_FORMATS,
+        },
+        .capture = {
+                .stream_name = "Capture",
+                .channels_min = 1,
+                .channels_max = 2,   /* Only 1 channel of data */
+                .rates = NAU8810_RATES,
+                .formats = NAU8810_FORMATS,
+        },
+        .ops = &nau8810_ops,
+        .symmetric_rates = 1,
+};
+
+static const struct regmap_config nau8810_regmap_config = {
+        .reg_bits = 7,
+        .val_bits = 9,
+
+        .max_register = NAU8810_REG_MAX,
+        .readable_reg = nau8810_readable_reg,
+        .writeable_reg = nau8810_writeable_reg,
+        .volatile_reg = nau8810_volatile_reg,
+
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = nau8810_reg_defaults,
+        .num_reg_defaults = ARRAY_SIZE(nau8810_reg_defaults),
+};
+
+static struct snd_soc_codec_driver nau8810_codec_driver = {
+        .set_bias_level = nau8810_set_bias_level,
+        .suspend_bias_off = true,
+
+        .component_driver = {
+                .controls = nau8810_snd_controls,
+                .num_controls = ARRAY_SIZE(nau8810_snd_controls),
+                .dapm_widgets = nau8810_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(nau8810_dapm_widgets),
+                .dapm_routes = nau8810_dapm_routes,
+                .num_dapm_routes = ARRAY_SIZE(nau8810_dapm_routes),
+        },
+};
+
+static int nau8810_i2c_probe(struct i2c_client *i2c,
+                            const struct i2c_device_id *id)
+{
+        struct device *dev = &i2c->dev;
+        struct nau8810 *nau8810 = dev_get_platdata(dev);
+
+        if (!nau8810) {
+                nau8810 = devm_kzalloc(dev, sizeof(*nau8810), GFP_KERNEL);
+                if (!nau8810)
+                        return -ENOMEM;
+        }
+        i2c_set_clientdata(i2c, nau8810);
+
+        nau8810->regmap = devm_regmap_init_i2c(i2c, &nau8810_regmap_config);
+        if (IS_ERR(nau8810->regmap))
+                return PTR_ERR(nau8810->regmap);
+        nau8810->dev = dev;
+
+        regmap_write(nau8810->regmap, NAU8810_REG_RESET, 0x00);
+
+        return snd_soc_register_codec(dev,
+                &nau8810_codec_driver, &nau8810_dai, 1);
+}
+
+static int nau8810_i2c_remove(struct i2c_client *client)
+{
+        snd_soc_unregister_codec(&client->dev);
+
+        return 0;
+}
+
+static const struct i2c_device_id nau8810_i2c_id[] = {
+        { "nau8810", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, nau8810_i2c_id);
+
+#ifdef CONFIG_OF
+static const struct of_device_id nau8810_of_match[] = {
+        { .compatible = "nuvoton,nau8810", },
+        { }
+};
+MODULE_DEVICE_TABLE(of, nau8810_of_match);
+#endif
+
+static struct i2c_driver nau8810_i2c_driver = {
+        .driver = {
+                .name = "nau8810",
+                .of_match_table = of_match_ptr(nau8810_of_match),
+        },
+        .probe =    nau8810_i2c_probe,
+        .remove =   nau8810_i2c_remove,
+        .id_table = nau8810_i2c_id,
+};
+
+module_i2c_driver(nau8810_i2c_driver);
+
+MODULE_DESCRIPTION("ASoC NAU8810 driver");
+MODULE_AUTHOR("David Lin <ctlin0@nuvoton.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/nau8810.h b/sound/soc/codecs/nau8810.h
new file mode 100644
index 000000000000..df882658ca91
--- /dev/null
+++ b/sound/soc/codecs/nau8810.h
@@ -0,0 +1,281 @@
+/*
+ * NAU8810 ALSA SoC audio driver
+ *
+ * Copyright 2016 Nuvoton Technology Corp.
+ * Author: David Lin <ctlin0@nuvoton.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __NAU8810_H__
+#define __NAU8810_H__
+
+#define NAU8810_REG_RESET               0x00
+#define NAU8810_REG_POWER1              0x01
+#define NAU8810_REG_POWER2              0x02
+#define NAU8810_REG_POWER3              0x03
+#define NAU8810_REG_IFACE               0x04
+#define NAU8810_REG_COMP                0x05
+#define NAU8810_REG_CLOCK               0x06
+#define NAU8810_REG_SMPLR               0x07
+#define NAU8810_REG_DAC         0x0A
+#define NAU8810_REG_DACGAIN             0x0B
+#define NAU8810_REG_ADC         0x0E
+#define NAU8810_REG_ADCGAIN             0x0F
+#define NAU8810_REG_EQ1         0x12
+#define NAU8810_REG_EQ2         0x13
+#define NAU8810_REG_EQ3         0x14
+#define NAU8810_REG_EQ4         0x15
+#define NAU8810_REG_EQ5         0x16
+#define NAU8810_REG_DACLIM1             0x18
+#define NAU8810_REG_DACLIM2             0x19
+#define NAU8810_REG_NOTCH1              0x1B
+#define NAU8810_REG_NOTCH2              0x1C
+#define NAU8810_REG_NOTCH3              0x1D
+#define NAU8810_REG_NOTCH4              0x1E
+#define NAU8810_REG_ALC1                0x20
+#define NAU8810_REG_ALC2                0x21
+#define NAU8810_REG_ALC3                0x22
+#define NAU8810_REG_NOISEGATE           0x23
+#define NAU8810_REG_PLLN                0x24
+#define NAU8810_REG_PLLK1               0x25
+#define NAU8810_REG_PLLK2               0x26
+#define NAU8810_REG_PLLK3               0x27
+#define NAU8810_REG_ATTEN               0x28
+#define NAU8810_REG_INPUT_SIGNAL        0x2C
+#define NAU8810_REG_PGAGAIN             0x2D
+#define NAU8810_REG_ADCBOOST            0x2F
+#define NAU8810_REG_OUTPUT              0x31
+#define NAU8810_REG_SPKMIX              0x32
+#define NAU8810_REG_SPKGAIN             0x36
+#define NAU8810_REG_MONOMIX             0x38
+#define NAU8810_REG_POWER4              0x3A
+#define NAU8810_REG_TSLOTCTL1           0x3B
+#define NAU8810_REG_TSLOTCTL2           0x3C
+#define NAU8810_REG_DEVICE_REVID        0x3E
+#define NAU8810_REG_I2C_DEVICEID        0x3F
+#define NAU8810_REG_ADDITIONID  0x40
+#define NAU8810_REG_RESERVE             0x41
+#define NAU8810_REG_OUTCTL              0x45
+#define NAU8810_REG_ALC1ENHAN1  0x46
+#define NAU8810_REG_ALC1ENHAN2  0x47
+#define NAU8810_REG_MISCCTL             0x49
+#define NAU8810_REG_OUTTIEOFF           0x4B
+#define NAU8810_REG_AGCP2POUT   0x4C
+#define NAU8810_REG_AGCPOUT             0x4D
+#define NAU8810_REG_AMTCTL              0x4E
+#define NAU8810_REG_OUTTIEOFFMAN        0x4F
+#define NAU8810_REG_MAX         NAU8810_REG_OUTTIEOFFMAN
+
+
+/* NAU8810_REG_POWER1 (0x1) */
+#define NAU8810_DCBUF_EN                (0x1 << 8)
+#define NAU8810_PLL_EN_SFT              5
+#define NAU8810_MICBIAS_EN_SFT  4
+#define NAU8810_ABIAS_EN                (0x1 << 3)
+#define NAU8810_IOBUF_EN                (0x1 << 2)
+#define NAU8810_REFIMP_MASK             0x3
+#define NAU8810_REFIMP_DIS              0x0
+#define NAU8810_REFIMP_80K              0x1
+#define NAU8810_REFIMP_300K             0x2
+#define NAU8810_REFIMP_3K               0x3
+
+/* NAU8810_REG_POWER2 (0x2) */
+#define NAU8810_BST_EN_SFT              4
+#define NAU8810_PGA_EN_SFT              2
+#define NAU8810_ADC_EN_SFT              0
+
+/* NAU8810_REG_POWER3 (0x3) */
+#define NAU8810_DAC_EN_SFT              0
+#define NAU8810_SPKMX_EN_SFT            2
+#define NAU8810_MOUTMX_EN_SFT   3
+#define NAU8810_PSPK_EN_SFT             5
+#define NAU8810_NSPK_EN_SFT             6
+#define NAU8810_MOUT_EN_SFT             7
+
+/* NAU8810_REG_IFACE (0x4) */
+#define NAU8810_AIFMT_SFT               3
+#define NAU8810_AIFMT_MASK              (0x3 << NAU8810_AIFMT_SFT)
+#define NAU8810_AIFMT_RIGHT             (0x0 << NAU8810_AIFMT_SFT)
+#define NAU8810_AIFMT_LEFT              (0x1 << NAU8810_AIFMT_SFT)
+#define NAU8810_AIFMT_I2S               (0x2 << NAU8810_AIFMT_SFT)
+#define NAU8810_AIFMT_PCM_A             (0x3 << NAU8810_AIFMT_SFT)
+#define NAU8810_WLEN_SFT                5
+#define NAU8810_WLEN_MASK               (0x3 << NAU8810_WLEN_SFT)
+#define NAU8810_WLEN_16         (0x0 << NAU8810_WLEN_SFT)
+#define NAU8810_WLEN_20         (0x1 << NAU8810_WLEN_SFT)
+#define NAU8810_WLEN_24         (0x2 << NAU8810_WLEN_SFT)
+#define NAU8810_WLEN_32         (0x3 << NAU8810_WLEN_SFT)
+#define NAU8810_FSP_IF                  (0x1 << 7)
+#define NAU8810_BCLKP_IB                (0x1 << 8)
+
+/* NAU8810_REG_COMP (0x5) */
+#define NAU8810_ADDAP_SFT               0
+#define NAU8810_ADCCM_SFT               1
+#define NAU8810_DACCM_SFT               3
+
+/* NAU8810_REG_CLOCK (0x6) */
+#define NAU8810_CLKIO_MASK              0x1
+#define NAU8810_CLKIO_SLAVE             0x0
+#define NAU8810_CLKIO_MASTER            0x1
+#define NAU8810_BCLKSEL_SFT             2
+#define NAU8810_BCLKSEL_MASK            (0x7 << NAU8810_BCLKSEL_SFT)
+#define NAU8810_BCLKDIV_1               (0x0 << NAU8810_BCLKSEL_SFT)
+#define NAU8810_BCLKDIV_2               (0x1 << NAU8810_BCLKSEL_SFT)
+#define NAU8810_BCLKDIV_4               (0x2 << NAU8810_BCLKSEL_SFT)
+#define NAU8810_BCLKDIV_8               (0x3 << NAU8810_BCLKSEL_SFT)
+#define NAU8810_BCLKDIV_16              (0x4 << NAU8810_BCLKSEL_SFT)
+#define NAU8810_BCLKDIV_32              (0x5 << NAU8810_BCLKSEL_SFT)
+#define NAU8810_MCLKSEL_SFT             5
+#define NAU8810_MCLKSEL_MASK            (0x7 << NAU8810_MCLKSEL_SFT)
+#define NAU8810_CLKM_SFT                8
+#define NAU8810_CLKM_MASK               (0x1 << NAU8810_CLKM_SFT)
+#define NAU8810_CLKM_MCLK               (0x0 << NAU8810_CLKM_SFT)
+#define NAU8810_CLKM_PLL                (0x1 << NAU8810_CLKM_SFT)
+
+/* NAU8810_REG_SMPLR (0x7) */
+#define NAU8810_SMPLR_SFT               1
+#define NAU8810_SMPLR_MASK              (0x7 << NAU8810_SMPLR_SFT)
+#define NAU8810_SMPLR_48K               (0x0 << NAU8810_SMPLR_SFT)
+#define NAU8810_SMPLR_32K               (0x1 << NAU8810_SMPLR_SFT)
+#define NAU8810_SMPLR_24K               (0x2 << NAU8810_SMPLR_SFT)
+#define NAU8810_SMPLR_16K               (0x3 << NAU8810_SMPLR_SFT)
+#define NAU8810_SMPLR_12K               (0x4 << NAU8810_SMPLR_SFT)
+#define NAU8810_SMPLR_8K                (0x5 << NAU8810_SMPLR_SFT)
+
+/* NAU8810_REG_DAC (0xA) */
+#define NAU8810_DACPL_SFT               0
+#define NAU8810_DACOS_SFT               3
+#define NAU8810_DEEMP_SFT               4
+
+/* NAU8810_REG_DACGAIN (0xB) */
+#define NAU8810_DACGAIN_SFT             0
+
+/* NAU8810_REG_ADC (0xE) */
+#define NAU8810_ADCPL_SFT               0
+#define NAU8810_ADCOS_SFT               3
+#define NAU8810_HPF_SFT         4
+#define NAU8810_HPFEN_SFT               8
+
+/* NAU8810_REG_ADCGAIN (0xF) */
+#define NAU8810_ADCGAIN_SFT             0
+
+/* NAU8810_REG_EQ1 (0x12) */
+#define NAU8810_EQ1GC_SFT               0
+#define NAU8810_EQ1CF_SFT               5
+#define NAU8810_EQM_SFT         8
+
+/* NAU8810_REG_EQ2 (0x13) */
+#define NAU8810_EQ2GC_SFT               0
+#define NAU8810_EQ2CF_SFT               5
+#define NAU8810_EQ2BW_SFT               8
+
+/* NAU8810_REG_EQ3 (0x14) */
+#define NAU8810_EQ3GC_SFT               0
+#define NAU8810_EQ3CF_SFT               5
+#define NAU8810_EQ3BW_SFT               8
+
+/* NAU8810_REG_EQ4 (0x15) */
+#define NAU8810_EQ4GC_SFT               0
+#define NAU8810_EQ4CF_SFT               5
+#define NAU8810_EQ4BW_SFT               8
+
+/* NAU8810_REG_EQ5 (0x16) */
+#define NAU8810_EQ5GC_SFT               0
+#define NAU8810_EQ5CF_SFT               5
+
+/* NAU8810_REG_DACLIM1 (0x18) */
+#define NAU8810_DACLIMATK_SFT           0
+#define NAU8810_DACLIMDCY_SFT           4
+#define NAU8810_DACLIMEN_SFT            8
+
+/* NAU8810_REG_DACLIM2 (0x19) */
+#define NAU8810_DACLIMBST_SFT           0
+#define NAU8810_DACLIMTHL_SFT           4
+
+/* NAU8810_REG_ALC1 (0x20) */
+#define NAU8810_ALCMINGAIN_SFT  0
+#define NAU8810_ALCMXGAIN_SFT           3
+#define NAU8810_ALCEN_SFT               8
+
+/* NAU8810_REG_ALC2 (0x21) */
+#define NAU8810_ALCSL_SFT               0
+#define NAU8810_ALCHT_SFT               4
+#define NAU8810_ALCZC_SFT               8
+
+/* NAU8810_REG_ALC3 (0x22) */
+#define NAU8810_ALCATK_SFT              0
+#define NAU8810_ALCDCY_SFT              4
+#define NAU8810_ALCM_SFT                8
+
+/* NAU8810_REG_NOISEGATE (0x23) */
+#define NAU8810_ALCNTH_SFT              0
+#define NAU8810_ALCNEN_SFT              3
+
+/* NAU8810_REG_PLLN (0x24) */
+#define NAU8810_PLLN_MASK               0xF
+#define NAU8810_PLLMCLK_DIV2            (0x1 << 4)
+
+/* NAU8810_REG_PLLK1 (0x25) */
+#define NAU8810_PLLK1_SFT               18
+#define NAU8810_PLLK1_MASK              0x3F
+
+/* NAU8810_REG_PLLK2 (0x26) */
+#define NAU8810_PLLK2_SFT               9
+#define NAU8810_PLLK2_MASK              0x1FF
+
+/* NAU8810_REG_PLLK3 (0x27) */
+#define NAU8810_PLLK3_MASK              0x1FF
+
+/* NAU8810_REG_INPUT_SIGNAL (0x2C) */
+#define NAU8810_PMICPGA_SFT             0
+#define NAU8810_NMICPGA_SFT             1
+
+/* NAU8810_REG_PGAGAIN (0x2D) */
+#define NAU8810_PGAGAIN_SFT             0
+#define NAU8810_PGAMT_SFT               6
+#define NAU8810_PGAZC_SFT               7
+
+/* NAU8810_REG_ADCBOOST (0x2F) */
+#define NAU8810_PMICBSTGAIN_SFT 4
+#define NAU8810_PGABST_SFT              8
+
+/* NAU8810_REG_SPKMIX (0x32) */
+#define NAU8810_DACSPK_SFT              0
+#define NAU8810_BYPSPK_SFT              1
+
+/* NAU8810_REG_SPKGAIN (0x36) */
+#define NAU8810_SPKGAIN_SFT             0
+#define NAU8810_SPKMT_SFT               6
+#define NAU8810_SPKZC_SFT               7
+
+/* NAU8810_REG_MONOMIX (0x38) */
+#define NAU8810_DACMOUT_SFT             0
+#define NAU8810_BYPMOUT_SFT             1
+#define NAU8810_MOUTMXMT_SFT            6
+
+
+/* System Clock Source */
+enum {
+        NAU8810_SCLK_MCLK,
+        NAU8810_SCLK_PLL,
+};
+
+struct nau8810_pll {
+        int pre_factor;
+        int mclk_scaler;
+        int pll_frac;
+        int pll_int;
+};
+
+struct nau8810 {
+        struct device *dev;
+        struct regmap *regmap;
+        struct nau8810_pll pll;
+        int sysclk;
+        int clk_id;
+};
+
+#endif
diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c
index 5c9707ac4bbf..e643be91d762 100644
--- a/sound/soc/codecs/nau8825.c
+++ b/sound/soc/codecs/nau8825.c
@@ -212,31 +212,6 @@ static const unsigned short logtable[256] = {
         0xfa2f, 0xfaea, 0xfba5, 0xfc60, 0xfd1a, 0xfdd4, 0xfe8e, 0xff47
 };
 
-static struct snd_soc_dai *nau8825_get_codec_dai(struct nau8825 *nau8825)
-{
-        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(nau8825->dapm);
-        struct snd_soc_component *component = &codec->component;
-        struct snd_soc_dai *codec_dai, *_dai;
-
-        list_for_each_entry_safe(codec_dai, _dai, &component->dai_list, list) {
-                if (!strncmp(codec_dai->name, NUVOTON_CODEC_DAI,
-                        strlen(NUVOTON_CODEC_DAI)))
-                        return codec_dai;
-        }
-        return NULL;
-}
-
-static bool nau8825_dai_is_active(struct nau8825 *nau8825)
-{
-        struct snd_soc_dai *codec_dai = nau8825_get_codec_dai(nau8825);
-
-        if (codec_dai) {
-                if (codec_dai->playback_active || codec_dai->capture_active)
-                        return true;
-        }
-        return false;
-}
-
 /**
  * nau8825_sema_acquire - acquire the semaphore of nau88l25
  * @nau8825:  component to register the codec private data with
@@ -250,19 +225,26 @@ static bool nau8825_dai_is_active(struct nau8825 *nau8825)
  * Acquires the semaphore without jiffies. If no more tasks are allowed
  * to acquire the semaphore, calling this function will put the task to
  * sleep until the semaphore is released.
- * It returns if the semaphore was acquired.
+ * If the semaphore is not released within the specified number of jiffies,
+ * this function returns -ETIME.
+ * If the sleep is interrupted by a signal, this function will return -EINTR.
+ * It returns 0 if the semaphore was acquired successfully.
  */
-static void nau8825_sema_acquire(struct nau8825 *nau8825, long timeout)
+static int nau8825_sema_acquire(struct nau8825 *nau8825, long timeout)
 {
         int ret;
 
-        if (timeout)
+        if (timeout) {
                 ret = down_timeout(&nau8825->xtalk_sem, timeout);
-        else
+                if (ret < 0)
+                        dev_warn(nau8825->dev, "Acquire semaphone timeout\n");
+        } else {
                 ret = down_interruptible(&nau8825->xtalk_sem);
+                if (ret < 0)
+                        dev_warn(nau8825->dev, "Acquire semaphone fail\n");
+        }
 
-        if (ret < 0)
-                dev_warn(nau8825->dev, "Acquire semaphone fail\n");
+        return ret;
 }
 
 /**
@@ -1205,6 +1187,8 @@ static int nau8825_hw_params(struct snd_pcm_substream *substream,
         struct nau8825 *nau8825 = snd_soc_codec_get_drvdata(codec);
         unsigned int val_len = 0;
 
+        nau8825_sema_acquire(nau8825, 2 * HZ);
+
         switch (params_width(params)) {
         case 16:
                 val_len |= NAU8825_I2S_DL_16;
@@ -1225,6 +1209,9 @@ static int nau8825_hw_params(struct snd_pcm_substream *substream,
         regmap_update_bits(nau8825->regmap, NAU8825_REG_I2S_PCM_CTRL1,
                 NAU8825_I2S_DL_MASK, val_len);
 
+        /* Release the semaphone. */
+        nau8825_sema_release(nau8825);
+
         return 0;
 }
 
@@ -1234,6 +1221,8 @@ static int nau8825_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
         struct nau8825 *nau8825 = snd_soc_codec_get_drvdata(codec);
         unsigned int ctrl1_val = 0, ctrl2_val = 0;
 
+        nau8825_sema_acquire(nau8825, 2 * HZ);
+
         switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
         case SND_SOC_DAIFMT_CBM_CFM:
                 ctrl2_val |= NAU8825_I2S_MS_MASTER;
@@ -1282,6 +1271,9 @@ static int nau8825_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
         regmap_update_bits(nau8825->regmap, NAU8825_REG_I2S_PCM_CTRL2,
                 NAU8825_I2S_MS_MASK, ctrl2_val);
 
+        /* Release the semaphone. */
+        nau8825_sema_release(nau8825);
+
         return 0;
 }
 
@@ -1611,8 +1603,11 @@ static irqreturn_t nau8825_interrupt(int irq, void *data)
                                          * cess and restore changes if process
                                          * is ongoing when ejection.
                                          */
+                                        int ret;
                                         nau8825->xtalk_protect = true;
-                                        nau8825_sema_acquire(nau8825, 0);
+                                        ret = nau8825_sema_acquire(nau8825, 0);
+                                        if (ret < 0)
+                                                nau8825->xtalk_protect = false;
                                 }
                                 /* Startup cross talk detection process */
                                 nau8825->xtalk_state = NAU8825_XTALK_PREPARE;
@@ -1912,7 +1907,7 @@ static int nau8825_calc_fll_param(unsigned int fll_in, unsigned int fs,
         /* Calculate the FLL 10-bit integer input and the FLL 16-bit fractional
          * input based on FDCO, FREF and FLL ratio.
          */
-        fvco = div_u64(fvco << 16, fref * fll_param->ratio);
+        fvco = div_u64(fvco_max << 16, fref * fll_param->ratio);
         fll_param->fll_int = (fvco >> 16) & 0x3FF;
         fll_param->fll_frac = fvco & 0xFFFF;
         return 0;
@@ -2238,23 +2233,14 @@ static int __maybe_unused nau8825_suspend(struct snd_soc_codec *codec)
 static int __maybe_unused nau8825_resume(struct snd_soc_codec *codec)
 {
         struct nau8825 *nau8825 = snd_soc_codec_get_drvdata(codec);
+        int ret;
 
         regcache_cache_only(nau8825->regmap, false);
         regcache_sync(nau8825->regmap);
-        if (nau8825_is_jack_inserted(nau8825->regmap)) {
-                /* If the jack is inserted, we need to check whether the play-
-                 * back is active before suspend. If active, the driver has to
-                 * raise the protection for cross talk function to avoid the
-                 * playback recovers before cross talk process finish. Other-
-                 * wise, the playback will be interfered by cross talk func-
-                 * tion. It is better to apply hardware related parameters
-                 * before starting playback or record.
-                 */
-                if (nau8825_dai_is_active(nau8825)) {
-                        nau8825->xtalk_protect = true;
-                        nau8825_sema_acquire(nau8825, 0);
-                }
-        }
+        nau8825->xtalk_protect = true;
+        ret = nau8825_sema_acquire(nau8825, 0);
+        if (ret < 0)
+                nau8825->xtalk_protect = false;
         enable_irq(nau8825->irq);
 
         return 0;
@@ -2270,12 +2256,14 @@ static struct snd_soc_codec_driver nau8825_codec_driver = {
         .suspend = nau8825_suspend,
         .resume = nau8825_resume,
 
-        .controls = nau8825_controls,
-        .num_controls = ARRAY_SIZE(nau8825_controls),
-        .dapm_widgets = nau8825_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(nau8825_dapm_widgets),
-        .dapm_routes = nau8825_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(nau8825_dapm_routes),
+        .component_driver = {
+                .controls               = nau8825_controls,
+                .num_controls           = ARRAY_SIZE(nau8825_controls),
+                .dapm_widgets           = nau8825_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(nau8825_dapm_widgets),
+                .dapm_routes            = nau8825_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(nau8825_dapm_routes),
+        },
 };
 
 static void nau8825_reset_chip(struct regmap *regmap)
diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
index 33e1fc2d1598..0b14efab6280 100644
--- a/sound/soc/codecs/pcm1681.c
+++ b/sound/soc/codecs/pcm1681.c
@@ -289,12 +289,14 @@ static const struct regmap_config pcm1681_regmap = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_pcm1681 = {
-        .controls               = pcm1681_controls,
-        .num_controls           = ARRAY_SIZE(pcm1681_controls),
-        .dapm_widgets           = pcm1681_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(pcm1681_dapm_widgets),
-        .dapm_routes            = pcm1681_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(pcm1681_dapm_routes),
+        .component_driver = {
+                .controls               = pcm1681_controls,
+                .num_controls           = ARRAY_SIZE(pcm1681_controls),
+                .dapm_widgets           = pcm1681_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(pcm1681_dapm_widgets),
+                .dapm_routes            = pcm1681_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(pcm1681_dapm_routes),
+        },
 };
 
 static const struct i2c_device_id pcm1681_i2c_id[] = {
diff --git a/sound/soc/codecs/pcm179x.c b/sound/soc/codecs/pcm179x.c
index 88fbdd184aa0..b813a154ddd9 100644
--- a/sound/soc/codecs/pcm179x.c
+++ b/sound/soc/codecs/pcm179x.c
@@ -206,12 +206,14 @@ const struct regmap_config pcm179x_regmap_config = {
 EXPORT_SYMBOL_GPL(pcm179x_regmap_config);
 
 static struct snd_soc_codec_driver soc_codec_dev_pcm179x = {
-        .controls               = pcm179x_controls,
-        .num_controls           = ARRAY_SIZE(pcm179x_controls),
-        .dapm_widgets           = pcm179x_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(pcm179x_dapm_widgets),
-        .dapm_routes            = pcm179x_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(pcm179x_dapm_routes),
+        .component_driver = {
+                .controls               = pcm179x_controls,
+                .num_controls           = ARRAY_SIZE(pcm179x_controls),
+                .dapm_widgets           = pcm179x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(pcm179x_dapm_widgets),
+                .dapm_routes            = pcm179x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(pcm179x_dapm_routes),
+        },
 };
 
 int pcm179x_common_init(struct device *dev, struct regmap *regmap)
diff --git a/sound/soc/codecs/pcm3008.c b/sound/soc/codecs/pcm3008.c
index 8fb445f33f6f..708af05486f6 100644
--- a/sound/soc/codecs/pcm3008.c
+++ b/sound/soc/codecs/pcm3008.c
@@ -99,10 +99,12 @@ static struct snd_soc_dai_driver pcm3008_dai = {
 };
 
 static struct snd_soc_codec_driver soc_codec_dev_pcm3008 = {
-        .dapm_widgets = pcm3008_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(pcm3008_dapm_widgets),
-        .dapm_routes = pcm3008_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(pcm3008_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = pcm3008_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(pcm3008_dapm_widgets),
+                .dapm_routes            = pcm3008_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(pcm3008_dapm_routes),
+        },
 };
 
 static int pcm3008_codec_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/pcm3168a.c b/sound/soc/codecs/pcm3168a.c
index 992a77edcd5d..39bc02d5bc5d 100644
--- a/sound/soc/codecs/pcm3168a.c
+++ b/sound/soc/codecs/pcm3168a.c
@@ -599,12 +599,14 @@ EXPORT_SYMBOL_GPL(pcm3168a_regmap);
 
 static const struct snd_soc_codec_driver pcm3168a_driver = {
         .idle_bias_off = true,
-        .controls = pcm3168a_snd_controls,
-        .num_controls = ARRAY_SIZE(pcm3168a_snd_controls),
-        .dapm_widgets = pcm3168a_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(pcm3168a_dapm_widgets),
-        .dapm_routes = pcm3168a_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(pcm3168a_dapm_routes)
+        .component_driver = {
+                .controls               = pcm3168a_snd_controls,
+                .num_controls           = ARRAY_SIZE(pcm3168a_snd_controls),
+                .dapm_widgets           = pcm3168a_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(pcm3168a_dapm_widgets),
+                .dapm_routes            = pcm3168a_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(pcm3168a_dapm_routes)
+        },
 };
 
 int pcm3168a_probe(struct device *dev, struct regmap *regmap)
diff --git a/sound/soc/codecs/pcm512x.c b/sound/soc/codecs/pcm512x.c
index 047c48953a20..72b19e62f626 100644
--- a/sound/soc/codecs/pcm512x.c
+++ b/sound/soc/codecs/pcm512x.c
@@ -1348,12 +1348,14 @@ static struct snd_soc_codec_driver pcm512x_codec_driver = {
         .set_bias_level = pcm512x_set_bias_level,
         .idle_bias_off = true,
 
-        .controls = pcm512x_controls,
-        .num_controls = ARRAY_SIZE(pcm512x_controls),
-        .dapm_widgets = pcm512x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(pcm512x_dapm_widgets),
-        .dapm_routes = pcm512x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(pcm512x_dapm_routes),
+        .component_driver = {
+                .controls               = pcm512x_controls,
+                .num_controls           = ARRAY_SIZE(pcm512x_controls),
+                .dapm_widgets           = pcm512x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(pcm512x_dapm_widgets),
+                .dapm_routes            = pcm512x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(pcm512x_dapm_routes),
+        },
 };
 
 static const struct regmap_range_cfg pcm512x_range = {
diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
index 74c0e4eb3788..9c365a7f758d 100644
--- a/sound/soc/codecs/rt286.c
+++ b/sound/soc/codecs/rt286.c
@@ -1053,12 +1053,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt286 = {
         .resume = rt286_resume,
         .set_bias_level = rt286_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt286_snd_controls,
-        .num_controls = ARRAY_SIZE(rt286_snd_controls),
-        .dapm_widgets = rt286_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt286_dapm_widgets),
-        .dapm_routes = rt286_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt286_dapm_routes),
+        .component_driver = {
+                .controls               = rt286_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt286_snd_controls),
+                .dapm_widgets           = rt286_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt286_dapm_widgets),
+                .dapm_routes            = rt286_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt286_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt286_regmap = {
diff --git a/sound/soc/codecs/rt298.c b/sound/soc/codecs/rt298.c
index f80cfe4d2ef2..55558643166f 100644
--- a/sound/soc/codecs/rt298.c
+++ b/sound/soc/codecs/rt298.c
@@ -1095,12 +1095,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt298 = {
         .resume = rt298_resume,
         .set_bias_level = rt298_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt298_snd_controls,
-        .num_controls = ARRAY_SIZE(rt298_snd_controls),
-        .dapm_widgets = rt298_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt298_dapm_widgets),
-        .dapm_routes = rt298_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt298_dapm_routes),
+        .component_driver = {
+                .controls               = rt298_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt298_snd_controls),
+                .dapm_widgets           = rt298_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt298_dapm_widgets),
+                .dapm_routes            = rt298_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt298_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt298_regmap = {
diff --git a/sound/soc/codecs/rt5514-spi.c b/sound/soc/codecs/rt5514-spi.c
index 77ff8ebe6dfb..09103aab0cb2 100644
--- a/sound/soc/codecs/rt5514-spi.c
+++ b/sound/soc/codecs/rt5514-spi.c
@@ -236,7 +236,7 @@ static snd_pcm_uframes_t rt5514_spi_pcm_pointer(
         return bytes_to_frames(runtime, rt5514_dsp->dma_offset);
 }
 
-static struct snd_pcm_ops rt5514_spi_pcm_ops = {
+static const struct snd_pcm_ops rt5514_spi_pcm_ops = {
         .open           = rt5514_spi_pcm_open,
         .hw_params      = rt5514_spi_hw_params,
         .hw_free        = rt5514_spi_hw_free,
diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c
index 7162f05101d9..f24b7cfd3a89 100644
--- a/sound/soc/codecs/rt5514.c
+++ b/sound/soc/codecs/rt5514.c
@@ -278,7 +278,7 @@ static const DECLARE_TLV_DB_RANGE(bst_tlv,
         8, 8, TLV_DB_SCALE_ITEM(1700, 0, 0)
 );
 
-static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -17625, 375, 0);
+static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -1725, 75, 0);
 
 static int rt5514_dsp_voice_wake_up_get(struct snd_kcontrol *kcontrol,
                 struct snd_ctl_elem_value *ucontrol)
@@ -352,10 +352,10 @@ static const struct snd_kcontrol_new rt5514_snd_controls[] = {
         SOC_DOUBLE_TLV("MIC Boost Volume", RT5514_ANA_CTRL_MICBST,
                 RT5514_SEL_BSTL_SFT, RT5514_SEL_BSTR_SFT, 8, 0, bst_tlv),
         SOC_DOUBLE_R_TLV("ADC1 Capture Volume", RT5514_DOWNFILTER0_CTRL1,
-                RT5514_DOWNFILTER0_CTRL2, RT5514_AD_GAIN_SFT, 127, 0,
+                RT5514_DOWNFILTER0_CTRL2, RT5514_AD_GAIN_SFT, 63, 0,
                 adc_vol_tlv),
         SOC_DOUBLE_R_TLV("ADC2 Capture Volume", RT5514_DOWNFILTER1_CTRL1,
-                RT5514_DOWNFILTER1_CTRL2, RT5514_AD_GAIN_SFT, 127, 0,
+                RT5514_DOWNFILTER1_CTRL2, RT5514_AD_GAIN_SFT, 63, 0,
                 adc_vol_tlv),
         SOC_SINGLE_EXT("DSP Voice Wake Up", SND_SOC_NOPM, 0, 1, 0,
                 rt5514_dsp_voice_wake_up_get, rt5514_dsp_voice_wake_up_put),
@@ -1023,12 +1023,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5514 = {
         .probe = rt5514_probe,
         .idle_bias_off = true,
         .set_bias_level = rt5514_set_bias_level,
-        .controls = rt5514_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5514_snd_controls),
-        .dapm_widgets = rt5514_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5514_dapm_widgets),
-        .dapm_routes = rt5514_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5514_dapm_routes),
+        .component_driver = {
+                .controls               = rt5514_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5514_snd_controls),
+                .dapm_widgets           = rt5514_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5514_dapm_widgets),
+                .dapm_routes            = rt5514_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5514_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt5514_i2c_regmap = {
diff --git a/sound/soc/codecs/rt5514.h b/sound/soc/codecs/rt5514.h
index 68883c68e999..229de0e2c88c 100644
--- a/sound/soc/codecs/rt5514.h
+++ b/sound/soc/codecs/rt5514.h
@@ -196,8 +196,8 @@
 #define RT5514_AD_AD_MIX_BIT                    10
 #define RT5514_AD_AD_MUTE                       (0x1 << 7)
 #define RT5514_AD_AD_MUTE_BIT                   7
-#define RT5514_AD_GAIN_MASK                     (0x7f << 0)
-#define RT5514_AD_GAIN_SFT                      0
+#define RT5514_AD_GAIN_MASK                     (0x3f << 1)
+#define RT5514_AD_GAIN_SFT                      1
 
 /*  RT5514_ANA_CTRL_MICBST (0x2220) */
 #define RT5514_SEL_BSTL_MASK                    (0xf << 4)
diff --git a/sound/soc/codecs/rt5616.c b/sound/soc/codecs/rt5616.c
index f527b5b2817b..d1f273b24991 100644
--- a/sound/soc/codecs/rt5616.c
+++ b/sound/soc/codecs/rt5616.c
@@ -294,8 +294,7 @@ static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -17625, 375, 0);
 static const DECLARE_TLV_DB_SCALE(adc_bst_tlv, 0, 1200, 0);
 
 /* {0, +20, +24, +30, +35, +40, +44, +50, +52} dB */
-static unsigned int bst_tlv[] = {
-        TLV_DB_RANGE_HEAD(7),
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(bst_tlv,
         0, 0, TLV_DB_SCALE_ITEM(0, 0, 0),
         1, 1, TLV_DB_SCALE_ITEM(2000, 0, 0),
         2, 2, TLV_DB_SCALE_ITEM(2400, 0, 0),
@@ -303,7 +302,7 @@ static unsigned int bst_tlv[] = {
         6, 6, TLV_DB_SCALE_ITEM(4400, 0, 0),
         7, 7, TLV_DB_SCALE_ITEM(5000, 0, 0),
         8, 8, TLV_DB_SCALE_ITEM(5200, 0, 0),
-};
+);
 
 static const struct snd_kcontrol_new rt5616_snd_controls[] = {
         /* Headphone Output Volume */
@@ -1267,14 +1266,14 @@ static int rt5616_resume(struct snd_soc_codec *codec)
 #define RT5616_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \
                         SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S8)
 
-struct snd_soc_dai_ops rt5616_aif_dai_ops = {
+static struct snd_soc_dai_ops rt5616_aif_dai_ops = {
         .hw_params = rt5616_hw_params,
         .set_fmt = rt5616_set_dai_fmt,
         .set_sysclk = rt5616_set_dai_sysclk,
         .set_pll = rt5616_set_dai_pll,
 };
 
-struct snd_soc_dai_driver rt5616_dai[] = {
+static struct snd_soc_dai_driver rt5616_dai[] = {
         {
                 .name = "rt5616-aif1",
                 .id = RT5616_AIF1,
@@ -1302,12 +1301,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5616 = {
         .resume = rt5616_resume,
         .set_bias_level = rt5616_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt5616_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5616_snd_controls),
-        .dapm_widgets = rt5616_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5616_dapm_widgets),
-        .dapm_routes = rt5616_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5616_dapm_routes),
+        .component_driver = {
+                .controls               = rt5616_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5616_snd_controls),
+                .dapm_widgets           = rt5616_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5616_dapm_widgets),
+                .dapm_routes            = rt5616_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5616_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt5616_regmap = {
diff --git a/sound/soc/codecs/rt5631.c b/sound/soc/codecs/rt5631.c
index 1be2bab7dee3..0e418089c053 100644
--- a/sound/soc/codecs/rt5631.c
+++ b/sound/soc/codecs/rt5631.c
@@ -1657,12 +1657,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5631 = {
         .probe = rt5631_probe,
         .set_bias_level = rt5631_set_bias_level,
         .suspend_bias_off = true,
-        .controls = rt5631_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5631_snd_controls),
-        .dapm_widgets = rt5631_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5631_dapm_widgets),
-        .dapm_routes = rt5631_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5631_dapm_routes),
+        .component_driver = {
+                .controls               = rt5631_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5631_snd_controls),
+                .dapm_widgets           = rt5631_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5631_dapm_widgets),
+                .dapm_routes            = rt5631_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5631_dapm_routes),
+        },
 };
 
 static const struct i2c_device_id rt5631_i2c_id[] = {
diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
index 09e8988bbb2d..3cc1135fc2cd 100644
--- a/sound/soc/codecs/rt5640.c
+++ b/sound/soc/codecs/rt5640.c
@@ -1870,6 +1870,9 @@ static int rt5640_set_dai_sysclk(struct snd_soc_dai *dai,
         case RT5640_SCLK_S_PLL1:
                 reg_val |= RT5640_SCLK_SRC_PLL1;
                 break;
+        case RT5640_SCLK_S_RCCLK:
+                reg_val |= RT5640_SCLK_SRC_RCCLK;
+                break;
         default:
                 dev_err(codec->dev, "Invalid clock id (%d)\n", clk_id);
                 return -EINVAL;
@@ -2261,12 +2264,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5640 = {
         .resume = rt5640_resume,
         .set_bias_level = rt5640_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt5640_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5640_snd_controls),
-        .dapm_widgets = rt5640_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5640_dapm_widgets),
-        .dapm_routes = rt5640_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5640_dapm_routes),
+        .component_driver = {
+                .controls               = rt5640_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5640_snd_controls),
+                .dapm_widgets           = rt5640_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5640_dapm_widgets),
+                .dapm_routes            = rt5640_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5640_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt5640_regmap = {
diff --git a/sound/soc/codecs/rt5640.h b/sound/soc/codecs/rt5640.h
index 58b664b06c16..90c88711c72a 100644
--- a/sound/soc/codecs/rt5640.h
+++ b/sound/soc/codecs/rt5640.h
@@ -984,6 +984,7 @@
 #define RT5640_SCLK_SRC_SFT                     14
 #define RT5640_SCLK_SRC_MCLK                    (0x0 << 14)
 #define RT5640_SCLK_SRC_PLL1                    (0x1 << 14)
+#define RT5640_SCLK_SRC_RCCLK                   (0x2 << 14)
 #define RT5640_PLL1_SRC_MASK                    (0x3 << 12)
 #define RT5640_PLL1_SRC_SFT                     12
 #define RT5640_PLL1_SRC_MCLK                    (0x0 << 12)
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 490bfe661346..10c2a564a715 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3484,12 +3484,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5645 = {
         .resume = rt5645_resume,
         .set_bias_level = rt5645_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt5645_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5645_snd_controls),
-        .dapm_widgets = rt5645_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5645_dapm_widgets),
-        .dapm_routes = rt5645_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5645_dapm_routes),
+        .component_driver = {
+                .controls               = rt5645_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5645_snd_controls),
+                .dapm_widgets           = rt5645_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5645_dapm_widgets),
+                .dapm_routes            = rt5645_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5645_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt5645_regmap = {
diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c
index 7a6197042423..f5d34153e21f 100644
--- a/sound/soc/codecs/rt5651.c
+++ b/sound/soc/codecs/rt5651.c
@@ -1712,12 +1712,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5651 = {
         .resume = rt5651_resume,
         .set_bias_level = rt5651_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt5651_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5651_snd_controls),
-        .dapm_widgets = rt5651_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5651_dapm_widgets),
-        .dapm_routes = rt5651_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5651_dapm_routes),
+        .component_driver = {
+                .controls               = rt5651_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5651_snd_controls),
+                .dapm_widgets           = rt5651_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5651_dapm_widgets),
+                .dapm_routes            = rt5651_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5651_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt5651_regmap = {
diff --git a/sound/soc/codecs/rt5659.c b/sound/soc/codecs/rt5659.c
index 1b30914c2d91..db54550aed60 100644
--- a/sound/soc/codecs/rt5659.c
+++ b/sound/soc/codecs/rt5659.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/clk.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/init.h>
@@ -3565,7 +3566,9 @@ static int rt5659_set_bclk_ratio(struct snd_soc_dai *dai, unsigned int ratio)
 static int rt5659_set_bias_level(struct snd_soc_codec *codec,
                         enum snd_soc_bias_level level)
 {
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
         struct rt5659_priv *rt5659 = snd_soc_codec_get_drvdata(codec);
+        int ret;
 
         switch (level) {
         case SND_SOC_BIAS_PREPARE:
@@ -3582,6 +3585,17 @@ static int rt5659_set_bias_level(struct snd_soc_codec *codec,
                         RT5659_PWR_FV1 | RT5659_PWR_FV2);
                 break;
 
+        case SND_SOC_BIAS_STANDBY:
+                if (dapm->bias_level == SND_SOC_BIAS_OFF) {
+                        ret = clk_prepare_enable(rt5659->mclk);
+                        if (ret) {
+                                dev_err(codec->dev,
+                                        "failed to enable MCLK: %d\n", ret);
+                                return ret;
+                        }
+                }
+                break;
+
         case SND_SOC_BIAS_OFF:
                 regmap_update_bits(rt5659->regmap, RT5659_PWR_DIG_1,
                         RT5659_PWR_LDO, 0);
@@ -3591,6 +3605,7 @@ static int rt5659_set_bias_level(struct snd_soc_codec *codec,
                         RT5659_PWR_MB | RT5659_PWR_VREF2);
                 regmap_update_bits(rt5659->regmap, RT5659_DIG_MISC,
                         RT5659_DIG_GATE_CTRL, 0);
+                clk_disable_unprepare(rt5659->mclk);
                 break;
 
         default:
@@ -3722,12 +3737,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5659 = {
         .resume = rt5659_resume,
         .set_bias_level = rt5659_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt5659_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5659_snd_controls),
-        .dapm_widgets = rt5659_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5659_dapm_widgets),
-        .dapm_routes = rt5659_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5659_dapm_routes),
+        .component_driver = {
+                .controls               = rt5659_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5659_snd_controls),
+                .dapm_widgets           = rt5659_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5659_dapm_widgets),
+                .dapm_routes            = rt5659_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5659_dapm_routes),
+        },
 };
 
 
@@ -4020,6 +4037,15 @@ static int rt5659_i2c_probe(struct i2c_client *i2c,
 
         regmap_write(rt5659->regmap, RT5659_RESET, 0);
 
+        /* Check if MCLK provided */
+        rt5659->mclk = devm_clk_get(&i2c->dev, "mclk");
+        if (IS_ERR(rt5659->mclk)) {
+                if (PTR_ERR(rt5659->mclk) != -ENOENT)
+                        return PTR_ERR(rt5659->mclk);
+                /* Otherwise mark the mclk pointer to NULL */
+                rt5659->mclk = NULL;
+        }
+
         rt5659_calibrate(rt5659);
 
         /* line in diff mode*/
@@ -4163,6 +4189,9 @@ static int rt5659_i2c_probe(struct i2c_client *i2c,
                 if (ret)
                         dev_err(&i2c->dev, "Failed to reguest IRQ: %d\n", ret);
 
+                /* Enable IRQ output for GPIO1 pin any way */
+                regmap_update_bits(rt5659->regmap, RT5659_GPIO_CTRL_1,
+                                   RT5659_GP1_PIN_MASK, RT5659_GP1_PIN_IRQ);
         }
 
         return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5659,
diff --git a/sound/soc/codecs/rt5659.h b/sound/soc/codecs/rt5659.h
index d31c9e5bcec8..8f1aeef08489 100644
--- a/sound/soc/codecs/rt5659.h
+++ b/sound/soc/codecs/rt5659.h
@@ -180,9 +180,9 @@
 #define RT5659_IRQ_CTRL_1                       0x00b6
 #define RT5659_IRQ_CTRL_2                       0x00b7
 #define RT5659_IRQ_CTRL_3                       0x00b8
-#define RT5659_IRQ_CTRL_4                       0x00b9
-#define RT5659_IRQ_CTRL_5                       0x00ba
-#define RT5659_IRQ_CTRL_6                       0x00bb
+#define RT5659_IRQ_CTRL_4                       0x00ba
+#define RT5659_IRQ_CTRL_5                       0x00bb
+#define RT5659_IRQ_CTRL_6                       0x00bc
 #define RT5659_INT_ST_1                         0x00be
 #define RT5659_INT_ST_2                         0x00bf
 #define RT5659_GPIO_CTRL_1                      0x00c0
@@ -1796,6 +1796,7 @@ struct rt5659_priv {
         struct gpio_desc *gpiod_reset;
         struct snd_soc_jack *hs_jack;
         struct delayed_work jack_detect_work;
+        struct clk *mclk;
 
         int sysclk;
         int sysclk_src;
diff --git a/sound/soc/codecs/rt5660.c b/sound/soc/codecs/rt5660.c
new file mode 100644
index 000000000000..9f0933ced804
--- /dev/null
+++ b/sound/soc/codecs/rt5660.c
@@ -0,0 +1,1353 @@
+/*
+ * rt5660.c  --  RT5660 ALSA SoC audio codec driver
+ *
+ * Copyright 2016 Realtek Semiconductor Corp.
+ * Author: Oder Chiou <oder_chiou@realtek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/pm.h>
+#include <linux/gpio.h>
+#include <linux/i2c.h>
+#include <linux/regmap.h>
+#include <linux/of.h>
+#include <linux/of_gpio.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+#include <linux/acpi.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <sound/initval.h>
+#include <sound/tlv.h>
+
+#include "rl6231.h"
+#include "rt5660.h"
+
+#define RT5660_DEVICE_ID 0x6338
+
+#define RT5660_PR_RANGE_BASE (0xff + 1)
+#define RT5660_PR_SPACING 0x100
+
+#define RT5660_PR_BASE (RT5660_PR_RANGE_BASE + (0 * RT5660_PR_SPACING))
+
+static const struct regmap_range_cfg rt5660_ranges[] = {
+        { .name = "PR", .range_min = RT5660_PR_BASE,
+          .range_max = RT5660_PR_BASE + 0xf3,
+          .selector_reg = RT5660_PRIV_INDEX,
+          .selector_mask = 0xff,
+          .selector_shift = 0x0,
+          .window_start = RT5660_PRIV_DATA,
+          .window_len = 0x1, },
+};
+
+static const struct reg_sequence rt5660_patch[] = {
+        { RT5660_ALC_PGA_CTRL2,         0x44c3 },
+        { RT5660_PR_BASE + 0x3d,        0x2600 },
+};
+
+static const struct reg_default rt5660_reg[] = {
+        { 0x00, 0x0000 },
+        { 0x01, 0xc800 },
+        { 0x02, 0xc8c8 },
+        { 0x0d, 0x1010 },
+        { 0x0e, 0x1010 },
+        { 0x19, 0xafaf },
+        { 0x1c, 0x2f2f },
+        { 0x1e, 0x0000 },
+        { 0x27, 0x6060 },
+        { 0x29, 0x8080 },
+        { 0x2a, 0x4242 },
+        { 0x2f, 0x0000 },
+        { 0x3b, 0x0000 },
+        { 0x3c, 0x007f },
+        { 0x3d, 0x0000 },
+        { 0x3e, 0x007f },
+        { 0x45, 0xe000 },
+        { 0x46, 0x003e },
+        { 0x48, 0xf800 },
+        { 0x4a, 0x0004 },
+        { 0x4d, 0x0000 },
+        { 0x4e, 0x0000 },
+        { 0x4f, 0x01ff },
+        { 0x50, 0x0000 },
+        { 0x51, 0x0000 },
+        { 0x52, 0x01ff },
+        { 0x61, 0x0000 },
+        { 0x62, 0x0000 },
+        { 0x63, 0x00c0 },
+        { 0x64, 0x0000 },
+        { 0x65, 0x0000 },
+        { 0x66, 0x0000 },
+        { 0x70, 0x8000 },
+        { 0x73, 0x7000 },
+        { 0x74, 0x3c00 },
+        { 0x75, 0x2800 },
+        { 0x80, 0x0000 },
+        { 0x81, 0x0000 },
+        { 0x82, 0x0000 },
+        { 0x8c, 0x0228 },
+        { 0x8d, 0xa000 },
+        { 0x8e, 0x0000 },
+        { 0x92, 0x0000 },
+        { 0x93, 0x3000 },
+        { 0xa1, 0x0059 },
+        { 0xa2, 0x0001 },
+        { 0xa3, 0x5c80 },
+        { 0xa4, 0x0146 },
+        { 0xa5, 0x1f1f },
+        { 0xa6, 0x78c6 },
+        { 0xa7, 0xe5ec },
+        { 0xa8, 0xba61 },
+        { 0xa9, 0x3c78 },
+        { 0xaa, 0x8ae2 },
+        { 0xab, 0xe5ec },
+        { 0xac, 0xc600 },
+        { 0xad, 0xba61 },
+        { 0xae, 0x17ed },
+        { 0xb0, 0x2080 },
+        { 0xb1, 0x0000 },
+        { 0xb3, 0x001f },
+        { 0xb4, 0x020c },
+        { 0xb5, 0x1f00 },
+        { 0xb6, 0x0000 },
+        { 0xb7, 0x4000 },
+        { 0xbb, 0x0000 },
+        { 0xbd, 0x0000 },
+        { 0xbe, 0x0000 },
+        { 0xbf, 0x0100 },
+        { 0xc0, 0x0000 },
+        { 0xc2, 0x0000 },
+        { 0xd3, 0xa220 },
+        { 0xd9, 0x0809 },
+        { 0xda, 0x0000 },
+        { 0xe0, 0x8000 },
+        { 0xe1, 0x0200 },
+        { 0xe2, 0x8000 },
+        { 0xe3, 0x0200 },
+        { 0xe4, 0x0f20 },
+        { 0xe5, 0x001f },
+        { 0xe6, 0x020c },
+        { 0xe7, 0x1f00 },
+        { 0xe8, 0x0000 },
+        { 0xe9, 0x4000 },
+        { 0xea, 0x00a6 },
+        { 0xeb, 0x04c3 },
+        { 0xec, 0x27c8 },
+        { 0xed, 0x7418 },
+        { 0xee, 0xbf50 },
+        { 0xef, 0x0045 },
+        { 0xf0, 0x0007 },
+        { 0xfa, 0x0000 },
+        { 0xfd, 0x0000 },
+        { 0xfe, 0x10ec },
+        { 0xff, 0x6338 },
+};
+
+static bool rt5660_volatile_register(struct device *dev, unsigned int reg)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(rt5660_ranges); i++)
+                if ((reg >= rt5660_ranges[i].window_start &&
+                     reg <= rt5660_ranges[i].window_start +
+                     rt5660_ranges[i].window_len) ||
+                    (reg >= rt5660_ranges[i].range_min &&
+                     reg <= rt5660_ranges[i].range_max))
+                        return true;
+
+        switch (reg) {
+        case RT5660_RESET:
+        case RT5660_PRIV_DATA:
+        case RT5660_EQ_CTRL1:
+        case RT5660_IRQ_CTRL2:
+        case RT5660_INT_IRQ_ST:
+        case RT5660_VENDOR_ID:
+        case RT5660_VENDOR_ID1:
+        case RT5660_VENDOR_ID2:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool rt5660_readable_register(struct device *dev, unsigned int reg)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(rt5660_ranges); i++)
+                if ((reg >= rt5660_ranges[i].window_start &&
+                     reg <= rt5660_ranges[i].window_start +
+                     rt5660_ranges[i].window_len) ||
+                    (reg >= rt5660_ranges[i].range_min &&
+                     reg <= rt5660_ranges[i].range_max))
+                        return true;
+
+        switch (reg) {
+        case RT5660_RESET:
+        case RT5660_SPK_VOL:
+        case RT5660_LOUT_VOL:
+        case RT5660_IN1_IN2:
+        case RT5660_IN3_IN4:
+        case RT5660_DAC1_DIG_VOL:
+        case RT5660_STO1_ADC_DIG_VOL:
+        case RT5660_ADC_BST_VOL1:
+        case RT5660_STO1_ADC_MIXER:
+        case RT5660_AD_DA_MIXER:
+        case RT5660_STO_DAC_MIXER:
+        case RT5660_DIG_INF1_DATA:
+        case RT5660_REC_L1_MIXER:
+        case RT5660_REC_L2_MIXER:
+        case RT5660_REC_R1_MIXER:
+        case RT5660_REC_R2_MIXER:
+        case RT5660_LOUT_MIXER:
+        case RT5660_SPK_MIXER:
+        case RT5660_SPO_MIXER:
+        case RT5660_SPO_CLSD_RATIO:
+        case RT5660_OUT_L_GAIN1:
+        case RT5660_OUT_L_GAIN2:
+        case RT5660_OUT_L1_MIXER:
+        case RT5660_OUT_R_GAIN1:
+        case RT5660_OUT_R_GAIN2:
+        case RT5660_OUT_R1_MIXER:
+        case RT5660_PWR_DIG1:
+        case RT5660_PWR_DIG2:
+        case RT5660_PWR_ANLG1:
+        case RT5660_PWR_ANLG2:
+        case RT5660_PWR_MIXER:
+        case RT5660_PWR_VOL:
+        case RT5660_PRIV_INDEX:
+        case RT5660_PRIV_DATA:
+        case RT5660_I2S1_SDP:
+        case RT5660_ADDA_CLK1:
+        case RT5660_ADDA_CLK2:
+        case RT5660_DMIC_CTRL1:
+        case RT5660_GLB_CLK:
+        case RT5660_PLL_CTRL1:
+        case RT5660_PLL_CTRL2:
+        case RT5660_CLSD_AMP_OC_CTRL:
+        case RT5660_CLSD_AMP_CTRL:
+        case RT5660_LOUT_AMP_CTRL:
+        case RT5660_SPK_AMP_SPKVDD:
+        case RT5660_MICBIAS:
+        case RT5660_CLSD_OUT_CTRL1:
+        case RT5660_CLSD_OUT_CTRL2:
+        case RT5660_DIPOLE_MIC_CTRL1:
+        case RT5660_DIPOLE_MIC_CTRL2:
+        case RT5660_DIPOLE_MIC_CTRL3:
+        case RT5660_DIPOLE_MIC_CTRL4:
+        case RT5660_DIPOLE_MIC_CTRL5:
+        case RT5660_DIPOLE_MIC_CTRL6:
+        case RT5660_DIPOLE_MIC_CTRL7:
+        case RT5660_DIPOLE_MIC_CTRL8:
+        case RT5660_DIPOLE_MIC_CTRL9:
+        case RT5660_DIPOLE_MIC_CTRL10:
+        case RT5660_DIPOLE_MIC_CTRL11:
+        case RT5660_DIPOLE_MIC_CTRL12:
+        case RT5660_EQ_CTRL1:
+        case RT5660_EQ_CTRL2:
+        case RT5660_DRC_AGC_CTRL1:
+        case RT5660_DRC_AGC_CTRL2:
+        case RT5660_DRC_AGC_CTRL3:
+        case RT5660_DRC_AGC_CTRL4:
+        case RT5660_DRC_AGC_CTRL5:
+        case RT5660_JD_CTRL:
+        case RT5660_IRQ_CTRL1:
+        case RT5660_IRQ_CTRL2:
+        case RT5660_INT_IRQ_ST:
+        case RT5660_GPIO_CTRL1:
+        case RT5660_GPIO_CTRL2:
+        case RT5660_WIND_FILTER_CTRL1:
+        case RT5660_SV_ZCD1:
+        case RT5660_SV_ZCD2:
+        case RT5660_DRC1_LM_CTRL1:
+        case RT5660_DRC1_LM_CTRL2:
+        case RT5660_DRC2_LM_CTRL1:
+        case RT5660_DRC2_LM_CTRL2:
+        case RT5660_MULTI_DRC_CTRL:
+        case RT5660_DRC2_CTRL1:
+        case RT5660_DRC2_CTRL2:
+        case RT5660_DRC2_CTRL3:
+        case RT5660_DRC2_CTRL4:
+        case RT5660_DRC2_CTRL5:
+        case RT5660_ALC_PGA_CTRL1:
+        case RT5660_ALC_PGA_CTRL2:
+        case RT5660_ALC_PGA_CTRL3:
+        case RT5660_ALC_PGA_CTRL4:
+        case RT5660_ALC_PGA_CTRL5:
+        case RT5660_ALC_PGA_CTRL6:
+        case RT5660_ALC_PGA_CTRL7:
+        case RT5660_GEN_CTRL1:
+        case RT5660_GEN_CTRL2:
+        case RT5660_GEN_CTRL3:
+        case RT5660_VENDOR_ID:
+        case RT5660_VENDOR_ID1:
+        case RT5660_VENDOR_ID2:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static const DECLARE_TLV_DB_SCALE(rt5660_out_vol_tlv, -4650, 150, 0);
+static const DECLARE_TLV_DB_SCALE(rt5660_dac_vol_tlv, -6525, 75, 0);
+static const DECLARE_TLV_DB_SCALE(rt5660_adc_vol_tlv, -1725, 75, 0);
+static const DECLARE_TLV_DB_SCALE(rt5660_adc_bst_tlv, 0, 1200, 0);
+static const DECLARE_TLV_DB_SCALE(rt5660_bst_tlv, -1200, 75, 0);
+
+static const struct snd_kcontrol_new rt5660_snd_controls[] = {
+        /* Speaker Output Volume */
+        SOC_SINGLE("Speaker Playback Switch", RT5660_SPK_VOL, RT5660_L_MUTE_SFT,
+                1, 1),
+        SOC_SINGLE_TLV("Speaker Playback Volume", RT5660_SPK_VOL,
+                RT5660_L_VOL_SFT, 39, 1, rt5660_out_vol_tlv),
+
+        /* OUTPUT Control */
+        SOC_DOUBLE("OUT Playback Switch", RT5660_LOUT_VOL, RT5660_L_MUTE_SFT,
+                RT5660_R_MUTE_SFT, 1, 1),
+        SOC_DOUBLE_TLV("OUT Playback Volume", RT5660_LOUT_VOL, RT5660_L_VOL_SFT,
+                RT5660_R_VOL_SFT, 39, 1, rt5660_out_vol_tlv),
+
+        /* DAC Digital Volume */
+        SOC_DOUBLE_TLV("DAC1 Playback Volume", RT5660_DAC1_DIG_VOL,
+                RT5660_DAC_L1_VOL_SFT, RT5660_DAC_R1_VOL_SFT, 87, 0,
+                rt5660_dac_vol_tlv),
+
+        /* IN1/IN2/IN3 Control */
+        SOC_SINGLE_TLV("IN1 Boost Volume", RT5660_IN1_IN2, RT5660_BST_SFT1, 69,
+                0, rt5660_bst_tlv),
+        SOC_SINGLE_TLV("IN2 Boost Volume", RT5660_IN1_IN2, RT5660_BST_SFT2, 69,
+                0, rt5660_bst_tlv),
+        SOC_SINGLE_TLV("IN3 Boost Volume", RT5660_IN3_IN4, RT5660_BST_SFT3, 69,
+                0, rt5660_bst_tlv),
+
+        /* ADC Digital Volume Control */
+        SOC_DOUBLE("ADC Capture Switch", RT5660_STO1_ADC_DIG_VOL,
+                RT5660_L_MUTE_SFT, RT5660_R_MUTE_SFT, 1, 1),
+        SOC_DOUBLE_TLV("ADC Capture Volume", RT5660_STO1_ADC_DIG_VOL,
+                RT5660_ADC_L_VOL_SFT, RT5660_ADC_R_VOL_SFT, 63, 0,
+                rt5660_adc_vol_tlv),
+
+        /* ADC Boost Volume Control */
+        SOC_DOUBLE_TLV("STO1 ADC Boost Gain Volume", RT5660_ADC_BST_VOL1,
+                RT5660_STO1_ADC_L_BST_SFT, RT5660_STO1_ADC_R_BST_SFT, 3, 0,
+                rt5660_adc_bst_tlv),
+};
+
+/**
+ * rt5660_set_dmic_clk - Set parameter of dmic.
+ *
+ * @w: DAPM widget.
+ * @kcontrol: The kcontrol of this widget.
+ * @event: Event id.
+ *
+ */
+static int rt5660_set_dmic_clk(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+        int idx, rate;
+
+        rate = rt5660->sysclk / rl6231_get_pre_div(rt5660->regmap,
+                RT5660_ADDA_CLK1, RT5660_I2S_PD1_SFT);
+        idx = rl6231_calc_dmic_clk(rate);
+        if (idx < 0)
+                dev_err(codec->dev, "Failed to set DMIC clock\n");
+        else
+                snd_soc_update_bits(codec, RT5660_DMIC_CTRL1,
+                        RT5660_DMIC_CLK_MASK, idx << RT5660_DMIC_CLK_SFT);
+
+        return idx;
+}
+
+static int rt5660_is_sys_clk_from_pll(struct snd_soc_dapm_widget *source,
+                         struct snd_soc_dapm_widget *sink)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(source->dapm);
+        unsigned int val;
+
+        val = snd_soc_read(codec, RT5660_GLB_CLK);
+        val &= RT5660_SCLK_SRC_MASK;
+        if (val == RT5660_SCLK_SRC_PLL1)
+                return 1;
+        else
+                return 0;
+}
+
+/* Digital Mixer */
+static const struct snd_kcontrol_new rt5660_sto1_adc_l_mix[] = {
+        SOC_DAPM_SINGLE("ADC1 Switch", RT5660_STO1_ADC_MIXER,
+                        RT5660_M_ADC_L1_SFT, 1, 1),
+        SOC_DAPM_SINGLE("ADC2 Switch", RT5660_STO1_ADC_MIXER,
+                        RT5660_M_ADC_L2_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_sto1_adc_r_mix[] = {
+        SOC_DAPM_SINGLE("ADC1 Switch", RT5660_STO1_ADC_MIXER,
+                        RT5660_M_ADC_R1_SFT, 1, 1),
+        SOC_DAPM_SINGLE("ADC2 Switch", RT5660_STO1_ADC_MIXER,
+                        RT5660_M_ADC_R2_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_dac_l_mix[] = {
+        SOC_DAPM_SINGLE("Stereo ADC Switch", RT5660_AD_DA_MIXER,
+                        RT5660_M_ADCMIX_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC1 Switch", RT5660_AD_DA_MIXER,
+                        RT5660_M_DAC1_L_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_dac_r_mix[] = {
+        SOC_DAPM_SINGLE("Stereo ADC Switch", RT5660_AD_DA_MIXER,
+                        RT5660_M_ADCMIX_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC1 Switch", RT5660_AD_DA_MIXER,
+                        RT5660_M_DAC1_R_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_sto_dac_l_mix[] = {
+        SOC_DAPM_SINGLE("DAC L1 Switch", RT5660_STO_DAC_MIXER,
+                        RT5660_M_DAC_L1_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC R1 Switch", RT5660_STO_DAC_MIXER,
+                        RT5660_M_DAC_R1_STO_L_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_sto_dac_r_mix[] = {
+        SOC_DAPM_SINGLE("DAC R1 Switch", RT5660_STO_DAC_MIXER,
+                        RT5660_M_DAC_R1_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC L1 Switch", RT5660_STO_DAC_MIXER,
+                        RT5660_M_DAC_L1_STO_R_SFT, 1, 1),
+};
+
+/* Analog Input Mixer */
+static const struct snd_kcontrol_new rt5660_rec_l_mix[] = {
+        SOC_DAPM_SINGLE("BST3 Switch", RT5660_REC_L2_MIXER,
+                        RT5660_M_BST3_RM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST2 Switch", RT5660_REC_L2_MIXER,
+                        RT5660_M_BST2_RM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST1 Switch", RT5660_REC_L2_MIXER,
+                        RT5660_M_BST1_RM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("OUT MIXL Switch", RT5660_REC_L2_MIXER,
+                        RT5660_M_OM_L_RM_L_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_rec_r_mix[] = {
+        SOC_DAPM_SINGLE("BST3 Switch", RT5660_REC_R2_MIXER,
+                        RT5660_M_BST3_RM_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST2 Switch", RT5660_REC_R2_MIXER,
+                        RT5660_M_BST2_RM_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST1 Switch", RT5660_REC_R2_MIXER,
+                        RT5660_M_BST1_RM_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("OUT MIXR Switch", RT5660_REC_R2_MIXER,
+                        RT5660_M_OM_R_RM_R_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_spk_mix[] = {
+        SOC_DAPM_SINGLE("BST3 Switch", RT5660_SPK_MIXER,
+                        RT5660_M_BST3_SM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST1 Switch", RT5660_SPK_MIXER,
+                        RT5660_M_BST1_SM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DACL Switch", RT5660_SPK_MIXER,
+                        RT5660_M_DACL_SM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DACR Switch", RT5660_SPK_MIXER,
+                        RT5660_M_DACR_SM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("OUTMIXL Switch", RT5660_SPK_MIXER,
+                        RT5660_M_OM_L_SM_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_out_l_mix[] = {
+        SOC_DAPM_SINGLE("BST3 Switch", RT5660_OUT_L1_MIXER,
+                        RT5660_M_BST3_OM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST2 Switch", RT5660_OUT_L1_MIXER,
+                        RT5660_M_BST2_OM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST1 Switch", RT5660_OUT_L1_MIXER,
+                        RT5660_M_BST1_OM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("RECMIXL Switch", RT5660_OUT_L1_MIXER,
+                        RT5660_M_RM_L_OM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DACR Switch", RT5660_OUT_L1_MIXER,
+                        RT5660_M_DAC_R_OM_L_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DACL Switch", RT5660_OUT_L1_MIXER,
+                        RT5660_M_DAC_L_OM_L_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_out_r_mix[] = {
+        SOC_DAPM_SINGLE("BST2 Switch", RT5660_OUT_R1_MIXER,
+                        RT5660_M_BST2_OM_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST1 Switch", RT5660_OUT_R1_MIXER,
+                        RT5660_M_BST1_OM_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("RECMIXR Switch", RT5660_OUT_R1_MIXER,
+                        RT5660_M_RM_R_OM_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DACR Switch", RT5660_OUT_R1_MIXER,
+                        RT5660_M_DAC_R_OM_R_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DACL Switch", RT5660_OUT_R1_MIXER,
+                        RT5660_M_DAC_L_OM_R_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_spo_mix[] = {
+        SOC_DAPM_SINGLE("DACR Switch", RT5660_SPO_MIXER,
+                        RT5660_M_DAC_R_SPM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("DACL Switch", RT5660_SPO_MIXER,
+                        RT5660_M_DAC_L_SPM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("SPKVOL Switch", RT5660_SPO_MIXER,
+                        RT5660_M_SV_SPM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("BST1 Switch", RT5660_SPO_MIXER,
+                        RT5660_M_BST1_SPM_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5660_lout_mix[] = {
+        SOC_DAPM_SINGLE("DAC Switch", RT5660_LOUT_MIXER,
+                        RT5660_M_DAC1_LM_SFT, 1, 1),
+        SOC_DAPM_SINGLE("OUTMIX Switch", RT5660_LOUT_MIXER,
+                        RT5660_M_LOVOL_LM_SFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new spk_vol_control =
+        SOC_DAPM_SINGLE("Switch", RT5660_SPK_VOL,
+                RT5660_VOL_L_SFT, 1, 1);
+
+static const struct snd_kcontrol_new lout_l_vol_control =
+        SOC_DAPM_SINGLE("Switch", RT5660_LOUT_VOL,
+                RT5660_VOL_L_SFT, 1, 1);
+
+static const struct snd_kcontrol_new lout_r_vol_control =
+        SOC_DAPM_SINGLE("Switch", RT5660_LOUT_VOL,
+                RT5660_VOL_R_SFT, 1, 1);
+
+/* Interface data select */
+static const char * const rt5660_data_select[] = {
+        "L/R", "R/L", "L/L", "R/R"
+};
+
+static const SOC_ENUM_SINGLE_DECL(rt5660_if1_dac_enum,
+        RT5660_DIG_INF1_DATA, RT5660_IF1_DAC_IN_SFT, rt5660_data_select);
+
+static const SOC_ENUM_SINGLE_DECL(rt5660_if1_adc_enum,
+        RT5660_DIG_INF1_DATA, RT5660_IF1_ADC_IN_SFT, rt5660_data_select);
+
+static const struct snd_kcontrol_new rt5660_if1_dac_swap_mux =
+        SOC_DAPM_ENUM("IF1 DAC Swap Source", rt5660_if1_dac_enum);
+
+static const struct snd_kcontrol_new rt5660_if1_adc_swap_mux =
+        SOC_DAPM_ENUM("IF1 ADC Swap Source", rt5660_if1_adc_enum);
+
+static int rt5660_lout_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                snd_soc_update_bits(codec, RT5660_LOUT_AMP_CTRL,
+                        RT5660_LOUT_CO_MASK | RT5660_LOUT_CB_MASK,
+                        RT5660_LOUT_CO_EN | RT5660_LOUT_CB_PU);
+                break;
+
+        case SND_SOC_DAPM_PRE_PMD:
+                snd_soc_update_bits(codec, RT5660_LOUT_AMP_CTRL,
+                        RT5660_LOUT_CO_MASK | RT5660_LOUT_CB_MASK,
+                        RT5660_LOUT_CO_DIS | RT5660_LOUT_CB_PD);
+                break;
+
+        default:
+                return 0;
+        }
+
+        return 0;
+}
+
+static const struct snd_soc_dapm_widget rt5660_dapm_widgets[] = {
+        SND_SOC_DAPM_SUPPLY("LDO2", RT5660_PWR_ANLG1,
+                RT5660_PWR_LDO2_BIT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("PLL1", RT5660_PWR_ANLG2,
+                RT5660_PWR_PLL_BIT, 0, NULL, 0),
+
+        /* MICBIAS */
+        SND_SOC_DAPM_SUPPLY("MICBIAS1", RT5660_PWR_ANLG2,
+                        RT5660_PWR_MB1_BIT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("MICBIAS2", RT5660_PWR_ANLG2,
+                        RT5660_PWR_MB2_BIT, 0, NULL, 0),
+
+        /* Input Side */
+        /* Input Lines */
+        SND_SOC_DAPM_INPUT("DMIC L1"),
+        SND_SOC_DAPM_INPUT("DMIC R1"),
+
+        SND_SOC_DAPM_INPUT("IN1P"),
+        SND_SOC_DAPM_INPUT("IN1N"),
+        SND_SOC_DAPM_INPUT("IN2P"),
+        SND_SOC_DAPM_INPUT("IN3P"),
+        SND_SOC_DAPM_INPUT("IN3N"),
+
+        SND_SOC_DAPM_SUPPLY("DMIC CLK", SND_SOC_NOPM, 0, 0,
+                rt5660_set_dmic_clk, SND_SOC_DAPM_PRE_PMU),
+        SND_SOC_DAPM_SUPPLY("DMIC Power", RT5660_DMIC_CTRL1,
+                RT5660_DMIC_1_EN_SFT, 0, NULL, 0),
+
+        /* Boost */
+        SND_SOC_DAPM_PGA("BST1", RT5660_PWR_ANLG2, RT5660_PWR_BST1_BIT, 0,
+                NULL, 0),
+        SND_SOC_DAPM_PGA("BST2", RT5660_PWR_ANLG2, RT5660_PWR_BST2_BIT, 0,
+                NULL, 0),
+        SND_SOC_DAPM_PGA("BST3", RT5660_PWR_ANLG2, RT5660_PWR_BST3_BIT, 0,
+                NULL, 0),
+
+        /* REC Mixer */
+        SND_SOC_DAPM_MIXER("RECMIXL", RT5660_PWR_MIXER, RT5660_PWR_RM_L_BIT,
+                        0, rt5660_rec_l_mix, ARRAY_SIZE(rt5660_rec_l_mix)),
+        SND_SOC_DAPM_MIXER("RECMIXR", RT5660_PWR_MIXER, RT5660_PWR_RM_R_BIT,
+                        0, rt5660_rec_r_mix, ARRAY_SIZE(rt5660_rec_r_mix)),
+
+        /* ADCs */
+        SND_SOC_DAPM_ADC("ADC L", NULL, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_ADC("ADC R", NULL, SND_SOC_NOPM, 0, 0),
+
+        SND_SOC_DAPM_SUPPLY("ADC L power", RT5660_PWR_DIG1,
+                        RT5660_PWR_ADC_L_BIT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ADC R power", RT5660_PWR_DIG1,
+                        RT5660_PWR_ADC_R_BIT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ADC clock", RT5660_PR_BASE + RT5660_CHOP_DAC_ADC,
+                        12, 0, NULL, 0),
+
+        /* ADC Mixer */
+        SND_SOC_DAPM_SUPPLY("adc stereo1 filter", RT5660_PWR_DIG2,
+                RT5660_PWR_ADC_S1F_BIT, 0, NULL, 0),
+        SND_SOC_DAPM_MIXER("Sto1 ADC MIXL", SND_SOC_NOPM, 0, 0,
+                rt5660_sto1_adc_l_mix, ARRAY_SIZE(rt5660_sto1_adc_l_mix)),
+        SND_SOC_DAPM_MIXER("Sto1 ADC MIXR", SND_SOC_NOPM, 0, 0,
+                rt5660_sto1_adc_r_mix, ARRAY_SIZE(rt5660_sto1_adc_r_mix)),
+
+        /* ADC */
+        SND_SOC_DAPM_ADC("Stereo1 ADC MIXL", NULL, RT5660_STO1_ADC_DIG_VOL,
+                RT5660_L_MUTE_SFT, 1),
+        SND_SOC_DAPM_ADC("Stereo1 ADC MIXR", NULL, RT5660_STO1_ADC_DIG_VOL,
+                RT5660_R_MUTE_SFT, 1),
+
+        /* Digital Interface */
+        SND_SOC_DAPM_SUPPLY("I2S1", RT5660_PWR_DIG1, RT5660_PWR_I2S1_BIT, 0,
+                NULL, 0),
+        SND_SOC_DAPM_PGA("IF1 DAC", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("IF1 DAC L", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("IF1 DAC R", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_MUX("IF1 DAC Swap Mux", SND_SOC_NOPM, 0, 0,
+                        &rt5660_if1_dac_swap_mux),
+        SND_SOC_DAPM_PGA("IF1 ADC", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_MUX("IF1 ADC Swap Mux", SND_SOC_NOPM, 0, 0,
+                        &rt5660_if1_adc_swap_mux),
+
+        /* Audio Interface */
+        SND_SOC_DAPM_AIF_IN("AIF1RX", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("AIF1TX", "AIF1 Capture", 0, SND_SOC_NOPM, 0, 0),
+
+        /* Output Side */
+        /* DAC mixer before sound effect  */
+        SND_SOC_DAPM_MIXER("DAC1 MIXL", SND_SOC_NOPM, 0, 0, rt5660_dac_l_mix,
+                ARRAY_SIZE(rt5660_dac_l_mix)),
+        SND_SOC_DAPM_MIXER("DAC1 MIXR", SND_SOC_NOPM, 0, 0, rt5660_dac_r_mix,
+                ARRAY_SIZE(rt5660_dac_r_mix)),
+
+        /* DAC Mixer */
+        SND_SOC_DAPM_SUPPLY("dac stereo1 filter", RT5660_PWR_DIG2,
+                RT5660_PWR_DAC_S1F_BIT, 0, NULL, 0),
+        SND_SOC_DAPM_MIXER("Stereo DAC MIXL", SND_SOC_NOPM, 0, 0,
+                rt5660_sto_dac_l_mix, ARRAY_SIZE(rt5660_sto_dac_l_mix)),
+        SND_SOC_DAPM_MIXER("Stereo DAC MIXR", SND_SOC_NOPM, 0, 0,
+                rt5660_sto_dac_r_mix, ARRAY_SIZE(rt5660_sto_dac_r_mix)),
+
+        /* DACs */
+        SND_SOC_DAPM_DAC("DAC L1", NULL, RT5660_PWR_DIG1,
+                        RT5660_PWR_DAC_L1_BIT, 0),
+        SND_SOC_DAPM_DAC("DAC R1", NULL, RT5660_PWR_DIG1,
+                        RT5660_PWR_DAC_R1_BIT, 0),
+
+        /* OUT Mixer */
+        SND_SOC_DAPM_MIXER("SPK MIX", RT5660_PWR_MIXER, RT5660_PWR_SM_BIT,
+                0, rt5660_spk_mix, ARRAY_SIZE(rt5660_spk_mix)),
+        SND_SOC_DAPM_MIXER("OUT MIXL", RT5660_PWR_MIXER, RT5660_PWR_OM_L_BIT,
+                0, rt5660_out_l_mix, ARRAY_SIZE(rt5660_out_l_mix)),
+        SND_SOC_DAPM_MIXER("OUT MIXR", RT5660_PWR_MIXER, RT5660_PWR_OM_R_BIT,
+                0, rt5660_out_r_mix, ARRAY_SIZE(rt5660_out_r_mix)),
+
+        /* Output Volume */
+        SND_SOC_DAPM_SWITCH("SPKVOL", RT5660_PWR_VOL,
+                RT5660_PWR_SV_BIT, 0, &spk_vol_control),
+        SND_SOC_DAPM_PGA("DAC 1", SND_SOC_NOPM,
+                0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("LOUTVOL", SND_SOC_NOPM,
+                0, 0, NULL, 0),
+        SND_SOC_DAPM_SWITCH("LOUTVOL L", SND_SOC_NOPM,
+                RT5660_PWR_LV_L_BIT, 0, &lout_l_vol_control),
+        SND_SOC_DAPM_SWITCH("LOUTVOL R", SND_SOC_NOPM,
+                RT5660_PWR_LV_R_BIT, 0, &lout_r_vol_control),
+
+        /* HPO/LOUT/Mono Mixer */
+        SND_SOC_DAPM_MIXER("SPO MIX", SND_SOC_NOPM, 0,
+                0, rt5660_spo_mix, ARRAY_SIZE(rt5660_spo_mix)),
+        SND_SOC_DAPM_MIXER("LOUT MIX", SND_SOC_NOPM, 0, 0,
+                rt5660_lout_mix, ARRAY_SIZE(rt5660_lout_mix)),
+        SND_SOC_DAPM_SUPPLY("VREF HP", RT5660_GEN_CTRL1,
+                RT5660_PWR_VREF_HP_SFT, 0, NULL, 0),
+        SND_SOC_DAPM_PGA_S("LOUT amp", 1, RT5660_PWR_ANLG1,
+                RT5660_PWR_HA_BIT, 0, rt5660_lout_event,
+                SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU),
+        SND_SOC_DAPM_PGA_S("SPK amp", 1, RT5660_PWR_DIG1,
+                RT5660_PWR_CLS_D_BIT, 0, NULL, 0),
+
+        /* Output Lines */
+        SND_SOC_DAPM_OUTPUT("LOUTL"),
+        SND_SOC_DAPM_OUTPUT("LOUTR"),
+        SND_SOC_DAPM_OUTPUT("SPO"),
+};
+
+static const struct snd_soc_dapm_route rt5660_dapm_routes[] = {
+        { "MICBIAS1", NULL, "LDO2" },
+        { "MICBIAS2", NULL, "LDO2" },
+
+        { "BST1", NULL, "IN1P" },
+        { "BST1", NULL, "IN1N" },
+        { "BST2", NULL, "IN2P" },
+        { "BST3", NULL, "IN3P" },
+        { "BST3", NULL, "IN3N" },
+
+        { "RECMIXL", "BST3 Switch", "BST3" },
+        { "RECMIXL", "BST2 Switch", "BST2" },
+        { "RECMIXL", "BST1 Switch", "BST1" },
+        { "RECMIXL", "OUT MIXL Switch", "OUT MIXL" },
+
+        { "RECMIXR", "BST3 Switch", "BST3" },
+        { "RECMIXR", "BST2 Switch", "BST2" },
+        { "RECMIXR", "BST1 Switch", "BST1" },
+        { "RECMIXR", "OUT MIXR Switch", "OUT MIXR" },
+
+        { "ADC L", NULL, "RECMIXL" },
+        { "ADC L", NULL, "ADC L power" },
+        { "ADC L", NULL, "ADC clock" },
+        { "ADC R", NULL, "RECMIXR" },
+        { "ADC R", NULL, "ADC R power" },
+        { "ADC R", NULL, "ADC clock" },
+
+        {"DMIC L1", NULL, "DMIC CLK"},
+        {"DMIC L1", NULL, "DMIC Power"},
+        {"DMIC R1", NULL, "DMIC CLK"},
+        {"DMIC R1", NULL, "DMIC Power"},
+
+        { "Sto1 ADC MIXL", "ADC1 Switch", "ADC L" },
+        { "Sto1 ADC MIXL", "ADC2 Switch", "DMIC L1" },
+        { "Sto1 ADC MIXR", "ADC1 Switch", "ADC R" },
+        { "Sto1 ADC MIXR", "ADC2 Switch", "DMIC R1" },
+
+        { "Stereo1 ADC MIXL", NULL, "Sto1 ADC MIXL" },
+        { "Stereo1 ADC MIXL", NULL, "adc stereo1 filter" },
+        { "adc stereo1 filter", NULL, "PLL1", rt5660_is_sys_clk_from_pll },
+
+        { "Stereo1 ADC MIXR", NULL, "Sto1 ADC MIXR" },
+        { "Stereo1 ADC MIXR", NULL, "adc stereo1 filter" },
+        { "adc stereo1 filter", NULL, "PLL1", rt5660_is_sys_clk_from_pll },
+
+        { "IF1 ADC", NULL, "Stereo1 ADC MIXL" },
+        { "IF1 ADC", NULL, "Stereo1 ADC MIXR" },
+        { "IF1 ADC", NULL, "I2S1" },
+
+        { "IF1 ADC Swap Mux", "L/R", "IF1 ADC" },
+        { "IF1 ADC Swap Mux", "R/L", "IF1 ADC" },
+        { "IF1 ADC Swap Mux", "L/L", "IF1 ADC" },
+        { "IF1 ADC Swap Mux", "R/R", "IF1 ADC" },
+        { "AIF1TX", NULL, "IF1 ADC Swap Mux" },
+
+        { "IF1 DAC", NULL, "AIF1RX" },
+        { "IF1 DAC", NULL, "I2S1" },
+
+        { "IF1 DAC Swap Mux", "L/R", "IF1 DAC" },
+        { "IF1 DAC Swap Mux", "R/L", "IF1 DAC" },
+        { "IF1 DAC Swap Mux", "L/L", "IF1 DAC" },
+        { "IF1 DAC Swap Mux", "R/R", "IF1 DAC" },
+
+        { "IF1 DAC L", NULL, "IF1 DAC Swap Mux" },
+        { "IF1 DAC R", NULL, "IF1 DAC Swap Mux" },
+
+        { "DAC1 MIXL", "Stereo ADC Switch", "Stereo1 ADC MIXL" },
+        { "DAC1 MIXL", "DAC1 Switch", "IF1 DAC L" },
+        { "DAC1 MIXR", "Stereo ADC Switch", "Stereo1 ADC MIXR" },
+        { "DAC1 MIXR", "DAC1 Switch", "IF1 DAC R" },
+
+        { "Stereo DAC MIXL", "DAC L1 Switch", "DAC1 MIXL" },
+        { "Stereo DAC MIXL", "DAC R1 Switch", "DAC1 MIXR" },
+        { "Stereo DAC MIXL", NULL, "dac stereo1 filter" },
+        { "dac stereo1 filter", NULL, "PLL1", rt5660_is_sys_clk_from_pll },
+        { "Stereo DAC MIXR", "DAC R1 Switch", "DAC1 MIXR" },
+        { "Stereo DAC MIXR", "DAC L1 Switch", "DAC1 MIXL" },
+        { "Stereo DAC MIXR", NULL, "dac stereo1 filter" },
+        { "dac stereo1 filter", NULL, "PLL1", rt5660_is_sys_clk_from_pll },
+
+        { "DAC L1", NULL, "Stereo DAC MIXL" },
+        { "DAC R1", NULL, "Stereo DAC MIXR" },
+
+        { "SPK MIX", "BST3 Switch", "BST3" },
+        { "SPK MIX", "BST1 Switch", "BST1" },
+        { "SPK MIX", "DACL Switch", "DAC L1" },
+        { "SPK MIX", "DACR Switch", "DAC R1" },
+        { "SPK MIX", "OUTMIXL Switch", "OUT MIXL" },
+
+        { "OUT MIXL", "BST3 Switch", "BST3" },
+        { "OUT MIXL", "BST2 Switch", "BST2" },
+        { "OUT MIXL", "BST1 Switch", "BST1" },
+        { "OUT MIXL", "RECMIXL Switch", "RECMIXL" },
+        { "OUT MIXL", "DACR Switch", "DAC R1" },
+        { "OUT MIXL", "DACL Switch", "DAC L1" },
+
+        { "OUT MIXR", "BST2 Switch", "BST2" },
+        { "OUT MIXR", "BST1 Switch", "BST1" },
+        { "OUT MIXR", "RECMIXR Switch", "RECMIXR" },
+        { "OUT MIXR", "DACR Switch", "DAC R1" },
+        { "OUT MIXR", "DACL Switch", "DAC L1" },
+
+        { "SPO MIX", "DACR Switch", "DAC R1" },
+        { "SPO MIX", "DACL Switch", "DAC L1" },
+        { "SPO MIX", "SPKVOL Switch", "SPKVOL" },
+        { "SPO MIX", "BST1 Switch", "BST1" },
+
+        { "SPKVOL", "Switch", "SPK MIX" },
+        { "LOUTVOL L", "Switch", "OUT MIXL" },
+        { "LOUTVOL R", "Switch", "OUT MIXR" },
+
+        { "LOUTVOL", NULL, "LOUTVOL L" },
+        { "LOUTVOL", NULL, "LOUTVOL R" },
+
+        { "DAC 1", NULL, "DAC L1" },
+        { "DAC 1", NULL, "DAC R1" },
+
+        { "LOUT MIX", "DAC Switch", "DAC 1" },
+        { "LOUT MIX", "OUTMIX Switch", "LOUTVOL" },
+
+        { "LOUT amp", NULL, "LOUT MIX" },
+        { "LOUT amp", NULL, "VREF HP" },
+        { "LOUTL", NULL, "LOUT amp" },
+        { "LOUTR", NULL, "LOUT amp" },
+
+        { "SPK amp", NULL, "SPO MIX" },
+        { "SPO", NULL, "SPK amp" },
+};
+
+static int rt5660_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+        unsigned int val_len = 0, val_clk, mask_clk;
+        int pre_div, bclk_ms, frame_size;
+
+        rt5660->lrck[dai->id] = params_rate(params);
+        pre_div = rl6231_get_clk_info(rt5660->sysclk, rt5660->lrck[dai->id]);
+        if (pre_div < 0) {
+                dev_err(codec->dev, "Unsupported clock setting %d for DAI %d\n",
+                        rt5660->lrck[dai->id], dai->id);
+                return -EINVAL;
+        }
+
+        frame_size = snd_soc_params_to_frame_size(params);
+        if (frame_size < 0) {
+                dev_err(codec->dev, "Unsupported frame size: %d\n", frame_size);
+                return frame_size;
+        }
+
+        if (frame_size > 32)
+                bclk_ms = 1;
+        else
+                bclk_ms = 0;
+
+        rt5660->bclk[dai->id] = rt5660->lrck[dai->id] * (32 << bclk_ms);
+
+        dev_dbg(dai->dev, "bclk is %dHz and lrck is %dHz\n",
+                rt5660->bclk[dai->id], rt5660->lrck[dai->id]);
+        dev_dbg(dai->dev, "bclk_ms is %d and pre_div is %d for iis %d\n",
+                                bclk_ms, pre_div, dai->id);
+
+        switch (params_width(params)) {
+        case 16:
+                break;
+        case 20:
+                val_len |= RT5660_I2S_DL_20;
+                break;
+        case 24:
+                val_len |= RT5660_I2S_DL_24;
+                break;
+        case 8:
+                val_len |= RT5660_I2S_DL_8;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (dai->id) {
+        case RT5660_AIF1:
+                mask_clk = RT5660_I2S_BCLK_MS1_MASK | RT5660_I2S_PD1_MASK;
+                val_clk = bclk_ms << RT5660_I2S_BCLK_MS1_SFT |
+                        pre_div << RT5660_I2S_PD1_SFT;
+                snd_soc_update_bits(codec, RT5660_I2S1_SDP, RT5660_I2S_DL_MASK,
+                        val_len);
+                snd_soc_update_bits(codec, RT5660_ADDA_CLK1, mask_clk, val_clk);
+                break;
+
+        default:
+                dev_err(codec->dev, "Invalid dai->id: %d\n", dai->id);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int rt5660_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+        unsigned int reg_val = 0;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                rt5660->master[dai->id] = 1;
+                break;
+
+        case SND_SOC_DAIFMT_CBS_CFS:
+                reg_val |= RT5660_I2S_MS_S;
+                rt5660->master[dai->id] = 0;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+
+        case SND_SOC_DAIFMT_IB_NF:
+                reg_val |= RT5660_I2S_BP_INV;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                break;
+
+        case SND_SOC_DAIFMT_LEFT_J:
+                reg_val |= RT5660_I2S_DF_LEFT;
+                break;
+
+        case SND_SOC_DAIFMT_DSP_A:
+                reg_val |= RT5660_I2S_DF_PCM_A;
+                break;
+
+        case SND_SOC_DAIFMT_DSP_B:
+                reg_val  |= RT5660_I2S_DF_PCM_B;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        switch (dai->id) {
+        case RT5660_AIF1:
+                snd_soc_update_bits(codec, RT5660_I2S1_SDP,
+                        RT5660_I2S_MS_MASK | RT5660_I2S_BP_MASK |
+                        RT5660_I2S_DF_MASK, reg_val);
+                break;
+
+        default:
+                dev_err(codec->dev, "Invalid dai->id: %d\n", dai->id);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int rt5660_set_dai_sysclk(struct snd_soc_dai *dai,
+                int clk_id, unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+        unsigned int reg_val = 0;
+
+        if (freq == rt5660->sysclk && clk_id == rt5660->sysclk_src)
+                return 0;
+
+        switch (clk_id) {
+        case RT5660_SCLK_S_MCLK:
+                reg_val |= RT5660_SCLK_SRC_MCLK;
+                break;
+
+        case RT5660_SCLK_S_PLL1:
+                reg_val |= RT5660_SCLK_SRC_PLL1;
+                break;
+
+        case RT5660_SCLK_S_RCCLK:
+                reg_val |= RT5660_SCLK_SRC_RCCLK;
+                break;
+
+        default:
+                dev_err(codec->dev, "Invalid clock id (%d)\n", clk_id);
+                return -EINVAL;
+        }
+
+        snd_soc_update_bits(codec, RT5660_GLB_CLK, RT5660_SCLK_SRC_MASK,
+                reg_val);
+
+        rt5660->sysclk = freq;
+        rt5660->sysclk_src = clk_id;
+
+        dev_dbg(dai->dev, "Sysclk is %dHz and clock id is %d\n", freq, clk_id);
+
+        return 0;
+}
+
+static int rt5660_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int source,
+                        unsigned int freq_in, unsigned int freq_out)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+        struct rl6231_pll_code pll_code;
+        int ret;
+
+        if (source == rt5660->pll_src && freq_in == rt5660->pll_in &&
+                freq_out == rt5660->pll_out)
+                return 0;
+
+        if (!freq_in || !freq_out) {
+                dev_dbg(codec->dev, "PLL disabled\n");
+
+                rt5660->pll_in = 0;
+                rt5660->pll_out = 0;
+                snd_soc_update_bits(codec, RT5660_GLB_CLK,
+                        RT5660_SCLK_SRC_MASK, RT5660_SCLK_SRC_MCLK);
+                return 0;
+        }
+
+        switch (source) {
+        case RT5660_PLL1_S_MCLK:
+                snd_soc_update_bits(codec, RT5660_GLB_CLK,
+                        RT5660_PLL1_SRC_MASK, RT5660_PLL1_SRC_MCLK);
+                break;
+
+        case RT5660_PLL1_S_BCLK:
+                snd_soc_update_bits(codec, RT5660_GLB_CLK,
+                        RT5660_PLL1_SRC_MASK, RT5660_PLL1_SRC_BCLK1);
+                break;
+
+        default:
+                dev_err(codec->dev, "Unknown PLL source %d\n", source);
+                return -EINVAL;
+        }
+
+        ret = rl6231_pll_calc(freq_in, freq_out, &pll_code);
+        if (ret < 0) {
+                dev_err(codec->dev, "Unsupport input clock %d\n", freq_in);
+                return ret;
+        }
+
+        dev_dbg(codec->dev, "bypass=%d m=%d n=%d k=%d\n",
+                pll_code.m_bp, (pll_code.m_bp ? 0 : pll_code.m_code),
+                pll_code.n_code, pll_code.k_code);
+
+        snd_soc_write(codec, RT5660_PLL_CTRL1,
+                pll_code.n_code << RT5660_PLL_N_SFT | pll_code.k_code);
+        snd_soc_write(codec, RT5660_PLL_CTRL2,
+                (pll_code.m_bp ? 0 : pll_code.m_code) << RT5660_PLL_M_SFT |
+                pll_code.m_bp << RT5660_PLL_M_BP_SFT);
+
+        rt5660->pll_in = freq_in;
+        rt5660->pll_out = freq_out;
+        rt5660->pll_src = source;
+
+        return 0;
+}
+
+static int rt5660_set_bias_level(struct snd_soc_codec *codec,
+                        enum snd_soc_bias_level level)
+{
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+        int ret;
+
+        switch (level) {
+        case SND_SOC_BIAS_ON:
+                break;
+
+        case SND_SOC_BIAS_PREPARE:
+                snd_soc_update_bits(codec, RT5660_GEN_CTRL1,
+                        RT5660_DIG_GATE_CTRL, RT5660_DIG_GATE_CTRL);
+
+                if (IS_ERR(rt5660->mclk))
+                        break;
+
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_ON) {
+                        clk_disable_unprepare(rt5660->mclk);
+                } else {
+                        ret = clk_prepare_enable(rt5660->mclk);
+                        if (ret)
+                                return ret;
+                }
+                break;
+
+        case SND_SOC_BIAS_STANDBY:
+                if (snd_soc_codec_get_bias_level(codec) == SND_SOC_BIAS_OFF) {
+                        snd_soc_update_bits(codec, RT5660_PWR_ANLG1,
+                                RT5660_PWR_VREF1 | RT5660_PWR_MB |
+                                RT5660_PWR_BG | RT5660_PWR_VREF2,
+                                RT5660_PWR_VREF1 | RT5660_PWR_MB |
+                                RT5660_PWR_BG | RT5660_PWR_VREF2);
+                        usleep_range(10000, 15000);
+                        snd_soc_update_bits(codec, RT5660_PWR_ANLG1,
+                                RT5660_PWR_FV1 | RT5660_PWR_FV2,
+                                RT5660_PWR_FV1 | RT5660_PWR_FV2);
+                }
+                break;
+
+        case SND_SOC_BIAS_OFF:
+                snd_soc_update_bits(codec, RT5660_GEN_CTRL1,
+                        RT5660_DIG_GATE_CTRL, 0);
+                break;
+
+        default:
+                break;
+        }
+
+        return 0;
+}
+
+static int rt5660_probe(struct snd_soc_codec *codec)
+{
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+
+        rt5660->codec = codec;
+
+        return 0;
+}
+
+static int rt5660_remove(struct snd_soc_codec *codec)
+{
+        return snd_soc_write(codec, RT5660_RESET, 0);
+}
+
+#ifdef CONFIG_PM
+static int rt5660_suspend(struct snd_soc_codec *codec)
+{
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+
+        regcache_cache_only(rt5660->regmap, true);
+        regcache_mark_dirty(rt5660->regmap);
+
+        return 0;
+}
+
+static int rt5660_resume(struct snd_soc_codec *codec)
+{
+        struct rt5660_priv *rt5660 = snd_soc_codec_get_drvdata(codec);
+
+        if (rt5660->pdata.poweroff_codec_in_suspend)
+                usleep_range(350000, 400000);
+
+        regcache_cache_only(rt5660->regmap, false);
+        regcache_sync(rt5660->regmap);
+
+        return 0;
+}
+#else
+#define rt5660_suspend NULL
+#define rt5660_resume NULL
+#endif
+
+#define RT5660_STEREO_RATES SNDRV_PCM_RATE_8000_192000
+#define RT5660_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \
+                        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S8)
+
+static const struct snd_soc_dai_ops rt5660_aif_dai_ops = {
+        .hw_params = rt5660_hw_params,
+        .set_fmt = rt5660_set_dai_fmt,
+        .set_sysclk = rt5660_set_dai_sysclk,
+        .set_pll = rt5660_set_dai_pll,
+};
+
+static struct snd_soc_dai_driver rt5660_dai[] = {
+        {
+                .name = "rt5660-aif1",
+                .id = RT5660_AIF1,
+                .playback = {
+                        .stream_name = "AIF1 Playback",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = RT5660_STEREO_RATES,
+                        .formats = RT5660_FORMATS,
+                },
+                .capture = {
+                        .stream_name = "AIF1 Capture",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = RT5660_STEREO_RATES,
+                        .formats = RT5660_FORMATS,
+                },
+                .ops = &rt5660_aif_dai_ops,
+        },
+};
+
+static struct snd_soc_codec_driver soc_codec_dev_rt5660 = {
+        .probe = rt5660_probe,
+        .remove = rt5660_remove,
+        .suspend = rt5660_suspend,
+        .resume = rt5660_resume,
+        .set_bias_level = rt5660_set_bias_level,
+        .idle_bias_off = true,
+        .component_driver = {
+                .controls               = rt5660_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5660_snd_controls),
+                .dapm_widgets           = rt5660_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5660_dapm_widgets),
+                .dapm_routes            = rt5660_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5660_dapm_routes),
+        },
+};
+
+static const struct regmap_config rt5660_regmap = {
+        .reg_bits = 8,
+        .val_bits = 16,
+        .use_single_rw = true,
+
+        .max_register = RT5660_VENDOR_ID2 + 1 + (ARRAY_SIZE(rt5660_ranges) *
+                                               RT5660_PR_SPACING),
+        .volatile_reg = rt5660_volatile_register,
+        .readable_reg = rt5660_readable_register,
+
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = rt5660_reg,
+        .num_reg_defaults = ARRAY_SIZE(rt5660_reg),
+        .ranges = rt5660_ranges,
+        .num_ranges = ARRAY_SIZE(rt5660_ranges),
+};
+
+static const struct i2c_device_id rt5660_i2c_id[] = {
+        { "rt5660", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, rt5660_i2c_id);
+
+static const struct of_device_id rt5660_of_match[] = {
+        { .compatible = "realtek,rt5660", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, rt5660_of_match);
+
+static const struct acpi_device_id rt5660_acpi_match[] = {
+        { "10EC5660", 0 },
+        { },
+};
+MODULE_DEVICE_TABLE(acpi, rt5660_acpi_match);
+
+static int rt5660_parse_dt(struct rt5660_priv *rt5660, struct device *dev)
+{
+        rt5660->pdata.in1_diff = device_property_read_bool(dev,
+                                        "realtek,in1-differential");
+        rt5660->pdata.in3_diff = device_property_read_bool(dev,
+                                        "realtek,in3-differential");
+        rt5660->pdata.poweroff_codec_in_suspend = device_property_read_bool(dev,
+                                        "realtek,poweroff-in-suspend");
+        device_property_read_u32(dev, "realtek,dmic1-data-pin",
+                &rt5660->pdata.dmic1_data_pin);
+
+        return 0;
+}
+
+static int rt5660_i2c_probe(struct i2c_client *i2c,
+                    const struct i2c_device_id *id)
+{
+        struct rt5660_platform_data *pdata = dev_get_platdata(&i2c->dev);
+        struct rt5660_priv *rt5660;
+        int ret;
+        unsigned int val;
+
+        rt5660 = devm_kzalloc(&i2c->dev, sizeof(struct rt5660_priv),
+                GFP_KERNEL);
+
+        if (rt5660 == NULL)
+                return -ENOMEM;
+
+        /* Check if MCLK provided */
+        rt5660->mclk = devm_clk_get(&i2c->dev, "mclk");
+        if (PTR_ERR(rt5660->mclk) == -EPROBE_DEFER)
+                return -EPROBE_DEFER;
+
+        i2c_set_clientdata(i2c, rt5660);
+
+        if (pdata)
+                rt5660->pdata = *pdata;
+        else if (i2c->dev.of_node)
+                rt5660_parse_dt(rt5660, &i2c->dev);
+
+        rt5660->regmap = devm_regmap_init_i2c(i2c, &rt5660_regmap);
+        if (IS_ERR(rt5660->regmap)) {
+                ret = PTR_ERR(rt5660->regmap);
+                dev_err(&i2c->dev, "Failed to allocate register map: %d\n",
+                        ret);
+                return ret;
+        }
+
+        regmap_read(rt5660->regmap, RT5660_VENDOR_ID2, &val);
+        if (val != RT5660_DEVICE_ID) {
+                dev_err(&i2c->dev,
+                        "Device with ID register %#x is not rt5660\n", val);
+                return -ENODEV;
+        }
+
+        regmap_write(rt5660->regmap, RT5660_RESET, 0);
+
+        ret = regmap_register_patch(rt5660->regmap, rt5660_patch,
+                                    ARRAY_SIZE(rt5660_patch));
+        if (ret != 0)
+                dev_warn(&i2c->dev, "Failed to apply regmap patch: %d\n", ret);
+
+        if (rt5660->pdata.dmic1_data_pin) {
+                regmap_update_bits(rt5660->regmap, RT5660_GPIO_CTRL1,
+                        RT5660_GP1_PIN_MASK, RT5660_GP1_PIN_DMIC1_SCL);
+
+                if (rt5660->pdata.dmic1_data_pin == RT5660_DMIC1_DATA_GPIO2)
+                        regmap_update_bits(rt5660->regmap, RT5660_DMIC_CTRL1,
+                                RT5660_SEL_DMIC_DATA_MASK,
+                                RT5660_SEL_DMIC_DATA_GPIO2);
+                else if (rt5660->pdata.dmic1_data_pin == RT5660_DMIC1_DATA_IN1P)
+                        regmap_update_bits(rt5660->regmap, RT5660_DMIC_CTRL1,
+                                RT5660_SEL_DMIC_DATA_MASK,
+                                RT5660_SEL_DMIC_DATA_IN1P);
+        }
+
+        return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5660,
+                                      rt5660_dai, ARRAY_SIZE(rt5660_dai));
+}
+
+static int rt5660_i2c_remove(struct i2c_client *i2c)
+{
+        snd_soc_unregister_codec(&i2c->dev);
+
+        return 0;
+}
+
+static struct i2c_driver rt5660_i2c_driver = {
+        .driver = {
+                .name = "rt5660",
+                .acpi_match_table = ACPI_PTR(rt5660_acpi_match),
+                .of_match_table = of_match_ptr(rt5660_of_match),
+        },
+        .probe = rt5660_i2c_probe,
+        .remove   = rt5660_i2c_remove,
+        .id_table = rt5660_i2c_id,
+};
+module_i2c_driver(rt5660_i2c_driver);
+
+MODULE_DESCRIPTION("ASoC RT5660 driver");
+MODULE_AUTHOR("Oder Chiou <oder_chiou@realtek.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/rt5660.h b/sound/soc/codecs/rt5660.h
new file mode 100644
index 000000000000..6cdb9269ec9e
--- /dev/null
+++ b/sound/soc/codecs/rt5660.h
@@ -0,0 +1,847 @@
+/*
+ * rt5660.h  --  RT5660 ALSA SoC audio driver
+ *
+ * Copyright 2016 Realtek Semiconductor Corp.
+ * Author: Oder Chiou <oder_chiou@realtek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _RT5660_H
+#define _RT5660_H
+
+#include <linux/clk.h>
+#include <sound/rt5660.h>
+
+/* Info */
+#define RT5660_RESET                            0x00
+#define RT5660_VENDOR_ID                        0xfd
+#define RT5660_VENDOR_ID1                       0xfe
+#define RT5660_VENDOR_ID2                       0xff
+/*  I/O - Output */
+#define RT5660_SPK_VOL                          0x01
+#define RT5660_LOUT_VOL                         0x02
+/* I/O - Input */
+#define RT5660_IN1_IN2                          0x0d
+#define RT5660_IN3_IN4                          0x0e
+/* I/O - ADC/DAC/DMIC */
+#define RT5660_DAC1_DIG_VOL                     0x19
+#define RT5660_STO1_ADC_DIG_VOL                 0x1c
+#define RT5660_ADC_BST_VOL1                     0x1e
+/* Mixer - D-D */
+#define RT5660_STO1_ADC_MIXER                   0x27
+#define RT5660_AD_DA_MIXER                      0x29
+#define RT5660_STO_DAC_MIXER                    0x2a
+#define RT5660_DIG_INF1_DATA                    0x2f
+/* Mixer - ADC */
+#define RT5660_REC_L1_MIXER                     0x3b
+#define RT5660_REC_L2_MIXER                     0x3c
+#define RT5660_REC_R1_MIXER                     0x3d
+#define RT5660_REC_R2_MIXER                     0x3e
+/* Mixer - DAC */
+#define RT5660_LOUT_MIXER                       0x45
+#define RT5660_SPK_MIXER                        0x46
+#define RT5660_SPO_MIXER                        0x48
+#define RT5660_SPO_CLSD_RATIO                   0x4a
+#define RT5660_OUT_L_GAIN1                      0x4d
+#define RT5660_OUT_L_GAIN2                      0x4e
+#define RT5660_OUT_L1_MIXER                     0x4f
+#define RT5660_OUT_R_GAIN1                      0x50
+#define RT5660_OUT_R_GAIN2                      0x51
+#define RT5660_OUT_R1_MIXER                     0x52
+/* Power */
+#define RT5660_PWR_DIG1                         0x61
+#define RT5660_PWR_DIG2                         0x62
+#define RT5660_PWR_ANLG1                        0x63
+#define RT5660_PWR_ANLG2                        0x64
+#define RT5660_PWR_MIXER                        0x65
+#define RT5660_PWR_VOL                          0x66
+/* Private Register Control */
+#define RT5660_PRIV_INDEX                       0x6a
+#define RT5660_PRIV_DATA                        0x6c
+/* Format - ADC/DAC */
+#define RT5660_I2S1_SDP                         0x70
+#define RT5660_ADDA_CLK1                        0x73
+#define RT5660_ADDA_CLK2                        0x74
+#define RT5660_DMIC_CTRL1                       0x75
+/* Function - Analog */
+#define RT5660_GLB_CLK                          0x80
+#define RT5660_PLL_CTRL1                        0x81
+#define RT5660_PLL_CTRL2                        0x82
+#define RT5660_CLSD_AMP_OC_CTRL                 0x8c
+#define RT5660_CLSD_AMP_CTRL                    0x8d
+#define RT5660_LOUT_AMP_CTRL                    0x8e
+#define RT5660_SPK_AMP_SPKVDD                   0x92
+#define RT5660_MICBIAS                          0x93
+#define RT5660_CLSD_OUT_CTRL1                   0xa1
+#define RT5660_CLSD_OUT_CTRL2                   0xa2
+#define RT5660_DIPOLE_MIC_CTRL1                 0xa3
+#define RT5660_DIPOLE_MIC_CTRL2                 0xa4
+#define RT5660_DIPOLE_MIC_CTRL3                 0xa5
+#define RT5660_DIPOLE_MIC_CTRL4                 0xa6
+#define RT5660_DIPOLE_MIC_CTRL5                 0xa7
+#define RT5660_DIPOLE_MIC_CTRL6                 0xa8
+#define RT5660_DIPOLE_MIC_CTRL7                 0xa9
+#define RT5660_DIPOLE_MIC_CTRL8                 0xaa
+#define RT5660_DIPOLE_MIC_CTRL9                 0xab
+#define RT5660_DIPOLE_MIC_CTRL10                0xac
+#define RT5660_DIPOLE_MIC_CTRL11                0xad
+#define RT5660_DIPOLE_MIC_CTRL12                0xae
+/* Function - Digital */
+#define RT5660_EQ_CTRL1                         0xb0
+#define RT5660_EQ_CTRL2                         0xb1
+#define RT5660_DRC_AGC_CTRL1                    0xb3
+#define RT5660_DRC_AGC_CTRL2                    0xb4
+#define RT5660_DRC_AGC_CTRL3                    0xb5
+#define RT5660_DRC_AGC_CTRL4                    0xb6
+#define RT5660_DRC_AGC_CTRL5                    0xb7
+#define RT5660_JD_CTRL                          0xbb
+#define RT5660_IRQ_CTRL1                        0xbd
+#define RT5660_IRQ_CTRL2                        0xbe
+#define RT5660_INT_IRQ_ST                       0xbf
+#define RT5660_GPIO_CTRL1                       0xc0
+#define RT5660_GPIO_CTRL2                       0xc2
+#define RT5660_WIND_FILTER_CTRL1                0xd3
+#define RT5660_SV_ZCD1                          0xd9
+#define RT5660_SV_ZCD2                          0xda
+#define RT5660_DRC1_LM_CTRL1                    0xe0
+#define RT5660_DRC1_LM_CTRL2                    0xe1
+#define RT5660_DRC2_LM_CTRL1                    0xe2
+#define RT5660_DRC2_LM_CTRL2                    0xe3
+#define RT5660_MULTI_DRC_CTRL                   0xe4
+#define RT5660_DRC2_CTRL1                       0xe5
+#define RT5660_DRC2_CTRL2                       0xe6
+#define RT5660_DRC2_CTRL3                       0xe7
+#define RT5660_DRC2_CTRL4                       0xe8
+#define RT5660_DRC2_CTRL5                       0xe9
+#define RT5660_ALC_PGA_CTRL1                    0xea
+#define RT5660_ALC_PGA_CTRL2                    0xeb
+#define RT5660_ALC_PGA_CTRL3                    0xec
+#define RT5660_ALC_PGA_CTRL4                    0xed
+#define RT5660_ALC_PGA_CTRL5                    0xee
+#define RT5660_ALC_PGA_CTRL6                    0xef
+#define RT5660_ALC_PGA_CTRL7                    0xf0
+
+/* General Control */
+#define RT5660_GEN_CTRL1                        0xfa
+#define RT5660_GEN_CTRL2                        0xfb
+#define RT5660_GEN_CTRL3                        0xfc
+
+/* Index of Codec Private Register definition */
+#define RT5660_CHOP_DAC_ADC                     0x3d
+
+/* Global Definition */
+#define RT5660_L_MUTE                           (0x1 << 15)
+#define RT5660_L_MUTE_SFT                       15
+#define RT5660_VOL_L_MUTE                       (0x1 << 14)
+#define RT5660_VOL_L_SFT                        14
+#define RT5660_R_MUTE                           (0x1 << 7)
+#define RT5660_R_MUTE_SFT                       7
+#define RT5660_VOL_R_MUTE                       (0x1 << 6)
+#define RT5660_VOL_R_SFT                        6
+#define RT5660_L_VOL_MASK                       (0x3f << 8)
+#define RT5660_L_VOL_SFT                        8
+#define RT5660_R_VOL_MASK                       (0x3f)
+#define RT5660_R_VOL_SFT                        0
+
+/* IN1 and IN2 Control (0x0d) */
+#define RT5660_IN_DF1                           (0x1 << 15)
+#define RT5660_IN_SFT1                          15
+#define RT5660_BST_MASK1                        (0x7f << 8)
+#define RT5660_BST_SFT1                         8
+#define RT5660_IN_DF2                           (0x1 << 7)
+#define RT5660_IN_SFT2                          7
+#define RT5660_BST_MASK2                        (0x7f << 0)
+#define RT5660_BST_SFT2                         0
+
+/* IN3 and IN4 Control (0x0e) */
+#define RT5660_IN_DF3                           (0x1 << 15)
+#define RT5660_IN_SFT3                          15
+#define RT5660_BST_MASK3                        (0x7f << 8)
+#define RT5660_BST_SFT3                         8
+#define RT5660_IN_DF4                           (0x1 << 7)
+#define RT5660_IN_SFT4                          7
+#define RT5660_BST_MASK4                        (0x7f << 0)
+#define RT5660_BST_SFT4                         0
+
+/* DAC1 Digital Volume (0x19) */
+#define RT5660_DAC_L1_VOL_MASK                  (0x7f << 9)
+#define RT5660_DAC_L1_VOL_SFT                   9
+#define RT5660_DAC_R1_VOL_MASK                  (0x7f << 1)
+#define RT5660_DAC_R1_VOL_SFT                   1
+
+/* ADC Digital Volume Control (0x1c) */
+#define RT5660_ADC_L_VOL_MASK                   (0x3f << 9)
+#define RT5660_ADC_L_VOL_SFT                    9
+#define RT5660_ADC_R_VOL_MASK                   (0x3f << 1)
+#define RT5660_ADC_R_VOL_SFT                    1
+
+/* ADC Boost Volume Control (0x1e) */
+#define RT5660_STO1_ADC_L_BST_MASK              (0x3 << 14)
+#define RT5660_STO1_ADC_L_BST_SFT               14
+#define RT5660_STO1_ADC_R_BST_MASK              (0x3 << 12)
+#define RT5660_STO1_ADC_R_BST_SFT               12
+
+/* Stereo ADC Mixer Control (0x27) */
+#define RT5660_M_ADC_L1                         (0x1 << 14)
+#define RT5660_M_ADC_L1_SFT                     14
+#define RT5660_M_ADC_L2                         (0x1 << 13)
+#define RT5660_M_ADC_L2_SFT                     13
+#define RT5660_M_ADC_R1                         (0x1 << 6)
+#define RT5660_M_ADC_R1_SFT                     6
+#define RT5660_M_ADC_R2                         (0x1 << 5)
+#define RT5660_M_ADC_R2_SFT                     5
+
+/* ADC Mixer to DAC Mixer Control (0x29) */
+#define RT5660_M_ADCMIX_L                       (0x1 << 15)
+#define RT5660_M_ADCMIX_L_SFT                   15
+#define RT5660_M_DAC1_L                         (0x1 << 14)
+#define RT5660_M_DAC1_L_SFT                     14
+#define RT5660_M_ADCMIX_R                       (0x1 << 7)
+#define RT5660_M_ADCMIX_R_SFT                   7
+#define RT5660_M_DAC1_R                         (0x1 << 6)
+#define RT5660_M_DAC1_R_SFT                     6
+
+/* Stereo DAC Mixer Control (0x2a) */
+#define RT5660_M_DAC_L1                         (0x1 << 14)
+#define RT5660_M_DAC_L1_SFT                     14
+#define RT5660_DAC_L1_STO_L_VOL_MASK            (0x1 << 13)
+#define RT5660_DAC_L1_STO_L_VOL_SFT             13
+#define RT5660_M_DAC_R1_STO_L                   (0x1 << 9)
+#define RT5660_M_DAC_R1_STO_L_SFT               9
+#define RT5660_DAC_R1_STO_L_VOL_MASK            (0x1 << 8)
+#define RT5660_DAC_R1_STO_L_VOL_SFT             8
+#define RT5660_M_DAC_R1                         (0x1 << 6)
+#define RT5660_M_DAC_R1_SFT                     6
+#define RT5660_DAC_R1_STO_R_VOL_MASK            (0x1 << 5)
+#define RT5660_DAC_R1_STO_R_VOL_SFT             5
+#define RT5660_M_DAC_L1_STO_R                   (0x1 << 1)
+#define RT5660_M_DAC_L1_STO_R_SFT               1
+#define RT5660_DAC_L1_STO_R_VOL_MASK            (0x1)
+#define RT5660_DAC_L1_STO_R_VOL_SFT             0
+
+/* Digital Interface Data Control (0x2f) */
+#define RT5660_IF1_DAC_IN_SEL                   (0x3 << 14)
+#define RT5660_IF1_DAC_IN_SFT                   14
+#define RT5660_IF1_ADC_IN_SEL                   (0x3 << 12)
+#define RT5660_IF1_ADC_IN_SFT                   12
+
+/* REC Left Mixer Control 1 (0x3b) */
+#define RT5660_G_BST3_RM_L_MASK                 (0x7 << 4)
+#define RT5660_G_BST3_RM_L_SFT                  4
+#define RT5660_G_BST2_RM_L_MASK                 (0x7 << 1)
+#define RT5660_G_BST2_RM_L_SFT                  1
+
+/* REC Left Mixer Control 2 (0x3c) */
+#define RT5660_G_BST1_RM_L_MASK                 (0x7 << 13)
+#define RT5660_G_BST1_RM_L_SFT                  13
+#define RT5660_G_OM_L_RM_L_MASK                 (0x7 << 10)
+#define RT5660_G_OM_L_RM_L_SFT                  10
+#define RT5660_M_BST3_RM_L                      (0x1 << 3)
+#define RT5660_M_BST3_RM_L_SFT                  3
+#define RT5660_M_BST2_RM_L                      (0x1 << 2)
+#define RT5660_M_BST2_RM_L_SFT                  2
+#define RT5660_M_BST1_RM_L                      (0x1 << 1)
+#define RT5660_M_BST1_RM_L_SFT                  1
+#define RT5660_M_OM_L_RM_L                      (0x1)
+#define RT5660_M_OM_L_RM_L_SFT                  0
+
+/* REC Right Mixer Control 1 (0x3d) */
+#define RT5660_G_BST3_RM_R_MASK                 (0x7 << 4)
+#define RT5660_G_BST3_RM_R_SFT                  4
+#define RT5660_G_BST2_RM_R_MASK                 (0x7 << 1)
+#define RT5660_G_BST2_RM_R_SFT                  1
+
+/* REC Right Mixer Control 2 (0x3e) */
+#define RT5660_G_BST1_RM_R_MASK                 (0x7 << 13)
+#define RT5660_G_BST1_RM_R_SFT                  13
+#define RT5660_G_OM_R_RM_R_MASK                 (0x7 << 10)
+#define RT5660_G_OM_R_RM_R_SFT                  10
+#define RT5660_M_BST3_RM_R                      (0x1 << 3)
+#define RT5660_M_BST3_RM_R_SFT                  3
+#define RT5660_M_BST2_RM_R                      (0x1 << 2)
+#define RT5660_M_BST2_RM_R_SFT                  2
+#define RT5660_M_BST1_RM_R                      (0x1 << 1)
+#define RT5660_M_BST1_RM_R_SFT                  1
+#define RT5660_M_OM_R_RM_R                      (0x1)
+#define RT5660_M_OM_R_RM_R_SFT                  0
+
+/* LOUTMIX Control (0x45) */
+#define RT5660_M_DAC1_LM                        (0x1 << 14)
+#define RT5660_M_DAC1_LM_SFT                    14
+#define RT5660_M_LOVOL_M                        (0x1 << 13)
+#define RT5660_M_LOVOL_LM_SFT                   13
+
+/* SPK Mixer Control (0x46) */
+#define RT5660_G_BST3_SM_MASK                   (0x3 << 14)
+#define RT5660_G_BST3_SM_SFT                    14
+#define RT5660_G_BST1_SM_MASK                   (0x3 << 12)
+#define RT5660_G_BST1_SM_SFT                    12
+#define RT5660_G_DACl_SM_MASK                   (0x3 << 10)
+#define RT5660_G_DACl_SM_SFT                    10
+#define RT5660_G_DACR_SM_MASK                   (0x3 << 8)
+#define RT5660_G_DACR_SM_SFT                    8
+#define RT5660_G_OM_L_SM_MASK                   (0x3 << 6)
+#define RT5660_G_OM_L_SM_SFT                    6
+#define RT5660_M_DACR_SM                        (0x1 << 5)
+#define RT5660_M_DACR_SM_SFT                    5
+#define RT5660_M_BST1_SM                        (0x1 << 4)
+#define RT5660_M_BST1_SM_SFT                    4
+#define RT5660_M_BST3_SM                        (0x1 << 3)
+#define RT5660_M_BST3_SM_SFT                    3
+#define RT5660_M_DACL_SM                        (0x1 << 2)
+#define RT5660_M_DACL_SM_SFT                    2
+#define RT5660_M_OM_L_SM                        (0x1 << 1)
+#define RT5660_M_OM_L_SM_SFT                    1
+
+/* SPOMIX Control (0x48) */
+#define RT5660_M_DAC_R_SPM                      (0x1 << 14)
+#define RT5660_M_DAC_R_SPM_SFT                  14
+#define RT5660_M_DAC_L_SPM                      (0x1 << 13)
+#define RT5660_M_DAC_L_SPM_SFT                  13
+#define RT5660_M_SV_SPM                         (0x1 << 12)
+#define RT5660_M_SV_SPM_SFT                     12
+#define RT5660_M_BST1_SPM                       (0x1 << 11)
+#define RT5660_M_BST1_SPM_SFT                   11
+
+/* Output Left Mixer Control 1 (0x4d) */
+#define RT5660_G_BST3_OM_L_MASK                 (0x7 << 13)
+#define RT5660_G_BST3_OM_L_SFT                  13
+#define RT5660_G_BST2_OM_L_MASK                 (0x7 << 10)
+#define RT5660_G_BST2_OM_L_SFT                  10
+#define RT5660_G_BST1_OM_L_MASK                 (0x7 << 7)
+#define RT5660_G_BST1_OM_L_SFT                  7
+#define RT5660_G_RM_L_OM_L_MASK                 (0x7 << 1)
+#define RT5660_G_RM_L_OM_L_SFT                  1
+
+/* Output Left Mixer Control 2 (0x4e) */
+#define RT5660_G_DAC_R1_OM_L_MASK               (0x7 << 10)
+#define RT5660_G_DAC_R1_OM_L_SFT                10
+#define RT5660_G_DAC_L1_OM_L_MASK               (0x7 << 7)
+#define RT5660_G_DAC_L1_OM_L_SFT                7
+
+/* Output Left Mixer Control 3 (0x4f) */
+#define RT5660_M_BST3_OM_L                      (0x1 << 5)
+#define RT5660_M_BST3_OM_L_SFT                  5
+#define RT5660_M_BST2_OM_L                      (0x1 << 4)
+#define RT5660_M_BST2_OM_L_SFT                  4
+#define RT5660_M_BST1_OM_L                      (0x1 << 3)
+#define RT5660_M_BST1_OM_L_SFT                  3
+#define RT5660_M_RM_L_OM_L                      (0x1 << 2)
+#define RT5660_M_RM_L_OM_L_SFT                  2
+#define RT5660_M_DAC_R_OM_L                     (0x1 << 1)
+#define RT5660_M_DAC_R_OM_L_SFT                 1
+#define RT5660_M_DAC_L_OM_L                     (0x1)
+#define RT5660_M_DAC_L_OM_L_SFT                 0
+
+/* Output Right Mixer Control 1 (0x50) */
+#define RT5660_G_BST2_OM_R_MASK                 (0x7 << 10)
+#define RT5660_G_BST2_OM_R_SFT                  10
+#define RT5660_G_BST1_OM_R_MASK                 (0x7 << 7)
+#define RT5660_G_BST1_OM_R_SFT                  7
+#define RT5660_G_RM_R_OM_R_MASK                 (0x7 << 1)
+#define RT5660_G_RM_R_OM_R_SFT                  1
+
+/* Output Right Mixer Control 2 (0x51) */
+#define RT5660_G_DAC_L_OM_R_MASK                (0x7 << 10)
+#define RT5660_G_DAC_L_OM_R_SFT                 10
+#define RT5660_G_DAC_R_OM_R_MASK                (0x7 << 7)
+#define RT5660_G_DAC_R_OM_R_SFT                 7
+
+/* Output Right Mixer Control 3 (0x52) */
+#define RT5660_M_BST2_OM_R                      (0x1 << 4)
+#define RT5660_M_BST2_OM_R_SFT                  4
+#define RT5660_M_BST1_OM_R                      (0x1 << 3)
+#define RT5660_M_BST1_OM_R_SFT                  3
+#define RT5660_M_RM_R_OM_R                      (0x1 << 2)
+#define RT5660_M_RM_R_OM_R_SFT                  2
+#define RT5660_M_DAC_L_OM_R                     (0x1 << 1)
+#define RT5660_M_DAC_L_OM_R_SFT                 1
+#define RT5660_M_DAC_R_OM_R                     (0x1)
+#define RT5660_M_DAC_R_OM_R_SFT                 0
+
+/* Power Management for Digital 1 (0x61) */
+#define RT5660_PWR_I2S1                         (0x1 << 15)
+#define RT5660_PWR_I2S1_BIT                     15
+#define RT5660_PWR_DAC_L1                       (0x1 << 12)
+#define RT5660_PWR_DAC_L1_BIT                   12
+#define RT5660_PWR_DAC_R1                       (0x1 << 11)
+#define RT5660_PWR_DAC_R1_BIT                   11
+#define RT5660_PWR_ADC_L                        (0x1 << 2)
+#define RT5660_PWR_ADC_L_BIT                    2
+#define RT5660_PWR_ADC_R                        (0x1 << 1)
+#define RT5660_PWR_ADC_R_BIT                    1
+#define RT5660_PWR_CLS_D                        (0x1)
+#define RT5660_PWR_CLS_D_BIT                    0
+
+/* Power Management for Digital 2 (0x62) */
+#define RT5660_PWR_ADC_S1F                      (0x1 << 15)
+#define RT5660_PWR_ADC_S1F_BIT                  15
+#define RT5660_PWR_DAC_S1F                      (0x1 << 11)
+#define RT5660_PWR_DAC_S1F_BIT                  11
+
+/* Power Management for Analog 1 (0x63) */
+#define RT5660_PWR_VREF1                        (0x1 << 15)
+#define RT5660_PWR_VREF1_BIT                    15
+#define RT5660_PWR_FV1                          (0x1 << 14)
+#define RT5660_PWR_FV1_BIT                      14
+#define RT5660_PWR_MB                           (0x1 << 13)
+#define RT5660_PWR_MB_BIT                       13
+#define RT5660_PWR_BG                           (0x1 << 11)
+#define RT5660_PWR_BG_BIT                       11
+#define RT5660_PWR_HP_L                         (0x1 << 7)
+#define RT5660_PWR_HP_L_BIT                     7
+#define RT5660_PWR_HP_R                         (0x1 << 6)
+#define RT5660_PWR_HP_R_BIT                     6
+#define RT5660_PWR_HA                           (0x1 << 5)
+#define RT5660_PWR_HA_BIT                       5
+#define RT5660_PWR_VREF2                        (0x1 << 4)
+#define RT5660_PWR_VREF2_BIT                    4
+#define RT5660_PWR_FV2                          (0x1 << 3)
+#define RT5660_PWR_FV2_BIT                      3
+#define RT5660_PWR_LDO2                         (0x1 << 2)
+#define RT5660_PWR_LDO2_BIT                     2
+
+/* Power Management for Analog 2 (0x64) */
+#define RT5660_PWR_BST1                         (0x1 << 15)
+#define RT5660_PWR_BST1_BIT                     15
+#define RT5660_PWR_BST2                         (0x1 << 14)
+#define RT5660_PWR_BST2_BIT                     14
+#define RT5660_PWR_BST3                         (0x1 << 13)
+#define RT5660_PWR_BST3_BIT                     13
+#define RT5660_PWR_MB1                          (0x1 << 11)
+#define RT5660_PWR_MB1_BIT                      11
+#define RT5660_PWR_MB2                          (0x1 << 10)
+#define RT5660_PWR_MB2_BIT                      10
+#define RT5660_PWR_PLL                          (0x1 << 9)
+#define RT5660_PWR_PLL_BIT                      9
+
+/* Power Management for Mixer (0x65) */
+#define RT5660_PWR_OM_L                         (0x1 << 15)
+#define RT5660_PWR_OM_L_BIT                     15
+#define RT5660_PWR_OM_R                         (0x1 << 14)
+#define RT5660_PWR_OM_R_BIT                     14
+#define RT5660_PWR_SM                           (0x1 << 13)
+#define RT5660_PWR_SM_BIT                       13
+#define RT5660_PWR_RM_L                         (0x1 << 11)
+#define RT5660_PWR_RM_L_BIT                     11
+#define RT5660_PWR_RM_R                         (0x1 << 10)
+#define RT5660_PWR_RM_R_BIT                     10
+
+/* Power Management for Volume (0x66) */
+#define RT5660_PWR_SV                           (0x1 << 15)
+#define RT5660_PWR_SV_BIT                       15
+#define RT5660_PWR_LV_L                         (0x1 << 11)
+#define RT5660_PWR_LV_L_BIT                     11
+#define RT5660_PWR_LV_R                         (0x1 << 10)
+#define RT5660_PWR_LV_R_BIT                     10
+
+/* I2S1 Audio Serial Data Port Control (0x70) */
+#define RT5660_I2S_MS_MASK                      (0x1 << 15)
+#define RT5660_I2S_MS_SFT                       15
+#define RT5660_I2S_MS_M                         (0x0 << 15)
+#define RT5660_I2S_MS_S                         (0x1 << 15)
+#define RT5660_I2S_O_CP_MASK                    (0x3 << 10)
+#define RT5660_I2S_O_CP_SFT                     10
+#define RT5660_I2S_O_CP_OFF                     (0x0 << 10)
+#define RT5660_I2S_O_CP_U_LAW                   (0x1 << 10)
+#define RT5660_I2S_O_CP_A_LAW                   (0x2 << 10)
+#define RT5660_I2S_I_CP_MASK                    (0x3 << 8)
+#define RT5660_I2S_I_CP_SFT                     8
+#define RT5660_I2S_I_CP_OFF                     (0x0 << 8)
+#define RT5660_I2S_I_CP_U_LAW                   (0x1 << 8)
+#define RT5660_I2S_I_CP_A_LAW                   (0x2 << 8)
+#define RT5660_I2S_BP_MASK                      (0x1 << 7)
+#define RT5660_I2S_BP_SFT                       7
+#define RT5660_I2S_BP_NOR                       (0x0 << 7)
+#define RT5660_I2S_BP_INV                       (0x1 << 7)
+#define RT5660_I2S_DL_MASK                      (0x3 << 2)
+#define RT5660_I2S_DL_SFT                       2
+#define RT5660_I2S_DL_16                        (0x0 << 2)
+#define RT5660_I2S_DL_20                        (0x1 << 2)
+#define RT5660_I2S_DL_24                        (0x2 << 2)
+#define RT5660_I2S_DL_8                         (0x3 << 2)
+#define RT5660_I2S_DF_MASK                      (0x3)
+#define RT5660_I2S_DF_SFT                       0
+#define RT5660_I2S_DF_I2S                       (0x0)
+#define RT5660_I2S_DF_LEFT                      (0x1)
+#define RT5660_I2S_DF_PCM_A                     (0x2)
+#define RT5660_I2S_DF_PCM_B                     (0x3)
+
+/* ADC/DAC Clock Control 1 (0x73) */
+#define RT5660_I2S_BCLK_MS1_MASK                (0x1 << 15)
+#define RT5660_I2S_BCLK_MS1_SFT                 15
+#define RT5660_I2S_BCLK_MS1_32                  (0x0 << 15)
+#define RT5660_I2S_BCLK_MS1_64                  (0x1 << 15)
+#define RT5660_I2S_PD1_MASK                     (0x7 << 12)
+#define RT5660_I2S_PD1_SFT                      12
+#define RT5660_I2S_PD1_1                        (0x0 << 12)
+#define RT5660_I2S_PD1_2                        (0x1 << 12)
+#define RT5660_I2S_PD1_3                        (0x2 << 12)
+#define RT5660_I2S_PD1_4                        (0x3 << 12)
+#define RT5660_I2S_PD1_6                        (0x4 << 12)
+#define RT5660_I2S_PD1_8                        (0x5 << 12)
+#define RT5660_I2S_PD1_12                       (0x6 << 12)
+#define RT5660_I2S_PD1_16                       (0x7 << 12)
+#define RT5660_DAC_OSR_MASK                     (0x3 << 2)
+#define RT5660_DAC_OSR_SFT                      2
+#define RT5660_DAC_OSR_128                      (0x0 << 2)
+#define RT5660_DAC_OSR_64                       (0x1 << 2)
+#define RT5660_DAC_OSR_32                       (0x2 << 2)
+#define RT5660_DAC_OSR_16                       (0x3 << 2)
+#define RT5660_ADC_OSR_MASK                     (0x3)
+#define RT5660_ADC_OSR_SFT                      0
+#define RT5660_ADC_OSR_128                      (0x0)
+#define RT5660_ADC_OSR_64                       (0x1)
+#define RT5660_ADC_OSR_32                       (0x2)
+#define RT5660_ADC_OSR_16                       (0x3)
+
+/* ADC/DAC Clock Control 2 (0x74) */
+#define RT5660_RESET_ADF                        (0x1 << 13)
+#define RT5660_RESET_ADF_SFT                    13
+#define RT5660_RESET_DAF                        (0x1 << 12)
+#define RT5660_RESET_DAF_SFT                    12
+#define RT5660_DAHPF_EN                         (0x1 << 11)
+#define RT5660_DAHPF_EN_SFT                     11
+#define RT5660_ADHPF_EN                         (0x1 << 10)
+#define RT5660_ADHPF_EN_SFT                     10
+
+/* Digital Microphone Control (0x75) */
+#define RT5660_DMIC_1_EN_MASK                   (0x1 << 15)
+#define RT5660_DMIC_1_EN_SFT                    15
+#define RT5660_DMIC_1_DIS                       (0x0 << 15)
+#define RT5660_DMIC_1_EN                        (0x1 << 15)
+#define RT5660_DMIC_1L_LH_MASK                  (0x1 << 13)
+#define RT5660_DMIC_1L_LH_SFT                   13
+#define RT5660_DMIC_1L_LH_RISING                (0x0 << 13)
+#define RT5660_DMIC_1L_LH_FALLING               (0x1 << 13)
+#define RT5660_DMIC_1R_LH_MASK                  (0x1 << 12)
+#define RT5660_DMIC_1R_LH_SFT                   12
+#define RT5660_DMIC_1R_LH_RISING                (0x0 << 12)
+#define RT5660_DMIC_1R_LH_FALLING               (0x1 << 12)
+#define RT5660_SEL_DMIC_DATA_MASK               (0x1 << 11)
+#define RT5660_SEL_DMIC_DATA_SFT                11
+#define RT5660_SEL_DMIC_DATA_GPIO2              (0x0 << 11)
+#define RT5660_SEL_DMIC_DATA_IN1P               (0x1 << 11)
+#define RT5660_DMIC_CLK_MASK                    (0x7 << 5)
+#define RT5660_DMIC_CLK_SFT                     5
+
+/* Global Clock Control (0x80) */
+#define RT5660_SCLK_SRC_MASK                    (0x3 << 14)
+#define RT5660_SCLK_SRC_SFT                     14
+#define RT5660_SCLK_SRC_MCLK                    (0x0 << 14)
+#define RT5660_SCLK_SRC_PLL1                    (0x1 << 14)
+#define RT5660_SCLK_SRC_RCCLK                   (0x2 << 14)
+#define RT5660_PLL1_SRC_MASK                    (0x3 << 12)
+#define RT5660_PLL1_SRC_SFT                     12
+#define RT5660_PLL1_SRC_MCLK                    (0x0 << 12)
+#define RT5660_PLL1_SRC_BCLK1                   (0x1 << 12)
+#define RT5660_PLL1_SRC_RCCLK                   (0x2 << 12)
+#define RT5660_PLL1_PD_MASK                     (0x1 << 3)
+#define RT5660_PLL1_PD_SFT                      3
+#define RT5660_PLL1_PD_1                        (0x0 << 3)
+#define RT5660_PLL1_PD_2                        (0x1 << 3)
+
+#define RT5660_PLL_INP_MAX                      40000000
+#define RT5660_PLL_INP_MIN                      256000
+/* PLL M/N/K Code Control 1 (0x81) */
+#define RT5660_PLL_N_MAX                        0x1ff
+#define RT5660_PLL_N_MASK                       (RT5660_PLL_N_MAX << 7)
+#define RT5660_PLL_N_SFT                        7
+#define RT5660_PLL_K_MAX                        0x1f
+#define RT5660_PLL_K_MASK                       (RT5660_PLL_K_MAX)
+#define RT5660_PLL_K_SFT                        0
+
+/* PLL M/N/K Code Control 2 (0x82) */
+#define RT5660_PLL_M_MAX                        0xf
+#define RT5660_PLL_M_MASK                       (RT5660_PLL_M_MAX << 12)
+#define RT5660_PLL_M_SFT                        12
+#define RT5660_PLL_M_BP                         (0x1 << 11)
+#define RT5660_PLL_M_BP_SFT                     11
+
+/* Class D Over Current Control (0x8c) */
+#define RT5660_CLSD_OC_MASK                     (0x1 << 9)
+#define RT5660_CLSD_OC_SFT                      9
+#define RT5660_CLSD_OC_PU                       (0x0 << 9)
+#define RT5660_CLSD_OC_PD                       (0x1 << 9)
+#define RT5660_AUTO_PD_MASK                     (0x1 << 8)
+#define RT5660_AUTO_PD_SFT                      8
+#define RT5660_AUTO_PD_DIS                      (0x0 << 8)
+#define RT5660_AUTO_PD_EN                       (0x1 << 8)
+#define RT5660_CLSD_OC_TH_MASK                  (0x3f)
+#define RT5660_CLSD_OC_TH_SFT                   0
+
+/* Class D Output Control (0x8d) */
+#define RT5660_CLSD_RATIO_MASK                  (0xf << 12)
+#define RT5660_CLSD_RATIO_SFT                   12
+
+/* Lout Amp Control 1 (0x8e) */
+#define RT5660_LOUT_CO_MASK                     (0x1 << 4)
+#define RT5660_LOUT_CO_SFT                      4
+#define RT5660_LOUT_CO_DIS                      (0x0 << 4)
+#define RT5660_LOUT_CO_EN                       (0x1 << 4)
+#define RT5660_LOUT_CB_MASK                     (0x1)
+#define RT5660_LOUT_CB_SFT                      0
+#define RT5660_LOUT_CB_PD                       (0x0)
+#define RT5660_LOUT_CB_PU                       (0x1)
+
+/* SPKVDD detection control (0x92) */
+#define RT5660_SPKVDD_DET_MASK                  (0x1 << 15)
+#define RT5660_SPKVDD_DET_SFT                   15
+#define RT5660_SPKVDD_DET_DIS                   (0x0 << 15)
+#define RT5660_SPKVDD_DET_EN                    (0x1 << 15)
+#define RT5660_SPK_AG_MASK                      (0x1 << 14)
+#define RT5660_SPK_AG_SFT                       14
+#define RT5660_SPK_AG_DIS                       (0x0 << 14)
+#define RT5660_SPK_AG_EN                        (0x1 << 14)
+
+/* Micbias Control (0x93) */
+#define RT5660_MIC1_BS_MASK                     (0x1 << 15)
+#define RT5660_MIC1_BS_SFT                      15
+#define RT5660_MIC1_BS_9AV                      (0x0 << 15)
+#define RT5660_MIC1_BS_75AV                     (0x1 << 15)
+#define RT5660_MIC2_BS_MASK                     (0x1 << 14)
+#define RT5660_MIC2_BS_SFT                      14
+#define RT5660_MIC2_BS_9AV                      (0x0 << 14)
+#define RT5660_MIC2_BS_75AV                     (0x1 << 14)
+#define RT5660_MIC1_OVCD_MASK                   (0x1 << 11)
+#define RT5660_MIC1_OVCD_SFT                    11
+#define RT5660_MIC1_OVCD_DIS                    (0x0 << 11)
+#define RT5660_MIC1_OVCD_EN                     (0x1 << 11)
+#define RT5660_MIC1_OVTH_MASK                   (0x3 << 9)
+#define RT5660_MIC1_OVTH_SFT                    9
+#define RT5660_MIC1_OVTH_600UA                  (0x0 << 9)
+#define RT5660_MIC1_OVTH_1500UA                 (0x1 << 9)
+#define RT5660_MIC1_OVTH_2000UA                 (0x2 << 9)
+#define RT5660_MIC2_OVCD_MASK                   (0x1 << 8)
+#define RT5660_MIC2_OVCD_SFT                    8
+#define RT5660_MIC2_OVCD_DIS                    (0x0 << 8)
+#define RT5660_MIC2_OVCD_EN                     (0x1 << 8)
+#define RT5660_MIC2_OVTH_MASK                   (0x3 << 6)
+#define RT5660_MIC2_OVTH_SFT                    6
+#define RT5660_MIC2_OVTH_600UA                  (0x0 << 6)
+#define RT5660_MIC2_OVTH_1500UA                 (0x1 << 6)
+#define RT5660_MIC2_OVTH_2000UA                 (0x2 << 6)
+#define RT5660_PWR_CLK25M_MASK                  (0x1 << 4)
+#define RT5660_PWR_CLK25M_SFT                   4
+#define RT5660_PWR_CLK25M_PD                    (0x0 << 4)
+#define RT5660_PWR_CLK25M_PU                    (0x1 << 4)
+
+/* EQ Control 1 (0xb0) */
+#define RT5660_EQ_SRC_MASK                      (0x1 << 15)
+#define RT5660_EQ_SRC_SFT                       15
+#define RT5660_EQ_SRC_DAC                       (0x0 << 15)
+#define RT5660_EQ_SRC_ADC                       (0x1 << 15)
+#define RT5660_EQ_UPD                           (0x1 << 14)
+#define RT5660_EQ_UPD_BIT                       14
+
+/* Jack Detect Control (0xbb) */
+#define RT5660_JD_MASK                          (0x3 << 14)
+#define RT5660_JD_SFT                           14
+#define RT5660_JD_DIS                           (0x0 << 14)
+#define RT5660_JD_GPIO1                         (0x1 << 14)
+#define RT5660_JD_GPIO2                         (0x2 << 14)
+#define RT5660_JD_LOUT_MASK                     (0x1 << 11)
+#define RT5660_JD_LOUT_SFT                      11
+#define RT5660_JD_LOUT_DIS                      (0x0 << 11)
+#define RT5660_JD_LOUT_EN                       (0x1 << 11)
+#define RT5660_JD_LOUT_TRG_MASK                 (0x1 << 10)
+#define RT5660_JD_LOUT_TRG_SFT                  10
+#define RT5660_JD_LOUT_TRG_LO                   (0x0 << 10)
+#define RT5660_JD_LOUT_TRG_HI                   (0x1 << 10)
+#define RT5660_JD_SPO_MASK                      (0x1 << 9)
+#define RT5660_JD_SPO_SFT                       9
+#define RT5660_JD_SPO_DIS                       (0x0 << 9)
+#define RT5660_JD_SPO_EN                        (0x1 << 9)
+#define RT5660_JD_SPO_TRG_MASK                  (0x1 << 8)
+#define RT5660_JD_SPO_TRG_SFT                   8
+#define RT5660_JD_SPO_TRG_LO                    (0x0 << 8)
+#define RT5660_JD_SPO_TRG_HI                    (0x1 << 8)
+
+/* IRQ Control 1 (0xbd) */
+#define RT5660_IRQ_JD_MASK                      (0x1 << 15)
+#define RT5660_IRQ_JD_SFT                       15
+#define RT5660_IRQ_JD_BP                        (0x0 << 15)
+#define RT5660_IRQ_JD_NOR                       (0x1 << 15)
+#define RT5660_IRQ_OT_MASK                      (0x1 << 14)
+#define RT5660_IRQ_OT_SFT                       14
+#define RT5660_IRQ_OT_BP                        (0x0 << 14)
+#define RT5660_IRQ_OT_NOR                       (0x1 << 14)
+#define RT5660_JD_STKY_MASK                     (0x1 << 13)
+#define RT5660_JD_STKY_SFT                      13
+#define RT5660_JD_STKY_DIS                      (0x0 << 13)
+#define RT5660_JD_STKY_EN                       (0x1 << 13)
+#define RT5660_OT_STKY_MASK                     (0x1 << 12)
+#define RT5660_OT_STKY_SFT                      12
+#define RT5660_OT_STKY_DIS                      (0x0 << 12)
+#define RT5660_OT_STKY_EN                       (0x1 << 12)
+#define RT5660_JD_P_MASK                        (0x1 << 11)
+#define RT5660_JD_P_SFT                         11
+#define RT5660_JD_P_NOR                         (0x0 << 11)
+#define RT5660_JD_P_INV                         (0x1 << 11)
+#define RT5660_OT_P_MASK                        (0x1 << 10)
+#define RT5660_OT_P_SFT                         10
+#define RT5660_OT_P_NOR                         (0x0 << 10)
+#define RT5660_OT_P_INV                         (0x1 << 10)
+
+/* IRQ Control 2 (0xbe) */
+#define RT5660_IRQ_MB1_OC_MASK                  (0x1 << 15)
+#define RT5660_IRQ_MB1_OC_SFT                   15
+#define RT5660_IRQ_MB1_OC_BP                    (0x0 << 15)
+#define RT5660_IRQ_MB1_OC_NOR                   (0x1 << 15)
+#define RT5660_IRQ_MB2_OC_MASK                  (0x1 << 14)
+#define RT5660_IRQ_MB2_OC_SFT                   14
+#define RT5660_IRQ_MB2_OC_BP                    (0x0 << 14)
+#define RT5660_IRQ_MB2_OC_NOR                   (0x1 << 14)
+#define RT5660_MB1_OC_STKY_MASK                 (0x1 << 11)
+#define RT5660_MB1_OC_STKY_SFT                  11
+#define RT5660_MB1_OC_STKY_DIS                  (0x0 << 11)
+#define RT5660_MB1_OC_STKY_EN                   (0x1 << 11)
+#define RT5660_MB2_OC_STKY_MASK                 (0x1 << 10)
+#define RT5660_MB2_OC_STKY_SFT                  10
+#define RT5660_MB2_OC_STKY_DIS                  (0x0 << 10)
+#define RT5660_MB2_OC_STKY_EN                   (0x1 << 10)
+#define RT5660_MB1_OC_P_MASK                    (0x1 << 7)
+#define RT5660_MB1_OC_P_SFT                     7
+#define RT5660_MB1_OC_P_NOR                     (0x0 << 7)
+#define RT5660_MB1_OC_P_INV                     (0x1 << 7)
+#define RT5660_MB2_OC_P_MASK                    (0x1 << 6)
+#define RT5660_MB2_OC_P_SFT                     6
+#define RT5660_MB2_OC_P_NOR                     (0x0 << 6)
+#define RT5660_MB2_OC_P_INV                     (0x1 << 6)
+#define RT5660_MB1_OC_CLR                       (0x1 << 3)
+#define RT5660_MB1_OC_CLR_SFT                   3
+#define RT5660_MB2_OC_CLR                       (0x1 << 2)
+#define RT5660_MB2_OC_CLR_SFT                   2
+
+/* GPIO Control 1 (0xc0) */
+#define RT5660_GP2_PIN_MASK                     (0x1 << 14)
+#define RT5660_GP2_PIN_SFT                      14
+#define RT5660_GP2_PIN_GPIO2                    (0x0 << 14)
+#define RT5660_GP2_PIN_DMIC1_SDA                (0x1 << 14)
+#define RT5660_GP1_PIN_MASK                     (0x3 << 12)
+#define RT5660_GP1_PIN_SFT                      12
+#define RT5660_GP1_PIN_GPIO1                    (0x0 << 12)
+#define RT5660_GP1_PIN_DMIC1_SCL                (0x1 << 12)
+#define RT5660_GP1_PIN_IRQ                      (0x2 << 12)
+#define RT5660_GPIO_M_MASK                      (0x1 << 9)
+#define RT5660_GPIO_M_SFT                       9
+#define RT5660_GPIO_M_FLT                       (0x0 << 9)
+#define RT5660_GPIO_M_PH                        (0x1 << 9)
+
+/* GPIO Control 3 (0xc2) */
+#define RT5660_GP2_PF_MASK                      (0x1 << 5)
+#define RT5660_GP2_PF_SFT                       5
+#define RT5660_GP2_PF_IN                        (0x0 << 5)
+#define RT5660_GP2_PF_OUT                       (0x1 << 5)
+#define RT5660_GP2_OUT_MASK                     (0x1 << 4)
+#define RT5660_GP2_OUT_SFT                      4
+#define RT5660_GP2_OUT_LO                       (0x0 << 4)
+#define RT5660_GP2_OUT_HI                       (0x1 << 4)
+#define RT5660_GP2_P_MASK                       (0x1 << 3)
+#define RT5660_GP2_P_SFT                        3
+#define RT5660_GP2_P_NOR                        (0x0 << 3)
+#define RT5660_GP2_P_INV                        (0x1 << 3)
+#define RT5660_GP1_PF_MASK                      (0x1 << 2)
+#define RT5660_GP1_PF_SFT                       2
+#define RT5660_GP1_PF_IN                        (0x0 << 2)
+#define RT5660_GP1_PF_OUT                       (0x1 << 2)
+#define RT5660_GP1_OUT_MASK                     (0x1 << 1)
+#define RT5660_GP1_OUT_SFT                      1
+#define RT5660_GP1_OUT_LO                       (0x0 << 1)
+#define RT5660_GP1_OUT_HI                       (0x1 << 1)
+#define RT5660_GP1_P_MASK                       (0x1)
+#define RT5660_GP1_P_SFT                        0
+#define RT5660_GP1_P_NOR                        (0x0)
+#define RT5660_GP1_P_INV                        (0x1)
+
+/* Soft volume and zero cross control 1 (0xd9) */
+#define RT5660_SV_MASK                          (0x1 << 15)
+#define RT5660_SV_SFT                           15
+#define RT5660_SV_DIS                           (0x0 << 15)
+#define RT5660_SV_EN                            (0x1 << 15)
+#define RT5660_SPO_SV_MASK                      (0x1 << 14)
+#define RT5660_SPO_SV_SFT                       14
+#define RT5660_SPO_SV_DIS                       (0x0 << 14)
+#define RT5660_SPO_SV_EN                        (0x1 << 14)
+#define RT5660_OUT_SV_MASK                      (0x1 << 12)
+#define RT5660_OUT_SV_SFT                       12
+#define RT5660_OUT_SV_DIS                       (0x0 << 12)
+#define RT5660_OUT_SV_EN                        (0x1 << 12)
+#define RT5660_ZCD_DIG_MASK                     (0x1 << 11)
+#define RT5660_ZCD_DIG_SFT                      11
+#define RT5660_ZCD_DIG_DIS                      (0x0 << 11)
+#define RT5660_ZCD_DIG_EN                       (0x1 << 11)
+#define RT5660_ZCD_MASK                         (0x1 << 10)
+#define RT5660_ZCD_SFT                          10
+#define RT5660_ZCD_PD                           (0x0 << 10)
+#define RT5660_ZCD_PU                           (0x1 << 10)
+#define RT5660_SV_DLY_MASK                      (0xf)
+#define RT5660_SV_DLY_SFT                       0
+
+/* Soft volume and zero cross control 2 (0xda) */
+#define RT5660_ZCD_SPO_MASK                     (0x1 << 15)
+#define RT5660_ZCD_SPO_SFT                      15
+#define RT5660_ZCD_SPO_DIS                      (0x0 << 15)
+#define RT5660_ZCD_SPO_EN                       (0x1 << 15)
+#define RT5660_ZCD_OMR_MASK                     (0x1 << 8)
+#define RT5660_ZCD_OMR_SFT                      8
+#define RT5660_ZCD_OMR_DIS                      (0x0 << 8)
+#define RT5660_ZCD_OMR_EN                       (0x1 << 8)
+#define RT5660_ZCD_OML_MASK                     (0x1 << 7)
+#define RT5660_ZCD_OML_SFT                      7
+#define RT5660_ZCD_OML_DIS                      (0x0 << 7)
+#define RT5660_ZCD_OML_EN                       (0x1 << 7)
+#define RT5660_ZCD_SPM_MASK                     (0x1 << 6)
+#define RT5660_ZCD_SPM_SFT                      6
+#define RT5660_ZCD_SPM_DIS                      (0x0 << 6)
+#define RT5660_ZCD_SPM_EN                       (0x1 << 6)
+#define RT5660_ZCD_RMR_MASK                     (0x1 << 5)
+#define RT5660_ZCD_RMR_SFT                      5
+#define RT5660_ZCD_RMR_DIS                      (0x0 << 5)
+#define RT5660_ZCD_RMR_EN                       (0x1 << 5)
+#define RT5660_ZCD_RML_MASK                     (0x1 << 4)
+#define RT5660_ZCD_RML_SFT                      4
+#define RT5660_ZCD_RML_DIS                      (0x0 << 4)
+#define RT5660_ZCD_RML_EN                       (0x1 << 4)
+
+/* General Control 1 (0xfa) */
+#define RT5660_PWR_VREF_HP                      (0x1 << 11)
+#define RT5660_PWR_VREF_HP_SFT                  11
+#define RT5660_DIG_GATE_CTRL                    (0x1)
+#define RT5660_DIG_GATE_CTRL_SFT                0
+
+/* System Clock Source */
+#define RT5660_SCLK_S_MCLK                      0
+#define RT5660_SCLK_S_PLL1                      1
+#define RT5660_SCLK_S_RCCLK                     2
+
+/* PLL1 Source */
+#define RT5660_PLL1_S_MCLK                      0
+#define RT5660_PLL1_S_BCLK                      1
+
+enum {
+        RT5660_AIF1,
+        RT5660_AIFS,
+};
+
+struct rt5660_priv {
+        struct snd_soc_codec *codec;
+        struct rt5660_platform_data pdata;
+        struct regmap *regmap;
+        struct clk *mclk;
+
+        int sysclk;
+        int sysclk_src;
+        int lrck[RT5660_AIFS];
+        int bclk[RT5660_AIFS];
+        int master[RT5660_AIFS];
+
+        int pll_src;
+        int pll_in;
+        int pll_out;
+};
+
+#endif
diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c
new file mode 100644
index 000000000000..01a18d88f1eb
--- /dev/null
+++ b/sound/soc/codecs/rt5663.c
@@ -0,0 +1,3218 @@
+/*
+ * rt5663.c  --  RT5668/RT5663 ALSA SoC audio codec driver
+ *
+ * Copyright 2016 Realtek Semiconductor Corp.
+ * Author: Jack Yu <jack.yu@realtek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/pm.h>
+#include <linux/i2c.h>
+#include <linux/platform_device.h>
+#include <linux/spi/spi.h>
+#include <linux/acpi.h>
+#include <linux/workqueue.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/jack.h>
+#include <sound/soc.h>
+#include <sound/soc-dapm.h>
+#include <sound/initval.h>
+#include <sound/tlv.h>
+
+#include "rt5663.h"
+#include "rl6231.h"
+
+#define RT5668_DEVICE_ID 0x6451
+#define RT5663_DEVICE_ID 0x6406
+
+enum {
+        CODEC_TYPE_RT5668,
+        CODEC_TYPE_RT5663,
+};
+
+struct rt5663_priv {
+        struct snd_soc_codec *codec;
+        struct regmap *regmap;
+        struct delayed_work jack_detect_work;
+        struct snd_soc_jack *hs_jack;
+        struct timer_list btn_check_timer;
+
+        int codec_type;
+        int sysclk;
+        int sysclk_src;
+        int lrck;
+
+        int pll_src;
+        int pll_in;
+        int pll_out;
+
+        int jack_type;
+};
+
+static const struct reg_default rt5668_reg[] = {
+        { 0x0000, 0x0000 },
+        { 0x0001, 0xc8c8 },
+        { 0x0002, 0x8080 },
+        { 0x0003, 0x8000 },
+        { 0x0004, 0xc80a },
+        { 0x0005, 0x0000 },
+        { 0x0006, 0x0000 },
+        { 0x0007, 0x0000 },
+        { 0x000a, 0x0000 },
+        { 0x000b, 0x0000 },
+        { 0x000c, 0x0000 },
+        { 0x000d, 0x0000 },
+        { 0x000f, 0x0808 },
+        { 0x0010, 0x4000 },
+        { 0x0011, 0x0000 },
+        { 0x0012, 0x1404 },
+        { 0x0013, 0x1000 },
+        { 0x0014, 0xa00a },
+        { 0x0015, 0x0404 },
+        { 0x0016, 0x0404 },
+        { 0x0017, 0x0011 },
+        { 0x0018, 0xafaf },
+        { 0x0019, 0xafaf },
+        { 0x001a, 0xafaf },
+        { 0x001b, 0x0011 },
+        { 0x001c, 0x2f2f },
+        { 0x001d, 0x2f2f },
+        { 0x001e, 0x2f2f },
+        { 0x001f, 0x0000 },
+        { 0x0020, 0x0000 },
+        { 0x0021, 0x0000 },
+        { 0x0022, 0x5757 },
+        { 0x0023, 0x0039 },
+        { 0x0024, 0x000b },
+        { 0x0026, 0xc0c0 },
+        { 0x0027, 0xc0c0 },
+        { 0x0028, 0xc0c0 },
+        { 0x0029, 0x8080 },
+        { 0x002a, 0xaaaa },
+        { 0x002b, 0xaaaa },
+        { 0x002c, 0xaba8 },
+        { 0x002d, 0x0000 },
+        { 0x002e, 0x0000 },
+        { 0x002f, 0x0000 },
+        { 0x0030, 0x0000 },
+        { 0x0031, 0x5000 },
+        { 0x0032, 0x0000 },
+        { 0x0033, 0x0000 },
+        { 0x0034, 0x0000 },
+        { 0x0035, 0x0000 },
+        { 0x003a, 0x0000 },
+        { 0x003b, 0x0000 },
+        { 0x003c, 0x00ff },
+        { 0x003d, 0x0000 },
+        { 0x003e, 0x00ff },
+        { 0x003f, 0x0000 },
+        { 0x0040, 0x0000 },
+        { 0x0041, 0x00ff },
+        { 0x0042, 0x0000 },
+        { 0x0043, 0x00ff },
+        { 0x0044, 0x0c0c },
+        { 0x0049, 0xc00b },
+        { 0x004a, 0x0000 },
+        { 0x004b, 0x031f },
+        { 0x004d, 0x0000 },
+        { 0x004e, 0x001f },
+        { 0x004f, 0x0000 },
+        { 0x0050, 0x001f },
+        { 0x0052, 0xf000 },
+        { 0x0061, 0x0000 },
+        { 0x0062, 0x0000 },
+        { 0x0063, 0x003e },
+        { 0x0064, 0x0000 },
+        { 0x0065, 0x0000 },
+        { 0x0066, 0x003f },
+        { 0x0067, 0x0000 },
+        { 0x006b, 0x0000 },
+        { 0x006d, 0xff00 },
+        { 0x006e, 0x2808 },
+        { 0x006f, 0x000a },
+        { 0x0070, 0x8000 },
+        { 0x0071, 0x8000 },
+        { 0x0072, 0x8000 },
+        { 0x0073, 0x7000 },
+        { 0x0074, 0x7770 },
+        { 0x0075, 0x0002 },
+        { 0x0076, 0x0001 },
+        { 0x0078, 0x00f0 },
+        { 0x0079, 0x0000 },
+        { 0x007a, 0x0000 },
+        { 0x007b, 0x0000 },
+        { 0x007c, 0x0000 },
+        { 0x007d, 0x0123 },
+        { 0x007e, 0x4500 },
+        { 0x007f, 0x8003 },
+        { 0x0080, 0x0000 },
+        { 0x0081, 0x0000 },
+        { 0x0082, 0x0000 },
+        { 0x0083, 0x0000 },
+        { 0x0084, 0x0000 },
+        { 0x0085, 0x0000 },
+        { 0x0086, 0x0008 },
+        { 0x0087, 0x0000 },
+        { 0x0088, 0x0000 },
+        { 0x0089, 0x0000 },
+        { 0x008a, 0x0000 },
+        { 0x008b, 0x0000 },
+        { 0x008c, 0x0003 },
+        { 0x008e, 0x0060 },
+        { 0x008f, 0x1000 },
+        { 0x0091, 0x0c26 },
+        { 0x0092, 0x0073 },
+        { 0x0093, 0x0000 },
+        { 0x0094, 0x0080 },
+        { 0x0098, 0x0000 },
+        { 0x0099, 0x0000 },
+        { 0x009a, 0x0007 },
+        { 0x009f, 0x0000 },
+        { 0x00a0, 0x0000 },
+        { 0x00a1, 0x0002 },
+        { 0x00a2, 0x0001 },
+        { 0x00a3, 0x0002 },
+        { 0x00a4, 0x0001 },
+        { 0x00ae, 0x2040 },
+        { 0x00af, 0x0000 },
+        { 0x00b6, 0x0000 },
+        { 0x00b7, 0x0000 },
+        { 0x00b8, 0x0000 },
+        { 0x00b9, 0x0000 },
+        { 0x00ba, 0x0002 },
+        { 0x00bb, 0x0000 },
+        { 0x00be, 0x0000 },
+        { 0x00c0, 0x0000 },
+        { 0x00c1, 0x0aaa },
+        { 0x00c2, 0xaa80 },
+        { 0x00c3, 0x0003 },
+        { 0x00c4, 0x0000 },
+        { 0x00d0, 0x0000 },
+        { 0x00d1, 0x2244 },
+        { 0x00d2, 0x0000 },
+        { 0x00d3, 0x3300 },
+        { 0x00d4, 0x2200 },
+        { 0x00d9, 0x0809 },
+        { 0x00da, 0x0000 },
+        { 0x00db, 0x0008 },
+        { 0x00dc, 0x00c0 },
+        { 0x00dd, 0x6724 },
+        { 0x00de, 0x3131 },
+        { 0x00df, 0x0008 },
+        { 0x00e0, 0x4000 },
+        { 0x00e1, 0x3131 },
+        { 0x00e2, 0x600c },
+        { 0x00ea, 0xb320 },
+        { 0x00eb, 0x0000 },
+        { 0x00ec, 0xb300 },
+        { 0x00ed, 0x0000 },
+        { 0x00ee, 0xb320 },
+        { 0x00ef, 0x0000 },
+        { 0x00f0, 0x0201 },
+        { 0x00f1, 0x0ddd },
+        { 0x00f2, 0x0ddd },
+        { 0x00f6, 0x0000 },
+        { 0x00f7, 0x0000 },
+        { 0x00f8, 0x0000 },
+        { 0x00fa, 0x0000 },
+        { 0x00fb, 0x0000 },
+        { 0x00fc, 0x0000 },
+        { 0x00fd, 0x0000 },
+        { 0x00fe, 0x10ec },
+        { 0x00ff, 0x6451 },
+        { 0x0100, 0xaaaa },
+        { 0x0101, 0x000a },
+        { 0x010a, 0xaaaa },
+        { 0x010b, 0xa0a0 },
+        { 0x010c, 0xaeae },
+        { 0x010d, 0xaaaa },
+        { 0x010e, 0xaaaa },
+        { 0x010f, 0xaaaa },
+        { 0x0110, 0xe002 },
+        { 0x0111, 0xa602 },
+        { 0x0112, 0xaaaa },
+        { 0x0113, 0x2000 },
+        { 0x0117, 0x0f00 },
+        { 0x0125, 0x0420 },
+        { 0x0132, 0x0000 },
+        { 0x0133, 0x0000 },
+        { 0x0136, 0x5555 },
+        { 0x0137, 0x5540 },
+        { 0x0138, 0x3700 },
+        { 0x0139, 0x79a1 },
+        { 0x013a, 0x2020 },
+        { 0x013b, 0x2020 },
+        { 0x013c, 0x2005 },
+        { 0x013f, 0x0000 },
+        { 0x0145, 0x0002 },
+        { 0x0146, 0x0000 },
+        { 0x0147, 0x0000 },
+        { 0x0148, 0x0000 },
+        { 0x0160, 0x4ec0 },
+        { 0x0161, 0x0080 },
+        { 0x0162, 0x0200 },
+        { 0x0163, 0x0800 },
+        { 0x0164, 0x0000 },
+        { 0x0165, 0x0000 },
+        { 0x0166, 0x0000 },
+        { 0x0167, 0x000f },
+        { 0x0168, 0x000f },
+        { 0x0170, 0x4e80 },
+        { 0x0171, 0x0080 },
+        { 0x0172, 0x0200 },
+        { 0x0173, 0x0800 },
+        { 0x0174, 0x00ff },
+        { 0x0175, 0x0000 },
+        { 0x0190, 0x4131 },
+        { 0x0191, 0x4131 },
+        { 0x0192, 0x4131 },
+        { 0x0193, 0x4131 },
+        { 0x0194, 0x0000 },
+        { 0x0195, 0x0000 },
+        { 0x0196, 0x0000 },
+        { 0x0197, 0x0000 },
+        { 0x0198, 0x0000 },
+        { 0x0199, 0x0000 },
+        { 0x01a0, 0x1e64 },
+        { 0x01a1, 0x06a3 },
+        { 0x01a2, 0x0000 },
+        { 0x01a3, 0x0000 },
+        { 0x01a4, 0x0000 },
+        { 0x01a5, 0x0000 },
+        { 0x01a6, 0x0000 },
+        { 0x01a7, 0x0000 },
+        { 0x01a8, 0x0000 },
+        { 0x01a9, 0x0000 },
+        { 0x01aa, 0x0000 },
+        { 0x01ab, 0x0000 },
+        { 0x01b5, 0x0000 },
+        { 0x01b6, 0x01c3 },
+        { 0x01b7, 0x02a0 },
+        { 0x01b8, 0x03e9 },
+        { 0x01b9, 0x1389 },
+        { 0x01ba, 0xc351 },
+        { 0x01bb, 0x0009 },
+        { 0x01bc, 0x0018 },
+        { 0x01bd, 0x002a },
+        { 0x01be, 0x004c },
+        { 0x01bf, 0x0097 },
+        { 0x01c0, 0x433d },
+        { 0x01c1, 0x0000 },
+        { 0x01c2, 0x0000 },
+        { 0x01c3, 0x0000 },
+        { 0x01c4, 0x0000 },
+        { 0x01c5, 0x0000 },
+        { 0x01c6, 0x0000 },
+        { 0x01c7, 0x0000 },
+        { 0x01c8, 0x40af },
+        { 0x01c9, 0x0702 },
+        { 0x01ca, 0x0000 },
+        { 0x01cb, 0x0000 },
+        { 0x01cc, 0x5757 },
+        { 0x01cd, 0x5757 },
+        { 0x01ce, 0x5757 },
+        { 0x01cf, 0x5757 },
+        { 0x01d0, 0x5757 },
+        { 0x01d1, 0x5757 },
+        { 0x01d2, 0x5757 },
+        { 0x01d3, 0x5757 },
+        { 0x01d4, 0x5757 },
+        { 0x01d5, 0x5757 },
+        { 0x01d6, 0x003c },
+        { 0x01da, 0x0000 },
+        { 0x01db, 0x0000 },
+        { 0x01dc, 0x0000 },
+        { 0x01de, 0x7c00 },
+        { 0x01df, 0x0320 },
+        { 0x01e0, 0x06a1 },
+        { 0x01e1, 0x0000 },
+        { 0x01e2, 0x0000 },
+        { 0x01e3, 0x0000 },
+        { 0x01e4, 0x0000 },
+        { 0x01e5, 0x0000 },
+        { 0x01e6, 0x0001 },
+        { 0x01e7, 0x0000 },
+        { 0x01e8, 0x0000 },
+        { 0x01ea, 0x0000 },
+        { 0x01eb, 0x0000 },
+        { 0x01ec, 0x0000 },
+        { 0x01ed, 0x0000 },
+        { 0x01ee, 0x0000 },
+        { 0x01ef, 0x0000 },
+        { 0x01f0, 0x0000 },
+        { 0x01f1, 0x0000 },
+        { 0x01f2, 0x0000 },
+        { 0x01f3, 0x0000 },
+        { 0x01f4, 0x0000 },
+        { 0x0200, 0x0000 },
+        { 0x0201, 0x0000 },
+        { 0x0202, 0x0000 },
+        { 0x0203, 0x0000 },
+        { 0x0204, 0x0000 },
+        { 0x0205, 0x0000 },
+        { 0x0206, 0x0000 },
+        { 0x0207, 0x0000 },
+        { 0x0208, 0x0000 },
+        { 0x0210, 0x60b1 },
+        { 0x0211, 0xa000 },
+        { 0x0212, 0x024c },
+        { 0x0213, 0xf7ff },
+        { 0x0214, 0x024c },
+        { 0x0215, 0x0102 },
+        { 0x0216, 0x00a3 },
+        { 0x0217, 0x0048 },
+        { 0x0218, 0x92c0 },
+        { 0x0219, 0x0000 },
+        { 0x021a, 0x00c8 },
+        { 0x021b, 0x0020 },
+        { 0x02fa, 0x0000 },
+        { 0x02fb, 0x0000 },
+        { 0x02fc, 0x0000 },
+        { 0x02ff, 0x0110 },
+        { 0x0300, 0x001f },
+        { 0x0301, 0x032c },
+        { 0x0302, 0x5f21 },
+        { 0x0303, 0x4000 },
+        { 0x0304, 0x4000 },
+        { 0x0305, 0x06d5 },
+        { 0x0306, 0x8000 },
+        { 0x0307, 0x0700 },
+        { 0x0310, 0x4560 },
+        { 0x0311, 0xa4a8 },
+        { 0x0312, 0x7418 },
+        { 0x0313, 0x0000 },
+        { 0x0314, 0x0006 },
+        { 0x0315, 0xffff },
+        { 0x0316, 0xc400 },
+        { 0x0317, 0x0000 },
+        { 0x0330, 0x00a6 },
+        { 0x0331, 0x04c3 },
+        { 0x0332, 0x27c8 },
+        { 0x0333, 0xbf50 },
+        { 0x0334, 0x0045 },
+        { 0x0335, 0x0007 },
+        { 0x0336, 0x7418 },
+        { 0x0337, 0x0501 },
+        { 0x0338, 0x0000 },
+        { 0x0339, 0x0010 },
+        { 0x033a, 0x1010 },
+        { 0x03c0, 0x7e00 },
+        { 0x03c1, 0x8000 },
+        { 0x03c2, 0x8000 },
+        { 0x03c3, 0x8000 },
+        { 0x03c4, 0x8000 },
+        { 0x03c5, 0x8000 },
+        { 0x03c6, 0x8000 },
+        { 0x03c7, 0x8000 },
+        { 0x03c8, 0x8000 },
+        { 0x03c9, 0x8000 },
+        { 0x03ca, 0x8000 },
+        { 0x03cb, 0x8000 },
+        { 0x03cc, 0x8000 },
+        { 0x03d0, 0x0000 },
+        { 0x03d1, 0x0000 },
+        { 0x03d2, 0x0000 },
+        { 0x03d3, 0x0000 },
+        { 0x03d4, 0x2000 },
+        { 0x03d5, 0x2000 },
+        { 0x03d6, 0x0000 },
+        { 0x03d7, 0x0000 },
+        { 0x03d8, 0x2000 },
+        { 0x03d9, 0x2000 },
+        { 0x03da, 0x2000 },
+        { 0x03db, 0x2000 },
+        { 0x03dc, 0x0000 },
+        { 0x03dd, 0x0000 },
+        { 0x03de, 0x0000 },
+        { 0x03df, 0x2000 },
+        { 0x03e0, 0x0000 },
+        { 0x03e1, 0x0000 },
+        { 0x03e2, 0x0000 },
+        { 0x03e3, 0x0000 },
+        { 0x03e4, 0x0000 },
+        { 0x03e5, 0x0000 },
+        { 0x03e6, 0x0000 },
+        { 0x03e7, 0x0000 },
+        { 0x03e8, 0x0000 },
+        { 0x03e9, 0x0000 },
+        { 0x03ea, 0x0000 },
+        { 0x03eb, 0x0000 },
+        { 0x03ec, 0x0000 },
+        { 0x03ed, 0x0000 },
+        { 0x03ee, 0x0000 },
+        { 0x03ef, 0x0000 },
+        { 0x03f0, 0x0800 },
+        { 0x03f1, 0x0800 },
+        { 0x03f2, 0x0800 },
+        { 0x03f3, 0x0800 },
+        { 0x03fe, 0x0000 },
+        { 0x03ff, 0x0000 },
+        { 0x07f0, 0x0000 },
+        { 0x07fa, 0x0000 },
+};
+
+static const struct reg_default rt5663_reg[] = {
+        { 0x0000, 0x0000 },
+        { 0x0002, 0x0008 },
+        { 0x0005, 0x1000 },
+        { 0x0006, 0x1000 },
+        { 0x000a, 0x0000 },
+        { 0x0010, 0x000f },
+        { 0x0015, 0x42c1 },
+        { 0x0016, 0x0000 },
+        { 0x0018, 0x000b },
+        { 0x0019, 0xafaf },
+        { 0x001c, 0x2f2f },
+        { 0x001f, 0x0000 },
+        { 0x0022, 0x5757 },
+        { 0x0023, 0x0039 },
+        { 0x0026, 0xc0c0 },
+        { 0x0029, 0x8080 },
+        { 0x002a, 0xa0a0 },
+        { 0x002c, 0x000c },
+        { 0x002d, 0x0000 },
+        { 0x0040, 0x0808 },
+        { 0x0061, 0x0000 },
+        { 0x0062, 0x0000 },
+        { 0x0063, 0x003e },
+        { 0x0064, 0x0000 },
+        { 0x0065, 0x0000 },
+        { 0x0066, 0x0000 },
+        { 0x006b, 0x0000 },
+        { 0x006e, 0x0000 },
+        { 0x006f, 0x0000 },
+        { 0x0070, 0x8020 },
+        { 0x0073, 0x1000 },
+        { 0x0074, 0xe400 },
+        { 0x0075, 0x0002 },
+        { 0x0076, 0x0001 },
+        { 0x0077, 0x00f0 },
+        { 0x0078, 0x0000 },
+        { 0x0079, 0x0000 },
+        { 0x007a, 0x0123 },
+        { 0x007b, 0x8003 },
+        { 0x0080, 0x0000 },
+        { 0x0081, 0x0000 },
+        { 0x0082, 0x0000 },
+        { 0x0083, 0x0000 },
+        { 0x0084, 0x0000 },
+        { 0x0086, 0x0008 },
+        { 0x0087, 0x0000 },
+        { 0x008a, 0x0000 },
+        { 0x008b, 0x0000 },
+        { 0x008c, 0x0003 },
+        { 0x008e, 0x0004 },
+        { 0x008f, 0x1000 },
+        { 0x0090, 0x0646 },
+        { 0x0091, 0x0e3e },
+        { 0x0092, 0x1071 },
+        { 0x0093, 0x0000 },
+        { 0x0094, 0x0080 },
+        { 0x0097, 0x0000 },
+        { 0x0098, 0x0000 },
+        { 0x009a, 0x0000 },
+        { 0x009f, 0x0000 },
+        { 0x00ae, 0x2000 },
+        { 0x00af, 0x0000 },
+        { 0x00b6, 0x0000 },
+        { 0x00b7, 0x0000 },
+        { 0x00b8, 0x0000 },
+        { 0x00ba, 0x0000 },
+        { 0x00bb, 0x0000 },
+        { 0x00be, 0x0000 },
+        { 0x00bf, 0x0000 },
+        { 0x00c0, 0x0000 },
+        { 0x00c1, 0x0000 },
+        { 0x00c5, 0x0000 },
+        { 0x00cb, 0xa02f },
+        { 0x00cc, 0x0000 },
+        { 0x00cd, 0x0e02 },
+        { 0x00d9, 0x08f9 },
+        { 0x00db, 0x0008 },
+        { 0x00dc, 0x00c0 },
+        { 0x00dd, 0x6724 },
+        { 0x00de, 0x3131 },
+        { 0x00df, 0x0008 },
+        { 0x00e0, 0x4000 },
+        { 0x00e1, 0x3131 },
+        { 0x00e2, 0x0043 },
+        { 0x00e4, 0x400b },
+        { 0x00e5, 0x8031 },
+        { 0x00e6, 0x3080 },
+        { 0x00e7, 0x4100 },
+        { 0x00e8, 0x1400 },
+        { 0x00e9, 0xe00a },
+        { 0x00ea, 0x0404 },
+        { 0x00eb, 0x0404 },
+        { 0x00ec, 0xb320 },
+        { 0x00ed, 0x0000 },
+        { 0x00f4, 0x0000 },
+        { 0x00f6, 0x0000 },
+        { 0x00f8, 0x0000 },
+        { 0x00fa, 0x8000 },
+        { 0x00fd, 0x0001 },
+        { 0x00fe, 0x10ec },
+        { 0x00ff, 0x6406 },
+        { 0x0100, 0xa0a0 },
+        { 0x0108, 0x4444 },
+        { 0x0109, 0x4444 },
+        { 0x010a, 0xaaaa },
+        { 0x010b, 0x00a0 },
+        { 0x010c, 0x8aaa },
+        { 0x010d, 0xaaaa },
+        { 0x010e, 0x2aaa },
+        { 0x010f, 0x002a },
+        { 0x0110, 0xa0a4 },
+        { 0x0111, 0x4602 },
+        { 0x0112, 0x0101 },
+        { 0x0113, 0x2000 },
+        { 0x0114, 0x0000 },
+        { 0x0116, 0x0000 },
+        { 0x0117, 0x0f00 },
+        { 0x0118, 0x0006 },
+        { 0x0125, 0x2224 },
+        { 0x0126, 0x5550 },
+        { 0x0127, 0x0400 },
+        { 0x0128, 0x7711 },
+        { 0x0132, 0x0004 },
+        { 0x0137, 0x5441 },
+        { 0x0139, 0x79a1 },
+        { 0x013a, 0x30c0 },
+        { 0x013b, 0x2000 },
+        { 0x013c, 0x2005 },
+        { 0x013d, 0x30c0 },
+        { 0x013e, 0x0000 },
+        { 0x0140, 0x3700 },
+        { 0x0141, 0x1f00 },
+        { 0x0144, 0x0000 },
+        { 0x0145, 0x0002 },
+        { 0x0146, 0x0000 },
+        { 0x0160, 0x0e80 },
+        { 0x0161, 0x0020 },
+        { 0x0162, 0x0080 },
+        { 0x0163, 0x0800 },
+        { 0x0164, 0x0000 },
+        { 0x0165, 0x0000 },
+        { 0x0166, 0x0000 },
+        { 0x0167, 0x1417 },
+        { 0x0168, 0x0017 },
+        { 0x0169, 0x0017 },
+        { 0x0180, 0x2000 },
+        { 0x0181, 0x0000 },
+        { 0x0182, 0x0000 },
+        { 0x0183, 0x2000 },
+        { 0x0184, 0x0000 },
+        { 0x0185, 0x0000 },
+        { 0x01b0, 0x4b30 },
+        { 0x01b1, 0x0000 },
+        { 0x01b2, 0xd870 },
+        { 0x01b3, 0x0000 },
+        { 0x01b4, 0x0030 },
+        { 0x01b5, 0x5757 },
+        { 0x01b6, 0x5757 },
+        { 0x01b7, 0x5757 },
+        { 0x01b8, 0x5757 },
+        { 0x01c0, 0x433d },
+        { 0x01c1, 0x0540 },
+        { 0x01c2, 0x0000 },
+        { 0x01c3, 0x0000 },
+        { 0x01c4, 0x0000 },
+        { 0x01c5, 0x0009 },
+        { 0x01c6, 0x0018 },
+        { 0x01c7, 0x002a },
+        { 0x01c8, 0x004c },
+        { 0x01c9, 0x0097 },
+        { 0x01ca, 0x01c3 },
+        { 0x01cb, 0x03e9 },
+        { 0x01cc, 0x1389 },
+        { 0x01cd, 0xc351 },
+        { 0x01ce, 0x0000 },
+        { 0x01cf, 0x0000 },
+        { 0x01d0, 0x0000 },
+        { 0x01d1, 0x0000 },
+        { 0x01d2, 0x0000 },
+        { 0x01d3, 0x003c },
+        { 0x01d4, 0x5757 },
+        { 0x01d5, 0x5757 },
+        { 0x01d6, 0x5757 },
+        { 0x01d7, 0x5757 },
+        { 0x01d8, 0x5757 },
+        { 0x01d9, 0x5757 },
+        { 0x01da, 0x0000 },
+        { 0x01db, 0x0000 },
+        { 0x01dd, 0x0009 },
+        { 0x01de, 0x7f00 },
+        { 0x01df, 0x00c8 },
+        { 0x01e0, 0x0691 },
+        { 0x01e1, 0x0000 },
+        { 0x01e2, 0x0000 },
+        { 0x01e3, 0x0000 },
+        { 0x01e4, 0x0000 },
+        { 0x01e5, 0x0040 },
+        { 0x01e6, 0x0000 },
+        { 0x01e7, 0x0000 },
+        { 0x01e8, 0x0000 },
+        { 0x01ea, 0x0000 },
+        { 0x01eb, 0x0000 },
+        { 0x01ec, 0x0000 },
+        { 0x01ed, 0x0000 },
+        { 0x01ee, 0x0000 },
+        { 0x01ef, 0x0000 },
+        { 0x01f0, 0x0000 },
+        { 0x01f1, 0x0000 },
+        { 0x01f2, 0x0000 },
+        { 0x0200, 0x0000 },
+        { 0x0201, 0x2244 },
+        { 0x0202, 0xaaaa },
+        { 0x0250, 0x8010 },
+        { 0x0251, 0x0000 },
+        { 0x0252, 0x028a },
+        { 0x02fa, 0x0000 },
+        { 0x02fb, 0x0000 },
+        { 0x02fc, 0x0000 },
+        { 0x0300, 0x0000 },
+        { 0x03d0, 0x0000 },
+        { 0x03d1, 0x0000 },
+        { 0x03d2, 0x0000 },
+        { 0x03d3, 0x0000 },
+        { 0x03d4, 0x2000 },
+        { 0x03d5, 0x2000 },
+        { 0x03d6, 0x0000 },
+        { 0x03d7, 0x0000 },
+        { 0x03d8, 0x2000 },
+        { 0x03d9, 0x2000 },
+        { 0x03da, 0x2000 },
+        { 0x03db, 0x2000 },
+        { 0x03dc, 0x0000 },
+        { 0x03dd, 0x0000 },
+        { 0x03de, 0x0000 },
+        { 0x03df, 0x2000 },
+        { 0x03e0, 0x0000 },
+        { 0x03e1, 0x0000 },
+        { 0x03e2, 0x0000 },
+        { 0x03e3, 0x0000 },
+        { 0x03e4, 0x0000 },
+        { 0x03e5, 0x0000 },
+        { 0x03e6, 0x0000 },
+        { 0x03e7, 0x0000 },
+        { 0x03e8, 0x0000 },
+        { 0x03e9, 0x0000 },
+        { 0x03ea, 0x0000 },
+        { 0x03eb, 0x0000 },
+        { 0x03ec, 0x0000 },
+        { 0x03ed, 0x0000 },
+        { 0x03ee, 0x0000 },
+        { 0x03ef, 0x0000 },
+        { 0x03f0, 0x0800 },
+        { 0x03f1, 0x0800 },
+        { 0x03f2, 0x0800 },
+        { 0x03f3, 0x0800 },
+};
+
+static bool rt5663_volatile_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case RT5663_RESET:
+        case RT5663_SIL_DET_CTL:
+        case RT5663_HP_IMP_GAIN_2:
+        case RT5663_AD_DA_MIXER:
+        case RT5663_FRAC_DIV_2:
+        case RT5663_MICBIAS_1:
+        case RT5663_ASRC_11_2:
+        case RT5663_ADC_EQ_1:
+        case RT5663_INT_ST_1:
+        case RT5663_INT_ST_2:
+        case RT5663_GPIO_STA:
+        case RT5663_SIN_GEN_1:
+        case RT5663_IL_CMD_1:
+        case RT5663_IL_CMD_5:
+        case RT5663_IL_CMD_PWRSAV1:
+        case RT5663_EM_JACK_TYPE_1:
+        case RT5663_EM_JACK_TYPE_2:
+        case RT5663_EM_JACK_TYPE_3:
+        case RT5663_JD_CTRL2:
+        case RT5663_VENDOR_ID:
+        case RT5663_VENDOR_ID_1:
+        case RT5663_VENDOR_ID_2:
+        case RT5663_PLL_INT_REG:
+        case RT5663_SOFT_RAMP:
+        case RT5663_STO_DRE_1:
+        case RT5663_STO_DRE_5:
+        case RT5663_STO_DRE_6:
+        case RT5663_STO_DRE_7:
+        case RT5663_MIC_DECRO_1:
+        case RT5663_MIC_DECRO_4:
+        case RT5663_HP_IMP_SEN_1:
+        case RT5663_HP_IMP_SEN_3:
+        case RT5663_HP_IMP_SEN_4:
+        case RT5663_HP_IMP_SEN_5:
+        case RT5663_HP_CALIB_1_1:
+        case RT5663_HP_CALIB_9:
+        case RT5663_HP_CALIB_ST1:
+        case RT5663_HP_CALIB_ST2:
+        case RT5663_HP_CALIB_ST3:
+        case RT5663_HP_CALIB_ST4:
+        case RT5663_HP_CALIB_ST5:
+        case RT5663_HP_CALIB_ST6:
+        case RT5663_HP_CALIB_ST7:
+        case RT5663_HP_CALIB_ST8:
+        case RT5663_HP_CALIB_ST9:
+        case RT5663_ANA_JD:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool rt5663_readable_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case RT5663_RESET:
+        case RT5663_HP_OUT_EN:
+        case RT5663_HP_LCH_DRE:
+        case RT5663_HP_RCH_DRE:
+        case RT5663_CALIB_BST:
+        case RT5663_RECMIX:
+        case RT5663_SIL_DET_CTL:
+        case RT5663_PWR_SAV_SILDET:
+        case RT5663_SIDETONE_CTL:
+        case RT5663_STO1_DAC_DIG_VOL:
+        case RT5663_STO1_ADC_DIG_VOL:
+        case RT5663_STO1_BOOST:
+        case RT5663_HP_IMP_GAIN_1:
+        case RT5663_HP_IMP_GAIN_2:
+        case RT5663_STO1_ADC_MIXER:
+        case RT5663_AD_DA_MIXER:
+        case RT5663_STO_DAC_MIXER:
+        case RT5663_DIG_SIDE_MIXER:
+        case RT5663_BYPASS_STO_DAC:
+        case RT5663_CALIB_REC_MIX:
+        case RT5663_PWR_DIG_1:
+        case RT5663_PWR_DIG_2:
+        case RT5663_PWR_ANLG_1:
+        case RT5663_PWR_ANLG_2:
+        case RT5663_PWR_ANLG_3:
+        case RT5663_PWR_MIXER:
+        case RT5663_SIG_CLK_DET:
+        case RT5663_PRE_DIV_GATING_1:
+        case RT5663_PRE_DIV_GATING_2:
+        case RT5663_I2S1_SDP:
+        case RT5663_ADDA_CLK_1:
+        case RT5663_ADDA_RST:
+        case RT5663_FRAC_DIV_1:
+        case RT5663_FRAC_DIV_2:
+        case RT5663_TDM_1:
+        case RT5663_TDM_2:
+        case RT5663_TDM_3:
+        case RT5663_TDM_4:
+        case RT5663_TDM_5:
+        case RT5663_GLB_CLK:
+        case RT5663_PLL_1:
+        case RT5663_PLL_2:
+        case RT5663_ASRC_1:
+        case RT5663_ASRC_2:
+        case RT5663_ASRC_4:
+        case RT5663_DUMMY_REG:
+        case RT5663_ASRC_8:
+        case RT5663_ASRC_9:
+        case RT5663_ASRC_11:
+        case RT5663_DEPOP_1:
+        case RT5663_DEPOP_2:
+        case RT5663_DEPOP_3:
+        case RT5663_HP_CHARGE_PUMP_1:
+        case RT5663_HP_CHARGE_PUMP_2:
+        case RT5663_MICBIAS_1:
+        case RT5663_RC_CLK:
+        case RT5663_ASRC_11_2:
+        case RT5663_DUMMY_REG_2:
+        case RT5663_REC_PATH_GAIN:
+        case RT5663_AUTO_1MRC_CLK:
+        case RT5663_ADC_EQ_1:
+        case RT5663_ADC_EQ_2:
+        case RT5663_IRQ_1:
+        case RT5663_IRQ_2:
+        case RT5663_IRQ_3:
+        case RT5663_IRQ_4:
+        case RT5663_IRQ_5:
+        case RT5663_INT_ST_1:
+        case RT5663_INT_ST_2:
+        case RT5663_GPIO_1:
+        case RT5663_GPIO_2:
+        case RT5663_GPIO_STA:
+        case RT5663_SIN_GEN_1:
+        case RT5663_SIN_GEN_2:
+        case RT5663_SIN_GEN_3:
+        case RT5663_SOF_VOL_ZC1:
+        case RT5663_IL_CMD_1:
+        case RT5663_IL_CMD_2:
+        case RT5663_IL_CMD_3:
+        case RT5663_IL_CMD_4:
+        case RT5663_IL_CMD_5:
+        case RT5663_IL_CMD_6:
+        case RT5663_IL_CMD_7:
+        case RT5663_IL_CMD_8:
+        case RT5663_IL_CMD_PWRSAV1:
+        case RT5663_IL_CMD_PWRSAV2:
+        case RT5663_EM_JACK_TYPE_1:
+        case RT5663_EM_JACK_TYPE_2:
+        case RT5663_EM_JACK_TYPE_3:
+        case RT5663_EM_JACK_TYPE_4:
+        case RT5663_EM_JACK_TYPE_5:
+        case RT5663_EM_JACK_TYPE_6:
+        case RT5663_STO1_HPF_ADJ1:
+        case RT5663_STO1_HPF_ADJ2:
+        case RT5663_FAST_OFF_MICBIAS:
+        case RT5663_JD_CTRL1:
+        case RT5663_JD_CTRL2:
+        case RT5663_DIG_MISC:
+        case RT5663_VENDOR_ID:
+        case RT5663_VENDOR_ID_1:
+        case RT5663_VENDOR_ID_2:
+        case RT5663_DIG_VOL_ZCD:
+        case RT5663_ANA_BIAS_CUR_1:
+        case RT5663_ANA_BIAS_CUR_2:
+        case RT5663_ANA_BIAS_CUR_3:
+        case RT5663_ANA_BIAS_CUR_4:
+        case RT5663_ANA_BIAS_CUR_5:
+        case RT5663_ANA_BIAS_CUR_6:
+        case RT5663_BIAS_CUR_5:
+        case RT5663_BIAS_CUR_6:
+        case RT5663_BIAS_CUR_7:
+        case RT5663_BIAS_CUR_8:
+        case RT5663_DACREF_LDO:
+        case RT5663_DUMMY_REG_3:
+        case RT5663_BIAS_CUR_9:
+        case RT5663_DUMMY_REG_4:
+        case RT5663_VREFADJ_OP:
+        case RT5663_VREF_RECMIX:
+        case RT5663_CHARGE_PUMP_1:
+        case RT5663_CHARGE_PUMP_1_2:
+        case RT5663_CHARGE_PUMP_1_3:
+        case RT5663_CHARGE_PUMP_2:
+        case RT5663_DIG_IN_PIN1:
+        case RT5663_PAD_DRV_CTL:
+        case RT5663_PLL_INT_REG:
+        case RT5663_CHOP_DAC_L:
+        case RT5663_CHOP_ADC:
+        case RT5663_CALIB_ADC:
+        case RT5663_CHOP_DAC_R:
+        case RT5663_DUMMY_CTL_DACLR:
+        case RT5663_DUMMY_REG_5:
+        case RT5663_SOFT_RAMP:
+        case RT5663_TEST_MODE_1:
+        case RT5663_TEST_MODE_2:
+        case RT5663_TEST_MODE_3:
+        case RT5663_STO_DRE_1:
+        case RT5663_STO_DRE_2:
+        case RT5663_STO_DRE_3:
+        case RT5663_STO_DRE_4:
+        case RT5663_STO_DRE_5:
+        case RT5663_STO_DRE_6:
+        case RT5663_STO_DRE_7:
+        case RT5663_STO_DRE_8:
+        case RT5663_STO_DRE_9:
+        case RT5663_STO_DRE_10:
+        case RT5663_MIC_DECRO_1:
+        case RT5663_MIC_DECRO_2:
+        case RT5663_MIC_DECRO_3:
+        case RT5663_MIC_DECRO_4:
+        case RT5663_MIC_DECRO_5:
+        case RT5663_MIC_DECRO_6:
+        case RT5663_HP_DECRO_1:
+        case RT5663_HP_DECRO_2:
+        case RT5663_HP_DECRO_3:
+        case RT5663_HP_DECRO_4:
+        case RT5663_HP_DECOUP:
+        case RT5663_HP_IMP_SEN_MAP8:
+        case RT5663_HP_IMP_SEN_MAP9:
+        case RT5663_HP_IMP_SEN_MAP10:
+        case RT5663_HP_IMP_SEN_MAP11:
+        case RT5663_HP_IMP_SEN_1:
+        case RT5663_HP_IMP_SEN_2:
+        case RT5663_HP_IMP_SEN_3:
+        case RT5663_HP_IMP_SEN_4:
+        case RT5663_HP_IMP_SEN_5:
+        case RT5663_HP_IMP_SEN_6:
+        case RT5663_HP_IMP_SEN_7:
+        case RT5663_HP_IMP_SEN_8:
+        case RT5663_HP_IMP_SEN_9:
+        case RT5663_HP_IMP_SEN_10:
+        case RT5663_HP_IMP_SEN_11:
+        case RT5663_HP_IMP_SEN_12:
+        case RT5663_HP_IMP_SEN_13:
+        case RT5663_HP_IMP_SEN_14:
+        case RT5663_HP_IMP_SEN_15:
+        case RT5663_HP_IMP_SEN_16:
+        case RT5663_HP_IMP_SEN_17:
+        case RT5663_HP_IMP_SEN_18:
+        case RT5663_HP_IMP_SEN_19:
+        case RT5663_HP_IMPSEN_DIG5:
+        case RT5663_HP_IMPSEN_MAP1:
+        case RT5663_HP_IMPSEN_MAP2:
+        case RT5663_HP_IMPSEN_MAP3:
+        case RT5663_HP_IMPSEN_MAP4:
+        case RT5663_HP_IMPSEN_MAP5:
+        case RT5663_HP_IMPSEN_MAP7:
+        case RT5663_HP_LOGIC_1:
+        case RT5663_HP_LOGIC_2:
+        case RT5663_HP_CALIB_1:
+        case RT5663_HP_CALIB_1_1:
+        case RT5663_HP_CALIB_2:
+        case RT5663_HP_CALIB_3:
+        case RT5663_HP_CALIB_4:
+        case RT5663_HP_CALIB_5:
+        case RT5663_HP_CALIB_5_1:
+        case RT5663_HP_CALIB_6:
+        case RT5663_HP_CALIB_7:
+        case RT5663_HP_CALIB_9:
+        case RT5663_HP_CALIB_10:
+        case RT5663_HP_CALIB_11:
+        case RT5663_HP_CALIB_ST1:
+        case RT5663_HP_CALIB_ST2:
+        case RT5663_HP_CALIB_ST3:
+        case RT5663_HP_CALIB_ST4:
+        case RT5663_HP_CALIB_ST5:
+        case RT5663_HP_CALIB_ST6:
+        case RT5663_HP_CALIB_ST7:
+        case RT5663_HP_CALIB_ST8:
+        case RT5663_HP_CALIB_ST9:
+        case RT5663_HP_AMP_DET:
+        case RT5663_DUMMY_REG_6:
+        case RT5663_HP_BIAS:
+        case RT5663_CBJ_1:
+        case RT5663_CBJ_2:
+        case RT5663_CBJ_3:
+        case RT5663_DUMMY_1:
+        case RT5663_DUMMY_2:
+        case RT5663_DUMMY_3:
+        case RT5663_ANA_JD:
+        case RT5663_ADC_LCH_LPF1_A1:
+        case RT5663_ADC_RCH_LPF1_A1:
+        case RT5663_ADC_LCH_LPF1_H0:
+        case RT5663_ADC_RCH_LPF1_H0:
+        case RT5663_ADC_LCH_BPF1_A1:
+        case RT5663_ADC_RCH_BPF1_A1:
+        case RT5663_ADC_LCH_BPF1_A2:
+        case RT5663_ADC_RCH_BPF1_A2:
+        case RT5663_ADC_LCH_BPF1_H0:
+        case RT5663_ADC_RCH_BPF1_H0:
+        case RT5663_ADC_LCH_BPF2_A1:
+        case RT5663_ADC_RCH_BPF2_A1:
+        case RT5663_ADC_LCH_BPF2_A2:
+        case RT5663_ADC_RCH_BPF2_A2:
+        case RT5663_ADC_LCH_BPF2_H0:
+        case RT5663_ADC_RCH_BPF2_H0:
+        case RT5663_ADC_LCH_BPF3_A1:
+        case RT5663_ADC_RCH_BPF3_A1:
+        case RT5663_ADC_LCH_BPF3_A2:
+        case RT5663_ADC_RCH_BPF3_A2:
+        case RT5663_ADC_LCH_BPF3_H0:
+        case RT5663_ADC_RCH_BPF3_H0:
+        case RT5663_ADC_LCH_BPF4_A1:
+        case RT5663_ADC_RCH_BPF4_A1:
+        case RT5663_ADC_LCH_BPF4_A2:
+        case RT5663_ADC_RCH_BPF4_A2:
+        case RT5663_ADC_LCH_BPF4_H0:
+        case RT5663_ADC_RCH_BPF4_H0:
+        case RT5663_ADC_LCH_HPF1_A1:
+        case RT5663_ADC_RCH_HPF1_A1:
+        case RT5663_ADC_LCH_HPF1_H0:
+        case RT5663_ADC_RCH_HPF1_H0:
+        case RT5663_ADC_EQ_PRE_VOL_L:
+        case RT5663_ADC_EQ_PRE_VOL_R:
+        case RT5663_ADC_EQ_POST_VOL_L:
+        case RT5663_ADC_EQ_POST_VOL_R:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool rt5668_volatile_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case RT5663_RESET:
+        case RT5668_CBJ_TYPE_2:
+        case RT5668_PDM_OUT_CTL:
+        case RT5668_PDM_I2C_DATA_CTL1:
+        case RT5668_PDM_I2C_DATA_CTL4:
+        case RT5668_ALC_BK_GAIN:
+        case RT5663_PLL_2:
+        case RT5663_MICBIAS_1:
+        case RT5663_ADC_EQ_1:
+        case RT5663_INT_ST_1:
+        case RT5668_GPIO_STA:
+        case RT5663_IL_CMD_1:
+        case RT5663_IL_CMD_5:
+        case RT5668_A_JD_CTRL:
+        case RT5663_JD_CTRL2:
+        case RT5663_VENDOR_ID:
+        case RT5663_VENDOR_ID_1:
+        case RT5663_VENDOR_ID_2:
+        case RT5663_STO_DRE_1:
+        case RT5663_STO_DRE_5:
+        case RT5663_STO_DRE_6:
+        case RT5663_STO_DRE_7:
+        case RT5668_MONO_DYNA_6:
+        case RT5668_STO1_SIL_DET:
+        case RT5668_MONOL_SIL_DET:
+        case RT5668_MONOR_SIL_DET:
+        case RT5668_STO2_DAC_SIL:
+        case RT5668_MONO_AMP_CAL_ST1:
+        case RT5668_MONO_AMP_CAL_ST2:
+        case RT5668_MONO_AMP_CAL_ST3:
+        case RT5668_MONO_AMP_CAL_ST4:
+        case RT5663_HP_IMP_SEN_2:
+        case RT5663_HP_IMP_SEN_3:
+        case RT5663_HP_IMP_SEN_4:
+        case RT5663_HP_IMP_SEN_10:
+        case RT5663_HP_CALIB_1:
+        case RT5663_HP_CALIB_10:
+        case RT5663_HP_CALIB_ST1:
+        case RT5663_HP_CALIB_ST4:
+        case RT5663_HP_CALIB_ST5:
+        case RT5663_HP_CALIB_ST6:
+        case RT5663_HP_CALIB_ST7:
+        case RT5663_HP_CALIB_ST8:
+        case RT5663_HP_CALIB_ST9:
+        case RT5668_HP_CALIB_ST10:
+        case RT5668_HP_CALIB_ST11:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool rt5668_readable_register(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case RT5668_LOUT_CTRL:
+        case RT5668_HP_AMP_2:
+        case RT5668_MONO_OUT:
+        case RT5668_MONO_GAIN:
+        case RT5668_AEC_BST:
+        case RT5668_IN1_IN2:
+        case RT5668_IN3_IN4:
+        case RT5668_INL1_INR1:
+        case RT5668_CBJ_TYPE_2:
+        case RT5668_CBJ_TYPE_3:
+        case RT5668_CBJ_TYPE_4:
+        case RT5668_CBJ_TYPE_5:
+        case RT5668_CBJ_TYPE_8:
+        case RT5668_DAC3_DIG_VOL:
+        case RT5668_DAC3_CTRL:
+        case RT5668_MONO_ADC_DIG_VOL:
+        case RT5668_STO2_ADC_DIG_VOL:
+        case RT5668_MONO_ADC_BST_GAIN:
+        case RT5668_STO2_ADC_BST_GAIN:
+        case RT5668_SIDETONE_CTRL:
+        case RT5668_MONO1_ADC_MIXER:
+        case RT5668_STO2_ADC_MIXER:
+        case RT5668_MONO_DAC_MIXER:
+        case RT5668_DAC2_SRC_CTRL:
+        case RT5668_IF_3_4_DATA_CTL:
+        case RT5668_IF_5_DATA_CTL:
+        case RT5668_PDM_OUT_CTL:
+        case RT5668_PDM_I2C_DATA_CTL1:
+        case RT5668_PDM_I2C_DATA_CTL2:
+        case RT5668_PDM_I2C_DATA_CTL3:
+        case RT5668_PDM_I2C_DATA_CTL4:
+        case RT5668_RECMIX1_NEW:
+        case RT5668_RECMIX1L_0:
+        case RT5668_RECMIX1L:
+        case RT5668_RECMIX1R_0:
+        case RT5668_RECMIX1R:
+        case RT5668_RECMIX2_NEW:
+        case RT5668_RECMIX2_L_2:
+        case RT5668_RECMIX2_R:
+        case RT5668_RECMIX2_R_2:
+        case RT5668_CALIB_REC_LR:
+        case RT5668_ALC_BK_GAIN:
+        case RT5668_MONOMIX_GAIN:
+        case RT5668_MONOMIX_IN_GAIN:
+        case RT5668_OUT_MIXL_GAIN:
+        case RT5668_OUT_LMIX_IN_GAIN:
+        case RT5668_OUT_RMIX_IN_GAIN:
+        case RT5668_OUT_RMIX_IN_GAIN1:
+        case RT5668_LOUT_MIXER_CTRL:
+        case RT5668_PWR_VOL:
+        case RT5668_ADCDAC_RST:
+        case RT5668_I2S34_SDP:
+        case RT5668_I2S5_SDP:
+        case RT5668_TDM_5:
+        case RT5668_TDM_6:
+        case RT5668_TDM_7:
+        case RT5668_TDM_8:
+        case RT5668_ASRC_3:
+        case RT5668_ASRC_6:
+        case RT5668_ASRC_7:
+        case RT5668_PLL_TRK_13:
+        case RT5668_I2S_M_CLK_CTL:
+        case RT5668_FDIV_I2S34_M_CLK:
+        case RT5668_FDIV_I2S34_M_CLK2:
+        case RT5668_FDIV_I2S5_M_CLK:
+        case RT5668_FDIV_I2S5_M_CLK2:
+        case RT5668_IRQ_4:
+        case RT5668_GPIO_3:
+        case RT5668_GPIO_4:
+        case RT5668_GPIO_STA:
+        case RT5668_HP_AMP_DET1:
+        case RT5668_HP_AMP_DET2:
+        case RT5668_HP_AMP_DET3:
+        case RT5668_MID_BD_HP_AMP:
+        case RT5668_LOW_BD_HP_AMP:
+        case RT5668_SOF_VOL_ZC2:
+        case RT5668_ADC_STO2_ADJ1:
+        case RT5668_ADC_STO2_ADJ2:
+        case RT5668_A_JD_CTRL:
+        case RT5668_JD1_TRES_CTRL:
+        case RT5668_JD2_TRES_CTRL:
+        case RT5668_JD_CTRL2:
+        case RT5668_DUM_REG_2:
+        case RT5668_DUM_REG_3:
+        case RT5663_VENDOR_ID:
+        case RT5663_VENDOR_ID_1:
+        case RT5663_VENDOR_ID_2:
+        case RT5668_DACADC_DIG_VOL2:
+        case RT5668_DIG_IN_PIN2:
+        case RT5668_PAD_DRV_CTL1:
+        case RT5668_SOF_RAM_DEPOP:
+        case RT5668_VOL_TEST:
+        case RT5668_TEST_MODE_3:
+        case RT5668_TEST_MODE_4:
+        case RT5663_STO_DRE_9:
+        case RT5668_MONO_DYNA_1:
+        case RT5668_MONO_DYNA_2:
+        case RT5668_MONO_DYNA_3:
+        case RT5668_MONO_DYNA_4:
+        case RT5668_MONO_DYNA_5:
+        case RT5668_MONO_DYNA_6:
+        case RT5668_STO1_SIL_DET:
+        case RT5668_MONOL_SIL_DET:
+        case RT5668_MONOR_SIL_DET:
+        case RT5668_STO2_DAC_SIL:
+        case RT5668_PWR_SAV_CTL1:
+        case RT5668_PWR_SAV_CTL2:
+        case RT5668_PWR_SAV_CTL3:
+        case RT5668_PWR_SAV_CTL4:
+        case RT5668_PWR_SAV_CTL5:
+        case RT5668_PWR_SAV_CTL6:
+        case RT5668_MONO_AMP_CAL1:
+        case RT5668_MONO_AMP_CAL2:
+        case RT5668_MONO_AMP_CAL3:
+        case RT5668_MONO_AMP_CAL4:
+        case RT5668_MONO_AMP_CAL5:
+        case RT5668_MONO_AMP_CAL6:
+        case RT5668_MONO_AMP_CAL7:
+        case RT5668_MONO_AMP_CAL_ST1:
+        case RT5668_MONO_AMP_CAL_ST2:
+        case RT5668_MONO_AMP_CAL_ST3:
+        case RT5668_MONO_AMP_CAL_ST4:
+        case RT5668_MONO_AMP_CAL_ST5:
+        case RT5668_HP_IMP_SEN_13:
+        case RT5668_HP_IMP_SEN_14:
+        case RT5668_HP_IMP_SEN_6:
+        case RT5668_HP_IMP_SEN_7:
+        case RT5668_HP_IMP_SEN_8:
+        case RT5668_HP_IMP_SEN_9:
+        case RT5668_HP_IMP_SEN_10:
+        case RT5668_HP_LOGIC_3:
+        case RT5668_HP_CALIB_ST10:
+        case RT5668_HP_CALIB_ST11:
+        case RT5668_PRO_REG_TBL_4:
+        case RT5668_PRO_REG_TBL_5:
+        case RT5668_PRO_REG_TBL_6:
+        case RT5668_PRO_REG_TBL_7:
+        case RT5668_PRO_REG_TBL_8:
+        case RT5668_PRO_REG_TBL_9:
+        case RT5668_SAR_ADC_INL_1:
+        case RT5668_SAR_ADC_INL_2:
+        case RT5668_SAR_ADC_INL_3:
+        case RT5668_SAR_ADC_INL_4:
+        case RT5668_SAR_ADC_INL_5:
+        case RT5668_SAR_ADC_INL_6:
+        case RT5668_SAR_ADC_INL_7:
+        case RT5668_SAR_ADC_INL_8:
+        case RT5668_SAR_ADC_INL_9:
+        case RT5668_SAR_ADC_INL_10:
+        case RT5668_SAR_ADC_INL_11:
+        case RT5668_SAR_ADC_INL_12:
+        case RT5668_DRC_CTRL_1:
+        case RT5668_DRC1_CTRL_2:
+        case RT5668_DRC1_CTRL_3:
+        case RT5668_DRC1_CTRL_4:
+        case RT5668_DRC1_CTRL_5:
+        case RT5668_DRC1_CTRL_6:
+        case RT5668_DRC1_HD_CTRL_1:
+        case RT5668_DRC1_HD_CTRL_2:
+        case RT5668_DRC1_PRI_REG_1:
+        case RT5668_DRC1_PRI_REG_2:
+        case RT5668_DRC1_PRI_REG_3:
+        case RT5668_DRC1_PRI_REG_4:
+        case RT5668_DRC1_PRI_REG_5:
+        case RT5668_DRC1_PRI_REG_6:
+        case RT5668_DRC1_PRI_REG_7:
+        case RT5668_DRC1_PRI_REG_8:
+        case RT5668_ALC_PGA_CTL_1:
+        case RT5668_ALC_PGA_CTL_2:
+        case RT5668_ALC_PGA_CTL_3:
+        case RT5668_ALC_PGA_CTL_4:
+        case RT5668_ALC_PGA_CTL_5:
+        case RT5668_ALC_PGA_CTL_6:
+        case RT5668_ALC_PGA_CTL_7:
+        case RT5668_ALC_PGA_CTL_8:
+        case RT5668_ALC_PGA_REG_1:
+        case RT5668_ALC_PGA_REG_2:
+        case RT5668_ALC_PGA_REG_3:
+        case RT5668_ADC_EQ_RECOV_1:
+        case RT5668_ADC_EQ_RECOV_2:
+        case RT5668_ADC_EQ_RECOV_3:
+        case RT5668_ADC_EQ_RECOV_4:
+        case RT5668_ADC_EQ_RECOV_5:
+        case RT5668_ADC_EQ_RECOV_6:
+        case RT5668_ADC_EQ_RECOV_7:
+        case RT5668_ADC_EQ_RECOV_8:
+        case RT5668_ADC_EQ_RECOV_9:
+        case RT5668_ADC_EQ_RECOV_10:
+        case RT5668_ADC_EQ_RECOV_11:
+        case RT5668_ADC_EQ_RECOV_12:
+        case RT5668_ADC_EQ_RECOV_13:
+        case RT5668_VID_HIDDEN:
+        case RT5668_VID_CUSTOMER:
+        case RT5668_SCAN_MODE:
+        case RT5668_I2C_BYPA:
+                return true;
+        case RT5663_TDM_1:
+        case RT5663_DEPOP_3:
+        case RT5663_ASRC_11_2:
+        case RT5663_INT_ST_2:
+        case RT5663_GPIO_STA:
+        case RT5663_SIN_GEN_1:
+        case RT5663_SIN_GEN_2:
+        case RT5663_SIN_GEN_3:
+        case RT5663_IL_CMD_PWRSAV1:
+        case RT5663_IL_CMD_PWRSAV2:
+        case RT5663_EM_JACK_TYPE_1:
+        case RT5663_EM_JACK_TYPE_2:
+        case RT5663_EM_JACK_TYPE_3:
+        case RT5663_EM_JACK_TYPE_4:
+        case RT5663_FAST_OFF_MICBIAS:
+        case RT5663_ANA_BIAS_CUR_1:
+        case RT5663_ANA_BIAS_CUR_2:
+        case RT5663_BIAS_CUR_9:
+        case RT5663_DUMMY_REG_4:
+        case RT5663_VREF_RECMIX:
+        case RT5663_CHARGE_PUMP_1_2:
+        case RT5663_CHARGE_PUMP_1_3:
+        case RT5663_CHARGE_PUMP_2:
+        case RT5663_CHOP_DAC_R:
+        case RT5663_DUMMY_CTL_DACLR:
+        case RT5663_DUMMY_REG_5:
+        case RT5663_SOFT_RAMP:
+        case RT5663_TEST_MODE_1:
+        case RT5663_STO_DRE_10:
+        case RT5663_MIC_DECRO_1:
+        case RT5663_MIC_DECRO_2:
+        case RT5663_MIC_DECRO_3:
+        case RT5663_MIC_DECRO_4:
+        case RT5663_MIC_DECRO_5:
+        case RT5663_MIC_DECRO_6:
+        case RT5663_HP_DECRO_1:
+        case RT5663_HP_DECRO_2:
+        case RT5663_HP_DECRO_3:
+        case RT5663_HP_DECRO_4:
+        case RT5663_HP_DECOUP:
+        case RT5663_HP_IMPSEN_MAP4:
+        case RT5663_HP_IMPSEN_MAP5:
+        case RT5663_HP_IMPSEN_MAP7:
+        case RT5663_HP_CALIB_1:
+        case RT5663_CBJ_1:
+        case RT5663_CBJ_2:
+        case RT5663_CBJ_3:
+                return false;
+        default:
+                return rt5663_readable_register(dev, reg);
+        }
+}
+
+static const DECLARE_TLV_DB_SCALE(rt5663_hp_vol_tlv, -2400, 150, 0);
+static const DECLARE_TLV_DB_SCALE(rt5668_hp_vol_tlv, -2250, 150, 0);
+static const DECLARE_TLV_DB_SCALE(dac_vol_tlv, -6525, 75, 0);
+static const DECLARE_TLV_DB_SCALE(adc_vol_tlv, -1725, 75, 0);
+
+/* {0, +20, +24, +30, +35, +40, +44, +50, +52} dB */
+static const DECLARE_TLV_DB_RANGE(in_bst_tlv,
+        0, 0, TLV_DB_SCALE_ITEM(0, 0, 0),
+        1, 1, TLV_DB_SCALE_ITEM(2000, 0, 0),
+        2, 2, TLV_DB_SCALE_ITEM(2400, 0, 0),
+        3, 5, TLV_DB_SCALE_ITEM(3000, 500, 0),
+        6, 6, TLV_DB_SCALE_ITEM(4400, 0, 0),
+        7, 7, TLV_DB_SCALE_ITEM(5000, 0, 0),
+        8, 8, TLV_DB_SCALE_ITEM(5200, 0, 0)
+);
+
+/* Interface data select */
+static const char * const rt5663_if1_adc_data_select[] = {
+        "L/R", "R/L", "L/L", "R/R"
+};
+
+static SOC_ENUM_SINGLE_DECL(rt5663_if1_adc_enum, RT5663_TDM_2,
+        RT5663_DATA_SWAP_ADCDAT1_SHIFT, rt5663_if1_adc_data_select);
+
+static void rt5663_enable_push_button_irq(struct snd_soc_codec *codec,
+        bool enable)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        if (enable) {
+                snd_soc_update_bits(codec, RT5663_IL_CMD_6,
+                        RT5668_EN_4BTN_INL_MASK, RT5668_EN_4BTN_INL_EN);
+                /* reset in-line command */
+                snd_soc_update_bits(codec, RT5663_IL_CMD_6,
+                        RT5668_RESET_4BTN_INL_MASK,
+                        RT5668_RESET_4BTN_INL_RESET);
+                snd_soc_update_bits(codec, RT5663_IL_CMD_6,
+                        RT5668_RESET_4BTN_INL_MASK,
+                        RT5668_RESET_4BTN_INL_NOR);
+                switch (rt5663->codec_type) {
+                case CODEC_TYPE_RT5668:
+                        snd_soc_update_bits(codec, RT5663_IRQ_3,
+                                RT5668_EN_IRQ_INLINE_MASK,
+                                RT5668_EN_IRQ_INLINE_NOR);
+                        break;
+                case CODEC_TYPE_RT5663:
+                        snd_soc_update_bits(codec, RT5663_IRQ_2,
+                                RT5663_EN_IRQ_INLINE_MASK,
+                                RT5663_EN_IRQ_INLINE_NOR);
+                        break;
+                default:
+                        dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                }
+        } else {
+                switch (rt5663->codec_type) {
+                case CODEC_TYPE_RT5668:
+                        snd_soc_update_bits(codec, RT5663_IRQ_3,
+                                RT5668_EN_IRQ_INLINE_MASK,
+                                RT5668_EN_IRQ_INLINE_BYP);
+                        break;
+                case CODEC_TYPE_RT5663:
+                        snd_soc_update_bits(codec, RT5663_IRQ_2,
+                                RT5663_EN_IRQ_INLINE_MASK,
+                                RT5663_EN_IRQ_INLINE_BYP);
+                        break;
+                default:
+                        dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                }
+                snd_soc_update_bits(codec, RT5663_IL_CMD_6,
+                        RT5668_EN_4BTN_INL_MASK, RT5668_EN_4BTN_INL_DIS);
+                /* reset in-line command */
+                snd_soc_update_bits(codec, RT5663_IL_CMD_6,
+                        RT5668_RESET_4BTN_INL_MASK,
+                        RT5668_RESET_4BTN_INL_RESET);
+                snd_soc_update_bits(codec, RT5663_IL_CMD_6,
+                        RT5668_RESET_4BTN_INL_MASK,
+                        RT5668_RESET_4BTN_INL_NOR);
+        }
+}
+
+/**
+ * rt5668_jack_detect - Detect headset.
+ * @codec: SoC audio codec device.
+ * @jack_insert: Jack insert or not.
+ *
+ * Detect whether is headset or not when jack inserted.
+ *
+ * Returns detect status.
+ */
+
+static int rt5668_jack_detect(struct snd_soc_codec *codec, int jack_insert)
+{
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+        struct rt5663_priv *rt5668 = snd_soc_codec_get_drvdata(codec);
+        int val, i = 0, sleep_time[5] = {300, 150, 100, 50, 30};
+
+        dev_dbg(codec->dev, "%s jack_insert:%d\n", __func__, jack_insert);
+        if (jack_insert) {
+                snd_soc_write(codec, RT5668_CBJ_TYPE_2, 0x8040);
+                snd_soc_write(codec, RT5668_CBJ_TYPE_3, 0x1484);
+
+                snd_soc_dapm_force_enable_pin(dapm, "MICBIAS1");
+                snd_soc_dapm_force_enable_pin(dapm, "MICBIAS2");
+                snd_soc_dapm_force_enable_pin(dapm, "Mic Det Power");
+                snd_soc_dapm_force_enable_pin(dapm, "CBJ Power");
+                snd_soc_dapm_sync(dapm);
+                snd_soc_update_bits(codec, RT5663_RC_CLK,
+                        RT5668_DIG_1M_CLK_MASK, RT5668_DIG_1M_CLK_EN);
+                snd_soc_update_bits(codec, RT5663_RECMIX, 0x8, 0x8);
+
+                while (i < 5) {
+                        msleep(sleep_time[i]);
+                        val = snd_soc_read(codec, RT5668_CBJ_TYPE_2) & 0x0003;
+                        if (val == 0x1 || val == 0x2 || val == 0x3)
+                                break;
+                        dev_dbg(codec->dev, "%s: MX-0011 val=%x sleep %d\n",
+                                __func__, val, sleep_time[i]);
+                        i++;
+                }
+                dev_dbg(codec->dev, "%s val = %d\n", __func__, val);
+                switch (val) {
+                case 1:
+                case 2:
+                        rt5668->jack_type = SND_JACK_HEADSET;
+                        rt5663_enable_push_button_irq(codec, true);
+                        break;
+                default:
+                        snd_soc_dapm_disable_pin(dapm, "MICBIAS1");
+                        snd_soc_dapm_disable_pin(dapm, "MICBIAS2");
+                        snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
+                        snd_soc_dapm_disable_pin(dapm, "CBJ Power");
+                        snd_soc_dapm_sync(dapm);
+                        rt5668->jack_type = SND_JACK_HEADPHONE;
+                        break;
+                }
+        } else {
+                snd_soc_update_bits(codec, RT5663_RECMIX, 0x8, 0x0);
+
+                if (rt5668->jack_type == SND_JACK_HEADSET) {
+                        rt5663_enable_push_button_irq(codec, false);
+                        snd_soc_dapm_disable_pin(dapm, "MICBIAS1");
+                        snd_soc_dapm_disable_pin(dapm, "MICBIAS2");
+                        snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
+                        snd_soc_dapm_disable_pin(dapm, "CBJ Power");
+                        snd_soc_dapm_sync(dapm);
+                }
+                rt5668->jack_type = 0;
+        }
+
+        dev_dbg(codec->dev, "jack_type = %d\n", rt5668->jack_type);
+        return rt5668->jack_type;
+}
+
+/**
+ * rt5663_jack_detect - Detect headset.
+ * @codec: SoC audio codec device.
+ * @jack_insert: Jack insert or not.
+ *
+ * Detect whether is headset or not when jack inserted.
+ *
+ * Returns detect status.
+ */
+static int rt5663_jack_detect(struct snd_soc_codec *codec, int jack_insert)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        int val, i = 0, sleep_time[5] = {300, 150, 100, 50, 30};
+
+        dev_dbg(codec->dev, "%s jack_insert:%d\n", __func__, jack_insert);
+
+        if (jack_insert) {
+                snd_soc_update_bits(codec, RT5663_DIG_MISC,
+                        RT5668_DIG_GATE_CTRL_MASK, RT5668_DIG_GATE_CTRL_EN);
+                snd_soc_update_bits(codec, RT5663_HP_CHARGE_PUMP_1,
+                        RT5663_SI_HP_MASK | RT5668_OSW_HP_L_MASK |
+                        RT5668_OSW_HP_R_MASK, RT5663_SI_HP_EN |
+                        RT5668_OSW_HP_L_DIS | RT5668_OSW_HP_R_DIS);
+                snd_soc_update_bits(codec, RT5663_DUMMY_1,
+                        RT5663_EMB_CLK_MASK | RT5663_HPA_CPL_BIAS_MASK |
+                        RT5663_HPA_CPR_BIAS_MASK, RT5663_EMB_CLK_EN |
+                        RT5663_HPA_CPL_BIAS_1 | RT5663_HPA_CPR_BIAS_1);
+                snd_soc_update_bits(codec, RT5663_CBJ_1,
+                        RT5663_INBUF_CBJ_BST1_MASK | RT5663_CBJ_SENSE_BST1_MASK,
+                        RT5663_INBUF_CBJ_BST1_ON | RT5663_CBJ_SENSE_BST1_L);
+                snd_soc_update_bits(codec, RT5663_IL_CMD_2,
+                        RT5663_PWR_MIC_DET_MASK, RT5663_PWR_MIC_DET_ON);
+                /* BST1 power on for JD */
+                snd_soc_update_bits(codec, RT5663_PWR_ANLG_2,
+                        RT5668_PWR_BST1_MASK, RT5668_PWR_BST1_ON);
+                snd_soc_update_bits(codec, RT5663_EM_JACK_TYPE_1,
+                        RT5663_CBJ_DET_MASK | RT5663_EXT_JD_MASK |
+                        RT5663_POL_EXT_JD_MASK, RT5663_CBJ_DET_EN |
+                        RT5663_EXT_JD_EN | RT5663_POL_EXT_JD_EN);
+                snd_soc_update_bits(codec, RT5663_PWR_ANLG_1,
+                        RT5668_PWR_MB_MASK | RT5668_LDO1_DVO_MASK |
+                        RT5668_AMP_HP_MASK, RT5668_PWR_MB |
+                        RT5668_LDO1_DVO_0_9V | RT5668_AMP_HP_3X);
+                snd_soc_update_bits(codec, RT5663_AUTO_1MRC_CLK,
+                        RT5668_IRQ_POW_SAV_MASK, RT5668_IRQ_POW_SAV_EN);
+                snd_soc_update_bits(codec, RT5663_IRQ_1,
+                        RT5663_EN_IRQ_JD1_MASK, RT5663_EN_IRQ_JD1_EN);
+                while (i < 5) {
+                        msleep(sleep_time[i]);
+                        val = snd_soc_read(codec, RT5663_EM_JACK_TYPE_2) &
+                                0x0003;
+                        i++;
+                        if (val == 0x1 || val == 0x2 || val == 0x3)
+                                break;
+                        dev_dbg(codec->dev, "%s: MX-00e7 val=%x sleep %d\n",
+                                __func__, val, sleep_time[i]);
+                }
+                dev_dbg(codec->dev, "%s val = %d\n", __func__, val);
+                switch (val) {
+                case 1:
+                case 2:
+                        rt5663->jack_type = SND_JACK_HEADSET;
+                        rt5663_enable_push_button_irq(codec, true);
+                        break;
+                default:
+                        rt5663->jack_type = SND_JACK_HEADPHONE;
+                        break;
+                }
+        } else {
+                if (rt5663->jack_type == SND_JACK_HEADSET)
+                        rt5663_enable_push_button_irq(codec, false);
+                rt5663->jack_type = 0;
+        }
+
+        dev_dbg(codec->dev, "jack_type = %d\n", rt5663->jack_type);
+        return rt5663->jack_type;
+}
+
+static int rt5663_button_detect(struct snd_soc_codec *codec)
+{
+        int btn_type, val;
+
+        val = snd_soc_read(codec, RT5663_IL_CMD_5);
+        dev_dbg(codec->dev, "%s: val=0x%x\n", __func__, val);
+        btn_type = val & 0xfff0;
+        snd_soc_write(codec, RT5663_IL_CMD_5, val);
+
+        return btn_type;
+}
+
+static irqreturn_t rt5663_irq(int irq, void *data)
+{
+        struct rt5663_priv *rt5663 = data;
+
+        dev_dbg(rt5663->codec->dev, "%s IRQ queue work\n", __func__);
+
+        queue_delayed_work(system_wq, &rt5663->jack_detect_work,
+                msecs_to_jiffies(250));
+
+        return IRQ_HANDLED;
+}
+
+int rt5663_set_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *hs_jack)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        rt5663->hs_jack = hs_jack;
+
+        rt5663_irq(0, rt5663);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt5663_set_jack_detect);
+
+static bool rt5663_check_jd_status(struct snd_soc_codec *codec)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        int val = snd_soc_read(codec, RT5663_INT_ST_1);
+
+        dev_dbg(codec->dev, "%s val=%x\n", __func__, val);
+
+        /* JD1 */
+        switch (rt5663->codec_type) {
+        case CODEC_TYPE_RT5668:
+                return !(val & 0x2000);
+        case CODEC_TYPE_RT5663:
+                return !(val & 0x1000);
+        default:
+                dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+        }
+
+        return false;
+}
+
+static void rt5663_jack_detect_work(struct work_struct *work)
+{
+        struct rt5663_priv *rt5663 =
+                container_of(work, struct rt5663_priv, jack_detect_work.work);
+        struct snd_soc_codec *codec = rt5663->codec;
+        int btn_type, report = 0;
+
+        if (!codec)
+                return;
+
+        if (rt5663_check_jd_status(codec)) {
+                /* jack in */
+                if (rt5663->jack_type == 0) {
+                        /* jack was out, report jack type */
+                        switch (rt5663->codec_type) {
+                        case CODEC_TYPE_RT5668:
+                                report = rt5668_jack_detect(rt5663->codec, 1);
+                                break;
+                        case CODEC_TYPE_RT5663:
+                                report = rt5663_jack_detect(rt5663->codec, 1);
+                                break;
+                        default:
+                                dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                        }
+                } else {
+                        /* jack is already in, report button event */
+                        report = SND_JACK_HEADSET;
+                        btn_type = rt5663_button_detect(rt5663->codec);
+                        /**
+                         * rt5663 can report three kinds of button behavior,
+                         * one click, double click and hold. However,
+                         * currently we will report button pressed/released
+                         * event. So all the three button behaviors are
+                         * treated as button pressed.
+                         */
+                        switch (btn_type) {
+                        case 0x8000:
+                        case 0x4000:
+                        case 0x2000:
+                                report |= SND_JACK_BTN_0;
+                                break;
+                        case 0x1000:
+                        case 0x0800:
+                        case 0x0400:
+                                report |= SND_JACK_BTN_1;
+                                break;
+                        case 0x0200:
+                        case 0x0100:
+                        case 0x0080:
+                                report |= SND_JACK_BTN_2;
+                                break;
+                        case 0x0040:
+                        case 0x0020:
+                        case 0x0010:
+                                report |= SND_JACK_BTN_3;
+                                break;
+                        case 0x0000: /* unpressed */
+                                break;
+                        default:
+                                btn_type = 0;
+                                dev_err(rt5663->codec->dev,
+                                        "Unexpected button code 0x%04x\n",
+                                        btn_type);
+                                break;
+                        }
+                        /* button release or spurious interrput*/
+                        if (btn_type == 0)
+                                report =  rt5663->jack_type;
+                }
+        } else {
+                /* jack out */
+                switch (rt5663->codec_type) {
+                case CODEC_TYPE_RT5668:
+                        report = rt5668_jack_detect(rt5663->codec, 0);
+                        break;
+                case CODEC_TYPE_RT5663:
+                        report = rt5663_jack_detect(rt5663->codec, 0);
+                        break;
+                default:
+                        dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                }
+        }
+        dev_dbg(codec->dev, "%s jack report: 0x%04x\n", __func__, report);
+        snd_soc_jack_report(rt5663->hs_jack, report, SND_JACK_HEADSET |
+                            SND_JACK_BTN_0 | SND_JACK_BTN_1 |
+                            SND_JACK_BTN_2 | SND_JACK_BTN_3);
+}
+
+static const struct snd_kcontrol_new rt5663_snd_controls[] = {
+        /* DAC Digital Volume */
+        SOC_DOUBLE_TLV("DAC Playback Volume", RT5663_STO1_DAC_DIG_VOL,
+                RT5668_DAC_L1_VOL_SHIFT + 1, RT5668_DAC_R1_VOL_SHIFT + 1,
+                87, 0, dac_vol_tlv),
+        /* ADC Digital Volume Control */
+        SOC_DOUBLE("ADC Capture Switch", RT5663_STO1_ADC_DIG_VOL,
+                RT5668_ADC_L_MUTE_SHIFT, RT5668_ADC_R_MUTE_SHIFT, 1, 1),
+        SOC_DOUBLE_TLV("ADC Capture Volume", RT5663_STO1_ADC_DIG_VOL,
+                RT5668_ADC_L_VOL_SHIFT + 1, RT5668_ADC_R_VOL_SHIFT + 1,
+                63, 0, adc_vol_tlv),
+};
+
+static const struct snd_kcontrol_new rt5668_specific_controls[] = {
+        /* Headphone Output Volume */
+        SOC_DOUBLE_R_TLV("Headphone Playback Volume", RT5663_HP_LCH_DRE,
+                RT5663_HP_RCH_DRE, RT5668_GAIN_HP_SHIFT, 15, 1,
+                rt5668_hp_vol_tlv),
+        /* Mic Boost Volume */
+        SOC_SINGLE_TLV("IN1 Capture Volume", RT5668_AEC_BST,
+                RT5668_GAIN_CBJ_SHIFT, 8, 0, in_bst_tlv),
+};
+
+static const struct snd_kcontrol_new rt5663_specific_controls[] = {
+        /* Headphone Output Volume */
+        SOC_DOUBLE_R_TLV("Headphone Playback Volume", RT5663_STO_DRE_9,
+                RT5663_STO_DRE_10, RT5663_DRE_GAIN_HP_SHIFT, 23, 1,
+                rt5663_hp_vol_tlv),
+        /* Mic Boost Volume*/
+        SOC_SINGLE_TLV("IN1 Capture Volume", RT5663_CBJ_2,
+                RT5663_GAIN_BST1_SHIFT, 8, 0, in_bst_tlv),
+        /* Data Swap for Slot0/1 in ADCDAT1 */
+        SOC_ENUM("IF1 ADC Data Swap", rt5663_if1_adc_enum),
+};
+
+static int rt5663_is_sys_clk_from_pll(struct snd_soc_dapm_widget *w,
+        struct snd_soc_dapm_widget *sink)
+{
+        unsigned int val;
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+
+        val = snd_soc_read(codec, RT5663_GLB_CLK);
+        val &= RT5663_SCLK_SRC_MASK;
+        if (val == RT5663_SCLK_SRC_PLL1)
+                return 1;
+        else
+                return 0;
+}
+
+static int rt5663_is_using_asrc(struct snd_soc_dapm_widget *w,
+        struct snd_soc_dapm_widget *sink)
+{
+        unsigned int reg, shift, val;
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        if (rt5663->codec_type == CODEC_TYPE_RT5668) {
+                switch (w->shift) {
+                case RT5668_ADC_STO1_ASRC_SHIFT:
+                        reg = RT5668_ASRC_3;
+                        shift = RT5668_AD_STO1_TRACK_SHIFT;
+                        break;
+                case RT5668_DAC_STO1_ASRC_SHIFT:
+                        reg = RT5663_ASRC_2;
+                        shift = RT5668_DA_STO1_TRACK_SHIFT;
+                        break;
+                default:
+                        return 0;
+                }
+        } else {
+                switch (w->shift) {
+                case RT5663_ADC_STO1_ASRC_SHIFT:
+                        reg = RT5663_ASRC_2;
+                        shift = RT5663_AD_STO1_TRACK_SHIFT;
+                        break;
+                case RT5663_DAC_STO1_ASRC_SHIFT:
+                        reg = RT5663_ASRC_2;
+                        shift = RT5663_DA_STO1_TRACK_SHIFT;
+                        break;
+                default:
+                        return 0;
+                }
+        }
+
+        val = (snd_soc_read(codec, reg) >> shift) & 0x7;
+
+        if (val)
+                return 1;
+
+        return 0;
+}
+
+static int rt5663_i2s_use_asrc(struct snd_soc_dapm_widget *source,
+        struct snd_soc_dapm_widget *sink)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(source->dapm);
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        int da_asrc_en, ad_asrc_en;
+
+        da_asrc_en = (snd_soc_read(codec, RT5663_ASRC_2) &
+                RT5663_DA_STO1_TRACK_MASK) ? 1 : 0;
+        switch (rt5663->codec_type) {
+        case CODEC_TYPE_RT5668:
+                ad_asrc_en = (snd_soc_read(codec, RT5668_ASRC_3) &
+                        RT5668_AD_STO1_TRACK_MASK) ? 1 : 0;
+                break;
+        case CODEC_TYPE_RT5663:
+                ad_asrc_en = (snd_soc_read(codec, RT5663_ASRC_2) &
+                        RT5663_AD_STO1_TRACK_MASK) ? 1 : 0;
+                break;
+        default:
+                dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                return 1;
+        }
+
+        if (da_asrc_en || ad_asrc_en)
+                if (rt5663->sysclk > rt5663->lrck * 384)
+                        return 1;
+
+        dev_err(codec->dev, "sysclk < 384 x fs, disable i2s asrc\n");
+
+        return 0;
+}
+
+/**
+ * rt5663_sel_asrc_clk_src - select ASRC clock source for a set of filters
+ * @codec: SoC audio codec device.
+ * @filter_mask: mask of filters.
+ * @clk_src: clock source
+ *
+ * The ASRC function is for asynchronous MCLK and LRCK. Also, since RT5668 can
+ * only support standard 32fs or 64fs i2s format, ASRC should be enabled to
+ * support special i2s clock format such as Intel's 100fs(100 * sampling rate).
+ * ASRC function will track i2s clock and generate a corresponding system clock
+ * for codec. This function provides an API to select the clock source for a
+ * set of filters specified by the mask. And the codec driver will turn on ASRC
+ * for these filters if ASRC is selected as their clock source.
+ */
+int rt5663_sel_asrc_clk_src(struct snd_soc_codec *codec,
+                unsigned int filter_mask, unsigned int clk_src)
+{
+        struct rt5663_priv *rt5668 = snd_soc_codec_get_drvdata(codec);
+        unsigned int asrc2_mask = 0;
+        unsigned int asrc2_value = 0;
+        unsigned int asrc3_mask = 0;
+        unsigned int asrc3_value = 0;
+
+        switch (clk_src) {
+        case RT5663_CLK_SEL_SYS:
+        case RT5663_CLK_SEL_I2S1_ASRC:
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        if (filter_mask & RT5663_DA_STEREO_FILTER) {
+                asrc2_mask |= RT5668_DA_STO1_TRACK_MASK;
+                asrc2_value |= clk_src << RT5668_DA_STO1_TRACK_SHIFT;
+        }
+
+        if (filter_mask & RT5663_AD_STEREO_FILTER) {
+                switch (rt5668->codec_type) {
+                case CODEC_TYPE_RT5668:
+                        asrc3_mask |= RT5668_AD_STO1_TRACK_MASK;
+                        asrc3_value |= clk_src << RT5668_AD_STO1_TRACK_SHIFT;
+                        break;
+                case CODEC_TYPE_RT5663:
+                        asrc2_mask |= RT5663_AD_STO1_TRACK_MASK;
+                        asrc2_value |= clk_src << RT5663_AD_STO1_TRACK_SHIFT;
+                        break;
+                default:
+                        dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                }
+        }
+
+        if (asrc2_mask)
+                snd_soc_update_bits(codec, RT5663_ASRC_2, asrc2_mask,
+                        asrc2_value);
+
+        if (asrc3_mask)
+                snd_soc_update_bits(codec, RT5668_ASRC_3, asrc3_mask,
+                        asrc3_value);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rt5663_sel_asrc_clk_src);
+
+/* Analog Mixer */
+static const struct snd_kcontrol_new rt5668_recmix1l[] = {
+        SOC_DAPM_SINGLE("BST2 Switch", RT5668_RECMIX1L,
+                RT5668_RECMIX1L_BST2_SHIFT, 1, 1),
+        SOC_DAPM_SINGLE("BST1 CBJ Switch", RT5668_RECMIX1L,
+                RT5668_RECMIX1L_BST1_CBJ_SHIFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5668_recmix1r[] = {
+        SOC_DAPM_SINGLE("BST2 Switch", RT5668_RECMIX1R,
+                RT5668_RECMIX1R_BST2_SHIFT, 1, 1),
+};
+
+/* Digital Mixer */
+static const struct snd_kcontrol_new rt5663_sto1_adc_l_mix[] = {
+        SOC_DAPM_SINGLE("ADC1 Switch", RT5663_STO1_ADC_MIXER,
+                        RT5668_M_STO1_ADC_L1_SHIFT, 1, 1),
+        SOC_DAPM_SINGLE("ADC2 Switch", RT5663_STO1_ADC_MIXER,
+                        RT5668_M_STO1_ADC_L2_SHIFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5668_sto1_adc_r_mix[] = {
+        SOC_DAPM_SINGLE("ADC1 Switch", RT5663_STO1_ADC_MIXER,
+                        RT5668_M_STO1_ADC_R1_SHIFT, 1, 1),
+        SOC_DAPM_SINGLE("ADC2 Switch", RT5663_STO1_ADC_MIXER,
+                        RT5668_M_STO1_ADC_R2_SHIFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5663_adda_l_mix[] = {
+        SOC_DAPM_SINGLE("ADC L Switch", RT5663_AD_DA_MIXER,
+                        RT5668_M_ADCMIX_L_SHIFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC L Switch", RT5663_AD_DA_MIXER,
+                        RT5668_M_DAC1_L_SHIFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5663_adda_r_mix[] = {
+        SOC_DAPM_SINGLE("ADC R Switch", RT5663_AD_DA_MIXER,
+                        RT5668_M_ADCMIX_R_SHIFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC R Switch", RT5663_AD_DA_MIXER,
+                        RT5668_M_DAC1_R_SHIFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5663_sto1_dac_l_mix[] = {
+        SOC_DAPM_SINGLE("DAC L Switch", RT5663_STO_DAC_MIXER,
+                        RT5668_M_DAC_L1_STO_L_SHIFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC R Switch", RT5663_STO_DAC_MIXER,
+                        RT5668_M_DAC_R1_STO_L_SHIFT, 1, 1),
+};
+
+static const struct snd_kcontrol_new rt5663_sto1_dac_r_mix[] = {
+        SOC_DAPM_SINGLE("DAC L Switch", RT5663_STO_DAC_MIXER,
+                        RT5668_M_DAC_L1_STO_R_SHIFT, 1, 1),
+        SOC_DAPM_SINGLE("DAC R Switch", RT5663_STO_DAC_MIXER,
+                        RT5668_M_DAC_R1_STO_R_SHIFT, 1, 1),
+};
+
+/* Out Switch */
+static const struct snd_kcontrol_new rt5668_hpo_switch =
+        SOC_DAPM_SINGLE_AUTODISABLE("Switch", RT5668_HP_AMP_2,
+                RT5668_EN_DAC_HPO_SHIFT, 1, 0);
+
+/* Stereo ADC source */
+static const char * const rt5668_sto1_adc_src[] = {
+        "ADC L", "ADC R"
+};
+
+static SOC_ENUM_SINGLE_DECL(rt5668_sto1_adcl_enum, RT5663_STO1_ADC_MIXER,
+        RT5668_STO1_ADC_L_SRC_SHIFT, rt5668_sto1_adc_src);
+
+static const struct snd_kcontrol_new rt5668_sto1_adcl_mux =
+        SOC_DAPM_ENUM("STO1 ADC L Mux", rt5668_sto1_adcl_enum);
+
+static SOC_ENUM_SINGLE_DECL(rt5668_sto1_adcr_enum, RT5663_STO1_ADC_MIXER,
+        RT5668_STO1_ADC_R_SRC_SHIFT, rt5668_sto1_adc_src);
+
+static const struct snd_kcontrol_new rt5668_sto1_adcr_mux =
+        SOC_DAPM_ENUM("STO1 ADC R Mux", rt5668_sto1_adcr_enum);
+
+/* RT5663: Analog DACL1 input source */
+static const char * const rt5663_alg_dacl_src[] = {
+        "DAC L", "STO DAC MIXL"
+};
+
+static SOC_ENUM_SINGLE_DECL(rt5663_alg_dacl_enum, RT5663_BYPASS_STO_DAC,
+        RT5663_DACL1_SRC_SHIFT, rt5663_alg_dacl_src);
+
+static const struct snd_kcontrol_new rt5663_alg_dacl_mux =
+        SOC_DAPM_ENUM("DAC L Mux", rt5663_alg_dacl_enum);
+
+/* RT5663: Analog DACR1 input source */
+static const char * const rt5663_alg_dacr_src[] = {
+        "DAC R", "STO DAC MIXR"
+};
+
+static SOC_ENUM_SINGLE_DECL(rt5663_alg_dacr_enum, RT5663_BYPASS_STO_DAC,
+        RT5663_DACR1_SRC_SHIFT, rt5663_alg_dacr_src);
+
+static const struct snd_kcontrol_new rt5663_alg_dacr_mux =
+        SOC_DAPM_ENUM("DAC R Mux", rt5663_alg_dacr_enum);
+
+static int rt5663_hp_event(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                if (rt5663->codec_type == CODEC_TYPE_RT5668) {
+                        snd_soc_update_bits(codec, RT5663_HP_CHARGE_PUMP_1,
+                                RT5668_SEL_PM_HP_SHIFT, RT5668_SEL_PM_HP_HIGH);
+                        snd_soc_update_bits(codec, RT5663_HP_LOGIC_2,
+                                RT5668_HP_SIG_SRC1_MASK,
+                                RT5668_HP_SIG_SRC1_SILENCE);
+                } else {
+                        snd_soc_write(codec, RT5663_DEPOP_2, 0x3003);
+                        snd_soc_update_bits(codec, RT5663_DEPOP_1, 0x000b,
+                                0x000b);
+                        snd_soc_update_bits(codec, RT5663_DEPOP_1, 0x0030,
+                                0x0030);
+                        snd_soc_update_bits(codec, RT5663_HP_CHARGE_PUMP_1,
+                                RT5668_OVCD_HP_MASK, RT5668_OVCD_HP_DIS);
+                        snd_soc_write(codec, RT5663_HP_CHARGE_PUMP_2, 0x1371);
+                        snd_soc_write(codec, RT5663_HP_BIAS, 0xabba);
+                        snd_soc_write(codec, RT5663_CHARGE_PUMP_1, 0x2224);
+                        snd_soc_write(codec, RT5663_ANA_BIAS_CUR_1, 0x7766);
+                        snd_soc_write(codec, RT5663_HP_BIAS, 0xafaa);
+                        snd_soc_write(codec, RT5663_CHARGE_PUMP_2, 0x7777);
+                        snd_soc_update_bits(codec, RT5663_DEPOP_1, 0x3000,
+                                0x3000);
+                }
+                break;
+
+        case SND_SOC_DAPM_PRE_PMD:
+                if (rt5663->codec_type == CODEC_TYPE_RT5668) {
+                        snd_soc_update_bits(codec, RT5663_HP_LOGIC_2,
+                                RT5668_HP_SIG_SRC1_MASK,
+                                RT5668_HP_SIG_SRC1_REG);
+                } else {
+                        snd_soc_update_bits(codec, RT5663_DEPOP_1, 0x3000, 0x0);
+                        snd_soc_update_bits(codec, RT5663_HP_CHARGE_PUMP_1,
+                                RT5668_OVCD_HP_MASK, RT5668_OVCD_HP_EN);
+                        snd_soc_update_bits(codec, RT5663_DEPOP_1, 0x0030, 0x0);
+                        snd_soc_update_bits(codec, RT5663_DEPOP_1, 0x000b,
+                                0x000b);
+                }
+                break;
+
+        default:
+                return 0;
+        }
+
+        return 0;
+}
+
+static int rt5668_bst2_power(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                snd_soc_update_bits(codec, RT5663_PWR_ANLG_2,
+                        RT5668_PWR_BST2_MASK | RT5668_PWR_BST2_OP_MASK,
+                        RT5668_PWR_BST2 | RT5668_PWR_BST2_OP);
+                break;
+
+        case SND_SOC_DAPM_PRE_PMD:
+                snd_soc_update_bits(codec, RT5663_PWR_ANLG_2,
+                        RT5668_PWR_BST2_MASK | RT5668_PWR_BST2_OP_MASK, 0);
+                break;
+
+        default:
+                return 0;
+        }
+
+        return 0;
+}
+
+static int rt5663_pre_div_power(struct snd_soc_dapm_widget *w,
+        struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
+
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                snd_soc_write(codec, RT5663_PRE_DIV_GATING_1, 0xff00);
+                snd_soc_write(codec, RT5663_PRE_DIV_GATING_2, 0xfffc);
+                break;
+
+        case SND_SOC_DAPM_PRE_PMD:
+                snd_soc_write(codec, RT5663_PRE_DIV_GATING_1, 0x0000);
+                snd_soc_write(codec, RT5663_PRE_DIV_GATING_2, 0x0000);
+                break;
+
+        default:
+                return 0;
+        }
+
+        return 0;
+}
+
+static const struct snd_soc_dapm_widget rt5663_dapm_widgets[] = {
+        SND_SOC_DAPM_SUPPLY("PLL", RT5663_PWR_ANLG_3, RT5668_PWR_PLL_SHIFT, 0,
+                NULL, 0),
+
+        /* micbias */
+        SND_SOC_DAPM_MICBIAS("MICBIAS1", RT5663_PWR_ANLG_2,
+                RT5668_PWR_MB1_SHIFT, 0),
+        SND_SOC_DAPM_MICBIAS("MICBIAS2", RT5663_PWR_ANLG_2,
+                RT5668_PWR_MB2_SHIFT, 0),
+
+        /* Input Lines */
+        SND_SOC_DAPM_INPUT("IN1P"),
+        SND_SOC_DAPM_INPUT("IN1N"),
+
+        /* REC Mixer Power */
+        SND_SOC_DAPM_SUPPLY("RECMIX1L Power", RT5663_PWR_ANLG_2,
+                RT5668_PWR_RECMIX1_SHIFT, 0, NULL, 0),
+
+        /* ADCs */
+        SND_SOC_DAPM_ADC("ADC L", NULL, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_SUPPLY("ADC L Power", RT5663_PWR_DIG_1,
+                RT5668_PWR_ADC_L1_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ADC Clock", RT5663_CHOP_ADC,
+                RT5668_CKGEN_ADCC_SHIFT, 0, NULL, 0),
+
+        /* ADC Mixer */
+        SND_SOC_DAPM_MIXER("STO1 ADC MIXL", SND_SOC_NOPM,
+                0, 0, rt5663_sto1_adc_l_mix,
+                ARRAY_SIZE(rt5663_sto1_adc_l_mix)),
+
+        /* ADC Filter Power */
+        SND_SOC_DAPM_SUPPLY("STO1 ADC Filter", RT5663_PWR_DIG_2,
+                RT5668_PWR_ADC_S1F_SHIFT, 0, NULL, 0),
+
+        /* Digital Interface */
+        SND_SOC_DAPM_SUPPLY("I2S", RT5663_PWR_DIG_1, RT5668_PWR_I2S1_SHIFT, 0,
+                NULL, 0),
+        SND_SOC_DAPM_PGA("IF DAC", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("IF1 DAC1 L", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("IF1 DAC1 R", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("IF1 ADC1", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("IF ADC", SND_SOC_NOPM, 0, 0, NULL, 0),
+
+        /* Audio Interface */
+        SND_SOC_DAPM_AIF_IN("AIFRX", "AIF Playback", 0, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_AIF_OUT("AIFTX", "AIF Capture", 0, SND_SOC_NOPM, 0, 0),
+
+        /* DAC mixer before sound effect  */
+        SND_SOC_DAPM_MIXER("ADDA MIXL", SND_SOC_NOPM, 0, 0, rt5663_adda_l_mix,
+                ARRAY_SIZE(rt5663_adda_l_mix)),
+        SND_SOC_DAPM_MIXER("ADDA MIXR", SND_SOC_NOPM, 0, 0, rt5663_adda_r_mix,
+                ARRAY_SIZE(rt5663_adda_r_mix)),
+        SND_SOC_DAPM_PGA("DAC L1", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("DAC R1", SND_SOC_NOPM, 0, 0, NULL, 0),
+
+        /* DAC Mixer */
+        SND_SOC_DAPM_SUPPLY("STO1 DAC Filter", RT5663_PWR_DIG_2,
+                RT5668_PWR_DAC_S1F_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_MIXER("STO1 DAC MIXL", SND_SOC_NOPM, 0, 0,
+                rt5663_sto1_dac_l_mix, ARRAY_SIZE(rt5663_sto1_dac_l_mix)),
+        SND_SOC_DAPM_MIXER("STO1 DAC MIXR", SND_SOC_NOPM, 0, 0,
+                rt5663_sto1_dac_r_mix, ARRAY_SIZE(rt5663_sto1_dac_r_mix)),
+
+        /* DACs */
+        SND_SOC_DAPM_SUPPLY("STO1 DAC L Power", RT5663_PWR_DIG_1,
+                RT5668_PWR_DAC_L1_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("STO1 DAC R Power", RT5663_PWR_DIG_1,
+                RT5668_PWR_DAC_R1_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_DAC("DAC L", NULL, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_DAC("DAC R", NULL, SND_SOC_NOPM, 0, 0),
+
+        /* Headphone*/
+        SND_SOC_DAPM_PGA_S("HP Amp", 1, SND_SOC_NOPM, 0, 0, rt5663_hp_event,
+                SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU),
+
+        /* Output Lines */
+        SND_SOC_DAPM_OUTPUT("HPOL"),
+        SND_SOC_DAPM_OUTPUT("HPOR"),
+};
+
+static const struct snd_soc_dapm_widget rt5668_specific_dapm_widgets[] = {
+        SND_SOC_DAPM_SUPPLY("LDO2", RT5663_PWR_ANLG_3,
+                RT5668_PWR_LDO2_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("Mic Det Power", RT5668_PWR_VOL,
+                RT5668_PWR_MIC_DET_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("LDO DAC", RT5663_PWR_DIG_1,
+                RT5668_PWR_LDO_DACREF_SHIFT, 0, NULL, 0),
+
+        /* ASRC */
+        SND_SOC_DAPM_SUPPLY("I2S ASRC", RT5663_ASRC_1,
+                RT5668_I2S1_ASRC_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DAC ASRC", RT5663_ASRC_1,
+                RT5668_DAC_STO1_ASRC_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ADC ASRC", RT5663_ASRC_1,
+                RT5668_ADC_STO1_ASRC_SHIFT, 0, NULL, 0),
+
+        /* Input Lines */
+        SND_SOC_DAPM_INPUT("IN2P"),
+        SND_SOC_DAPM_INPUT("IN2N"),
+
+        /* Boost */
+        SND_SOC_DAPM_PGA("BST1 CBJ", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("CBJ Power", RT5663_PWR_ANLG_3,
+                RT5668_PWR_CBJ_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("BST2", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("BST2 Power", SND_SOC_NOPM, 0, 0,
+                rt5668_bst2_power, SND_SOC_DAPM_PRE_PMD |
+                SND_SOC_DAPM_POST_PMU),
+
+        /* REC Mixer */
+        SND_SOC_DAPM_MIXER("RECMIX1L", SND_SOC_NOPM, 0, 0, rt5668_recmix1l,
+                ARRAY_SIZE(rt5668_recmix1l)),
+        SND_SOC_DAPM_MIXER("RECMIX1R", SND_SOC_NOPM, 0, 0, rt5668_recmix1r,
+                ARRAY_SIZE(rt5668_recmix1r)),
+        SND_SOC_DAPM_SUPPLY("RECMIX1R Power", RT5663_PWR_ANLG_2,
+                RT5668_PWR_RECMIX2_SHIFT, 0, NULL, 0),
+
+        /* ADC */
+        SND_SOC_DAPM_ADC("ADC R", NULL, SND_SOC_NOPM, 0, 0),
+        SND_SOC_DAPM_SUPPLY("ADC R Power", RT5663_PWR_DIG_1,
+                RT5668_PWR_ADC_R1_SHIFT, 0, NULL, 0),
+
+        /* ADC Mux */
+        SND_SOC_DAPM_PGA("STO1 ADC L1", RT5663_STO1_ADC_MIXER,
+                RT5668_STO1_ADC_L1_SRC_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("STO1 ADC R1", RT5663_STO1_ADC_MIXER,
+                RT5668_STO1_ADC_R1_SRC_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("STO1 ADC L2", RT5663_STO1_ADC_MIXER,
+                RT5668_STO1_ADC_L2_SRC_SHIFT, 1, NULL, 0),
+        SND_SOC_DAPM_PGA("STO1 ADC R2", RT5663_STO1_ADC_MIXER,
+                RT5668_STO1_ADC_R2_SRC_SHIFT, 1, NULL, 0),
+
+        SND_SOC_DAPM_MUX("STO1 ADC L Mux", SND_SOC_NOPM, 0, 0,
+                &rt5668_sto1_adcl_mux),
+        SND_SOC_DAPM_MUX("STO1 ADC R Mux", SND_SOC_NOPM, 0, 0,
+                &rt5668_sto1_adcr_mux),
+
+        /* ADC Mix */
+        SND_SOC_DAPM_MIXER("STO1 ADC MIXR", SND_SOC_NOPM, 0, 0,
+                rt5668_sto1_adc_r_mix, ARRAY_SIZE(rt5668_sto1_adc_r_mix)),
+
+        /* Analog DAC Clock */
+        SND_SOC_DAPM_SUPPLY("DAC Clock", RT5663_CHOP_DAC_L,
+                RT5668_CKGEN_DAC1_SHIFT, 0, NULL, 0),
+
+        /* Headphone out */
+        SND_SOC_DAPM_SWITCH("HPO Playback", SND_SOC_NOPM, 0, 0,
+                &rt5668_hpo_switch),
+};
+
+static const struct snd_soc_dapm_widget rt5663_specific_dapm_widgets[] = {
+        /* System Clock Pre Divider Gating */
+        SND_SOC_DAPM_SUPPLY("Pre Div Power", SND_SOC_NOPM, 0, 0,
+                rt5663_pre_div_power, SND_SOC_DAPM_POST_PMU |
+                SND_SOC_DAPM_PRE_PMD),
+
+        /* LDO */
+        SND_SOC_DAPM_SUPPLY("LDO ADC", RT5663_PWR_DIG_1,
+                RT5668_PWR_LDO_DACREF_SHIFT, 0, NULL, 0),
+
+        /* ASRC */
+        SND_SOC_DAPM_SUPPLY("I2S ASRC", RT5663_ASRC_1,
+                RT5663_I2S1_ASRC_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("DAC ASRC", RT5663_ASRC_1,
+                RT5663_DAC_STO1_ASRC_SHIFT, 0, NULL, 0),
+        SND_SOC_DAPM_SUPPLY("ADC ASRC", RT5663_ASRC_1,
+                RT5663_ADC_STO1_ASRC_SHIFT, 0, NULL, 0),
+
+        /* Boost */
+        SND_SOC_DAPM_PGA("BST1", SND_SOC_NOPM, 0, 0, NULL, 0),
+
+        /* STO ADC */
+        SND_SOC_DAPM_PGA("STO1 ADC L1", SND_SOC_NOPM, 0, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("STO1 ADC L2", SND_SOC_NOPM, 0, 0, NULL, 0),
+
+        /* Analog DAC source */
+        SND_SOC_DAPM_MUX("DAC L Mux", SND_SOC_NOPM, 0, 0, &rt5663_alg_dacl_mux),
+        SND_SOC_DAPM_MUX("DAC R Mux", SND_SOC_NOPM, 0, 0, &rt5663_alg_dacr_mux),
+};
+
+static const struct snd_soc_dapm_route rt5663_dapm_routes[] = {
+        /* PLL */
+        { "I2S", NULL, "PLL", rt5663_is_sys_clk_from_pll },
+
+        /* ASRC */
+        { "STO1 ADC Filter", NULL, "ADC ASRC", rt5663_is_using_asrc },
+        { "STO1 DAC Filter", NULL, "DAC ASRC", rt5663_is_using_asrc },
+        { "I2S", NULL, "I2S ASRC", rt5663_i2s_use_asrc },
+
+        { "ADC L", NULL, "ADC L Power" },
+        { "ADC L", NULL, "ADC Clock" },
+
+        { "STO1 ADC L2", NULL, "STO1 DAC MIXL" },
+
+        { "STO1 ADC MIXL", "ADC1 Switch", "STO1 ADC L1" },
+        { "STO1 ADC MIXL", "ADC2 Switch", "STO1 ADC L2" },
+        { "STO1 ADC MIXL", NULL, "STO1 ADC Filter" },
+
+        { "IF1 ADC1", NULL, "STO1 ADC MIXL" },
+        { "IF ADC", NULL, "IF1 ADC1" },
+        { "AIFTX", NULL, "IF ADC" },
+        { "AIFTX", NULL, "I2S" },
+
+        { "AIFRX", NULL, "I2S" },
+        { "IF DAC", NULL, "AIFRX" },
+        { "IF1 DAC1 L", NULL, "IF DAC" },
+        { "IF1 DAC1 R", NULL, "IF DAC" },
+
+        { "ADDA MIXL", "ADC L Switch", "STO1 ADC MIXL" },
+        { "ADDA MIXL", "DAC L Switch", "IF1 DAC1 L" },
+        { "ADDA MIXL", NULL, "STO1 DAC Filter" },
+        { "ADDA MIXL", NULL, "STO1 DAC L Power" },
+        { "ADDA MIXR", "DAC R Switch", "IF1 DAC1 R" },
+        { "ADDA MIXR", NULL, "STO1 DAC Filter" },
+        { "ADDA MIXR", NULL, "STO1 DAC R Power" },
+
+        { "DAC L1", NULL, "ADDA MIXL" },
+        { "DAC R1", NULL, "ADDA MIXR" },
+
+        { "STO1 DAC MIXL", "DAC L Switch", "DAC L1" },
+        { "STO1 DAC MIXL", "DAC R Switch", "DAC R1" },
+        { "STO1 DAC MIXL", NULL, "STO1 DAC L Power" },
+        { "STO1 DAC MIXL", NULL, "STO1 DAC Filter" },
+        { "STO1 DAC MIXR", "DAC R Switch", "DAC R1" },
+        { "STO1 DAC MIXR", "DAC L Switch", "DAC L1" },
+        { "STO1 DAC MIXR", NULL, "STO1 DAC R Power" },
+        { "STO1 DAC MIXR", NULL, "STO1 DAC Filter" },
+
+        { "HP Amp", NULL, "DAC L" },
+        { "HP Amp", NULL, "DAC R" },
+};
+
+static const struct snd_soc_dapm_route rt5668_specific_dapm_routes[] = {
+        { "MICBIAS1", NULL, "LDO2" },
+        { "MICBIAS2", NULL, "LDO2" },
+
+        { "BST1 CBJ", NULL, "IN1P" },
+        { "BST1 CBJ", NULL, "IN1N" },
+        { "BST1 CBJ", NULL, "CBJ Power" },
+
+        { "BST2", NULL, "IN2P" },
+        { "BST2", NULL, "IN2N" },
+        { "BST2", NULL, "BST2 Power" },
+
+        { "RECMIX1L", "BST2 Switch", "BST2" },
+        { "RECMIX1L", "BST1 CBJ Switch", "BST1 CBJ" },
+        { "RECMIX1L", NULL, "RECMIX1L Power" },
+        { "RECMIX1R", "BST2 Switch", "BST2" },
+        { "RECMIX1R", NULL, "RECMIX1R Power" },
+
+        { "ADC L", NULL, "RECMIX1L" },
+        { "ADC R", NULL, "RECMIX1R" },
+        { "ADC R", NULL, "ADC R Power" },
+        { "ADC R", NULL, "ADC Clock" },
+
+        { "STO1 ADC L Mux", "ADC L", "ADC L" },
+        { "STO1 ADC L Mux", "ADC R", "ADC R" },
+        { "STO1 ADC L1", NULL, "STO1 ADC L Mux" },
+
+        { "STO1 ADC R Mux", "ADC L", "ADC L" },
+        { "STO1 ADC R Mux", "ADC R", "ADC R" },
+        { "STO1 ADC R1", NULL, "STO1 ADC R Mux" },
+        { "STO1 ADC R2", NULL, "STO1 DAC MIXR" },
+
+        { "STO1 ADC MIXR", "ADC1 Switch", "STO1 ADC R1" },
+        { "STO1 ADC MIXR", "ADC2 Switch", "STO1 ADC R2" },
+        { "STO1 ADC MIXR", NULL, "STO1 ADC Filter" },
+
+        { "IF1 ADC1", NULL, "STO1 ADC MIXR" },
+
+        { "ADDA MIXR", "ADC R Switch", "STO1 ADC MIXR" },
+
+        { "DAC L", NULL, "STO1 DAC MIXL" },
+        { "DAC L", NULL, "LDO DAC" },
+        { "DAC L", NULL, "DAC Clock" },
+        { "DAC R", NULL, "STO1 DAC MIXR" },
+        { "DAC R", NULL, "LDO DAC" },
+        { "DAC R", NULL, "DAC Clock" },
+
+        { "HPO Playback", "Switch", "HP Amp" },
+        { "HPOL", NULL, "HPO Playback" },
+        { "HPOR", NULL, "HPO Playback" },
+};
+
+static const struct snd_soc_dapm_route rt5663_specific_dapm_routes[] = {
+        { "I2S", NULL, "Pre Div Power" },
+
+        { "BST1", NULL, "IN1P" },
+        { "BST1", NULL, "IN1N" },
+        { "BST1", NULL, "RECMIX1L Power" },
+
+        { "ADC L", NULL, "BST1" },
+
+        { "STO1 ADC L1", NULL, "ADC L" },
+
+        { "DAC L Mux", "DAC L",  "DAC L1" },
+        { "DAC L Mux", "STO DAC MIXL", "STO1 DAC MIXL" },
+        { "DAC R Mux", "DAC R",  "DAC R1"},
+        { "DAC R Mux", "STO DAC MIXR", "STO1 DAC MIXR" },
+
+        { "DAC L", NULL, "DAC L Mux" },
+        { "DAC R", NULL, "DAC R Mux" },
+
+        { "HPOL", NULL, "HP Amp" },
+        { "HPOR", NULL, "HP Amp" },
+};
+
+static int rt5663_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        unsigned int val_len = 0;
+        int pre_div;
+
+        rt5663->lrck = params_rate(params);
+
+        dev_dbg(dai->dev, "bclk is %dHz and sysclk is %dHz\n",
+                rt5663->lrck, rt5663->sysclk);
+
+        pre_div = rl6231_get_clk_info(rt5663->sysclk, rt5663->lrck);
+        if (pre_div < 0) {
+                dev_err(codec->dev, "Unsupported clock setting %d for DAI %d\n",
+                        rt5663->lrck, dai->id);
+                return -EINVAL;
+        }
+
+        dev_dbg(dai->dev, "pre_div is %d for iis %d\n", pre_div, dai->id);
+
+        switch (params_width(params)) {
+        case 8:
+                val_len = RT5668_I2S_DL_8;
+                break;
+        case 16:
+                val_len = RT5668_I2S_DL_16;
+                break;
+        case 20:
+                val_len = RT5668_I2S_DL_20;
+                break;
+        case 24:
+                val_len = RT5668_I2S_DL_24;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        snd_soc_update_bits(codec, RT5663_I2S1_SDP,
+                RT5668_I2S_DL_MASK, val_len);
+
+        snd_soc_update_bits(codec, RT5663_ADDA_CLK_1,
+                RT5668_I2S_PD1_MASK, pre_div << RT5668_I2S_PD1_SHIFT);
+
+        return 0;
+}
+
+static int rt5663_set_dai_fmt(struct snd_soc_dai *dai, unsigned int fmt)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        unsigned int reg_val = 0;
+
+        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+        case SND_SOC_DAIFMT_CBM_CFM:
+                break;
+        case SND_SOC_DAIFMT_CBS_CFS:
+                reg_val |= RT5668_I2S_MS_S;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+        case SND_SOC_DAIFMT_NB_NF:
+                break;
+        case SND_SOC_DAIFMT_IB_NF:
+                reg_val |= RT5668_I2S_BP_INV;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+        case SND_SOC_DAIFMT_I2S:
+                break;
+        case SND_SOC_DAIFMT_LEFT_J:
+                reg_val |= RT5668_I2S_DF_LEFT;
+                break;
+        case SND_SOC_DAIFMT_DSP_A:
+                reg_val |= RT5668_I2S_DF_PCM_A;
+                break;
+        case SND_SOC_DAIFMT_DSP_B:
+                reg_val |= RT5668_I2S_DF_PCM_B;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        snd_soc_update_bits(codec, RT5663_I2S1_SDP, RT5668_I2S_MS_MASK |
+                RT5668_I2S_BP_MASK | RT5668_I2S_DF_MASK, reg_val);
+
+        return 0;
+}
+
+static int rt5663_set_dai_sysclk(struct snd_soc_dai *dai, int clk_id,
+        unsigned int freq, int dir)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        unsigned int reg_val = 0;
+
+        if (freq == rt5663->sysclk && clk_id == rt5663->sysclk_src)
+                return 0;
+
+        switch (clk_id) {
+        case RT5663_SCLK_S_MCLK:
+                reg_val |= RT5663_SCLK_SRC_MCLK;
+                break;
+        case RT5663_SCLK_S_PLL1:
+                reg_val |= RT5663_SCLK_SRC_PLL1;
+                break;
+        case RT5663_SCLK_S_RCCLK:
+                reg_val |= RT5663_SCLK_SRC_RCCLK;
+                break;
+        default:
+                dev_err(codec->dev, "Invalid clock id (%d)\n", clk_id);
+                return -EINVAL;
+        }
+        snd_soc_update_bits(codec, RT5663_GLB_CLK, RT5668_SCLK_SRC_MASK,
+                reg_val);
+        rt5663->sysclk = freq;
+        rt5663->sysclk_src = clk_id;
+
+        dev_dbg(codec->dev, "Sysclk is %dHz and clock id is %d\n",
+                freq, clk_id);
+
+        return 0;
+}
+
+static int rt5663_set_dai_pll(struct snd_soc_dai *dai, int pll_id, int source,
+                        unsigned int freq_in, unsigned int freq_out)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        struct rl6231_pll_code pll_code;
+        int ret;
+        int mask, shift, val;
+
+        if (source == rt5663->pll_src && freq_in == rt5663->pll_in &&
+            freq_out == rt5663->pll_out)
+                return 0;
+
+        if (!freq_in || !freq_out) {
+                dev_dbg(codec->dev, "PLL disabled\n");
+
+                rt5663->pll_in = 0;
+                rt5663->pll_out = 0;
+                snd_soc_update_bits(codec, RT5663_GLB_CLK,
+                        RT5663_SCLK_SRC_MASK, RT5663_SCLK_SRC_MCLK);
+                return 0;
+        }
+
+        switch (rt5663->codec_type) {
+        case CODEC_TYPE_RT5668:
+                mask = RT5668_PLL1_SRC_MASK;
+                shift = RT5668_PLL1_SRC_SHIFT;
+                break;
+        case CODEC_TYPE_RT5663:
+                mask = RT5663_PLL1_SRC_MASK;
+                shift = RT5663_PLL1_SRC_SHIFT;
+                break;
+        default:
+                dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                return -EINVAL;
+        }
+
+        switch (source) {
+        case RT5663_PLL1_S_MCLK:
+                val = 0x0;
+                break;
+        case RT5663_PLL1_S_BCLK1:
+                val = 0x1;
+                break;
+        default:
+                dev_err(codec->dev, "Unknown PLL source %d\n", source);
+                return -EINVAL;
+        }
+        snd_soc_update_bits(codec, RT5663_GLB_CLK, mask, (val << shift));
+
+        ret = rl6231_pll_calc(freq_in, freq_out, &pll_code);
+        if (ret < 0) {
+                dev_err(codec->dev, "Unsupport input clock %d\n", freq_in);
+                return ret;
+        }
+
+        dev_dbg(codec->dev, "bypass=%d m=%d n=%d k=%d\n", pll_code.m_bp,
+                (pll_code.m_bp ? 0 : pll_code.m_code), pll_code.n_code,
+                pll_code.k_code);
+
+        snd_soc_write(codec, RT5663_PLL_1,
+                pll_code.n_code << RT5668_PLL_N_SHIFT | pll_code.k_code);
+        snd_soc_write(codec, RT5663_PLL_2,
+                (pll_code.m_bp ? 0 : pll_code.m_code) << RT5668_PLL_M_SHIFT |
+                pll_code.m_bp << RT5668_PLL_M_BP_SHIFT);
+
+        rt5663->pll_in = freq_in;
+        rt5663->pll_out = freq_out;
+        rt5663->pll_src = source;
+
+        return 0;
+}
+
+static int rt5663_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
+        unsigned int rx_mask, int slots, int slot_width)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        unsigned int val = 0, reg;
+
+        if (rx_mask || tx_mask)
+                val |= RT5668_TDM_MODE_TDM;
+
+        switch (slots) {
+        case 4:
+                val |= RT5668_TDM_IN_CH_4;
+                val |= RT5668_TDM_OUT_CH_4;
+                break;
+        case 6:
+                val |= RT5668_TDM_IN_CH_6;
+                val |= RT5668_TDM_OUT_CH_6;
+                break;
+        case 8:
+                val |= RT5668_TDM_IN_CH_8;
+                val |= RT5668_TDM_OUT_CH_8;
+                break;
+        case 2:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (slot_width) {
+        case 20:
+                val |= RT5668_TDM_IN_LEN_20;
+                val |= RT5668_TDM_OUT_LEN_20;
+                break;
+        case 24:
+                val |= RT5668_TDM_IN_LEN_24;
+                val |= RT5668_TDM_OUT_LEN_24;
+                break;
+        case 32:
+                val |= RT5668_TDM_IN_LEN_32;
+                val |= RT5668_TDM_OUT_LEN_32;
+                break;
+        case 16:
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        switch (rt5663->codec_type) {
+        case CODEC_TYPE_RT5668:
+                reg = RT5663_TDM_2;
+                break;
+        case CODEC_TYPE_RT5663:
+                reg = RT5663_TDM_1;
+                break;
+        default:
+                dev_err(codec->dev, "Unknown CODEC_TYPE\n");
+                return -EINVAL;
+        }
+
+        snd_soc_update_bits(codec, reg, RT5668_TDM_MODE_MASK |
+                RT5668_TDM_IN_CH_MASK | RT5668_TDM_OUT_CH_MASK |
+                RT5668_TDM_IN_LEN_MASK | RT5668_TDM_OUT_LEN_MASK, val);
+
+        return 0;
+}
+
+static int rt5663_set_bclk_ratio(struct snd_soc_dai *dai, unsigned int ratio)
+{
+        struct snd_soc_codec *codec = dai->codec;
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+        unsigned int reg;
+
+        dev_dbg(codec->dev, "%s ratio = %d\n", __func__, ratio);
+
+        if (rt5663->codec_type == CODEC_TYPE_RT5668)
+                reg = RT5668_TDM_8;
+        else
+                reg = RT5663_TDM_5;
+
+        switch (ratio) {
+        case 32:
+                snd_soc_update_bits(codec, reg,
+                        RT5663_TDM_LENGTN_MASK,
+                        RT5663_TDM_LENGTN_16);
+                break;
+        case 40:
+                snd_soc_update_bits(codec, reg,
+                        RT5663_TDM_LENGTN_MASK,
+                        RT5663_TDM_LENGTN_20);
+                break;
+        case 48:
+                snd_soc_update_bits(codec, reg,
+                        RT5663_TDM_LENGTN_MASK,
+                        RT5663_TDM_LENGTN_24);
+                break;
+        case 64:
+                snd_soc_update_bits(codec, reg,
+                        RT5663_TDM_LENGTN_MASK,
+                        RT5663_TDM_LENGTN_32);
+                break;
+        default:
+                dev_err(codec->dev, "Invalid ratio!\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int rt5663_set_bias_level(struct snd_soc_codec *codec,
+                        enum snd_soc_bias_level level)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        switch (level) {
+        case SND_SOC_BIAS_ON:
+                snd_soc_update_bits(codec, RT5663_PWR_ANLG_1,
+                        RT5668_PWR_FV1_MASK | RT5668_PWR_FV2_MASK,
+                        RT5668_PWR_FV1 | RT5668_PWR_FV2);
+                break;
+
+        case SND_SOC_BIAS_PREPARE:
+                if (rt5663->codec_type == CODEC_TYPE_RT5668) {
+                        snd_soc_update_bits(codec, RT5663_DIG_MISC,
+                                RT5668_DIG_GATE_CTRL_MASK,
+                                RT5668_DIG_GATE_CTRL_EN);
+                        snd_soc_update_bits(codec, RT5663_SIG_CLK_DET,
+                                RT5668_EN_ANA_CLK_DET_MASK |
+                                RT5668_PWR_CLK_DET_MASK,
+                                RT5668_EN_ANA_CLK_DET_AUTO |
+                                RT5668_PWR_CLK_DET_EN);
+                }
+                break;
+
+        case SND_SOC_BIAS_STANDBY:
+                if (rt5663->codec_type == CODEC_TYPE_RT5668)
+                        snd_soc_update_bits(codec, RT5663_DIG_MISC,
+                                RT5668_DIG_GATE_CTRL_MASK,
+                                RT5668_DIG_GATE_CTRL_DIS);
+                snd_soc_update_bits(codec, RT5663_PWR_ANLG_1,
+                        RT5668_PWR_VREF1_MASK | RT5668_PWR_VREF2_MASK |
+                        RT5668_PWR_FV1_MASK | RT5668_PWR_FV2_MASK |
+                        RT5668_PWR_MB_MASK, RT5668_PWR_VREF1 |
+                        RT5668_PWR_VREF2 | RT5668_PWR_MB);
+                usleep_range(10000, 10005);
+                if (rt5663->codec_type == CODEC_TYPE_RT5668) {
+                        snd_soc_update_bits(codec, RT5663_SIG_CLK_DET,
+                                RT5668_EN_ANA_CLK_DET_MASK |
+                                RT5668_PWR_CLK_DET_MASK,
+                                RT5668_EN_ANA_CLK_DET_DIS |
+                                RT5668_PWR_CLK_DET_DIS);
+                }
+                break;
+
+        case SND_SOC_BIAS_OFF:
+                snd_soc_update_bits(codec, RT5663_PWR_ANLG_1,
+                        RT5668_PWR_VREF1_MASK | RT5668_PWR_VREF2_MASK |
+                        RT5668_PWR_FV1 | RT5668_PWR_FV2, 0x0);
+                break;
+
+        default:
+                break;
+        }
+
+        return 0;
+}
+
+static int rt5663_probe(struct snd_soc_codec *codec)
+{
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        rt5663->codec = codec;
+
+        switch (rt5663->codec_type) {
+        case CODEC_TYPE_RT5668:
+                snd_soc_dapm_new_controls(dapm,
+                        rt5668_specific_dapm_widgets,
+                        ARRAY_SIZE(rt5668_specific_dapm_widgets));
+                snd_soc_dapm_add_routes(dapm,
+                        rt5668_specific_dapm_routes,
+                        ARRAY_SIZE(rt5668_specific_dapm_routes));
+                snd_soc_add_codec_controls(codec, rt5668_specific_controls,
+                        ARRAY_SIZE(rt5668_specific_controls));
+                break;
+        case CODEC_TYPE_RT5663:
+                snd_soc_dapm_new_controls(dapm,
+                        rt5663_specific_dapm_widgets,
+                        ARRAY_SIZE(rt5663_specific_dapm_widgets));
+                snd_soc_dapm_add_routes(dapm,
+                        rt5663_specific_dapm_routes,
+                        ARRAY_SIZE(rt5663_specific_dapm_routes));
+                snd_soc_add_codec_controls(codec, rt5663_specific_controls,
+                        ARRAY_SIZE(rt5663_specific_controls));
+                break;
+        }
+
+        return 0;
+}
+
+static int rt5663_remove(struct snd_soc_codec *codec)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        regmap_write(rt5663->regmap, RT5663_RESET, 0);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int rt5663_suspend(struct snd_soc_codec *codec)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        regcache_cache_only(rt5663->regmap, true);
+        regcache_mark_dirty(rt5663->regmap);
+
+        return 0;
+}
+
+static int rt5663_resume(struct snd_soc_codec *codec)
+{
+        struct rt5663_priv *rt5663 = snd_soc_codec_get_drvdata(codec);
+
+        regcache_cache_only(rt5663->regmap, false);
+        regcache_sync(rt5663->regmap);
+
+        return 0;
+}
+#else
+#define rt5663_suspend NULL
+#define rt5663_resume NULL
+#endif
+
+#define RT5663_STEREO_RATES SNDRV_PCM_RATE_8000_192000
+#define RT5663_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S20_3LE | \
+                        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S8)
+
+static struct snd_soc_dai_ops rt5663_aif_dai_ops = {
+        .hw_params = rt5663_hw_params,
+        .set_fmt = rt5663_set_dai_fmt,
+        .set_sysclk = rt5663_set_dai_sysclk,
+        .set_pll = rt5663_set_dai_pll,
+        .set_tdm_slot = rt5663_set_tdm_slot,
+        .set_bclk_ratio = rt5663_set_bclk_ratio,
+};
+
+static struct snd_soc_dai_driver rt5663_dai[] = {
+        {
+                .name = "rt5663-aif",
+                .id = RT5663_AIF,
+                .playback = {
+                        .stream_name = "AIF Playback",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = RT5663_STEREO_RATES,
+                        .formats = RT5663_FORMATS,
+                },
+                .capture = {
+                        .stream_name = "AIF Capture",
+                        .channels_min = 1,
+                        .channels_max = 2,
+                        .rates = RT5663_STEREO_RATES,
+                        .formats = RT5663_FORMATS,
+                },
+                .ops = &rt5663_aif_dai_ops,
+        },
+};
+
+static struct snd_soc_codec_driver soc_codec_dev_rt5663 = {
+        .probe = rt5663_probe,
+        .remove = rt5663_remove,
+        .suspend = rt5663_suspend,
+        .resume = rt5663_resume,
+        .set_bias_level = rt5663_set_bias_level,
+        .idle_bias_off = true,
+        .component_driver = {
+                .controls = rt5663_snd_controls,
+                .num_controls = ARRAY_SIZE(rt5663_snd_controls),
+                .dapm_widgets = rt5663_dapm_widgets,
+                .num_dapm_widgets = ARRAY_SIZE(rt5663_dapm_widgets),
+                .dapm_routes = rt5663_dapm_routes,
+                .num_dapm_routes = ARRAY_SIZE(rt5663_dapm_routes),
+        }
+};
+
+static const struct regmap_config rt5668_regmap = {
+        .reg_bits = 16,
+        .val_bits = 16,
+        .use_single_rw = true,
+        .max_register = 0x07fa,
+        .volatile_reg = rt5668_volatile_register,
+        .readable_reg = rt5668_readable_register,
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = rt5668_reg,
+        .num_reg_defaults = ARRAY_SIZE(rt5668_reg),
+};
+
+static const struct regmap_config rt5663_regmap = {
+        .reg_bits = 16,
+        .val_bits = 16,
+        .use_single_rw = true,
+        .max_register = 0x03f3,
+        .volatile_reg = rt5663_volatile_register,
+        .readable_reg = rt5663_readable_register,
+        .cache_type = REGCACHE_RBTREE,
+        .reg_defaults = rt5663_reg,
+        .num_reg_defaults = ARRAY_SIZE(rt5663_reg),
+};
+
+static const struct regmap_config temp_regmap = {
+        .name = "nocache",
+        .reg_bits = 16,
+        .val_bits = 16,
+        .use_single_rw = true,
+        .max_register = 0x03f3,
+        .cache_type = REGCACHE_NONE,
+};
+
+static const struct i2c_device_id rt5663_i2c_id[] = {
+        { "rt5668", 0 },
+        { "rt5663", 0 },
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, rt5663_i2c_id);
+
+#if defined(CONFIG_OF)
+static const struct of_device_id rt5663_of_match[] = {
+        { .compatible = "realtek,rt5668", },
+        { .compatible = "realtek,rt5663", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, rt5663_of_match);
+#endif
+
+#ifdef CONFIG_ACPI
+static struct acpi_device_id rt5663_acpi_match[] = {
+        { "10EC5668", 0},
+        { "10EC5663", 0},
+        {},
+};
+MODULE_DEVICE_TABLE(acpi, rt5663_acpi_match);
+#endif
+
+static void rt5668_calibrate(struct rt5663_priv *rt5668)
+{
+        regmap_write(rt5668->regmap, RT5663_BIAS_CUR_8, 0xa402);
+        regmap_write(rt5668->regmap, RT5663_PWR_DIG_1, 0x0100);
+        regmap_write(rt5668->regmap, RT5663_RECMIX, 0x4040);
+        regmap_write(rt5668->regmap, RT5663_DIG_MISC, 0x0001);
+        regmap_write(rt5668->regmap, RT5663_RC_CLK, 0x0380);
+        regmap_write(rt5668->regmap, RT5663_GLB_CLK, 0x8000);
+        regmap_write(rt5668->regmap, RT5663_ADDA_CLK_1, 0x1000);
+        regmap_write(rt5668->regmap, RT5663_CHOP_DAC_L, 0x3030);
+        regmap_write(rt5668->regmap, RT5663_CALIB_ADC, 0x3c05);
+        regmap_write(rt5668->regmap, RT5663_PWR_ANLG_1, 0xa23e);
+        msleep(40);
+        regmap_write(rt5668->regmap, RT5663_PWR_ANLG_1, 0xf23e);
+        regmap_write(rt5668->regmap, RT5663_HP_CALIB_2, 0x0321);
+        regmap_write(rt5668->regmap, RT5663_HP_CALIB_1, 0xfc00);
+        msleep(500);
+}
+
+static void rt5663_calibrate(struct rt5663_priv *rt5668)
+{
+        int value, count;
+
+        regmap_write(rt5668->regmap, RT5663_RC_CLK, 0x0280);
+        regmap_write(rt5668->regmap, RT5663_GLB_CLK, 0x8000);
+        regmap_write(rt5668->regmap, RT5663_DIG_MISC, 0x8001);
+        regmap_write(rt5668->regmap, RT5663_VREF_RECMIX, 0x0032);
+        regmap_write(rt5668->regmap, RT5663_PWR_ANLG_1, 0xa2be);
+        msleep(20);
+        regmap_write(rt5668->regmap, RT5663_PWR_ANLG_1, 0xf2be);
+        regmap_write(rt5668->regmap, RT5663_PWR_DIG_2, 0x8400);
+        regmap_write(rt5668->regmap, RT5663_CHOP_ADC, 0x3000);
+        regmap_write(rt5668->regmap, RT5663_DEPOP_1, 0x003b);
+        regmap_write(rt5668->regmap, RT5663_PWR_DIG_1, 0x8df8);
+        regmap_write(rt5668->regmap, RT5663_PWR_ANLG_2, 0x0003);
+        regmap_write(rt5668->regmap, RT5663_PWR_ANLG_3, 0x018c);
+        regmap_write(rt5668->regmap, RT5663_ADDA_CLK_1, 0x1111);
+        regmap_write(rt5668->regmap, RT5663_PRE_DIV_GATING_1, 0xffff);
+        regmap_write(rt5668->regmap, RT5663_PRE_DIV_GATING_2, 0xffff);
+        regmap_write(rt5668->regmap, RT5663_DEPOP_2, 0x3003);
+        regmap_write(rt5668->regmap, RT5663_DEPOP_1, 0x003b);
+        regmap_write(rt5668->regmap, RT5663_HP_CHARGE_PUMP_1, 0x1e32);
+        regmap_write(rt5668->regmap, RT5663_HP_CHARGE_PUMP_2, 0x1371);
+        regmap_write(rt5668->regmap, RT5663_DACREF_LDO, 0x3b0b);
+        regmap_write(rt5668->regmap, RT5663_STO_DAC_MIXER, 0x2080);
+        regmap_write(rt5668->regmap, RT5663_BYPASS_STO_DAC, 0x000c);
+        regmap_write(rt5668->regmap, RT5663_HP_BIAS, 0xabba);
+        regmap_write(rt5668->regmap, RT5663_CHARGE_PUMP_1, 0x2224);
+        regmap_write(rt5668->regmap, RT5663_HP_OUT_EN, 0x8088);
+        regmap_write(rt5668->regmap, RT5663_STO_DRE_9, 0x0017);
+        regmap_write(rt5668->regmap, RT5663_STO_DRE_10, 0x0017);
+        regmap_write(rt5668->regmap, RT5663_STO1_ADC_MIXER, 0x4040);
+        regmap_write(rt5668->regmap, RT5663_RECMIX, 0x0005);
+        regmap_write(rt5668->regmap, RT5663_ADDA_RST, 0xc000);
+        regmap_write(rt5668->regmap, RT5663_STO1_HPF_ADJ1, 0x3320);
+        regmap_write(rt5668->regmap, RT5663_HP_CALIB_2, 0x00c9);
+        regmap_write(rt5668->regmap, RT5663_DUMMY_1, 0x004c);
+        regmap_write(rt5668->regmap, RT5663_ANA_BIAS_CUR_1, 0x7766);
+        regmap_write(rt5668->regmap, RT5663_BIAS_CUR_8, 0x4702);
+        msleep(200);
+        regmap_write(rt5668->regmap, RT5663_HP_CALIB_1, 0x0069);
+        regmap_write(rt5668->regmap, RT5663_HP_CALIB_3, 0x06c2);
+        regmap_write(rt5668->regmap, RT5663_HP_CALIB_1_1, 0x7b00);
+        regmap_write(rt5668->regmap, RT5663_HP_CALIB_1_1, 0xfb00);
+        count = 0;
+        while (true) {
+                regmap_read(rt5668->regmap, RT5663_HP_CALIB_1_1, &value);
+                if (value & 0x8000)
+                        usleep_range(10000, 10005);
+                else
+                        break;
+
+                if (count > 200)
+                        return;
+                count++;
+        }
+}
+
+static int rt5663_i2c_probe(struct i2c_client *i2c,
+                    const struct i2c_device_id *id)
+{
+        struct rt5663_priv *rt5663;
+        int ret;
+        unsigned int val;
+        struct regmap *regmap;
+
+        rt5663 = devm_kzalloc(&i2c->dev, sizeof(struct rt5663_priv),
+                GFP_KERNEL);
+
+        if (rt5663 == NULL)
+                return -ENOMEM;
+
+        i2c_set_clientdata(i2c, rt5663);
+
+        regmap = devm_regmap_init_i2c(i2c, &temp_regmap);
+        if (IS_ERR(regmap)) {
+                ret = PTR_ERR(regmap);
+                dev_err(&i2c->dev, "Failed to allocate temp register map: %d\n",
+                        ret);
+                return ret;
+        }
+        regmap_read(regmap, RT5663_VENDOR_ID_2, &val);
+        switch (val) {
+        case RT5668_DEVICE_ID:
+                rt5663->regmap = devm_regmap_init_i2c(i2c, &rt5668_regmap);
+                rt5663->codec_type = CODEC_TYPE_RT5668;
+                break;
+        case RT5663_DEVICE_ID:
+                rt5663->regmap = devm_regmap_init_i2c(i2c, &rt5663_regmap);
+                rt5663->codec_type = CODEC_TYPE_RT5663;
+                break;
+        default:
+                dev_err(&i2c->dev,
+                        "Device with ID register %#x is not rt5663 or rt5668\n",
+                        val);
+                return -ENODEV;
+        }
+
+        if (IS_ERR(rt5663->regmap)) {
+                ret = PTR_ERR(rt5663->regmap);
+                dev_err(&i2c->dev, "Failed to allocate register map: %d\n",
+                        ret);
+                return ret;
+        }
+
+        /* reset and calibrate */
+        regmap_write(rt5663->regmap, RT5663_RESET, 0);
+        regcache_cache_bypass(rt5663->regmap, true);
+        switch (rt5663->codec_type) {
+        case CODEC_TYPE_RT5668:
+                rt5668_calibrate(rt5663);
+                break;
+        case CODEC_TYPE_RT5663:
+                rt5663_calibrate(rt5663);
+                break;
+        default:
+                dev_err(&i2c->dev, "%s:Unknown codec type\n", __func__);
+        }
+        regcache_cache_bypass(rt5663->regmap, false);
+        regmap_write(rt5663->regmap, RT5663_RESET, 0);
+        dev_dbg(&i2c->dev, "calibrate done\n");
+
+        /* GPIO1 as IRQ */
+        regmap_update_bits(rt5663->regmap, RT5663_GPIO_1, RT5668_GP1_PIN_MASK,
+                RT5668_GP1_PIN_IRQ);
+        /* 4btn inline command debounce */
+        regmap_update_bits(rt5663->regmap, RT5663_IL_CMD_5,
+                RT5668_4BTN_CLK_DEB_MASK, RT5668_4BTN_CLK_DEB_65MS);
+
+        switch (rt5663->codec_type) {
+        case CODEC_TYPE_RT5668:
+                regmap_write(rt5663->regmap, RT5663_BIAS_CUR_8, 0xa402);
+                /* JD1 */
+                regmap_update_bits(rt5663->regmap, RT5663_AUTO_1MRC_CLK,
+                        RT5668_IRQ_POW_SAV_MASK | RT5668_IRQ_POW_SAV_JD1_MASK,
+                        RT5668_IRQ_POW_SAV_EN | RT5668_IRQ_POW_SAV_JD1_EN);
+                regmap_update_bits(rt5663->regmap, RT5663_PWR_ANLG_2,
+                        RT5668_PWR_JD1_MASK, RT5668_PWR_JD1);
+                regmap_update_bits(rt5663->regmap, RT5663_IRQ_1,
+                        RT5668_EN_CB_JD_MASK, RT5668_EN_CB_JD_EN);
+
+                regmap_update_bits(rt5663->regmap, RT5663_HP_LOGIC_2,
+                        RT5668_HP_SIG_SRC1_MASK, RT5668_HP_SIG_SRC1_REG);
+                regmap_update_bits(rt5663->regmap, RT5663_RECMIX,
+                        RT5668_VREF_BIAS_MASK | RT5668_CBJ_DET_MASK |
+                        RT5668_DET_TYPE_MASK, RT5668_VREF_BIAS_REG |
+                        RT5668_CBJ_DET_EN | RT5668_DET_TYPE_QFN);
+                /* Set GPIO4 and GPIO8 as input for combo jack */
+                regmap_update_bits(rt5663->regmap, RT5663_GPIO_2,
+                        RT5668_GP4_PIN_CONF_MASK, RT5668_GP4_PIN_CONF_INPUT);
+                regmap_update_bits(rt5663->regmap, RT5668_GPIO_3,
+                        RT5668_GP8_PIN_CONF_MASK, RT5668_GP8_PIN_CONF_INPUT);
+                regmap_update_bits(rt5663->regmap, RT5663_PWR_ANLG_1,
+                        RT5668_LDO1_DVO_MASK | RT5668_AMP_HP_MASK,
+                        RT5668_LDO1_DVO_0_9V | RT5668_AMP_HP_3X);
+                        break;
+        case CODEC_TYPE_RT5663:
+                regmap_write(rt5663->regmap, RT5663_VREF_RECMIX, 0x0032);
+                regmap_write(rt5663->regmap, RT5663_PWR_ANLG_1, 0xa2be);
+                msleep(20);
+                regmap_write(rt5663->regmap, RT5663_PWR_ANLG_1, 0xf2be);
+                regmap_update_bits(rt5663->regmap, RT5663_GPIO_2,
+                        RT5663_GP1_PIN_CONF_MASK, RT5663_GP1_PIN_CONF_OUTPUT);
+                /* DACREF LDO control */
+                regmap_update_bits(rt5663->regmap, RT5663_DACREF_LDO, 0x3e0e,
+                        0x3a0a);
+                regmap_update_bits(rt5663->regmap, RT5663_RECMIX,
+                        RT5663_RECMIX1_BST1_MASK, RT5663_RECMIX1_BST1_ON);
+                regmap_update_bits(rt5663->regmap, RT5663_TDM_2,
+                        RT5663_DATA_SWAP_ADCDAT1_MASK,
+                        RT5663_DATA_SWAP_ADCDAT1_LL);
+                        break;
+        default:
+                dev_err(&i2c->dev, "%s:Unknown codec type\n", __func__);
+        }
+
+        INIT_DELAYED_WORK(&rt5663->jack_detect_work, rt5663_jack_detect_work);
+
+        if (i2c->irq) {
+                ret = request_irq(i2c->irq, rt5663_irq,
+                        IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
+                        | IRQF_ONESHOT, "rt5663", rt5663);
+                if (ret)
+                        dev_err(&i2c->dev, "%s Failed to reguest IRQ: %d\n",
+                                __func__, ret);
+        }
+
+        ret = snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5663,
+                        rt5663_dai, ARRAY_SIZE(rt5663_dai));
+
+        if (ret) {
+                if (i2c->irq)
+                        free_irq(i2c->irq, rt5663);
+        }
+
+        return ret;
+}
+
+static int rt5663_i2c_remove(struct i2c_client *i2c)
+{
+        struct rt5663_priv *rt5663 = i2c_get_clientdata(i2c);
+
+        if (i2c->irq)
+                free_irq(i2c->irq, rt5663);
+
+        snd_soc_unregister_codec(&i2c->dev);
+
+        return 0;
+}
+
+static void rt5663_i2c_shutdown(struct i2c_client *client)
+{
+        struct rt5663_priv *rt5663 = i2c_get_clientdata(client);
+
+        regmap_write(rt5663->regmap, RT5663_RESET, 0);
+}
+
+static struct i2c_driver rt5663_i2c_driver = {
+        .driver = {
+                .name = "rt5663",
+                .acpi_match_table = ACPI_PTR(rt5663_acpi_match),
+                .of_match_table = of_match_ptr(rt5663_of_match),
+        },
+        .probe = rt5663_i2c_probe,
+        .remove = rt5663_i2c_remove,
+        .shutdown = rt5663_i2c_shutdown,
+        .id_table = rt5663_i2c_id,
+};
+module_i2c_driver(rt5663_i2c_driver);
+
+MODULE_DESCRIPTION("ASoC RT5663 driver");
+MODULE_AUTHOR("Jack Yu <jack.yu@realtek.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/codecs/rt5663.h b/sound/soc/codecs/rt5663.h
new file mode 100644
index 000000000000..2cc8f28080f6
--- /dev/null
+++ b/sound/soc/codecs/rt5663.h
@@ -0,0 +1,1121 @@
+/*
+ * rt5663.h  --  RT5663 ALSA SoC audio driver
+ *
+ * Copyright 2016 Realtek Microelectronics
+ * Author: Jack Yu <jack.yu@realtek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __RT5663_H__
+#define __RT5663_H__
+
+/* Info */
+#define RT5663_RESET                            0x0000
+#define RT5663_VENDOR_ID                        0x00fd
+#define RT5663_VENDOR_ID_1                      0x00fe
+#define RT5663_VENDOR_ID_2                      0x00ff
+
+#define RT5668_LOUT_CTRL                        0x0001
+#define RT5668_HP_AMP_2                         0x0003
+#define RT5668_MONO_OUT                         0x0004
+#define RT5668_MONO_GAIN                        0x0007
+
+#define RT5668_AEC_BST                          0x000b
+#define RT5668_IN1_IN2                          0x000c
+#define RT5668_IN3_IN4                          0x000d
+#define RT5668_INL1_INR1                        0x000f
+#define RT5668_CBJ_TYPE_2                       0x0011
+#define RT5668_CBJ_TYPE_3                       0x0012
+#define RT5668_CBJ_TYPE_4                       0x0013
+#define RT5668_CBJ_TYPE_5                       0x0014
+#define RT5668_CBJ_TYPE_8                       0x0017
+
+/* I/O - ADC/DAC/DMIC */
+#define RT5668_DAC3_DIG_VOL                     0x001a
+#define RT5668_DAC3_CTRL                        0x001b
+#define RT5668_MONO_ADC_DIG_VOL                 0x001d
+#define RT5668_STO2_ADC_DIG_VOL                 0x001e
+#define RT5668_MONO_ADC_BST_GAIN                0x0020
+#define RT5668_STO2_ADC_BST_GAIN                0x0021
+#define RT5668_SIDETONE_CTRL                    0x0024
+/* Mixer - D-D */
+#define RT5668_MONO1_ADC_MIXER                  0x0027
+#define RT5668_STO2_ADC_MIXER                   0x0028
+#define RT5668_MONO_DAC_MIXER                   0x002b
+#define RT5668_DAC2_SRC_CTRL                    0x002e
+#define RT5668_IF_3_4_DATA_CTL                  0x002f
+#define RT5668_IF_5_DATA_CTL                    0x0030
+#define RT5668_PDM_OUT_CTL                      0x0031
+#define RT5668_PDM_I2C_DATA_CTL1                0x0032
+#define RT5668_PDM_I2C_DATA_CTL2                0x0033
+#define RT5668_PDM_I2C_DATA_CTL3                0x0034
+#define RT5668_PDM_I2C_DATA_CTL4                0x0035
+
+/*Mixer - Analog*/
+#define RT5668_RECMIX1_NEW                      0x003a
+#define RT5668_RECMIX1L_0                       0x003b
+#define RT5668_RECMIX1L                         0x003c
+#define RT5668_RECMIX1R_0                       0x003d
+#define RT5668_RECMIX1R                         0x003e
+#define RT5668_RECMIX2_NEW                      0x003f
+#define RT5668_RECMIX2_L_2                      0x0041
+#define RT5668_RECMIX2_R                        0x0042
+#define RT5668_RECMIX2_R_2                      0x0043
+#define RT5668_CALIB_REC_LR                     0x0044
+#define RT5668_ALC_BK_GAIN                      0x0049
+#define RT5668_MONOMIX_GAIN                     0x004a
+#define RT5668_MONOMIX_IN_GAIN                  0x004b
+#define RT5668_OUT_MIXL_GAIN                    0x004d
+#define RT5668_OUT_LMIX_IN_GAIN                 0x004e
+#define RT5668_OUT_RMIX_IN_GAIN                 0x004f
+#define RT5668_OUT_RMIX_IN_GAIN1                0x0050
+#define RT5668_LOUT_MIXER_CTRL                  0x0052
+/* Power */
+#define RT5668_PWR_VOL                          0x0067
+
+#define RT5668_ADCDAC_RST                       0x006d
+/* Format - ADC/DAC */
+#define RT5668_I2S34_SDP                        0x0071
+#define RT5668_I2S5_SDP                         0x0072
+/* Format - TDM Control */
+#define RT5668_TDM_5                            0x007c
+#define RT5668_TDM_6                            0x007d
+#define RT5668_TDM_7                            0x007e
+#define RT5668_TDM_8                            0x007f
+
+/* Function - Analog */
+#define RT5668_ASRC_3                           0x0085
+#define RT5668_ASRC_6                           0x0088
+#define RT5668_ASRC_7                           0x0089
+#define RT5668_PLL_TRK_13                       0x0099
+#define RT5668_I2S_M_CLK_CTL                    0x00a0
+#define RT5668_FDIV_I2S34_M_CLK                 0x00a1
+#define RT5668_FDIV_I2S34_M_CLK2                0x00a2
+#define RT5668_FDIV_I2S5_M_CLK                  0x00a3
+#define RT5668_FDIV_I2S5_M_CLK2                 0x00a4
+
+/* Function - Digital */
+#define RT5668_IRQ_4                            0x00b9
+#define RT5668_GPIO_3                           0x00c2
+#define RT5668_GPIO_4                           0x00c3
+#define RT5668_GPIO_STA                         0x00c4
+#define RT5668_HP_AMP_DET1                      0x00d0
+#define RT5668_HP_AMP_DET2                      0x00d1
+#define RT5668_HP_AMP_DET3                      0x00d2
+#define RT5668_MID_BD_HP_AMP                    0x00d3
+#define RT5668_LOW_BD_HP_AMP                    0x00d4
+#define RT5668_SOF_VOL_ZC2                      0x00da
+#define RT5668_ADC_STO2_ADJ1                    0x00ee
+#define RT5668_ADC_STO2_ADJ2                    0x00ef
+/* General Control */
+#define RT5668_A_JD_CTRL                        0x00f0
+#define RT5668_JD1_TRES_CTRL                    0x00f1
+#define RT5668_JD2_TRES_CTRL                    0x00f2
+#define RT5668_JD_CTRL2                         0x00f7
+#define RT5668_DUM_REG_2                        0x00fb
+#define RT5668_DUM_REG_3                        0x00fc
+
+
+#define RT5668_DACADC_DIG_VOL2                  0x0101
+#define RT5668_DIG_IN_PIN2                      0x0133
+#define RT5668_PAD_DRV_CTL1                     0x0136
+#define RT5668_SOF_RAM_DEPOP                    0x0138
+#define RT5668_VOL_TEST                         0x013f
+#define RT5668_TEST_MODE_3                      0x0147
+#define RT5668_TEST_MODE_4                      0x0148
+#define RT5668_MONO_DYNA_1                      0x0170
+#define RT5668_MONO_DYNA_2                      0x0171
+#define RT5668_MONO_DYNA_3                      0x0172
+#define RT5668_MONO_DYNA_4                      0x0173
+#define RT5668_MONO_DYNA_5                      0x0174
+#define RT5668_MONO_DYNA_6                      0x0175
+#define RT5668_STO1_SIL_DET                     0x0190
+#define RT5668_MONOL_SIL_DET                    0x0191
+#define RT5668_MONOR_SIL_DET                    0x0192
+#define RT5668_STO2_DAC_SIL                     0x0193
+#define RT5668_PWR_SAV_CTL1                     0x0194
+#define RT5668_PWR_SAV_CTL2                     0x0195
+#define RT5668_PWR_SAV_CTL3                     0x0196
+#define RT5668_PWR_SAV_CTL4                     0x0197
+#define RT5668_PWR_SAV_CTL5                     0x0198
+#define RT5668_PWR_SAV_CTL6                     0x0199
+#define RT5668_MONO_AMP_CAL1                    0x01a0
+#define RT5668_MONO_AMP_CAL2                    0x01a1
+#define RT5668_MONO_AMP_CAL3                    0x01a2
+#define RT5668_MONO_AMP_CAL4                    0x01a3
+#define RT5668_MONO_AMP_CAL5                    0x01a4
+#define RT5668_MONO_AMP_CAL6                    0x01a5
+#define RT5668_MONO_AMP_CAL7                    0x01a6
+#define RT5668_MONO_AMP_CAL_ST1                 0x01a7
+#define RT5668_MONO_AMP_CAL_ST2                 0x01a8
+#define RT5668_MONO_AMP_CAL_ST3                 0x01a9
+#define RT5668_MONO_AMP_CAL_ST4                 0x01aa
+#define RT5668_MONO_AMP_CAL_ST5                 0x01ab
+#define RT5668_HP_IMP_SEN_13                    0x01b9
+#define RT5668_HP_IMP_SEN_14                    0x01ba
+#define RT5668_HP_IMP_SEN_6                     0x01bb
+#define RT5668_HP_IMP_SEN_7                     0x01bc
+#define RT5668_HP_IMP_SEN_8                     0x01bd
+#define RT5668_HP_IMP_SEN_9                     0x01be
+#define RT5668_HP_IMP_SEN_10                    0x01bf
+#define RT5668_HP_LOGIC_3                       0x01dc
+#define RT5668_HP_CALIB_ST10                    0x01f3
+#define RT5668_HP_CALIB_ST11                    0x01f4
+#define RT5668_PRO_REG_TBL_4                    0x0203
+#define RT5668_PRO_REG_TBL_5                    0x0204
+#define RT5668_PRO_REG_TBL_6                    0x0205
+#define RT5668_PRO_REG_TBL_7                    0x0206
+#define RT5668_PRO_REG_TBL_8                    0x0207
+#define RT5668_PRO_REG_TBL_9                    0x0208
+#define RT5668_SAR_ADC_INL_1                    0x0210
+#define RT5668_SAR_ADC_INL_2                    0x0211
+#define RT5668_SAR_ADC_INL_3                    0x0212
+#define RT5668_SAR_ADC_INL_4                    0x0213
+#define RT5668_SAR_ADC_INL_5                    0x0214
+#define RT5668_SAR_ADC_INL_6                    0x0215
+#define RT5668_SAR_ADC_INL_7                    0x0216
+#define RT5668_SAR_ADC_INL_8                    0x0217
+#define RT5668_SAR_ADC_INL_9                    0x0218
+#define RT5668_SAR_ADC_INL_10                   0x0219
+#define RT5668_SAR_ADC_INL_11                   0x021a
+#define RT5668_SAR_ADC_INL_12                   0x021b
+#define RT5668_DRC_CTRL_1                       0x02ff
+#define RT5668_DRC1_CTRL_2                      0x0301
+#define RT5668_DRC1_CTRL_3                      0x0302
+#define RT5668_DRC1_CTRL_4                      0x0303
+#define RT5668_DRC1_CTRL_5                      0x0304
+#define RT5668_DRC1_CTRL_6                      0x0305
+#define RT5668_DRC1_HD_CTRL_1                   0x0306
+#define RT5668_DRC1_HD_CTRL_2                   0x0307
+#define RT5668_DRC1_PRI_REG_1                   0x0310
+#define RT5668_DRC1_PRI_REG_2                   0x0311
+#define RT5668_DRC1_PRI_REG_3                   0x0312
+#define RT5668_DRC1_PRI_REG_4                   0x0313
+#define RT5668_DRC1_PRI_REG_5                   0x0314
+#define RT5668_DRC1_PRI_REG_6                   0x0315
+#define RT5668_DRC1_PRI_REG_7                   0x0316
+#define RT5668_DRC1_PRI_REG_8                   0x0317
+#define RT5668_ALC_PGA_CTL_1                    0x0330
+#define RT5668_ALC_PGA_CTL_2                    0x0331
+#define RT5668_ALC_PGA_CTL_3                    0x0332
+#define RT5668_ALC_PGA_CTL_4                    0x0333
+#define RT5668_ALC_PGA_CTL_5                    0x0334
+#define RT5668_ALC_PGA_CTL_6                    0x0335
+#define RT5668_ALC_PGA_CTL_7                    0x0336
+#define RT5668_ALC_PGA_CTL_8                    0x0337
+#define RT5668_ALC_PGA_REG_1                    0x0338
+#define RT5668_ALC_PGA_REG_2                    0x0339
+#define RT5668_ALC_PGA_REG_3                    0x033a
+#define RT5668_ADC_EQ_RECOV_1                   0x03c0
+#define RT5668_ADC_EQ_RECOV_2                   0x03c1
+#define RT5668_ADC_EQ_RECOV_3                   0x03c2
+#define RT5668_ADC_EQ_RECOV_4                   0x03c3
+#define RT5668_ADC_EQ_RECOV_5                   0x03c4
+#define RT5668_ADC_EQ_RECOV_6                   0x03c5
+#define RT5668_ADC_EQ_RECOV_7                   0x03c6
+#define RT5668_ADC_EQ_RECOV_8                   0x03c7
+#define RT5668_ADC_EQ_RECOV_9                   0x03c8
+#define RT5668_ADC_EQ_RECOV_10                  0x03c9
+#define RT5668_ADC_EQ_RECOV_11                  0x03ca
+#define RT5668_ADC_EQ_RECOV_12                  0x03cb
+#define RT5668_ADC_EQ_RECOV_13                  0x03cc
+#define RT5668_VID_HIDDEN                       0x03fe
+#define RT5668_VID_CUSTOMER                     0x03ff
+#define RT5668_SCAN_MODE                        0x07f0
+#define RT5668_I2C_BYPA                         0x07fa
+
+/* Headphone Amp Control 2 (0x0003) */
+#define RT5668_EN_DAC_HPO_MASK                  (0x1 << 14)
+#define RT5668_EN_DAC_HPO_SHIFT                 14
+#define RT5668_EN_DAC_HPO_DIS                   (0x0 << 14)
+#define RT5668_EN_DAC_HPO_EN                    (0x1 << 14)
+
+/*Headphone Amp L/R Analog Gain and Digital NG2 Gain Control (0x0005 0x0006)*/
+#define RT5668_GAIN_HP                          (0x1f << 8)
+#define RT5668_GAIN_HP_SHIFT                    8
+
+/* AEC BST Control (0x000b) */
+#define RT5668_GAIN_CBJ_MASK                    (0xf << 8)
+#define RT5668_GAIN_CBJ_SHIFT                   8
+
+/* IN1 Control / MIC GND REF (0x000c) */
+#define RT5668_IN1_DF_MASK                      (0x1 << 15)
+#define RT5668_IN1_DF_SHIFT                     15
+
+/* Combo Jack and Type Detection Control 1 (0x0010) */
+#define RT5668_CBJ_DET_MASK                     (0x1 << 15)
+#define RT5668_CBJ_DET_SHIFT                    15
+#define RT5668_CBJ_DET_DIS                      (0x0 << 15)
+#define RT5668_CBJ_DET_EN                       (0x1 << 15)
+#define RT5668_DET_TYPE_MASK                    (0x1 << 12)
+#define RT5668_DET_TYPE_SHIFT                   12
+#define RT5668_DET_TYPE_WLCSP                   (0x0 << 12)
+#define RT5668_DET_TYPE_QFN                     (0x1 << 12)
+#define RT5668_VREF_BIAS_MASK                   (0x1 << 6)
+#define RT5668_VREF_BIAS_SHIFT                  6
+#define RT5668_VREF_BIAS_FSM                    (0x0 << 6)
+#define RT5668_VREF_BIAS_REG                    (0x1 << 6)
+
+/* REC Left Mixer Control 2 (0x003c) */
+#define RT5668_RECMIX1L_BST1_CBJ                (0x1 << 7)
+#define RT5668_RECMIX1L_BST1_CBJ_SHIFT          7
+#define RT5668_RECMIX1L_BST2                    (0x1 << 4)
+#define RT5668_RECMIX1L_BST2_SHIFT              4
+
+/* REC Right Mixer Control 2 (0x003e) */
+#define RT5668_RECMIX1R_BST2                    (0x1 << 4)
+#define RT5668_RECMIX1R_BST2_SHIFT              4
+
+/* DAC1 Digital Volume (0x0019) */
+#define RT5668_DAC_L1_VOL_MASK                  (0xff << 8)
+#define RT5668_DAC_L1_VOL_SHIFT                 8
+#define RT5668_DAC_R1_VOL_MASK                  (0xff)
+#define RT5668_DAC_R1_VOL_SHIFT                 0
+
+/* ADC Digital Volume Control (0x001c) */
+#define RT5668_ADC_L_MUTE_MASK                  (0x1 << 15)
+#define RT5668_ADC_L_MUTE_SHIFT                 15
+#define RT5668_ADC_L_VOL_MASK                   (0x7f << 8)
+#define RT5668_ADC_L_VOL_SHIFT                  8
+#define RT5668_ADC_R_MUTE_MASK                  (0x1 << 7)
+#define RT5668_ADC_R_MUTE_SHIFT                 7
+#define RT5668_ADC_R_VOL_MASK                   (0x7f)
+#define RT5668_ADC_R_VOL_SHIFT                  0
+
+/* Stereo ADC Mixer Control (0x0026) */
+#define RT5668_M_STO1_ADC_L1                    (0x1 << 15)
+#define RT5668_M_STO1_ADC_L1_SHIFT              15
+#define RT5668_M_STO1_ADC_L2                    (0x1 << 14)
+#define RT5668_M_STO1_ADC_L2_SHIFT              14
+#define RT5668_STO1_ADC_L1_SRC                  (0x1 << 13)
+#define RT5668_STO1_ADC_L1_SRC_SHIFT            13
+#define RT5668_STO1_ADC_L2_SRC                  (0x1 << 12)
+#define RT5668_STO1_ADC_L2_SRC_SHIFT            12
+#define RT5668_STO1_ADC_L_SRC                   (0x3 << 10)
+#define RT5668_STO1_ADC_L_SRC_SHIFT             10
+#define RT5668_M_STO1_ADC_R1                    (0x1 << 7)
+#define RT5668_M_STO1_ADC_R1_SHIFT              7
+#define RT5668_M_STO1_ADC_R2                    (0x1 << 6)
+#define RT5668_M_STO1_ADC_R2_SHIFT              6
+#define RT5668_STO1_ADC_R1_SRC                  (0x1 << 5)
+#define RT5668_STO1_ADC_R1_SRC_SHIFT            5
+#define RT5668_STO1_ADC_R2_SRC                  (0x1 << 4)
+#define RT5668_STO1_ADC_R2_SRC_SHIFT            4
+#define RT5668_STO1_ADC_R_SRC                   (0x3 << 2)
+#define RT5668_STO1_ADC_R_SRC_SHIFT             2
+
+/* ADC Mixer to DAC Mixer Control (0x0029) */
+#define RT5668_M_ADCMIX_L                       (0x1 << 15)
+#define RT5668_M_ADCMIX_L_SHIFT                 15
+#define RT5668_M_DAC1_L                         (0x1 << 14)
+#define RT5668_M_DAC1_L_SHIFT                   14
+#define RT5668_M_ADCMIX_R                       (0x1 << 7)
+#define RT5668_M_ADCMIX_R_SHIFT                 7
+#define RT5668_M_DAC1_R                         (0x1 << 6)
+#define RT5668_M_DAC1_R_SHIFT                   6
+
+/* Stereo DAC Mixer Control (0x002a) */
+#define RT5668_M_DAC_L1_STO_L                   (0x1 << 15)
+#define RT5668_M_DAC_L1_STO_L_SHIFT             15
+#define RT5668_M_DAC_R1_STO_L                   (0x1 << 13)
+#define RT5668_M_DAC_R1_STO_L_SHIFT             13
+#define RT5668_M_DAC_L1_STO_R                   (0x1 << 7)
+#define RT5668_M_DAC_L1_STO_R_SHIFT             7
+#define RT5668_M_DAC_R1_STO_R                   (0x1 << 5)
+#define RT5668_M_DAC_R1_STO_R_SHIFT             5
+
+/* Power Management for Digital 1 (0x0061) */
+#define RT5668_PWR_I2S1                         (0x1 << 15)
+#define RT5668_PWR_I2S1_SHIFT                   15
+#define RT5668_PWR_DAC_L1                       (0x1 << 11)
+#define RT5668_PWR_DAC_L1_SHIFT                 11
+#define RT5668_PWR_DAC_R1                       (0x1 << 10)
+#define RT5668_PWR_DAC_R1_SHIFT                 10
+#define RT5668_PWR_LDO_DACREF_MASK              (0x1 << 8)
+#define RT5668_PWR_LDO_DACREF_SHIFT             8
+#define RT5668_PWR_LDO_DACREF_ON                (0x1 << 8)
+#define RT5668_PWR_LDO_DACREF_DOWN              (0x0 << 8)
+#define RT5668_PWR_LDO_SHIFT                    8
+#define RT5668_PWR_ADC_L1                       (0x1 << 4)
+#define RT5668_PWR_ADC_L1_SHIFT                 4
+#define RT5668_PWR_ADC_R1                       (0x1 << 3)
+#define RT5668_PWR_ADC_R1_SHIFT                 3
+
+/* Power Management for Digital 2 (0x0062) */
+#define RT5668_PWR_ADC_S1F                      (0x1 << 15)
+#define RT5668_PWR_ADC_S1F_SHIFT                15
+#define RT5668_PWR_DAC_S1F                      (0x1 << 10)
+#define RT5668_PWR_DAC_S1F_SHIFT                10
+
+/* Power Management for Analog 1 (0x0063) */
+#define RT5668_PWR_VREF1                        (0x1 << 15)
+#define RT5668_PWR_VREF1_MASK                   (0x1 << 15)
+#define RT5668_PWR_VREF1_SHIFT                  15
+#define RT5668_PWR_FV1                          (0x1 << 14)
+#define RT5668_PWR_FV1_MASK                     (0x1 << 14)
+#define RT5668_PWR_FV1_SHIFT                    14
+#define RT5668_PWR_VREF2                        (0x1 << 13)
+#define RT5668_PWR_VREF2_MASK                   (0x1 << 13)
+#define RT5668_PWR_VREF2_SHIFT                  13
+#define RT5668_PWR_FV2                          (0x1 << 12)
+#define RT5668_PWR_FV2_MASK                     (0x1 << 12)
+#define RT5668_PWR_FV2_SHIFT                    12
+#define RT5668_PWR_MB                           (0x1 << 9)
+#define RT5668_PWR_MB_MASK                      (0x1 << 9)
+#define RT5668_PWR_MB_SHIFT                     9
+#define RT5668_AMP_HP_MASK                      (0x3 << 2)
+#define RT5668_AMP_HP_SHIFT                     2
+#define RT5668_AMP_HP_1X                        (0x0 << 2)
+#define RT5668_AMP_HP_3X                        (0x1 << 2)
+#define RT5668_AMP_HP_5X                        (0x3 << 2)
+#define RT5668_LDO1_DVO_MASK                    (0x3)
+#define RT5668_LDO1_DVO_SHIFT                   0
+#define RT5668_LDO1_DVO_0_9V                    (0x0)
+#define RT5668_LDO1_DVO_1_0V                    (0x1)
+#define RT5668_LDO1_DVO_1_2V                    (0x2)
+#define RT5668_LDO1_DVO_1_4V                    (0x3)
+
+/* Power Management for Analog 2 (0x0064) */
+#define RT5668_PWR_BST1                         (0x1 << 15)
+#define RT5668_PWR_BST1_MASK                    (0x1 << 15)
+#define RT5668_PWR_BST1_SHIFT                   15
+#define RT5668_PWR_BST1_OFF                     (0x0 << 15)
+#define RT5668_PWR_BST1_ON                      (0x1 << 15)
+#define RT5668_PWR_BST2                         (0x1 << 14)
+#define RT5668_PWR_BST2_MASK                    (0x1 << 14)
+#define RT5668_PWR_BST2_SHIFT                   14
+#define RT5668_PWR_MB1                          (0x1 << 11)
+#define RT5668_PWR_MB1_SHIFT                    11
+#define RT5668_PWR_MB2                          (0x1 << 10)
+#define RT5668_PWR_MB2_SHIFT                    10
+#define RT5668_PWR_BST2_OP                      (0x1 << 6)
+#define RT5668_PWR_BST2_OP_MASK                 (0x1 << 6)
+#define RT5668_PWR_BST2_OP_SHIFT                6
+#define RT5668_PWR_JD1                          (0x1 << 3)
+#define RT5668_PWR_JD1_MASK                     (0x1 << 3)
+#define RT5668_PWR_JD1_SHIFT                    3
+#define RT5668_PWR_JD2                          (0x1 << 2)
+#define RT5668_PWR_JD2_MASK                     (0x1 << 2)
+#define RT5668_PWR_JD2_SHIFT                    2
+#define RT5668_PWR_RECMIX1                      (0x1 << 1)
+#define RT5668_PWR_RECMIX1_SHIFT                1
+#define RT5668_PWR_RECMIX2                      (0x1)
+#define RT5668_PWR_RECMIX2_SHIFT                0
+
+/* Power Management for Analog 3 (0x0065) */
+#define RT5668_PWR_CBJ_MASK                     (0x1 << 9)
+#define RT5668_PWR_CBJ_SHIFT                    9
+#define RT5668_PWR_CBJ_OFF                      (0x0 << 9)
+#define RT5668_PWR_CBJ_ON                       (0x1 << 9)
+#define RT5668_PWR_PLL                          (0x1 << 6)
+#define RT5668_PWR_PLL_SHIFT                    6
+#define RT5668_PWR_LDO2                         (0x1 << 2)
+#define RT5668_PWR_LDO2_SHIFT                   2
+
+/* Power Management for Volume (0x0067) */
+#define RT5668_PWR_MIC_DET                      (0x1 << 5)
+#define RT5668_PWR_MIC_DET_SHIFT                5
+
+/* MCLK and System Clock Detection Control (0x006b) */
+#define RT5668_EN_ANA_CLK_DET_MASK              (0x1 << 15)
+#define RT5668_EN_ANA_CLK_DET_SHIFT             15
+#define RT5668_EN_ANA_CLK_DET_DIS               (0x0 << 15)
+#define RT5668_EN_ANA_CLK_DET_AUTO              (0x1 << 15)
+#define RT5668_PWR_CLK_DET_MASK                 (0x1)
+#define RT5668_PWR_CLK_DET_SHIFT                0
+#define RT5668_PWR_CLK_DET_DIS                  (0x0)
+#define RT5668_PWR_CLK_DET_EN                   (0x1)
+
+/* I2S1 Audio Serial Data Port Control (0x0070) */
+#define RT5668_I2S_MS_MASK                      (0x1 << 15)
+#define RT5668_I2S_MS_SHIFT                     15
+#define RT5668_I2S_MS_M                         (0x0 << 15)
+#define RT5668_I2S_MS_S                         (0x1 << 15)
+#define RT5668_I2S_BP_MASK                      (0x1 << 8)
+#define RT5668_I2S_BP_SHIFT                     8
+#define RT5668_I2S_BP_NOR                       (0x0 << 8)
+#define RT5668_I2S_BP_INV                       (0x1 << 8)
+#define RT5668_I2S_DL_MASK                      (0x3 << 4)
+#define RT5668_I2S_DL_SHIFT                     4
+#define RT5668_I2S_DL_16                        (0x0 << 4)
+#define RT5668_I2S_DL_20                        (0x1 << 4)
+#define RT5668_I2S_DL_24                        (0x2 << 4)
+#define RT5668_I2S_DL_8                         (0x3 << 4)
+#define RT5668_I2S_DF_MASK                      (0x7)
+#define RT5668_I2S_DF_SHIFT                     0
+#define RT5668_I2S_DF_I2S                       (0x0)
+#define RT5668_I2S_DF_LEFT                      (0x1)
+#define RT5668_I2S_DF_PCM_A                     (0x2)
+#define RT5668_I2S_DF_PCM_B                     (0x3)
+#define RT5668_I2S_DF_PCM_A_N                   (0x6)
+#define RT5668_I2S_DF_PCM_B_N                   (0x7)
+
+/* ADC/DAC Clock Control 1 (0x0073) */
+#define RT5668_I2S_PD1_MASK                     (0x7 << 12)
+#define RT5668_I2S_PD1_SHIFT                    12
+#define RT5668_M_I2S_DIV_MASK                   (0x7 << 8)
+#define RT5668_M_I2S_DIV_SHIFT                  8
+#define RT5668_CLK_SRC_MASK                     (0x3 << 4)
+#define RT5668_CLK_SRC_MCLK                     (0x0 << 4)
+#define RT5668_CLK_SRC_PLL_OUT                  (0x1 << 4)
+#define RT5668_CLK_SRC_DIV                      (0x2 << 4)
+#define RT5668_CLK_SRC_RC                       (0x3 << 4)
+#define RT5668_DAC_OSR_MASK                     (0x3 << 2)
+#define RT5668_DAC_OSR_SHIFT                    2
+#define RT5668_DAC_OSR_128                      (0x0 << 2)
+#define RT5668_DAC_OSR_64                       (0x1 << 2)
+#define RT5668_DAC_OSR_32                       (0x2 << 2)
+#define RT5668_ADC_OSR_MASK                     (0x3)
+#define RT5668_ADC_OSR_SHIFT                    0
+#define RT5668_ADC_OSR_128                      (0x0)
+#define RT5668_ADC_OSR_64                       (0x1)
+#define RT5668_ADC_OSR_32                       (0x2)
+
+/* TDM1 control 1 (0x0078) */
+#define RT5668_TDM_MODE_MASK                    (0x1 << 15)
+#define RT5668_TDM_MODE_SHIFT                   15
+#define RT5668_TDM_MODE_I2S                     (0x0 << 15)
+#define RT5668_TDM_MODE_TDM                     (0x1 << 15)
+#define RT5668_TDM_IN_CH_MASK                   (0x3 << 10)
+#define RT5668_TDM_IN_CH_SHIFT                  10
+#define RT5668_TDM_IN_CH_2                      (0x0 << 10)
+#define RT5668_TDM_IN_CH_4                      (0x1 << 10)
+#define RT5668_TDM_IN_CH_6                      (0x2 << 10)
+#define RT5668_TDM_IN_CH_8                      (0x3 << 10)
+#define RT5668_TDM_OUT_CH_MASK                  (0x3 << 8)
+#define RT5668_TDM_OUT_CH_SHIFT                 8
+#define RT5668_TDM_OUT_CH_2                     (0x0 << 8)
+#define RT5668_TDM_OUT_CH_4                     (0x1 << 8)
+#define RT5668_TDM_OUT_CH_6                     (0x2 << 8)
+#define RT5668_TDM_OUT_CH_8                     (0x3 << 8)
+#define RT5668_TDM_IN_LEN_MASK                  (0x3 << 6)
+#define RT5668_TDM_IN_LEN_SHIFT                 6
+#define RT5668_TDM_IN_LEN_16                    (0x0 << 6)
+#define RT5668_TDM_IN_LEN_20                    (0x1 << 6)
+#define RT5668_TDM_IN_LEN_24                    (0x2 << 6)
+#define RT5668_TDM_IN_LEN_32                    (0x3 << 6)
+#define RT5668_TDM_OUT_LEN_MASK                 (0x3 << 4)
+#define RT5668_TDM_OUT_LEN_SHIFT                4
+#define RT5668_TDM_OUT_LEN_16                   (0x0 << 4)
+#define RT5668_TDM_OUT_LEN_20                   (0x1 << 4)
+#define RT5668_TDM_OUT_LEN_24                   (0x2 << 4)
+#define RT5668_TDM_OUT_LEN_32                   (0x3 << 4)
+
+/* Global Clock Control (0x0080) */
+#define RT5668_SCLK_SRC_MASK                    (0x3 << 14)
+#define RT5668_SCLK_SRC_SHIFT                   14
+#define RT5668_SCLK_SRC_MCLK                    (0x0 << 14)
+#define RT5668_SCLK_SRC_PLL1                    (0x1 << 14)
+#define RT5668_SCLK_SRC_RCCLK                   (0x2 << 14)
+#define RT5668_PLL1_SRC_MASK                    (0x7 << 8)
+#define RT5668_PLL1_SRC_SHIFT                   8
+#define RT5668_PLL1_SRC_MCLK                    (0x0 << 8)
+#define RT5668_PLL1_SRC_BCLK1                   (0x1 << 8)
+#define RT5668_PLL1_PD_MASK                     (0x1 << 4)
+#define RT5668_PLL1_PD_SHIFT                    4
+
+#define RT5668_PLL_INP_MAX                      40000000
+#define RT5668_PLL_INP_MIN                      256000
+/* PLL M/N/K Code Control 1 (0x0081) */
+#define RT5668_PLL_N_MAX                        0x001ff
+#define RT5668_PLL_N_MASK                       (RT5668_PLL_N_MAX << 7)
+#define RT5668_PLL_N_SHIFT                      7
+#define RT5668_PLL_K_MAX                        0x001f
+#define RT5668_PLL_K_MASK                       (RT5668_PLL_K_MAX)
+#define RT5668_PLL_K_SHIFT                      0
+
+/* PLL M/N/K Code Control 2 (0x0082) */
+#define RT5668_PLL_M_MAX                        0x00f
+#define RT5668_PLL_M_MASK                       (RT5668_PLL_M_MAX << 12)
+#define RT5668_PLL_M_SHIFT                      12
+#define RT5668_PLL_M_BP                         (0x1 << 11)
+#define RT5668_PLL_M_BP_SHIFT                   11
+
+/* PLL tracking mode 1 (0x0083) */
+#define RT5668_I2S1_ASRC_MASK                   (0x1 << 13)
+#define RT5668_I2S1_ASRC_SHIFT                  13
+#define RT5668_DAC_STO1_ASRC_MASK               (0x1 << 12)
+#define RT5668_DAC_STO1_ASRC_SHIFT              12
+#define RT5668_ADC_STO1_ASRC_MASK               (0x1 << 4)
+#define RT5668_ADC_STO1_ASRC_SHIFT              4
+
+/* PLL tracking mode 2 (0x0084)*/
+#define RT5668_DA_STO1_TRACK_MASK               (0x7 << 12)
+#define RT5668_DA_STO1_TRACK_SHIFT              12
+#define RT5668_DA_STO1_TRACK_SYSCLK             (0x0 << 12)
+#define RT5668_DA_STO1_TRACK_I2S1               (0x1 << 12)
+
+/* PLL tracking mode 3 (0x0085)*/
+#define RT5668_AD_STO1_TRACK_MASK               (0x7 << 12)
+#define RT5668_AD_STO1_TRACK_SHIFT              12
+#define RT5668_AD_STO1_TRACK_SYSCLK             (0x0 << 12)
+#define RT5668_AD_STO1_TRACK_I2S1               (0x1 << 12)
+
+/* HPOUT Charge pump control 1 (0x0091) */
+#define RT5668_OSW_HP_L_MASK                    (0x1 << 11)
+#define RT5668_OSW_HP_L_SHIFT                   11
+#define RT5668_OSW_HP_L_EN                      (0x1 << 11)
+#define RT5668_OSW_HP_L_DIS                     (0x0 << 11)
+#define RT5668_OSW_HP_R_MASK                    (0x1 << 10)
+#define RT5668_OSW_HP_R_SHIFT                   10
+#define RT5668_OSW_HP_R_EN                      (0x1 << 10)
+#define RT5668_OSW_HP_R_DIS                     (0x0 << 10)
+#define RT5668_SEL_PM_HP_MASK                   (0x3 << 8)
+#define RT5668_SEL_PM_HP_SHIFT                  8
+#define RT5668_SEL_PM_HP_0_6                    (0x0 << 8)
+#define RT5668_SEL_PM_HP_0_9                    (0x1 << 8)
+#define RT5668_SEL_PM_HP_1_8                    (0x2 << 8)
+#define RT5668_SEL_PM_HP_HIGH                   (0x3 << 8)
+#define RT5668_OVCD_HP_MASK                     (0x1 << 2)
+#define RT5668_OVCD_HP_SHIFT                    2
+#define RT5668_OVCD_HP_EN                       (0x1 << 2)
+#define RT5668_OVCD_HP_DIS                      (0x0 << 2)
+
+/* RC Clock Control (0x0094) */
+#define RT5668_DIG_25M_CLK_MASK                 (0x1 << 9)
+#define RT5668_DIG_25M_CLK_SHIFT                9
+#define RT5668_DIG_25M_CLK_DIS                  (0x0 << 9)
+#define RT5668_DIG_25M_CLK_EN                   (0x1 << 9)
+#define RT5668_DIG_1M_CLK_MASK                  (0x1 << 8)
+#define RT5668_DIG_1M_CLK_SHIFT                 8
+#define RT5668_DIG_1M_CLK_DIS                   (0x0 << 8)
+#define RT5668_DIG_1M_CLK_EN                    (0x1 << 8)
+
+/* Auto Turn On 1M RC CLK (0x009f) */
+#define RT5668_IRQ_POW_SAV_MASK                 (0x1 << 15)
+#define RT5668_IRQ_POW_SAV_SHIFT                15
+#define RT5668_IRQ_POW_SAV_DIS                  (0x0 << 15)
+#define RT5668_IRQ_POW_SAV_EN                   (0x1 << 15)
+#define RT5668_IRQ_POW_SAV_JD1_MASK             (0x1 << 14)
+#define RT5668_IRQ_POW_SAV_JD1_SHIFT            14
+#define RT5668_IRQ_POW_SAV_JD1_DIS              (0x0 << 14)
+#define RT5668_IRQ_POW_SAV_JD1_EN               (0x1 << 14)
+
+/* IRQ Control 1 (0x00b6) */
+#define RT5668_EN_CB_JD_MASK                    (0x1 << 3)
+#define RT5668_EN_CB_JD_SHIFT                   3
+#define RT5668_EN_CB_JD_EN                      (0x1 << 3)
+#define RT5668_EN_CB_JD_DIS                     (0x0 << 3)
+
+/* IRQ Control 3 (0x00b8) */
+#define RT5668_EN_IRQ_INLINE_MASK               (0x1 << 6)
+#define RT5668_EN_IRQ_INLINE_SHIFT              6
+#define RT5668_EN_IRQ_INLINE_BYP                (0x0 << 6)
+#define RT5668_EN_IRQ_INLINE_NOR                (0x1 << 6)
+
+/* GPIO Control 1 (0x00c0) */
+#define RT5668_GP1_PIN_MASK                     (0x1 << 15)
+#define RT5668_GP1_PIN_SHIFT                    15
+#define RT5668_GP1_PIN_GPIO1                    (0x0 << 15)
+#define RT5668_GP1_PIN_IRQ                      (0x1 << 15)
+
+/* GPIO Control 2 (0x00c1) */
+#define RT5668_GP4_PIN_CONF_MASK                (0x1 << 5)
+#define RT5668_GP4_PIN_CONF_SHIFT               5
+#define RT5668_GP4_PIN_CONF_INPUT               (0x0 << 5)
+#define RT5668_GP4_PIN_CONF_OUTPUT              (0x1 << 5)
+
+/* GPIO Control 2 (0x00c2) */
+#define RT5668_GP8_PIN_CONF_MASK                (0x1 << 13)
+#define RT5668_GP8_PIN_CONF_SHIFT               13
+#define RT5668_GP8_PIN_CONF_INPUT               (0x0 << 13)
+#define RT5668_GP8_PIN_CONF_OUTPUT              (0x1 << 13)
+
+/* 4 Buttons Inline Command Function 1 (0x00df) */
+#define RT5668_4BTN_CLK_DEB_MASK                (0x3 << 2)
+#define RT5668_4BTN_CLK_DEB_SHIFT               2
+#define RT5668_4BTN_CLK_DEB_8MS                 (0x0 << 2)
+#define RT5668_4BTN_CLK_DEB_16MS                (0x1 << 2)
+#define RT5668_4BTN_CLK_DEB_32MS                (0x2 << 2)
+#define RT5668_4BTN_CLK_DEB_65MS                (0x3 << 2)
+
+/* Inline Command Function 6 (0x00e0) */
+#define RT5668_EN_4BTN_INL_MASK                 (0x1 << 15)
+#define RT5668_EN_4BTN_INL_SHIFT                15
+#define RT5668_EN_4BTN_INL_DIS                  (0x0 << 15)
+#define RT5668_EN_4BTN_INL_EN                   (0x1 << 15)
+#define RT5668_RESET_4BTN_INL_MASK              (0x1 << 14)
+#define RT5668_RESET_4BTN_INL_SHIFT             14
+#define RT5668_RESET_4BTN_INL_RESET             (0x0 << 14)
+#define RT5668_RESET_4BTN_INL_NOR               (0x1 << 14)
+
+/* Digital Misc Control (0x00fa) */
+#define RT5668_DIG_GATE_CTRL_MASK               0x1
+#define RT5668_DIG_GATE_CTRL_SHIFT              (0)
+#define RT5668_DIG_GATE_CTRL_DIS                0x0
+#define RT5668_DIG_GATE_CTRL_EN                 0x1
+
+/* Chopper and Clock control for DAC L (0x013a)*/
+#define RT5668_CKXEN_DAC1_MASK                  (0x1 << 13)
+#define RT5668_CKXEN_DAC1_SHIFT                 13
+#define RT5668_CKGEN_DAC1_MASK                  (0x1 << 12)
+#define RT5668_CKGEN_DAC1_SHIFT                 12
+
+/* Chopper and Clock control for ADC (0x013b)*/
+#define RT5668_CKXEN_ADCC_MASK                  (0x1 << 13)
+#define RT5668_CKXEN_ADCC_SHIFT                 13
+#define RT5668_CKGEN_ADCC_MASK                  (0x1 << 12)
+#define RT5668_CKGEN_ADCC_SHIFT                 12
+
+/* HP Behavior Logic Control 2 (0x01db) */
+#define RT5668_HP_SIG_SRC1_MASK                 (0x3)
+#define RT5668_HP_SIG_SRC1_SHIFT                0
+#define RT5668_HP_SIG_SRC1_HP_DC                (0x0)
+#define RT5668_HP_SIG_SRC1_HP_CALIB             (0x1)
+#define RT5668_HP_SIG_SRC1_REG                  (0x2)
+#define RT5668_HP_SIG_SRC1_SILENCE              (0x3)
+
+/* RT5663 specific register */
+#define RT5663_HP_OUT_EN                        0x0002
+#define RT5663_HP_LCH_DRE                       0x0005
+#define RT5663_HP_RCH_DRE                       0x0006
+#define RT5663_CALIB_BST                        0x000a
+#define RT5663_RECMIX                           0x0010
+#define RT5663_SIL_DET_CTL                      0x0015
+#define RT5663_PWR_SAV_SILDET                   0x0016
+#define RT5663_SIDETONE_CTL                     0x0018
+#define RT5663_STO1_DAC_DIG_VOL                 0x0019
+#define RT5663_STO1_ADC_DIG_VOL                 0x001c
+#define RT5663_STO1_BOOST                       0x001f
+#define RT5663_HP_IMP_GAIN_1                    0x0022
+#define RT5663_HP_IMP_GAIN_2                    0x0023
+#define RT5663_STO1_ADC_MIXER                   0x0026
+#define RT5663_AD_DA_MIXER                      0x0029
+#define RT5663_STO_DAC_MIXER                    0x002a
+#define RT5663_DIG_SIDE_MIXER                   0x002c
+#define RT5663_BYPASS_STO_DAC                   0x002d
+#define RT5663_CALIB_REC_MIX                    0x0040
+#define RT5663_PWR_DIG_1                        0x0061
+#define RT5663_PWR_DIG_2                        0x0062
+#define RT5663_PWR_ANLG_1                       0x0063
+#define RT5663_PWR_ANLG_2                       0x0064
+#define RT5663_PWR_ANLG_3                       0x0065
+#define RT5663_PWR_MIXER                        0x0066
+#define RT5663_SIG_CLK_DET                      0x006b
+#define RT5663_PRE_DIV_GATING_1                 0x006e
+#define RT5663_PRE_DIV_GATING_2                 0x006f
+#define RT5663_I2S1_SDP                         0x0070
+#define RT5663_ADDA_CLK_1                       0x0073
+#define RT5663_ADDA_RST                         0x0074
+#define RT5663_FRAC_DIV_1                       0x0075
+#define RT5663_FRAC_DIV_2                       0x0076
+#define RT5663_TDM_1                            0x0077
+#define RT5663_TDM_2                            0x0078
+#define RT5663_TDM_3                            0x0079
+#define RT5663_TDM_4                            0x007a
+#define RT5663_TDM_5                            0x007b
+#define RT5663_GLB_CLK                          0x0080
+#define RT5663_PLL_1                            0x0081
+#define RT5663_PLL_2                            0x0082
+#define RT5663_ASRC_1                           0x0083
+#define RT5663_ASRC_2                           0x0084
+#define RT5663_ASRC_4                           0x0086
+#define RT5663_DUMMY_REG                        0x0087
+#define RT5663_ASRC_8                           0x008a
+#define RT5663_ASRC_9                           0x008b
+#define RT5663_ASRC_11                          0x008c
+#define RT5663_DEPOP_1                          0x008e
+#define RT5663_DEPOP_2                          0x008f
+#define RT5663_DEPOP_3                          0x0090
+#define RT5663_HP_CHARGE_PUMP_1                 0x0091
+#define RT5663_HP_CHARGE_PUMP_2                 0x0092
+#define RT5663_MICBIAS_1                        0x0093
+#define RT5663_RC_CLK                           0x0094
+#define RT5663_ASRC_11_2                        0x0097
+#define RT5663_DUMMY_REG_2                      0x0098
+#define RT5663_REC_PATH_GAIN                    0x009a
+#define RT5663_AUTO_1MRC_CLK                    0x009f
+#define RT5663_ADC_EQ_1                         0x00ae
+#define RT5663_ADC_EQ_2                         0x00af
+#define RT5663_IRQ_1                            0x00b6
+#define RT5663_IRQ_2                            0x00b7
+#define RT5663_IRQ_3                            0x00b8
+#define RT5663_IRQ_4                            0x00ba
+#define RT5663_IRQ_5                            0x00bb
+#define RT5663_INT_ST_1                         0x00be
+#define RT5663_INT_ST_2                         0x00bf
+#define RT5663_GPIO_1                           0x00c0
+#define RT5663_GPIO_2                           0x00c1
+#define RT5663_GPIO_STA                         0x00c5
+#define RT5663_SIN_GEN_1                        0x00cb
+#define RT5663_SIN_GEN_2                        0x00cc
+#define RT5663_SIN_GEN_3                        0x00cd
+#define RT5663_SOF_VOL_ZC1                      0x00d9
+#define RT5663_IL_CMD_1                         0x00db
+#define RT5663_IL_CMD_2                         0x00dc
+#define RT5663_IL_CMD_3                         0x00dd
+#define RT5663_IL_CMD_4                         0x00de
+#define RT5663_IL_CMD_5                         0x00df
+#define RT5663_IL_CMD_6                         0x00e0
+#define RT5663_IL_CMD_7                         0x00e1
+#define RT5663_IL_CMD_8                         0x00e2
+#define RT5663_IL_CMD_PWRSAV1                   0x00e4
+#define RT5663_IL_CMD_PWRSAV2                   0x00e5
+#define RT5663_EM_JACK_TYPE_1                   0x00e6
+#define RT5663_EM_JACK_TYPE_2                   0x00e7
+#define RT5663_EM_JACK_TYPE_3                   0x00e8
+#define RT5663_EM_JACK_TYPE_4                   0x00e9
+#define RT5663_EM_JACK_TYPE_5                   0x00ea
+#define RT5663_EM_JACK_TYPE_6                   0x00eb
+#define RT5663_STO1_HPF_ADJ1                    0x00ec
+#define RT5663_STO1_HPF_ADJ2                    0x00ed
+#define RT5663_FAST_OFF_MICBIAS                 0x00f4
+#define RT5663_JD_CTRL1                         0x00f6
+#define RT5663_JD_CTRL2                         0x00f8
+#define RT5663_DIG_MISC                         0x00fa
+#define RT5663_DIG_VOL_ZCD                      0x0100
+#define RT5663_ANA_BIAS_CUR_1                   0x0108
+#define RT5663_ANA_BIAS_CUR_2                   0x0109
+#define RT5663_ANA_BIAS_CUR_3                   0x010a
+#define RT5663_ANA_BIAS_CUR_4                   0x010b
+#define RT5663_ANA_BIAS_CUR_5                   0x010c
+#define RT5663_ANA_BIAS_CUR_6                   0x010d
+#define RT5663_BIAS_CUR_5                       0x010e
+#define RT5663_BIAS_CUR_6                       0x010f
+#define RT5663_BIAS_CUR_7                       0x0110
+#define RT5663_BIAS_CUR_8                       0x0111
+#define RT5663_DACREF_LDO                       0x0112
+#define RT5663_DUMMY_REG_3                      0x0113
+#define RT5663_BIAS_CUR_9                       0x0114
+#define RT5663_DUMMY_REG_4                      0x0116
+#define RT5663_VREFADJ_OP                       0x0117
+#define RT5663_VREF_RECMIX                      0x0118
+#define RT5663_CHARGE_PUMP_1                    0x0125
+#define RT5663_CHARGE_PUMP_1_2                  0x0126
+#define RT5663_CHARGE_PUMP_1_3                  0x0127
+#define RT5663_CHARGE_PUMP_2                    0x0128
+#define RT5663_DIG_IN_PIN1                      0x0132
+#define RT5663_PAD_DRV_CTL                      0x0137
+#define RT5663_PLL_INT_REG                      0x0139
+#define RT5663_CHOP_DAC_L                       0x013a
+#define RT5663_CHOP_ADC                         0x013b
+#define RT5663_CALIB_ADC                        0x013c
+#define RT5663_CHOP_DAC_R                       0x013d
+#define RT5663_DUMMY_CTL_DACLR                  0x013e
+#define RT5663_DUMMY_REG_5                      0x0140
+#define RT5663_SOFT_RAMP                        0x0141
+#define RT5663_TEST_MODE_1                      0x0144
+#define RT5663_TEST_MODE_2                      0x0145
+#define RT5663_TEST_MODE_3                      0x0146
+#define RT5663_STO_DRE_1                        0x0160
+#define RT5663_STO_DRE_2                        0x0161
+#define RT5663_STO_DRE_3                        0x0162
+#define RT5663_STO_DRE_4                        0x0163
+#define RT5663_STO_DRE_5                        0x0164
+#define RT5663_STO_DRE_6                        0x0165
+#define RT5663_STO_DRE_7                        0x0166
+#define RT5663_STO_DRE_8                        0x0167
+#define RT5663_STO_DRE_9                        0x0168
+#define RT5663_STO_DRE_10                       0x0169
+#define RT5663_MIC_DECRO_1                      0x0180
+#define RT5663_MIC_DECRO_2                      0x0181
+#define RT5663_MIC_DECRO_3                      0x0182
+#define RT5663_MIC_DECRO_4                      0x0183
+#define RT5663_MIC_DECRO_5                      0x0184
+#define RT5663_MIC_DECRO_6                      0x0185
+#define RT5663_HP_DECRO_1                       0x01b0
+#define RT5663_HP_DECRO_2                       0x01b1
+#define RT5663_HP_DECRO_3                       0x01b2
+#define RT5663_HP_DECRO_4                       0x01b3
+#define RT5663_HP_DECOUP                        0x01b4
+#define RT5663_HP_IMP_SEN_MAP8                  0x01b5
+#define RT5663_HP_IMP_SEN_MAP9                  0x01b6
+#define RT5663_HP_IMP_SEN_MAP10                 0x01b7
+#define RT5663_HP_IMP_SEN_MAP11                 0x01b8
+#define RT5663_HP_IMP_SEN_1                     0x01c0
+#define RT5663_HP_IMP_SEN_2                     0x01c1
+#define RT5663_HP_IMP_SEN_3                     0x01c2
+#define RT5663_HP_IMP_SEN_4                     0x01c3
+#define RT5663_HP_IMP_SEN_5                     0x01c4
+#define RT5663_HP_IMP_SEN_6                     0x01c5
+#define RT5663_HP_IMP_SEN_7                     0x01c6
+#define RT5663_HP_IMP_SEN_8                     0x01c7
+#define RT5663_HP_IMP_SEN_9                     0x01c8
+#define RT5663_HP_IMP_SEN_10                    0x01c9
+#define RT5663_HP_IMP_SEN_11                    0x01ca
+#define RT5663_HP_IMP_SEN_12                    0x01cb
+#define RT5663_HP_IMP_SEN_13                    0x01cc
+#define RT5663_HP_IMP_SEN_14                    0x01cd
+#define RT5663_HP_IMP_SEN_15                    0x01ce
+#define RT5663_HP_IMP_SEN_16                    0x01cf
+#define RT5663_HP_IMP_SEN_17                    0x01d0
+#define RT5663_HP_IMP_SEN_18                    0x01d1
+#define RT5663_HP_IMP_SEN_19                    0x01d2
+#define RT5663_HP_IMPSEN_DIG5                   0x01d3
+#define RT5663_HP_IMPSEN_MAP1                   0x01d4
+#define RT5663_HP_IMPSEN_MAP2                   0x01d5
+#define RT5663_HP_IMPSEN_MAP3                   0x01d6
+#define RT5663_HP_IMPSEN_MAP4                   0x01d7
+#define RT5663_HP_IMPSEN_MAP5                   0x01d8
+#define RT5663_HP_IMPSEN_MAP7                   0x01d9
+#define RT5663_HP_LOGIC_1                       0x01da
+#define RT5663_HP_LOGIC_2                       0x01db
+#define RT5663_HP_CALIB_1                       0x01dd
+#define RT5663_HP_CALIB_1_1                     0x01de
+#define RT5663_HP_CALIB_2                       0x01df
+#define RT5663_HP_CALIB_3                       0x01e0
+#define RT5663_HP_CALIB_4                       0x01e1
+#define RT5663_HP_CALIB_5                       0x01e2
+#define RT5663_HP_CALIB_5_1                     0x01e3
+#define RT5663_HP_CALIB_6                       0x01e4
+#define RT5663_HP_CALIB_7                       0x01e5
+#define RT5663_HP_CALIB_9                       0x01e6
+#define RT5663_HP_CALIB_10                      0x01e7
+#define RT5663_HP_CALIB_11                      0x01e8
+#define RT5663_HP_CALIB_ST1                     0x01ea
+#define RT5663_HP_CALIB_ST2                     0x01eb
+#define RT5663_HP_CALIB_ST3                     0x01ec
+#define RT5663_HP_CALIB_ST4                     0x01ed
+#define RT5663_HP_CALIB_ST5                     0x01ee
+#define RT5663_HP_CALIB_ST6                     0x01ef
+#define RT5663_HP_CALIB_ST7                     0x01f0
+#define RT5663_HP_CALIB_ST8                     0x01f1
+#define RT5663_HP_CALIB_ST9                     0x01f2
+#define RT5663_HP_AMP_DET                       0x0200
+#define RT5663_DUMMY_REG_6                      0x0201
+#define RT5663_HP_BIAS                          0x0202
+#define RT5663_CBJ_1                            0x0250
+#define RT5663_CBJ_2                            0x0251
+#define RT5663_CBJ_3                            0x0252
+#define RT5663_DUMMY_1                          0x02fa
+#define RT5663_DUMMY_2                          0x02fb
+#define RT5663_DUMMY_3                          0x02fc
+#define RT5663_ANA_JD                           0x0300
+#define RT5663_ADC_LCH_LPF1_A1                  0x03d0
+#define RT5663_ADC_RCH_LPF1_A1                  0x03d1
+#define RT5663_ADC_LCH_LPF1_H0                  0x03d2
+#define RT5663_ADC_RCH_LPF1_H0                  0x03d3
+#define RT5663_ADC_LCH_BPF1_A1                  0x03d4
+#define RT5663_ADC_RCH_BPF1_A1                  0x03d5
+#define RT5663_ADC_LCH_BPF1_A2                  0x03d6
+#define RT5663_ADC_RCH_BPF1_A2                  0x03d7
+#define RT5663_ADC_LCH_BPF1_H0                  0x03d8
+#define RT5663_ADC_RCH_BPF1_H0                  0x03d9
+#define RT5663_ADC_LCH_BPF2_A1                  0x03da
+#define RT5663_ADC_RCH_BPF2_A1                  0x03db
+#define RT5663_ADC_LCH_BPF2_A2                  0x03dc
+#define RT5663_ADC_RCH_BPF2_A2                  0x03dd
+#define RT5663_ADC_LCH_BPF2_H0                  0x03de
+#define RT5663_ADC_RCH_BPF2_H0                  0x03df
+#define RT5663_ADC_LCH_BPF3_A1                  0x03e0
+#define RT5663_ADC_RCH_BPF3_A1                  0x03e1
+#define RT5663_ADC_LCH_BPF3_A2                  0x03e2
+#define RT5663_ADC_RCH_BPF3_A2                  0x03e3
+#define RT5663_ADC_LCH_BPF3_H0                  0x03e4
+#define RT5663_ADC_RCH_BPF3_H0                  0x03e5
+#define RT5663_ADC_LCH_BPF4_A1                  0x03e6
+#define RT5663_ADC_RCH_BPF4_A1                  0x03e7
+#define RT5663_ADC_LCH_BPF4_A2                  0x03e8
+#define RT5663_ADC_RCH_BPF4_A2                  0x03e9
+#define RT5663_ADC_LCH_BPF4_H0                  0x03ea
+#define RT5663_ADC_RCH_BPF4_H0                  0x03eb
+#define RT5663_ADC_LCH_HPF1_A1                  0x03ec
+#define RT5663_ADC_RCH_HPF1_A1                  0x03ed
+#define RT5663_ADC_LCH_HPF1_H0                  0x03ee
+#define RT5663_ADC_RCH_HPF1_H0                  0x03ef
+#define RT5663_ADC_EQ_PRE_VOL_L                 0x03f0
+#define RT5663_ADC_EQ_PRE_VOL_R                 0x03f1
+#define RT5663_ADC_EQ_POST_VOL_L                0x03f2
+#define RT5663_ADC_EQ_POST_VOL_R                0x03f3
+
+/* RT5663: RECMIX Control (0x0010) */
+#define RT5663_RECMIX1_BST1_MASK                (0x1)
+#define RT5663_RECMIX1_BST1_SHIFT               0
+#define RT5663_RECMIX1_BST1_ON                  (0x0)
+#define RT5663_RECMIX1_BST1_OFF                 (0x1)
+
+/* RT5663: Bypass Stereo1 DAC Mixer Control (0x002d) */
+#define RT5663_DACL1_SRC_MASK                   (0x1 << 3)
+#define RT5663_DACL1_SRC_SHIFT                  3
+#define RT5663_DACR1_SRC_MASK                   (0x1 << 2)
+#define RT5663_DACR1_SRC_SHIFT                  2
+
+/* RT5663: TDM control 2 (0x0078) */
+#define RT5663_DATA_SWAP_ADCDAT1_MASK           (0x3 << 14)
+#define RT5663_DATA_SWAP_ADCDAT1_SHIFT          14
+#define RT5663_DATA_SWAP_ADCDAT1_LR             (0x0 << 14)
+#define RT5663_DATA_SWAP_ADCDAT1_RL             (0x1 << 14)
+#define RT5663_DATA_SWAP_ADCDAT1_LL             (0x2 << 14)
+#define RT5663_DATA_SWAP_ADCDAT1_RR             (0x3 << 14)
+
+/* RT5663: TDM control 5 (0x007b) */
+#define RT5663_TDM_LENGTN_MASK                  (0x3)
+#define RT5663_TDM_LENGTN_SHIFT                 0
+#define RT5663_TDM_LENGTN_16                    (0x0)
+#define RT5663_TDM_LENGTN_20                    (0x1)
+#define RT5663_TDM_LENGTN_24                    (0x2)
+#define RT5663_TDM_LENGTN_32                    (0x3)
+
+/* RT5663: Global Clock Control (0x0080) */
+#define RT5663_SCLK_SRC_MASK                    (0x3 << 14)
+#define RT5663_SCLK_SRC_SHIFT                   14
+#define RT5663_SCLK_SRC_MCLK                    (0x0 << 14)
+#define RT5663_SCLK_SRC_PLL1                    (0x1 << 14)
+#define RT5663_SCLK_SRC_RCCLK                   (0x2 << 14)
+#define RT5663_PLL1_SRC_MASK                    (0x7 << 11)
+#define RT5663_PLL1_SRC_SHIFT                   11
+#define RT5663_PLL1_SRC_MCLK                    (0x0 << 11)
+#define RT5663_PLL1_SRC_BCLK1                   (0x1 << 11)
+
+/* PLL tracking mode 1 (0x0083) */
+#define RT5663_I2S1_ASRC_MASK                   (0x1 << 11)
+#define RT5663_I2S1_ASRC_SHIFT                  11
+#define RT5663_DAC_STO1_ASRC_MASK               (0x1 << 10)
+#define RT5663_DAC_STO1_ASRC_SHIFT              10
+#define RT5663_ADC_STO1_ASRC_MASK               (0x1 << 3)
+#define RT5663_ADC_STO1_ASRC_SHIFT              3
+
+/* PLL tracking mode 2 (0x0084)*/
+#define RT5663_DA_STO1_TRACK_MASK               (0x7 << 12)
+#define RT5663_DA_STO1_TRACK_SHIFT              12
+#define RT5663_DA_STO1_TRACK_SYSCLK             (0x0 << 12)
+#define RT5663_DA_STO1_TRACK_I2S1               (0x1 << 12)
+#define RT5663_AD_STO1_TRACK_MASK               (0x7)
+#define RT5663_AD_STO1_TRACK_SHIFT              0
+#define RT5663_AD_STO1_TRACK_SYSCLK             (0x0)
+#define RT5663_AD_STO1_TRACK_I2S1               (0x1)
+
+/* RT5663: HPOUT Charge pump control 1 (0x0091) */
+#define RT5663_SI_HP_MASK                       (0x1 << 12)
+#define RT5663_SI_HP_SHIFT                      12
+#define RT5663_SI_HP_EN                         (0x1 << 12)
+#define RT5663_SI_HP_DIS                        (0x0 << 12)
+
+/* RT5663: GPIO Control 2 (0x00b6) */
+#define RT5663_GP1_PIN_CONF_MASK                (0x1 << 2)
+#define RT5663_GP1_PIN_CONF_SHIFT               2
+#define RT5663_GP1_PIN_CONF_OUTPUT              (0x1 << 2)
+#define RT5663_GP1_PIN_CONF_INPUT               (0x0 << 2)
+
+/* RT5663: GPIO Control 2 (0x00b7) */
+#define RT5663_EN_IRQ_INLINE_MASK               (0x1 << 3)
+#define RT5663_EN_IRQ_INLINE_SHIFT              3
+#define RT5663_EN_IRQ_INLINE_NOR                (0x1 << 3)
+#define RT5663_EN_IRQ_INLINE_BYP                (0x0 << 3)
+
+/* RT5663: IRQ Control 1 (0x00c1) */
+#define RT5663_EN_IRQ_JD1_MASK                  (0x1 << 6)
+#define RT5663_EN_IRQ_JD1_SHIFT                 6
+#define RT5663_EN_IRQ_JD1_EN                    (0x1 << 6)
+#define RT5663_EN_IRQ_JD1_DIS                   (0x0 << 6)
+
+/* RT5663: Inline Command Function 2 (0x00dc) */
+#define RT5663_PWR_MIC_DET_MASK                 (0x1)
+#define RT5663_PWR_MIC_DET_SHIFT                0
+#define RT5663_PWR_MIC_DET_ON                   (0x1)
+#define RT5663_PWR_MIC_DET_OFF                  (0x0)
+
+/* RT5663: Embeeded Jack and Type Detection Control 1 (0x00e6)*/
+#define RT5663_CBJ_DET_MASK                     (0x1 << 15)
+#define RT5663_CBJ_DET_SHIFT                    15
+#define RT5663_CBJ_DET_DIS                      (0x0 << 15)
+#define RT5663_CBJ_DET_EN                       (0x1 << 15)
+#define RT5663_EXT_JD_MASK                      (0x1 << 11)
+#define RT5663_EXT_JD_SHIFT                     11
+#define RT5663_EXT_JD_EN                        (0x1 << 11)
+#define RT5663_EXT_JD_DIS                       (0x0 << 11)
+#define RT5663_POL_EXT_JD_MASK                  (0x1 << 10)
+#define RT5663_POL_EXT_JD_SHIFT                 10
+#define RT5663_POL_EXT_JD_EN                    (0x1 << 10)
+#define RT5663_POL_EXT_JD_DIS                   (0x0 << 10)
+
+/* RT5663: DACREF LDO Control (0x0112)*/
+#define RT5663_PWR_LDO_DACREFL_MASK             (0x1 << 9)
+#define RT5663_PWR_LDO_DACREFL_SHIFT            9
+#define RT5663_PWR_LDO_DACREFR_MASK             (0x1 << 1)
+#define RT5663_PWR_LDO_DACREFR_SHIFT            1
+
+/* RT5663: Stereo Dynamic Range Enhancement Control 9 (0x0168, 0x0169)*/
+#define RT5663_DRE_GAIN_HP_MASK                 (0x1f)
+#define RT5663_DRE_GAIN_HP_SHIFT                0
+
+/* RT5663: Combo Jack Control (0x0250) */
+#define RT5663_INBUF_CBJ_BST1_MASK              (0x1 << 11)
+#define RT5663_INBUF_CBJ_BST1_SHIFT             11
+#define RT5663_INBUF_CBJ_BST1_ON                (0x1 << 11)
+#define RT5663_INBUF_CBJ_BST1_OFF               (0x0 << 11)
+#define RT5663_CBJ_SENSE_BST1_MASK              (0x1 << 10)
+#define RT5663_CBJ_SENSE_BST1_SHIFT             10
+#define RT5663_CBJ_SENSE_BST1_L                 (0x1 << 10)
+#define RT5663_CBJ_SENSE_BST1_R                 (0x0 << 10)
+
+/* RT5663: Combo Jack Control (0x0251) */
+#define RT5663_GAIN_BST1_MASK                   (0xf)
+#define RT5663_GAIN_BST1_SHIFT                  0
+
+/* RT5663: Dummy register 1 (0x02fa) */
+#define RT5663_EMB_CLK_MASK                     (0x1 << 9)
+#define RT5663_EMB_CLK_SHIFT                    9
+#define RT5663_EMB_CLK_EN                       (0x1 << 9)
+#define RT5663_EMB_CLK_DIS                      (0x0 << 9)
+#define RT5663_HPA_CPL_BIAS_MASK                (0x7 << 6)
+#define RT5663_HPA_CPL_BIAS_SHIFT               6
+#define RT5663_HPA_CPL_BIAS_0_5                 (0x0 << 6)
+#define RT5663_HPA_CPL_BIAS_1                   (0x1 << 6)
+#define RT5663_HPA_CPL_BIAS_2                   (0x2 << 6)
+#define RT5663_HPA_CPL_BIAS_3                   (0x3 << 6)
+#define RT5663_HPA_CPL_BIAS_4_1                 (0x4 << 6)
+#define RT5663_HPA_CPL_BIAS_4_2                 (0x5 << 6)
+#define RT5663_HPA_CPL_BIAS_6                   (0x6 << 6)
+#define RT5663_HPA_CPL_BIAS_8                   (0x7 << 6)
+#define RT5663_HPA_CPR_BIAS_MASK                (0x7 << 3)
+#define RT5663_HPA_CPR_BIAS_SHIFT               3
+#define RT5663_HPA_CPR_BIAS_0_5                 (0x0 << 3)
+#define RT5663_HPA_CPR_BIAS_1                   (0x1 << 3)
+#define RT5663_HPA_CPR_BIAS_2                   (0x2 << 3)
+#define RT5663_HPA_CPR_BIAS_3                   (0x3 << 3)
+#define RT5663_HPA_CPR_BIAS_4_1                 (0x4 << 3)
+#define RT5663_HPA_CPR_BIAS_4_2                 (0x5 << 3)
+#define RT5663_HPA_CPR_BIAS_6                   (0x6 << 3)
+#define RT5663_HPA_CPR_BIAS_8                   (0x7 << 3)
+#define RT5663_DUMMY_BIAS_MASK                  (0x7)
+#define RT5663_DUMMY_BIAS_SHIFT                 0
+#define RT5663_DUMMY_BIAS_0_5                   (0x0)
+#define RT5663_DUMMY_BIAS_1                     (0x1)
+#define RT5663_DUMMY_BIAS_2                     (0x2)
+#define RT5663_DUMMY_BIAS_3                     (0x3)
+#define RT5663_DUMMY_BIAS_4_1                   (0x4)
+#define RT5663_DUMMY_BIAS_4_2                   (0x5)
+#define RT5663_DUMMY_BIAS_6                     (0x6)
+#define RT5663_DUMMY_BIAS_8                     (0x7)
+
+
+/* System Clock Source */
+enum {
+        RT5663_SCLK_S_MCLK,
+        RT5663_SCLK_S_PLL1,
+        RT5663_SCLK_S_RCCLK,
+};
+
+/* PLL1 Source */
+enum {
+        RT5663_PLL1_S_MCLK,
+        RT5663_PLL1_S_BCLK1,
+};
+
+enum {
+        RT5663_AIF,
+        RT5663_AIFS,
+};
+
+/* asrc clock source */
+enum {
+        RT5663_CLK_SEL_SYS = 0x0,
+        RT5663_CLK_SEL_I2S1_ASRC = 0x1,
+};
+
+/* filter mask */
+enum {
+        RT5663_DA_STEREO_FILTER = 0x1,
+        RT5663_AD_STEREO_FILTER = 0x2,
+};
+
+int rt5663_set_jack_detect(struct snd_soc_codec *codec,
+        struct snd_soc_jack *hs_jack);
+int rt5663_sel_asrc_clk_src(struct snd_soc_codec *codec,
+        unsigned int filter_mask, unsigned int clk_src);
+
+#endif /* __RT5663_H__ */
diff --git a/sound/soc/codecs/rt5670.c b/sound/soc/codecs/rt5670.c
index 8ef467f64f03..49caf1393aeb 100644
--- a/sound/soc/codecs/rt5670.c
+++ b/sound/soc/codecs/rt5670.c
@@ -2777,12 +2777,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5670 = {
         .resume = rt5670_resume,
         .set_bias_level = rt5670_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt5670_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5670_snd_controls),
-        .dapm_widgets = rt5670_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5670_dapm_widgets),
-        .dapm_routes = rt5670_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5670_dapm_routes),
+        .component_driver = {
+                .controls               = rt5670_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5670_snd_controls),
+                .dapm_widgets           = rt5670_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5670_dapm_widgets),
+                .dapm_routes            = rt5670_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5670_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt5670_regmap = {
diff --git a/sound/soc/codecs/rt5677.c b/sound/soc/codecs/rt5677.c
index da9483c1c6fb..abc802a5a479 100644
--- a/sound/soc/codecs/rt5677.c
+++ b/sound/soc/codecs/rt5677.c
@@ -9,6 +9,7 @@
  * published by the Free Software Foundation.
  */
 
+#include <linux/acpi.h>
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
@@ -40,6 +41,15 @@
 
 #define RT5677_PR_BASE (RT5677_PR_RANGE_BASE + (0 * RT5677_PR_SPACING))
 
+/* GPIO indexes defined by ACPI */
+enum {
+        RT5677_GPIO_PLUG_DET            = 0,
+        RT5677_GPIO_MIC_PRESENT_L       = 1,
+        RT5677_GPIO_HOTWORD_DET_L       = 2,
+        RT5677_GPIO_DSP_INT             = 3,
+        RT5677_GPIO_HP_AMP_SHDN_L       = 4,
+};
+
 static const struct regmap_range_cfg rt5677_ranges[] = {
         {
                 .name = "PR",
@@ -4657,7 +4667,7 @@ static int rt5677_to_irq(struct gpio_chip *chip, unsigned offset)
         return regmap_irq_get_virq(data, irq);
 }
 
-static struct gpio_chip rt5677_template_chip = {
+static const struct gpio_chip rt5677_template_chip = {
         .label                  = "rt5677",
         .owner                  = THIS_MODULE,
         .direction_output       = rt5677_gpio_direction_out,
@@ -4974,12 +4984,14 @@ static struct snd_soc_codec_driver soc_codec_dev_rt5677 = {
         .resume = rt5677_resume,
         .set_bias_level = rt5677_set_bias_level,
         .idle_bias_off = true,
-        .controls = rt5677_snd_controls,
-        .num_controls = ARRAY_SIZE(rt5677_snd_controls),
-        .dapm_widgets = rt5677_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(rt5677_dapm_widgets),
-        .dapm_routes = rt5677_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(rt5677_dapm_routes),
+        .component_driver = {
+                .controls               = rt5677_snd_controls,
+                .num_controls           = ARRAY_SIZE(rt5677_snd_controls),
+                .dapm_widgets           = rt5677_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(rt5677_dapm_widgets),
+                .dapm_routes            = rt5677_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(rt5677_dapm_routes),
+        },
 };
 
 static const struct regmap_config rt5677_regmap_physical = {
@@ -5018,10 +5030,47 @@ static const struct regmap_config rt5677_regmap = {
 static const struct i2c_device_id rt5677_i2c_id[] = {
         { "rt5677", RT5677 },
         { "rt5676", RT5676 },
+        { "RT5677CE:00", RT5677 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, rt5677_i2c_id);
 
+static const struct acpi_gpio_params plug_det_gpio = { RT5677_GPIO_PLUG_DET, 0, false };
+static const struct acpi_gpio_params mic_present_gpio = { RT5677_GPIO_MIC_PRESENT_L, 0, false };
+static const struct acpi_gpio_params headphone_enable_gpio = { RT5677_GPIO_HP_AMP_SHDN_L, 0, false };
+
+static const struct acpi_gpio_mapping bdw_rt5677_gpios[] = {
+        { "plug-det-gpios", &plug_det_gpio, 1 },
+        { "mic-present-gpios", &mic_present_gpio, 1 },
+        { "headphone-enable-gpios", &headphone_enable_gpio, 1 },
+        { NULL },
+};
+
+static void rt5677_read_acpi_properties(struct rt5677_priv *rt5677,
+                struct device *dev)
+{
+        int ret;
+        u32 val;
+
+        ret = acpi_dev_add_driver_gpios(ACPI_COMPANION(dev),
+                        bdw_rt5677_gpios);
+        if (ret)
+                dev_warn(dev, "Failed to add driver gpios\n");
+
+        if (!device_property_read_u32(dev, "DCLK", &val))
+                rt5677->pdata.dmic2_clk_pin = val;
+
+        rt5677->pdata.in1_diff = device_property_read_bool(dev, "IN1");
+        rt5677->pdata.in2_diff = device_property_read_bool(dev, "IN2");
+        rt5677->pdata.lout1_diff = device_property_read_bool(dev, "OUT1");
+        rt5677->pdata.lout2_diff = device_property_read_bool(dev, "OUT2");
+        rt5677->pdata.lout3_diff = device_property_read_bool(dev, "OUT3");
+
+        device_property_read_u32(dev, "JD1", &rt5677->pdata.jd1_gpio);
+        device_property_read_u32(dev, "JD2", &rt5677->pdata.jd2_gpio);
+        device_property_read_u32(dev, "JD3", &rt5677->pdata.jd3_gpio);
+}
+
 static void rt5677_read_device_properties(struct rt5677_priv *rt5677,
                 struct device *dev)
 {
@@ -5127,8 +5176,12 @@ static int rt5677_i2c_probe(struct i2c_client *i2c,
 
         if (pdata)
                 rt5677->pdata = *pdata;
-        else
+        else if (i2c->dev.of_node)
                 rt5677_read_device_properties(rt5677, &i2c->dev);
+        else if (ACPI_HANDLE(&i2c->dev))
+                rt5677_read_acpi_properties(rt5677, &i2c->dev);
+        else
+                return -EINVAL;
 
         /* pow-ldo2 and reset are optional. The codec pins may be statically
          * connected on the board without gpios. If the gpio device property
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index 527b759c1562..1589325855bc 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -411,6 +411,8 @@ static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
                         0, 8,
                         0x7f, 1,
                         headphone_volume),
+        SOC_SINGLE("Headphone Playback Switch", SGTL5000_CHIP_ANA_CTRL,
+                        4, 1, 1),
         SOC_SINGLE("Headphone Playback ZC Switch", SGTL5000_CHIP_ANA_CTRL,
                         5, 1, 0),
 
@@ -423,6 +425,7 @@ static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
                         SGTL5000_LINE_OUT_VOL_RIGHT_SHIFT,
                         0x1f, 1,
                         lineout_volume),
+        SOC_SINGLE("Lineout Playback Switch", SGTL5000_CHIP_ANA_CTRL, 8, 1, 1),
 };
 
 /* mute the codec used by alsa core */
@@ -1151,12 +1154,14 @@ static struct snd_soc_codec_driver sgtl5000_driver = {
         .remove = sgtl5000_remove,
         .set_bias_level = sgtl5000_set_bias_level,
         .suspend_bias_off = true,
-        .controls = sgtl5000_snd_controls,
-        .num_controls = ARRAY_SIZE(sgtl5000_snd_controls),
-        .dapm_widgets = sgtl5000_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(sgtl5000_dapm_widgets),
-        .dapm_routes = sgtl5000_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(sgtl5000_dapm_routes),
+        .component_driver = {
+                .controls               = sgtl5000_snd_controls,
+                .num_controls           = ARRAY_SIZE(sgtl5000_snd_controls),
+                .dapm_widgets           = sgtl5000_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(sgtl5000_dapm_widgets),
+                .dapm_routes            = sgtl5000_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(sgtl5000_dapm_routes),
+        },
 };
 
 static const struct regmap_config sgtl5000_regmap = {
diff --git a/sound/soc/codecs/si476x.c b/sound/soc/codecs/si476x.c
index a8402d0af0ea..5344f4aa8fde 100644
--- a/sound/soc/codecs/si476x.c
+++ b/sound/soc/codecs/si476x.c
@@ -238,10 +238,12 @@ static struct regmap *si476x_get_regmap(struct device *dev)
 
 static struct snd_soc_codec_driver soc_codec_dev_si476x = {
         .get_regmap = si476x_get_regmap,
-        .dapm_widgets = si476x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(si476x_dapm_widgets),
-        .dapm_routes = si476x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(si476x_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = si476x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(si476x_dapm_widgets),
+                .dapm_routes            = si476x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(si476x_dapm_routes),
+        },
 };
 
 static int si476x_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
index 3a7de0159f24..eae54c37cff9 100644
--- a/sound/soc/codecs/sn95031.c
+++ b/sound/soc/codecs/sn95031.c
@@ -888,12 +888,14 @@ static struct snd_soc_codec_driver sn95031_codec = {
         .set_bias_level = sn95031_set_vaud_bias,
         .idle_bias_off  = true,
 
-        .controls       = sn95031_snd_controls,
-        .num_controls   = ARRAY_SIZE(sn95031_snd_controls),
-        .dapm_widgets   = sn95031_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(sn95031_dapm_widgets),
-        .dapm_routes    = sn95031_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(sn95031_audio_map),
+        .component_driver = {
+                .controls               = sn95031_snd_controls,
+                .num_controls           = ARRAY_SIZE(sn95031_snd_controls),
+                .dapm_widgets           = sn95031_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(sn95031_dapm_widgets),
+                .dapm_routes            = sn95031_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(sn95031_audio_map),
+        },
 };
 
 static int sn95031_device_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/spdif_receiver.c b/sound/soc/codecs/spdif_receiver.c
index 3ec41ccbf4e2..234f87b54838 100644
--- a/sound/soc/codecs/spdif_receiver.c
+++ b/sound/soc/codecs/spdif_receiver.c
@@ -38,10 +38,12 @@ static const struct snd_soc_dapm_route dir_routes[] = {
                         SNDRV_PCM_FMTBIT_IEC958_SUBFRAME_LE)
 
 static struct snd_soc_codec_driver soc_codec_spdif_dir = {
-        .dapm_widgets = dir_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(dir_widgets),
-        .dapm_routes = dir_routes,
-        .num_dapm_routes = ARRAY_SIZE(dir_routes),
+        .component_driver = {
+                .dapm_widgets           = dir_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(dir_widgets),
+                .dapm_routes            = dir_routes,
+                .num_dapm_routes        = ARRAY_SIZE(dir_routes),
+        },
 };
 
 static struct snd_soc_dai_driver dir_stub_dai = {
diff --git a/sound/soc/codecs/spdif_transmitter.c b/sound/soc/codecs/spdif_transmitter.c
index ef634a9ad673..ee367536a498 100644
--- a/sound/soc/codecs/spdif_transmitter.c
+++ b/sound/soc/codecs/spdif_transmitter.c
@@ -38,10 +38,12 @@ static const struct snd_soc_dapm_route dit_routes[] = {
 };
 
 static struct snd_soc_codec_driver soc_codec_spdif_dit = {
-        .dapm_widgets = dit_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(dit_widgets),
-        .dapm_routes = dit_routes,
-        .num_dapm_routes = ARRAY_SIZE(dit_routes),
+        .component_driver = {
+                .dapm_widgets           = dit_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(dit_widgets),
+                .dapm_routes            = dit_routes,
+                .num_dapm_routes        = ARRAY_SIZE(dit_routes),
+        },
 };
 
 static struct snd_soc_dai_driver dit_stub_dai = {
diff --git a/sound/soc/codecs/ssm2518.c b/sound/soc/codecs/ssm2518.c
index e2e0bfa7ec20..38a85f3adc80 100644
--- a/sound/soc/codecs/ssm2518.c
+++ b/sound/soc/codecs/ssm2518.c
@@ -715,12 +715,14 @@ static struct snd_soc_codec_driver ssm2518_codec_driver = {
         .set_sysclk = ssm2518_set_sysclk,
         .idle_bias_off = true,
 
-        .controls = ssm2518_snd_controls,
-        .num_controls = ARRAY_SIZE(ssm2518_snd_controls),
-        .dapm_widgets = ssm2518_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ssm2518_dapm_widgets),
-        .dapm_routes = ssm2518_routes,
-        .num_dapm_routes = ARRAY_SIZE(ssm2518_routes),
+        .component_driver = {
+                .controls               = ssm2518_snd_controls,
+                .num_controls           = ARRAY_SIZE(ssm2518_snd_controls),
+                .dapm_widgets           = ssm2518_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ssm2518_dapm_widgets),
+                .dapm_routes            = ssm2518_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ssm2518_routes),
+        },
 };
 
 static const struct regmap_config ssm2518_regmap_config = {
diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c
index 4452fea0b118..993bde29ca1b 100644
--- a/sound/soc/codecs/ssm2602.c
+++ b/sound/soc/codecs/ssm2602.c
@@ -597,12 +597,14 @@ static struct snd_soc_codec_driver soc_codec_dev_ssm2602 = {
         .set_bias_level = ssm2602_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = ssm260x_snd_controls,
-        .num_controls = ARRAY_SIZE(ssm260x_snd_controls),
-        .dapm_widgets = ssm260x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ssm260x_dapm_widgets),
-        .dapm_routes = ssm260x_routes,
-        .num_dapm_routes = ARRAY_SIZE(ssm260x_routes),
+        .component_driver = {
+                .controls               = ssm260x_snd_controls,
+                .num_controls           = ARRAY_SIZE(ssm260x_snd_controls),
+                .dapm_widgets           = ssm260x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ssm260x_dapm_widgets),
+                .dapm_routes            = ssm260x_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ssm260x_routes),
+        },
 };
 
 static bool ssm2602_register_volatile(struct device *dev, unsigned int reg)
diff --git a/sound/soc/codecs/ssm4567.c b/sound/soc/codecs/ssm4567.c
index 080c78e88e10..2bb5a11c9ba1 100644
--- a/sound/soc/codecs/ssm4567.c
+++ b/sound/soc/codecs/ssm4567.c
@@ -421,12 +421,14 @@ static struct snd_soc_codec_driver ssm4567_codec_driver = {
         .set_bias_level = ssm4567_set_bias_level,
         .idle_bias_off = true,
 
-        .controls = ssm4567_snd_controls,
-        .num_controls = ARRAY_SIZE(ssm4567_snd_controls),
-        .dapm_widgets = ssm4567_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(ssm4567_dapm_widgets),
-        .dapm_routes = ssm4567_routes,
-        .num_dapm_routes = ARRAY_SIZE(ssm4567_routes),
+        .component_driver = {
+                .controls               = ssm4567_snd_controls,
+                .num_controls           = ARRAY_SIZE(ssm4567_snd_controls),
+                .dapm_widgets           = ssm4567_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(ssm4567_dapm_widgets),
+                .dapm_routes            = ssm4567_routes,
+                .num_dapm_routes        = ARRAY_SIZE(ssm4567_routes),
+        },
 };
 
 static const struct regmap_config ssm4567_regmap_config = {
diff --git a/sound/soc/codecs/sta32x.c b/sound/soc/codecs/sta32x.c
index a9844b2ac829..0790ae8530d9 100644
--- a/sound/soc/codecs/sta32x.c
+++ b/sound/soc/codecs/sta32x.c
@@ -991,12 +991,14 @@ static const struct snd_soc_codec_driver sta32x_codec = {
         .remove =               sta32x_remove,
         .set_bias_level =       sta32x_set_bias_level,
         .suspend_bias_off =     true,
-        .controls =             sta32x_snd_controls,
-        .num_controls =         ARRAY_SIZE(sta32x_snd_controls),
-        .dapm_widgets =         sta32x_dapm_widgets,
-        .num_dapm_widgets =     ARRAY_SIZE(sta32x_dapm_widgets),
-        .dapm_routes =          sta32x_dapm_routes,
-        .num_dapm_routes =      ARRAY_SIZE(sta32x_dapm_routes),
+        .component_driver = {
+                .controls =             sta32x_snd_controls,
+                .num_controls =         ARRAY_SIZE(sta32x_snd_controls),
+                .dapm_widgets =         sta32x_dapm_widgets,
+                .num_dapm_widgets =     ARRAY_SIZE(sta32x_dapm_widgets),
+                .dapm_routes =          sta32x_dapm_routes,
+                .num_dapm_routes =      ARRAY_SIZE(sta32x_dapm_routes),
+        },
 };
 
 static const struct regmap_config sta32x_regmap = {
diff --git a/sound/soc/codecs/sta350.c b/sound/soc/codecs/sta350.c
index 33a4612f0a07..9644c20f44e3 100644
--- a/sound/soc/codecs/sta350.c
+++ b/sound/soc/codecs/sta350.c
@@ -1057,12 +1057,14 @@ static const struct snd_soc_codec_driver sta350_codec = {
         .remove =               sta350_remove,
         .set_bias_level =       sta350_set_bias_level,
         .suspend_bias_off =     true,
-        .controls =             sta350_snd_controls,
-        .num_controls =         ARRAY_SIZE(sta350_snd_controls),
-        .dapm_widgets =         sta350_dapm_widgets,
-        .num_dapm_widgets =     ARRAY_SIZE(sta350_dapm_widgets),
-        .dapm_routes =          sta350_dapm_routes,
-        .num_dapm_routes =      ARRAY_SIZE(sta350_dapm_routes),
+        .component_driver = {
+                .controls =             sta350_snd_controls,
+                .num_controls =         ARRAY_SIZE(sta350_snd_controls),
+                .dapm_widgets =         sta350_dapm_widgets,
+                .num_dapm_widgets =     ARRAY_SIZE(sta350_dapm_widgets),
+                .dapm_routes =          sta350_dapm_routes,
+                .num_dapm_routes =      ARRAY_SIZE(sta350_dapm_routes),
+        },
 };
 
 static const struct regmap_config sta350_regmap = {
diff --git a/sound/soc/codecs/sta529.c b/sound/soc/codecs/sta529.c
index 2cdaca943a8c..d4b384e4b266 100644
--- a/sound/soc/codecs/sta529.c
+++ b/sound/soc/codecs/sta529.c
@@ -317,8 +317,10 @@ static const struct snd_soc_codec_driver sta529_codec_driver = {
         .set_bias_level = sta529_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = sta529_snd_controls,
-        .num_controls = ARRAY_SIZE(sta529_snd_controls),
+        .component_driver = {
+                .controls               = sta529_snd_controls,
+                .num_controls           = ARRAY_SIZE(sta529_snd_controls),
+        },
 };
 
 static const struct regmap_config sta529_regmap = {
diff --git a/sound/soc/codecs/stac9766.c b/sound/soc/codecs/stac9766.c
index 0945c51df003..27f30d352867 100644
--- a/sound/soc/codecs/stac9766.c
+++ b/sound/soc/codecs/stac9766.c
@@ -85,10 +85,10 @@ static SOC_ENUM_SINGLE_DECL(stac9766_boost2_enum,
 static SOC_ENUM_SINGLE_DECL(stac9766_stereo_mic_enum,
                             AC97_STAC_STEREO_MIC, 2, stac9766_stereo_mic);
 
-static const DECLARE_TLV_DB_LINEAR(master_tlv, -4600, 0);
-static const DECLARE_TLV_DB_LINEAR(record_tlv, 0, 2250);
-static const DECLARE_TLV_DB_LINEAR(beep_tlv, -4500, 0);
-static const DECLARE_TLV_DB_LINEAR(mix_tlv, -3450, 1200);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(master_tlv, -4650, 150, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(record_tlv,     0, 150, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(beep_tlv,   -4500, 300, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(mix_tlv,    -3450, 150, 0);
 
 static const struct snd_kcontrol_new stac9766_snd_ac97_controls[] = {
         SOC_DOUBLE_TLV("Speaker Volume", AC97_MASTER, 8, 0, 31, 1, master_tlv),
@@ -320,8 +320,10 @@ static int stac9766_codec_remove(struct snd_soc_codec *codec)
 }
 
 static struct snd_soc_codec_driver soc_codec_dev_stac9766 = {
-        .controls = stac9766_snd_ac97_controls,
-        .num_controls = ARRAY_SIZE(stac9766_snd_ac97_controls),
+        .component_driver = {
+                .controls               = stac9766_snd_ac97_controls,
+                .num_controls           = ARRAY_SIZE(stac9766_snd_ac97_controls),
+        },
         .write = stac9766_ac97_write,
         .read = stac9766_ac97_read,
         .set_bias_level = stac9766_set_bias_level,
diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c
index 160d61a66204..7b31ee9b82bc 100644
--- a/sound/soc/codecs/sti-sas.c
+++ b/sound/soc/codecs/sti-sas.c
@@ -591,11 +591,11 @@ static int sti_sas_driver_probe(struct platform_device *pdev)
         sti_sas_dai[STI_SAS_DAI_ANALOG_OUT].ops = drvdata->dev_data->dac_ops;
 
         /* Set dapms*/
-        sti_sas_driver.dapm_widgets = drvdata->dev_data->dapm_widgets;
-        sti_sas_driver.num_dapm_widgets = drvdata->dev_data->num_dapm_widgets;
+        sti_sas_driver.component_driver.dapm_widgets = drvdata->dev_data->dapm_widgets;
+        sti_sas_driver.component_driver.num_dapm_widgets = drvdata->dev_data->num_dapm_widgets;
 
-        sti_sas_driver.dapm_routes = drvdata->dev_data->dapm_routes;
-        sti_sas_driver.num_dapm_routes = drvdata->dev_data->num_dapm_routes;
+        sti_sas_driver.component_driver.dapm_routes = drvdata->dev_data->dapm_routes;
+        sti_sas_driver.component_driver.num_dapm_routes = drvdata->dev_data->num_dapm_routes;
 
         /* Store context */
         dev_set_drvdata(&pdev->dev, drvdata);
diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
index cc1d3981fa4b..baf455e8c2f7 100644
--- a/sound/soc/codecs/tas2552.c
+++ b/sound/soc/codecs/tas2552.c
@@ -667,12 +667,14 @@ static struct snd_soc_codec_driver soc_codec_dev_tas2552 = {
         .resume = tas2552_resume,
         .ignore_pmdown_time = true,
 
-        .controls = tas2552_snd_controls,
-        .num_controls = ARRAY_SIZE(tas2552_snd_controls),
-        .dapm_widgets = tas2552_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(tas2552_dapm_widgets),
-        .dapm_routes = tas2552_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(tas2552_audio_map),
+        .component_driver = {
+                .controls               = tas2552_snd_controls,
+                .num_controls           = ARRAY_SIZE(tas2552_snd_controls),
+                .dapm_widgets           = tas2552_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(tas2552_dapm_widgets),
+                .dapm_routes            = tas2552_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(tas2552_audio_map),
+        },
 };
 
 static const struct regmap_config tas2552_regmap_config = {
diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
index d49d25d51957..b7de857abb16 100644
--- a/sound/soc/codecs/tas5086.c
+++ b/sound/soc/codecs/tas5086.c
@@ -387,7 +387,7 @@ static int tas5086_hw_params(struct snd_pcm_substream *substream,
         val = index_in_array(tas5086_ratios, ARRAY_SIZE(tas5086_ratios),
                              priv->mclk / priv->rate);
         if (val < 0) {
-                dev_err(codec->dev, "Inavlid MCLK / Fs ratio\n");
+                dev_err(codec->dev, "Invalid MCLK / Fs ratio\n");
                 return -EINVAL;
         }
 
@@ -890,12 +890,14 @@ static struct snd_soc_codec_driver soc_codec_dev_tas5086 = {
         .remove                 = tas5086_remove,
         .suspend                = tas5086_soc_suspend,
         .resume                 = tas5086_soc_resume,
-        .controls               = tas5086_controls,
-        .num_controls           = ARRAY_SIZE(tas5086_controls),
-        .dapm_widgets           = tas5086_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(tas5086_dapm_widgets),
-        .dapm_routes            = tas5086_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(tas5086_dapm_routes),
+        .component_driver = {
+                .controls               = tas5086_controls,
+                .num_controls           = ARRAY_SIZE(tas5086_controls),
+                .dapm_widgets           = tas5086_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(tas5086_dapm_widgets),
+                .dapm_routes            = tas5086_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(tas5086_dapm_routes),
+        },
 };
 
 static const struct i2c_device_id tas5086_i2c_id[] = {
diff --git a/sound/soc/codecs/tas571x.c b/sound/soc/codecs/tas571x.c
index d8baca3f8413..df5e5cb33baa 100644
--- a/sound/soc/codecs/tas571x.c
+++ b/sound/soc/codecs/tas571x.c
@@ -658,10 +658,12 @@ static const struct snd_soc_codec_driver tas571x_codec = {
         .set_bias_level = tas571x_set_bias_level,
         .idle_bias_off = true,
 
-        .dapm_widgets = tas571x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(tas571x_dapm_widgets),
-        .dapm_routes = tas571x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(tas571x_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = tas571x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(tas571x_dapm_widgets),
+                .dapm_routes            = tas571x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(tas571x_dapm_routes),
+        },
 };
 
 static struct snd_soc_dai_driver tas571x_dai = {
@@ -754,8 +756,8 @@ static int tas571x_i2c_probe(struct i2c_client *client,
 
 
         memcpy(&priv->codec_driver, &tas571x_codec, sizeof(priv->codec_driver));
-        priv->codec_driver.controls = priv->chip->controls;
-        priv->codec_driver.num_controls = priv->chip->num_controls;
+        priv->codec_driver.component_driver.controls = priv->chip->controls;
+        priv->codec_driver.component_driver.num_controls = priv->chip->num_controls;
 
         if (priv->chip->vol_reg_size == 2) {
                 /*
diff --git a/sound/soc/codecs/tas5720.c b/sound/soc/codecs/tas5720.c
index f54fb46b77c2..c65b917598d2 100644
--- a/sound/soc/codecs/tas5720.c
+++ b/sound/soc/codecs/tas5720.c
@@ -489,12 +489,14 @@ static struct snd_soc_codec_driver soc_codec_dev_tas5720 = {
         .suspend = tas5720_suspend,
         .resume = tas5720_resume,
 
-        .controls = tas5720_snd_controls,
-        .num_controls = ARRAY_SIZE(tas5720_snd_controls),
-        .dapm_widgets = tas5720_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(tas5720_dapm_widgets),
-        .dapm_routes = tas5720_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(tas5720_audio_map),
+        .component_driver = {
+                .controls               = tas5720_snd_controls,
+                .num_controls           = ARRAY_SIZE(tas5720_snd_controls),
+                .dapm_widgets           = tas5720_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(tas5720_dapm_widgets),
+                .dapm_routes            = tas5720_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(tas5720_audio_map),
+        },
 };
 
 /* PCM rates supported by the TAS5720 driver */
diff --git a/sound/soc/codecs/tfa9879.c b/sound/soc/codecs/tfa9879.c
index cb5310d89c0f..95e0a7abeb7a 100644
--- a/sound/soc/codecs/tfa9879.c
+++ b/sound/soc/codecs/tfa9879.c
@@ -231,13 +231,14 @@ static const struct snd_soc_dapm_route tfa9879_dapm_routes[] = {
 };
 
 static const struct snd_soc_codec_driver tfa9879_codec = {
-        .controls = tfa9879_controls,
-        .num_controls = ARRAY_SIZE(tfa9879_controls),
-
-        .dapm_widgets = tfa9879_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(tfa9879_dapm_widgets),
-        .dapm_routes = tfa9879_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(tfa9879_dapm_routes),
+        .component_driver = {
+                .controls               = tfa9879_controls,
+                .num_controls           = ARRAY_SIZE(tfa9879_controls),
+                .dapm_widgets           = tfa9879_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(tfa9879_dapm_widgets),
+                .dapm_routes            = tfa9879_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(tfa9879_dapm_routes),
+        },
 };
 
 static const struct regmap_config tfa9879_regmap = {
diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
index cd8c02b6e4de..410cae0f2060 100644
--- a/sound/soc/codecs/tlv320aic23.c
+++ b/sound/soc/codecs/tlv320aic23.c
@@ -583,12 +583,14 @@ static struct snd_soc_codec_driver soc_codec_dev_tlv320aic23 = {
         .set_bias_level = tlv320aic23_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = tlv320aic23_snd_controls,
-        .num_controls = ARRAY_SIZE(tlv320aic23_snd_controls),
-        .dapm_widgets = tlv320aic23_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(tlv320aic23_dapm_widgets),
-        .dapm_routes = tlv320aic23_intercon,
-        .num_dapm_routes = ARRAY_SIZE(tlv320aic23_intercon),
+        .component_driver = {
+                .controls               = tlv320aic23_snd_controls,
+                .num_controls           = ARRAY_SIZE(tlv320aic23_snd_controls),
+                .dapm_widgets           = tlv320aic23_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(tlv320aic23_dapm_widgets),
+                .dapm_routes            = tlv320aic23_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(tlv320aic23_intercon),
+        },
 };
 
 int tlv320aic23_probe(struct device *dev, struct regmap *regmap)
diff --git a/sound/soc/codecs/tlv320aic26.c b/sound/soc/codecs/tlv320aic26.c
index 2c904d7150ad..14aa96d41719 100644
--- a/sound/soc/codecs/tlv320aic26.c
+++ b/sound/soc/codecs/tlv320aic26.c
@@ -321,12 +321,14 @@ static int aic26_probe(struct snd_soc_codec *codec)
 
 static struct snd_soc_codec_driver aic26_soc_codec_dev = {
         .probe = aic26_probe,
-        .controls = aic26_snd_controls,
-        .num_controls = ARRAY_SIZE(aic26_snd_controls),
-        .dapm_widgets = tlv320aic26_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(tlv320aic26_dapm_widgets),
-        .dapm_routes = tlv320aic26_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(tlv320aic26_dapm_routes),
+        .component_driver = {
+                .controls               = aic26_snd_controls,
+                .num_controls           = ARRAY_SIZE(aic26_snd_controls),
+                .dapm_widgets           = tlv320aic26_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(tlv320aic26_dapm_widgets),
+                .dapm_routes            = tlv320aic26_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(tlv320aic26_dapm_routes),
+        },
 };
 
 static const struct regmap_config aic26_regmap = {
diff --git a/sound/soc/codecs/tlv320aic31xx.c b/sound/soc/codecs/tlv320aic31xx.c
index 3c5e1df01c19..be1a64bfd320 100644
--- a/sound/soc/codecs/tlv320aic31xx.c
+++ b/sound/soc/codecs/tlv320aic31xx.c
@@ -273,10 +273,20 @@ static const DECLARE_TLV_DB_SCALE(sp_vol_tlv, -6350, 50, 0);
 /*
  * controls to be exported to the user space
  */
-static const struct snd_kcontrol_new aic31xx_snd_controls[] = {
+static const struct snd_kcontrol_new common31xx_snd_controls[] = {
         SOC_DOUBLE_R_S_TLV("DAC Playback Volume", AIC31XX_LDACVOL,
                            AIC31XX_RDACVOL, 0, -127, 48, 7, 0, dac_vol_tlv),
 
+        SOC_DOUBLE_R("HP Driver Playback Switch", AIC31XX_HPLGAIN,
+                     AIC31XX_HPRGAIN, 2, 1, 0),
+        SOC_DOUBLE_R_TLV("HP Driver Playback Volume", AIC31XX_HPLGAIN,
+                         AIC31XX_HPRGAIN, 3, 0x09, 0, hp_drv_tlv),
+
+        SOC_DOUBLE_R_TLV("HP Analog Playback Volume", AIC31XX_LANALOGHPL,
+                         AIC31XX_RANALOGHPR, 0, 0x7F, 1, hp_vol_tlv),
+};
+
+static const struct snd_kcontrol_new aic31xx_snd_controls[] = {
         SOC_SINGLE_TLV("ADC Fine Capture Volume", AIC31XX_ADCFGA, 4, 4, 1,
                        adc_fgain_tlv),
 
@@ -286,14 +296,6 @@ static const struct snd_kcontrol_new aic31xx_snd_controls[] = {
 
         SOC_SINGLE_TLV("Mic PGA Capture Volume", AIC31XX_MICPGA, 0,
                        119, 0, mic_pga_tlv),
-
-        SOC_DOUBLE_R("HP Driver Playback Switch", AIC31XX_HPLGAIN,
-                     AIC31XX_HPRGAIN, 2, 1, 0),
-        SOC_DOUBLE_R_TLV("HP Driver Playback Volume", AIC31XX_HPLGAIN,
-                         AIC31XX_HPRGAIN, 3, 0x09, 0, hp_drv_tlv),
-
-        SOC_DOUBLE_R_TLV("HP Analog Playback Volume", AIC31XX_LANALOGHPL,
-                         AIC31XX_RANALOGHPR, 0, 0x7F, 1, hp_vol_tlv),
 };
 
 static const struct snd_kcontrol_new aic311x_snd_controls[] = {
@@ -397,17 +399,28 @@ static int aic31xx_dapm_power_event(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
-static const struct snd_kcontrol_new left_output_switches[] = {
+static const struct snd_kcontrol_new aic31xx_left_output_switches[] = {
         SOC_DAPM_SINGLE("From Left DAC", AIC31XX_DACMIXERROUTE, 6, 1, 0),
         SOC_DAPM_SINGLE("From MIC1LP", AIC31XX_DACMIXERROUTE, 5, 1, 0),
         SOC_DAPM_SINGLE("From MIC1RP", AIC31XX_DACMIXERROUTE, 4, 1, 0),
 };
 
-static const struct snd_kcontrol_new right_output_switches[] = {
+static const struct snd_kcontrol_new aic31xx_right_output_switches[] = {
         SOC_DAPM_SINGLE("From Right DAC", AIC31XX_DACMIXERROUTE, 2, 1, 0),
         SOC_DAPM_SINGLE("From MIC1RP", AIC31XX_DACMIXERROUTE, 1, 1, 0),
 };
 
+static const struct snd_kcontrol_new dac31xx_left_output_switches[] = {
+        SOC_DAPM_SINGLE("From Left DAC", AIC31XX_DACMIXERROUTE, 6, 1, 0),
+        SOC_DAPM_SINGLE("From AIN1", AIC31XX_DACMIXERROUTE, 5, 1, 0),
+        SOC_DAPM_SINGLE("From AIN2", AIC31XX_DACMIXERROUTE, 4, 1, 0),
+};
+
+static const struct snd_kcontrol_new dac31xx_right_output_switches[] = {
+        SOC_DAPM_SINGLE("From Right DAC", AIC31XX_DACMIXERROUTE, 2, 1, 0),
+        SOC_DAPM_SINGLE("From AIN2", AIC31XX_DACMIXERROUTE, 1, 1, 0),
+};
+
 static const struct snd_kcontrol_new p_term_mic1lp =
         SOC_DAPM_ENUM("MIC1LP P-Terminal", mic1lp_p_enum);
 
@@ -457,7 +470,7 @@ static int mic_bias_event(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
-static const struct snd_soc_dapm_widget aic31xx_dapm_widgets[] = {
+static const struct snd_soc_dapm_widget common31xx_dapm_widgets[] = {
         SND_SOC_DAPM_AIF_IN("DAC IN", "DAC Playback", 0, SND_SOC_NOPM, 0, 0),
 
         SND_SOC_DAPM_MUX("DAC Left Input",
@@ -473,14 +486,7 @@ static const struct snd_soc_dapm_widget aic31xx_dapm_widgets[] = {
                            AIC31XX_DACSETUP, 6, 0, aic31xx_dapm_power_event,
                            SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
 
-        /* Output Mixers */
-        SND_SOC_DAPM_MIXER("Output Left", SND_SOC_NOPM, 0, 0,
-                           left_output_switches,
-                           ARRAY_SIZE(left_output_switches)),
-        SND_SOC_DAPM_MIXER("Output Right", SND_SOC_NOPM, 0, 0,
-                           right_output_switches,
-                           ARRAY_SIZE(right_output_switches)),
-
+        /* HP */
         SND_SOC_DAPM_SWITCH("HP Left", SND_SOC_NOPM, 0, 0,
                             &aic31xx_dapm_hpl_switch),
         SND_SOC_DAPM_SWITCH("HP Right", SND_SOC_NOPM, 0, 0,
@@ -494,10 +500,34 @@ static const struct snd_soc_dapm_widget aic31xx_dapm_widgets[] = {
                                NULL, 0, aic31xx_dapm_power_event,
                                SND_SOC_DAPM_POST_PMD | SND_SOC_DAPM_POST_PMU),
 
-        /* ADC */
-        SND_SOC_DAPM_ADC_E("ADC", "Capture", AIC31XX_ADCSETUP, 7, 0,
-                           aic31xx_dapm_power_event, SND_SOC_DAPM_POST_PMU |
-                           SND_SOC_DAPM_POST_PMD),
+        /* Mic Bias */
+        SND_SOC_DAPM_SUPPLY("MICBIAS", SND_SOC_NOPM, 0, 0, mic_bias_event,
+                            SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
+
+        /* Outputs */
+        SND_SOC_DAPM_OUTPUT("HPL"),
+        SND_SOC_DAPM_OUTPUT("HPR"),
+};
+
+static const struct snd_soc_dapm_widget dac31xx_dapm_widgets[] = {
+        /* Inputs */
+        SND_SOC_DAPM_INPUT("AIN1"),
+        SND_SOC_DAPM_INPUT("AIN2"),
+
+        /* Output Mixers */
+        SND_SOC_DAPM_MIXER("Output Left", SND_SOC_NOPM, 0, 0,
+                           dac31xx_left_output_switches,
+                           ARRAY_SIZE(dac31xx_left_output_switches)),
+        SND_SOC_DAPM_MIXER("Output Right", SND_SOC_NOPM, 0, 0,
+                           dac31xx_right_output_switches,
+                           ARRAY_SIZE(dac31xx_right_output_switches)),
+};
+
+static const struct snd_soc_dapm_widget aic31xx_dapm_widgets[] = {
+        /* Inputs */
+        SND_SOC_DAPM_INPUT("MIC1LP"),
+        SND_SOC_DAPM_INPUT("MIC1RP"),
+        SND_SOC_DAPM_INPUT("MIC1LM"),
 
         /* Input Selection to MIC_PGA */
         SND_SOC_DAPM_MUX("MIC1LP P-Terminal", SND_SOC_NOPM, 0, 0,
@@ -507,24 +537,25 @@ static const struct snd_soc_dapm_widget aic31xx_dapm_widgets[] = {
         SND_SOC_DAPM_MUX("MIC1LM P-Terminal", SND_SOC_NOPM, 0, 0,
                          &p_term_mic1lm),
 
+        /* ADC */
+        SND_SOC_DAPM_ADC_E("ADC", "Capture", AIC31XX_ADCSETUP, 7, 0,
+                           aic31xx_dapm_power_event, SND_SOC_DAPM_POST_PMU |
+                           SND_SOC_DAPM_POST_PMD),
+
         SND_SOC_DAPM_MUX("MIC1LM M-Terminal", SND_SOC_NOPM, 0, 0,
                          &m_term_mic1lm),
+
         /* Enabling & Disabling MIC Gain Ctl */
         SND_SOC_DAPM_PGA("MIC_GAIN_CTL", AIC31XX_MICPGA,
                          7, 1, NULL, 0),
 
-        /* Mic Bias */
-        SND_SOC_DAPM_SUPPLY("MICBIAS", SND_SOC_NOPM, 0, 0, mic_bias_event,
-                            SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
-
-        /* Outputs */
-        SND_SOC_DAPM_OUTPUT("HPL"),
-        SND_SOC_DAPM_OUTPUT("HPR"),
-
-        /* Inputs */
-        SND_SOC_DAPM_INPUT("MIC1LP"),
-        SND_SOC_DAPM_INPUT("MIC1RP"),
-        SND_SOC_DAPM_INPUT("MIC1LM"),
+        /* Output Mixers */
+        SND_SOC_DAPM_MIXER("Output Left", SND_SOC_NOPM, 0, 0,
+                           aic31xx_left_output_switches,
+                           ARRAY_SIZE(aic31xx_left_output_switches)),
+        SND_SOC_DAPM_MIXER("Output Right", SND_SOC_NOPM, 0, 0,
+                           aic31xx_right_output_switches,
+                           ARRAY_SIZE(aic31xx_right_output_switches)),
 };
 
 static const struct snd_soc_dapm_widget aic311x_dapm_widgets[] = {
@@ -554,7 +585,7 @@ static const struct snd_soc_dapm_widget aic310x_dapm_widgets[] = {
 };
 
 static const struct snd_soc_dapm_route
-aic31xx_audio_map[] = {
+common31xx_audio_map[] = {
         /* DAC Input Routing */
         {"DAC Left Input", "Left Data", "DAC IN"},
         {"DAC Left Input", "Right Data", "DAC IN"},
@@ -565,6 +596,31 @@ aic31xx_audio_map[] = {
         {"DAC Left", NULL, "DAC Left Input"},
         {"DAC Right", NULL, "DAC Right Input"},
 
+        /* HPL path */
+        {"HP Left", "Switch", "Output Left"},
+        {"HPL Driver", NULL, "HP Left"},
+        {"HPL", NULL, "HPL Driver"},
+
+        /* HPR path */
+        {"HP Right", "Switch", "Output Right"},
+        {"HPR Driver", NULL, "HP Right"},
+        {"HPR", NULL, "HPR Driver"},
+};
+
+static const struct snd_soc_dapm_route
+dac31xx_audio_map[] = {
+        /* Left Output */
+        {"Output Left", "From Left DAC", "DAC Left"},
+        {"Output Left", "From AIN1", "AIN1"},
+        {"Output Left", "From AIN2", "AIN2"},
+
+        /* Right Output */
+        {"Output Right", "From Right DAC", "DAC Right"},
+        {"Output Right", "From AIN2", "AIN2"},
+};
+
+static const struct snd_soc_dapm_route
+aic31xx_audio_map[] = {
         /* Mic input */
         {"MIC1LP P-Terminal", "FFR 10 Ohm", "MIC1LP"},
         {"MIC1LP P-Terminal", "FFR 20 Ohm", "MIC1LP"},
@@ -595,16 +651,6 @@ aic31xx_audio_map[] = {
         /* Right Output */
         {"Output Right", "From Right DAC", "DAC Right"},
         {"Output Right", "From MIC1RP", "MIC1RP"},
-
-        /* HPL path */
-        {"HP Left", "Switch", "Output Left"},
-        {"HPL Driver", NULL, "HP Left"},
-        {"HPL", NULL, "HPL Driver"},
-
-        /* HPR path */
-        {"HP Right", "Switch", "Output Right"},
-        {"HPR Driver", NULL, "HP Right"},
-        {"HPR", NULL, "HPR Driver"},
 };
 
 static const struct snd_soc_dapm_route
@@ -633,6 +679,13 @@ static int aic31xx_add_controls(struct snd_soc_codec *codec)
         int ret = 0;
         struct aic31xx_priv *aic31xx = snd_soc_codec_get_drvdata(codec);
 
+        if (!(aic31xx->pdata.codec_type & DAC31XX_BIT))
+                ret = snd_soc_add_codec_controls(
+                        codec, aic31xx_snd_controls,
+                        ARRAY_SIZE(aic31xx_snd_controls));
+        if (ret)
+                return ret;
+
         if (aic31xx->pdata.codec_type & AIC31XX_STEREO_CLASS_D_BIT)
                 ret = snd_soc_add_codec_controls(
                         codec, aic311x_snd_controls,
@@ -651,6 +704,30 @@ static int aic31xx_add_widgets(struct snd_soc_codec *codec)
         struct aic31xx_priv *aic31xx = snd_soc_codec_get_drvdata(codec);
         int ret = 0;
 
+        if (aic31xx->pdata.codec_type & DAC31XX_BIT) {
+                ret = snd_soc_dapm_new_controls(
+                        dapm, dac31xx_dapm_widgets,
+                        ARRAY_SIZE(dac31xx_dapm_widgets));
+                if (ret)
+                        return ret;
+
+                ret = snd_soc_dapm_add_routes(dapm, dac31xx_audio_map,
+                                              ARRAY_SIZE(dac31xx_audio_map));
+                if (ret)
+                        return ret;
+        } else {
+                ret = snd_soc_dapm_new_controls(
+                        dapm, aic31xx_dapm_widgets,
+                        ARRAY_SIZE(aic31xx_dapm_widgets));
+                if (ret)
+                        return ret;
+
+                ret = snd_soc_dapm_add_routes(dapm, aic31xx_audio_map,
+                                              ARRAY_SIZE(aic31xx_audio_map));
+                if (ret)
+                        return ret;
+        }
+
         if (aic31xx->pdata.codec_type & AIC31XX_STEREO_CLASS_D_BIT) {
                 ret = snd_soc_dapm_new_controls(
                         dapm, aic311x_dapm_widgets,
@@ -1114,12 +1191,14 @@ static struct snd_soc_codec_driver soc_codec_driver_aic31xx = {
         .set_bias_level         = aic31xx_set_bias_level,
         .suspend_bias_off       = true,
 
-        .controls               = aic31xx_snd_controls,
-        .num_controls           = ARRAY_SIZE(aic31xx_snd_controls),
-        .dapm_widgets           = aic31xx_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(aic31xx_dapm_widgets),
-        .dapm_routes            = aic31xx_audio_map,
-        .num_dapm_routes        = ARRAY_SIZE(aic31xx_audio_map),
+        .component_driver = {
+                .controls               = common31xx_snd_controls,
+                .num_controls           = ARRAY_SIZE(common31xx_snd_controls),
+                .dapm_widgets           = common31xx_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(common31xx_dapm_widgets),
+                .dapm_routes            = common31xx_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(common31xx_audio_map),
+        },
 };
 
 static const struct snd_soc_dai_ops aic31xx_dai_ops = {
@@ -1129,19 +1208,34 @@ static const struct snd_soc_dai_ops aic31xx_dai_ops = {
         .digital_mute   = aic31xx_dac_mute,
 };
 
+static struct snd_soc_dai_driver dac31xx_dai_driver[] = {
+        {
+                .name = "tlv32dac31xx-hifi",
+                .playback = {
+                        .stream_name     = "Playback",
+                        .channels_min    = 2,
+                        .channels_max    = 2,
+                        .rates           = AIC31XX_RATES,
+                        .formats         = AIC31XX_FORMATS,
+                },
+                .ops = &aic31xx_dai_ops,
+                .symmetric_rates = 1,
+        }
+};
+
 static struct snd_soc_dai_driver aic31xx_dai_driver[] = {
         {
                 .name = "tlv320aic31xx-hifi",
                 .playback = {
                         .stream_name     = "Playback",
-                        .channels_min    = 1,
+                        .channels_min    = 2,
                         .channels_max    = 2,
                         .rates           = AIC31XX_RATES,
                         .formats         = AIC31XX_FORMATS,
                 },
                 .capture = {
                         .stream_name     = "Capture",
-                        .channels_min    = 1,
+                        .channels_min    = 2,
                         .channels_max    = 2,
                         .rates           = AIC31XX_RATES,
                         .formats         = AIC31XX_FORMATS,
@@ -1259,9 +1353,16 @@ static int aic31xx_i2c_probe(struct i2c_client *i2c,
         if (ret)
                 return ret;
 
-        return snd_soc_register_codec(&i2c->dev, &soc_codec_driver_aic31xx,
-                                     aic31xx_dai_driver,
-                                     ARRAY_SIZE(aic31xx_dai_driver));
+        if (aic31xx->pdata.codec_type & DAC31XX_BIT)
+                return snd_soc_register_codec(&i2c->dev,
+                                &soc_codec_driver_aic31xx,
+                                dac31xx_dai_driver,
+                                ARRAY_SIZE(dac31xx_dai_driver));
+        else
+                return snd_soc_register_codec(&i2c->dev,
+                                &soc_codec_driver_aic31xx,
+                                aic31xx_dai_driver,
+                                ARRAY_SIZE(aic31xx_dai_driver));
 }
 
 static int aic31xx_i2c_remove(struct i2c_client *i2c)
@@ -1277,6 +1378,7 @@ static const struct i2c_device_id aic31xx_i2c_id[] = {
         { "tlv320aic3110", AIC3110 },
         { "tlv320aic3120", AIC3120 },
         { "tlv320aic3111", AIC3111 },
+        { "tlv320dac3100", DAC3100 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, aic31xx_i2c_id);
diff --git a/sound/soc/codecs/tlv320aic31xx.h b/sound/soc/codecs/tlv320aic31xx.h
index ac9b146526eb..5acd5b69fb83 100644
--- a/sound/soc/codecs/tlv320aic31xx.h
+++ b/sound/soc/codecs/tlv320aic31xx.h
@@ -24,12 +24,14 @@
 
 #define AIC31XX_STEREO_CLASS_D_BIT      0x1
 #define AIC31XX_MINIDSP_BIT             0x2
+#define DAC31XX_BIT                     0x4
 
 enum aic31xx_type {
         AIC3100 = 0,
         AIC3110 = AIC31XX_STEREO_CLASS_D_BIT,
         AIC3120 = AIC31XX_MINIDSP_BIT,
         AIC3111 = (AIC31XX_STEREO_CLASS_D_BIT | AIC31XX_MINIDSP_BIT),
+        DAC3100 = DAC31XX_BIT,
 };
 
 struct aic31xx_pdata {
diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 85d4978d0384..28fdfc5ec544 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -797,12 +797,14 @@ static struct snd_soc_codec_driver soc_codec_dev_aic32x4 = {
         .set_bias_level = aic32x4_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = aic32x4_snd_controls,
-        .num_controls = ARRAY_SIZE(aic32x4_snd_controls),
-        .dapm_widgets = aic32x4_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(aic32x4_dapm_widgets),
-        .dapm_routes = aic32x4_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(aic32x4_dapm_routes),
+        .component_driver = {
+                .controls               = aic32x4_snd_controls,
+                .num_controls           = ARRAY_SIZE(aic32x4_snd_controls),
+                .dapm_widgets           = aic32x4_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(aic32x4_dapm_widgets),
+                .dapm_routes            = aic32x4_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(aic32x4_dapm_routes),
+        },
 };
 
 static int aic32x4_parse_dt(struct aic32x4_priv *aic32x4,
diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
index a564759845f9..5a8d96ec058c 100644
--- a/sound/soc/codecs/tlv320aic3x.c
+++ b/sound/soc/codecs/tlv320aic3x.c
@@ -1670,12 +1670,14 @@ static struct snd_soc_codec_driver soc_codec_dev_aic3x = {
         .idle_bias_off = true,
         .probe = aic3x_probe,
         .remove = aic3x_remove,
-        .controls = aic3x_snd_controls,
-        .num_controls = ARRAY_SIZE(aic3x_snd_controls),
-        .dapm_widgets = aic3x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(aic3x_dapm_widgets),
-        .dapm_routes = intercon,
-        .num_dapm_routes = ARRAY_SIZE(intercon),
+        .component_driver = {
+                .controls               = aic3x_snd_controls,
+                .num_controls           = ARRAY_SIZE(aic3x_snd_controls),
+                .dapm_widgets           = aic3x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(aic3x_dapm_widgets),
+                .dapm_routes            = intercon,
+                .num_dapm_routes        = ARRAY_SIZE(intercon),
+        },
 };
 
 /*
diff --git a/sound/soc/codecs/tlv320dac33.c b/sound/soc/codecs/tlv320dac33.c
index f7a6ce7e5fb1..7bcf01efdf9a 100644
--- a/sound/soc/codecs/tlv320dac33.c
+++ b/sound/soc/codecs/tlv320dac33.c
@@ -90,7 +90,6 @@ static const char *dac33_supply_names[DAC33_NUM_SUPPLIES] = {
 
 struct tlv320dac33_priv {
         struct mutex mutex;
-        struct workqueue_struct *dac33_wq;
         struct work_struct work;
         struct snd_soc_codec *codec;
         struct regulator_bulk_data supplies[DAC33_NUM_SUPPLIES];
@@ -771,7 +770,7 @@ static irqreturn_t dac33_interrupt_handler(int irq, void *dev)
 
         /* Do not schedule the workqueue in Mode7 */
         if (dac33->fifo_mode != DAC33_FIFO_MODE7)
-                queue_work(dac33->dac33_wq, &dac33->work);
+                schedule_work(&dac33->work);
 
         return IRQ_HANDLED;
 }
@@ -1127,7 +1126,7 @@ static int dac33_pcm_trigger(struct snd_pcm_substream *substream, int cmd,
         case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
                 if (dac33->fifo_mode) {
                         dac33->state = DAC33_PREFILL;
-                        queue_work(dac33->dac33_wq, &dac33->work);
+                        schedule_work(&dac33->work);
                 }
                 break;
         case SNDRV_PCM_TRIGGER_STOP:
@@ -1135,7 +1134,7 @@ static int dac33_pcm_trigger(struct snd_pcm_substream *substream, int cmd,
         case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                 if (dac33->fifo_mode) {
                         dac33->state = DAC33_FLUSH;
-                        queue_work(dac33->dac33_wq, &dac33->work);
+                        schedule_work(&dac33->work);
                 }
                 break;
         default:
@@ -1410,14 +1409,6 @@ static int dac33_soc_probe(struct snd_soc_codec *codec)
                         dac33->irq = -1;
                 }
                 if (dac33->irq != -1) {
-                        /* Setup work queue */
-                        dac33->dac33_wq =
-                                create_singlethread_workqueue("tlv320dac33");
-                        if (dac33->dac33_wq == NULL) {
-                                free_irq(dac33->irq, codec);
-                                return -ENOMEM;
-                        }
-
                         INIT_WORK(&dac33->work, dac33_work);
                 }
         }
@@ -1437,7 +1428,7 @@ static int dac33_soc_remove(struct snd_soc_codec *codec)
 
         if (dac33->irq >= 0) {
                 free_irq(dac33->irq, dac33->codec);
-                destroy_workqueue(dac33->dac33_wq);
+                flush_work(&dac33->work);
         }
         return 0;
 }
@@ -1453,12 +1444,14 @@ static struct snd_soc_codec_driver soc_codec_dev_tlv320dac33 = {
         .probe = dac33_soc_probe,
         .remove = dac33_soc_remove,
 
-        .controls = dac33_snd_controls,
-        .num_controls = ARRAY_SIZE(dac33_snd_controls),
-        .dapm_widgets = dac33_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(dac33_dapm_widgets),
-        .dapm_routes = audio_map,
-        .num_dapm_routes = ARRAY_SIZE(audio_map),
+        .component_driver = {
+                .controls               = dac33_snd_controls,
+                .num_controls           = ARRAY_SIZE(dac33_snd_controls),
+                .dapm_widgets           = dac33_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(dac33_dapm_widgets),
+                .dapm_routes            = audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(audio_map),
+        },
 };
 
 #define DAC33_RATES     (SNDRV_PCM_RATE_44100 | \
diff --git a/sound/soc/codecs/twl4030.c b/sound/soc/codecs/twl4030.c
index a5a4e9f75c57..a2104d68169d 100644
--- a/sound/soc/codecs/twl4030.c
+++ b/sound/soc/codecs/twl4030.c
@@ -2199,12 +2199,14 @@ static struct snd_soc_codec_driver soc_codec_dev_twl4030 = {
         .set_bias_level = twl4030_set_bias_level,
         .idle_bias_off = true,
 
-        .controls = twl4030_snd_controls,
-        .num_controls = ARRAY_SIZE(twl4030_snd_controls),
-        .dapm_widgets = twl4030_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(twl4030_dapm_widgets),
-        .dapm_routes = intercon,
-        .num_dapm_routes = ARRAY_SIZE(intercon),
+        .component_driver = {
+                .controls               = twl4030_snd_controls,
+                .num_controls           = ARRAY_SIZE(twl4030_snd_controls),
+                .dapm_widgets           = twl4030_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(twl4030_dapm_widgets),
+                .dapm_routes            = intercon,
+                .num_dapm_routes        = ARRAY_SIZE(intercon),
+        },
 };
 
 static int twl4030_codec_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/twl6040.c b/sound/soc/codecs/twl6040.c
index 1f7081043566..748036e851ea 100644
--- a/sound/soc/codecs/twl6040.c
+++ b/sound/soc/codecs/twl6040.c
@@ -1156,12 +1156,14 @@ static struct snd_soc_codec_driver soc_codec_dev_twl6040 = {
         .suspend_bias_off = true,
         .ignore_pmdown_time = true,
 
-        .controls = twl6040_snd_controls,
-        .num_controls = ARRAY_SIZE(twl6040_snd_controls),
-        .dapm_widgets = twl6040_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets),
-        .dapm_routes = intercon,
-        .num_dapm_routes = ARRAY_SIZE(intercon),
+        .component_driver = {
+                .controls               = twl6040_snd_controls,
+                .num_controls           = ARRAY_SIZE(twl6040_snd_controls),
+                .dapm_widgets           = twl6040_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(twl6040_dapm_widgets),
+                .dapm_routes            = intercon,
+                .num_dapm_routes        = ARRAY_SIZE(intercon),
+        },
 };
 
 static int twl6040_codec_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/uda134x.c b/sound/soc/codecs/uda134x.c
index e4c694c758b8..5fdee874406d 100644
--- a/sound/soc/codecs/uda134x.c
+++ b/sound/soc/codecs/uda134x.c
@@ -523,10 +523,12 @@ static struct snd_soc_codec_driver soc_codec_dev_uda134x = {
         .set_bias_level = uda134x_set_bias_level,
         .suspend_bias_off = true,
 
-        .dapm_widgets = uda134x_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(uda134x_dapm_widgets),
-        .dapm_routes = uda134x_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(uda134x_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = uda134x_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(uda134x_dapm_widgets),
+                .dapm_routes            = uda134x_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(uda134x_dapm_routes),
+        },
 };
 
 static const struct regmap_config uda134x_regmap_config = {
@@ -544,6 +546,7 @@ static int uda134x_codec_probe(struct platform_device *pdev)
 {
         struct uda134x_platform_data *pd = pdev->dev.platform_data;
         struct uda134x_priv *uda134x;
+        int ret;
 
         if (!pd) {
                 dev_err(&pdev->dev, "Missing L3 bitbang function\n");
@@ -557,6 +560,12 @@ static int uda134x_codec_probe(struct platform_device *pdev)
         uda134x->pd = pd;
         platform_set_drvdata(pdev, uda134x);
 
+        if (pd->l3.use_gpios) {
+                ret = l3_set_gpio_ops(&pdev->dev, &uda134x->pd->l3);
+                if (ret < 0)
+                        return ret;
+        }
+
         uda134x->regmap = devm_regmap_init(&pdev->dev, NULL, pd,
                 &uda134x_regmap_config);
         if (IS_ERR(uda134x->regmap))
diff --git a/sound/soc/codecs/uda1380.c b/sound/soc/codecs/uda1380.c
index 35f0469ebb16..533e3bb444e4 100644
--- a/sound/soc/codecs/uda1380.c
+++ b/sound/soc/codecs/uda1380.c
@@ -765,12 +765,14 @@ static struct snd_soc_codec_driver soc_codec_dev_uda1380 = {
         .reg_cache_default = uda1380_reg,
         .reg_cache_step = 1,
 
-        .controls = uda1380_snd_controls,
-        .num_controls = ARRAY_SIZE(uda1380_snd_controls),
-        .dapm_widgets = uda1380_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(uda1380_dapm_widgets),
-        .dapm_routes = uda1380_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(uda1380_dapm_routes),
+        .component_driver = {
+                .controls               = uda1380_snd_controls,
+                .num_controls           = ARRAY_SIZE(uda1380_snd_controls),
+                .dapm_widgets           = uda1380_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(uda1380_dapm_widgets),
+                .dapm_routes            = uda1380_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(uda1380_dapm_routes),
+        },
 };
 
 #if IS_ENABLED(CONFIG_I2C)
diff --git a/sound/soc/codecs/wl1273.c b/sound/soc/codecs/wl1273.c
index 1b79778098d2..fcffb6e707d9 100644
--- a/sound/soc/codecs/wl1273.c
+++ b/sound/soc/codecs/wl1273.c
@@ -484,12 +484,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wl1273 = {
         .probe = wl1273_probe,
         .remove = wl1273_remove,
 
-        .controls = wl1273_controls,
-        .num_controls = ARRAY_SIZE(wl1273_controls),
-        .dapm_widgets = wl1273_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wl1273_dapm_widgets),
-        .dapm_routes = wl1273_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wl1273_dapm_routes),
+        .component_driver = {
+                .controls               = wl1273_controls,
+                .num_controls           = ARRAY_SIZE(wl1273_controls),
+                .dapm_widgets           = wl1273_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wl1273_dapm_widgets),
+                .dapm_routes            = wl1273_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wl1273_dapm_routes),
+        },
 };
 
 static int wl1273_platform_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm0010.c b/sound/soc/codecs/wm0010.c
index e3c34bdc2772..0eb5dcf4c29d 100644
--- a/sound/soc/codecs/wm0010.c
+++ b/sound/soc/codecs/wm0010.c
@@ -789,16 +789,18 @@ static int wm0010_set_sysclk(struct snd_soc_codec *codec, int source,
 
 static int wm0010_probe(struct snd_soc_codec *codec);
 
-static struct snd_soc_codec_driver soc_codec_dev_wm0010 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm0010 = {
         .probe = wm0010_probe,
         .set_bias_level = wm0010_set_bias_level,
         .set_sysclk = wm0010_set_sysclk,
         .idle_bias_off = true,
 
-        .dapm_widgets = wm0010_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm0010_dapm_widgets),
-        .dapm_routes = wm0010_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm0010_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = wm0010_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm0010_dapm_widgets),
+                .dapm_routes            = wm0010_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm0010_dapm_routes),
+        },
 };
 
 #define WM0010_RATES (SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000)
diff --git a/sound/soc/codecs/wm1250-ev1.c b/sound/soc/codecs/wm1250-ev1.c
index ec45c5b220b1..cf5f0580df6a 100644
--- a/sound/soc/codecs/wm1250-ev1.c
+++ b/sound/soc/codecs/wm1250-ev1.c
@@ -141,12 +141,13 @@ static struct snd_soc_dai_driver wm1250_ev1_dai = {
         .ops = &wm1250_ev1_ops,
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm1250_ev1 = {
-        .dapm_widgets = wm1250_ev1_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm1250_ev1_dapm_widgets),
-        .dapm_routes = wm1250_ev1_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm1250_ev1_dapm_routes),
-
+static const struct snd_soc_codec_driver soc_codec_dev_wm1250_ev1 = {
+        .component_driver = {
+                .dapm_widgets           = wm1250_ev1_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm1250_ev1_dapm_widgets),
+                .dapm_routes            = wm1250_ev1_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm1250_ev1_dapm_routes),
+        },
         .set_bias_level = wm1250_ev1_set_bias_level,
         .idle_bias_off = true,
 };
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index a67ea10f41a1..23cde3a0dc11 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -581,7 +581,7 @@ static int wm2000_anc_transition(struct wm2000_priv *wm2000,
         if (anc_transitions[i].dest == ANC_OFF)
                 clk_disable_unprepare(wm2000->mclk);
 
-        return ret;
+        return 0;
 }
 
 static int wm2000_anc_set_mode(struct wm2000_priv *wm2000)
@@ -799,18 +799,20 @@ static int wm2000_remove(struct snd_soc_codec *codec)
         return wm2000_anc_transition(wm2000, ANC_OFF);
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm2000 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm2000 = {
         .probe = wm2000_probe,
         .remove = wm2000_remove,
         .suspend = wm2000_suspend,
         .resume = wm2000_resume,
 
-        .dapm_widgets = wm2000_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm2000_dapm_widgets),
-        .dapm_routes = wm2000_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(wm2000_audio_map),
-        .controls = wm2000_controls,
-        .num_controls = ARRAY_SIZE(wm2000_controls),
+        .component_driver = {
+                .controls               = wm2000_controls,
+                .num_controls           = ARRAY_SIZE(wm2000_controls),
+                .dapm_widgets           = wm2000_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm2000_dapm_widgets),
+                .dapm_routes            = wm2000_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(wm2000_audio_map),
+        },
 };
 
 static int wm2000_i2c_probe(struct i2c_client *i2c,
diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c
index fd1439ecb50a..606bf88abfc4 100644
--- a/sound/soc/codecs/wm2200.c
+++ b/sound/soc/codecs/wm2200.c
@@ -2103,7 +2103,7 @@ static struct snd_soc_dai_driver wm2200_dai = {
         .ops = &wm2200_dai_ops,
 };
 
-static struct snd_soc_codec_driver soc_codec_wm2200 = {
+static const struct snd_soc_codec_driver soc_codec_wm2200 = {
         .probe = wm2200_probe,
 
         .idle_bias_off = true,
@@ -2111,12 +2111,14 @@ static struct snd_soc_codec_driver soc_codec_wm2200 = {
         .set_sysclk = wm2200_set_sysclk,
         .set_pll = wm2200_set_fll,
 
-        .controls = wm2200_snd_controls,
-        .num_controls = ARRAY_SIZE(wm2200_snd_controls),
-        .dapm_widgets = wm2200_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm2200_dapm_widgets),
-        .dapm_routes = wm2200_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm2200_dapm_routes),
+        .component_driver = {
+                .controls               = wm2200_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm2200_snd_controls),
+                .dapm_widgets           = wm2200_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm2200_dapm_widgets),
+                .dapm_routes            = wm2200_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm2200_dapm_routes),
+        },
 };
 
 static irqreturn_t wm2200_irq(int irq, void *data)
diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
index 512a9d25fe6f..560575000cc5 100644
--- a/sound/soc/codecs/wm5100.c
+++ b/sound/soc/codecs/wm5100.c
@@ -2285,7 +2285,7 @@ static int wm5100_gpio_direction_in(struct gpio_chip *chip, unsigned offset)
                                   (1 << WM5100_GP1_DIR_SHIFT));
 }
 
-static struct gpio_chip wm5100_template_chip = {
+static const struct gpio_chip wm5100_template_chip = {
         .label                  = "wm5100",
         .owner                  = THIS_MODULE,
         .direction_output       = wm5100_gpio_direction_out,
@@ -2381,7 +2381,7 @@ static int wm5100_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm5100 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm5100 = {
         .probe =        wm5100_probe,
         .remove =       wm5100_remove,
 
@@ -2390,12 +2390,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm5100 = {
         .idle_bias_off = 1,
 
         .seq_notifier = wm5100_seq_notifier,
-        .controls = wm5100_snd_controls,
-        .num_controls = ARRAY_SIZE(wm5100_snd_controls),
-        .dapm_widgets = wm5100_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm5100_dapm_widgets),
-        .dapm_routes = wm5100_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm5100_dapm_routes),
+        .component_driver = {
+                .controls               = wm5100_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm5100_snd_controls),
+                .dapm_widgets           = wm5100_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm5100_dapm_widgets),
+                .dapm_routes            = wm5100_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm5100_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm5100_regmap = {
diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
index 846deed6af41..93876c6d48ee 100644
--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -1521,6 +1521,16 @@ static const struct snd_soc_dapm_route wm5102_dapm_routes[] = {
         { "IN3L", NULL, "SYSCLK" },
         { "IN3R", NULL, "SYSCLK" },
 
+        { "ASRC1L", NULL, "SYSCLK" },
+        { "ASRC1R", NULL, "SYSCLK" },
+        { "ASRC2L", NULL, "SYSCLK" },
+        { "ASRC2R", NULL, "SYSCLK" },
+
+        { "ASRC1L", NULL, "ASYNCCLK" },
+        { "ASRC1R", NULL, "ASYNCCLK" },
+        { "ASRC2L", NULL, "ASYNCCLK" },
+        { "ASRC2R", NULL, "ASYNCCLK" },
+
         { "MICBIAS1", NULL, "MICVDD" },
         { "MICBIAS2", NULL, "MICVDD" },
         { "MICBIAS3", NULL, "MICVDD" },
@@ -1600,7 +1610,6 @@ static const struct snd_soc_dapm_route wm5102_dapm_routes[] = {
         { "Slim3 Capture", NULL, "SYSCLK" },
 
         { "Audio Trace DSP", NULL, "DSP1" },
-        { "Audio Trace DSP", NULL, "SYSCLK" },
 
         { "IN1L PGA", NULL, "IN1L" },
         { "IN1R PGA", NULL, "IN1R" },
@@ -1990,7 +1999,7 @@ static struct regmap *wm5102_get_regmap(struct device *dev)
         return priv->core.arizona->regmap;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm5102 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm5102 = {
         .probe = wm5102_codec_probe,
         .remove = wm5102_codec_remove,
         .get_regmap = wm5102_get_regmap,
@@ -2000,12 +2009,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm5102 = {
         .set_sysclk = arizona_set_sysclk,
         .set_pll = wm5102_set_fll,
 
-        .controls = wm5102_snd_controls,
-        .num_controls = ARRAY_SIZE(wm5102_snd_controls),
-        .dapm_widgets = wm5102_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm5102_dapm_widgets),
-        .dapm_routes = wm5102_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm5102_dapm_routes),
+        .component_driver = {
+                .controls               = wm5102_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm5102_snd_controls),
+                .dapm_widgets           = wm5102_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm5102_dapm_widgets),
+                .dapm_routes            = wm5102_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm5102_dapm_routes),
+        },
 };
 
 static struct snd_compr_ops wm5102_compr_ops = {
diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
index 156547026a40..06bae3b23fce 100644
--- a/sound/soc/codecs/wm5110.c
+++ b/sound/soc/codecs/wm5110.c
@@ -1745,6 +1745,16 @@ static const struct snd_soc_dapm_route wm5110_dapm_routes[] = {
         { "IN4L", NULL, "SYSCLK" },
         { "IN4R", NULL, "SYSCLK" },
 
+        { "ASRC1L", NULL, "SYSCLK" },
+        { "ASRC1R", NULL, "SYSCLK" },
+        { "ASRC2L", NULL, "SYSCLK" },
+        { "ASRC2R", NULL, "SYSCLK" },
+
+        { "ASRC1L", NULL, "ASYNCCLK" },
+        { "ASRC1R", NULL, "ASYNCCLK" },
+        { "ASRC2L", NULL, "ASYNCCLK" },
+        { "ASRC2R", NULL, "ASYNCCLK" },
+
         { "MICBIAS1", NULL, "MICVDD" },
         { "MICBIAS2", NULL, "MICVDD" },
         { "MICBIAS3", NULL, "MICVDD" },
@@ -1832,10 +1842,8 @@ static const struct snd_soc_dapm_route wm5110_dapm_routes[] = {
         { "Slim3 Capture", NULL, "SYSCLK" },
 
         { "Voice Control DSP", NULL, "DSP3" },
-        { "Voice Control DSP", NULL, "SYSCLK" },
 
         { "Audio Trace DSP", NULL, "DSP1" },
-        { "Audio Trace DSP", NULL, "SYSCLK" },
 
         { "IN1L PGA", NULL, "IN1L" },
         { "IN1R PGA", NULL, "IN1R" },
@@ -2347,7 +2355,7 @@ static struct regmap *wm5110_get_regmap(struct device *dev)
         return priv->core.arizona->regmap;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm5110 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm5110 = {
         .probe = wm5110_codec_probe,
         .remove = wm5110_codec_remove,
         .get_regmap = wm5110_get_regmap,
@@ -2357,12 +2365,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm5110 = {
         .set_sysclk = arizona_set_sysclk,
         .set_pll = wm5110_set_fll,
 
-        .controls = wm5110_snd_controls,
-        .num_controls = ARRAY_SIZE(wm5110_snd_controls),
-        .dapm_widgets = wm5110_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm5110_dapm_widgets),
-        .dapm_routes = wm5110_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm5110_dapm_routes),
+        .component_driver = {
+                .controls               = wm5110_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm5110_snd_controls),
+                .dapm_widgets           = wm5110_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm5110_dapm_widgets),
+                .dapm_routes            = wm5110_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm5110_dapm_routes),
+        },
 };
 
 static struct snd_compr_ops wm5110_compr_ops = {
diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
index ffbf3df8ae97..2efc5b41ad0f 100644
--- a/sound/soc/codecs/wm8350.c
+++ b/sound/soc/codecs/wm8350.c
@@ -1587,19 +1587,21 @@ static struct regmap *wm8350_get_regmap(struct device *dev)
         return wm8350->regmap;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8350 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8350 = {
         .probe =        wm8350_codec_probe,
         .remove =       wm8350_codec_remove,
         .get_regmap =   wm8350_get_regmap,
         .set_bias_level = wm8350_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8350_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8350_snd_controls),
-        .dapm_widgets = wm8350_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8350_dapm_widgets),
-        .dapm_routes = wm8350_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8350_dapm_routes),
+        .component_driver = {
+                .controls               = wm8350_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8350_snd_controls),
+                .dapm_widgets           = wm8350_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8350_dapm_widgets),
+                .dapm_routes            = wm8350_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8350_dapm_routes),
+        },
 };
 
 static int wm8350_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm8400.c b/sound/soc/codecs/wm8400.c
index b1d346aa4696..6c59fb933bd6 100644
--- a/sound/soc/codecs/wm8400.c
+++ b/sound/soc/codecs/wm8400.c
@@ -1332,19 +1332,21 @@ static struct regmap *wm8400_get_regmap(struct device *dev)
         return wm8400->regmap;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8400 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8400 = {
         .probe =        wm8400_codec_probe,
         .remove =       wm8400_codec_remove,
         .get_regmap =   wm8400_get_regmap,
         .set_bias_level = wm8400_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8400_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8400_snd_controls),
-        .dapm_widgets = wm8400_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8400_dapm_widgets),
-        .dapm_routes = wm8400_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8400_dapm_routes),
+        .component_driver = {
+                .controls               = wm8400_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8400_snd_controls),
+                .dapm_widgets           = wm8400_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8400_dapm_widgets),
+                .dapm_routes            = wm8400_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8400_dapm_routes),
+        },
 };
 
 static int wm8400_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm8510.c b/sound/soc/codecs/wm8510.c
index 99e40e629cca..119ceac684ae 100644
--- a/sound/soc/codecs/wm8510.c
+++ b/sound/soc/codecs/wm8510.c
@@ -581,17 +581,19 @@ static int wm8510_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8510 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8510 = {
         .probe =        wm8510_probe,
         .set_bias_level = wm8510_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8510_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8510_snd_controls),
-        .dapm_widgets = wm8510_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8510_dapm_widgets),
-        .dapm_routes = wm8510_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8510_dapm_routes),
+        .component_driver = {
+                .controls               = wm8510_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8510_snd_controls),
+                .dapm_widgets           = wm8510_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8510_dapm_widgets),
+                .dapm_routes            = wm8510_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8510_dapm_routes),
+        },
 };
 
 static const struct of_device_id wm8510_of_match[] = {
diff --git a/sound/soc/codecs/wm8523.c b/sound/soc/codecs/wm8523.c
index aa287a3965e7..deb2e075428e 100644
--- a/sound/soc/codecs/wm8523.c
+++ b/sound/soc/codecs/wm8523.c
@@ -413,17 +413,19 @@ static int wm8523_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8523 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8523 = {
         .probe =        wm8523_probe,
         .set_bias_level = wm8523_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8523_controls,
-        .num_controls = ARRAY_SIZE(wm8523_controls),
-        .dapm_widgets = wm8523_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8523_dapm_widgets),
-        .dapm_routes = wm8523_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8523_dapm_routes),
+        .component_driver = {
+                .controls               = wm8523_controls,
+                .num_controls           = ARRAY_SIZE(wm8523_controls),
+                .dapm_widgets           = wm8523_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8523_dapm_widgets),
+                .dapm_routes            = wm8523_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8523_dapm_routes),
+        },
 };
 
 static const struct of_device_id wm8523_of_match[] = {
diff --git a/sound/soc/codecs/wm8580.c b/sound/soc/codecs/wm8580.c
index 66602bf02f6e..faa7287a5253 100644
--- a/sound/soc/codecs/wm8580.c
+++ b/sound/soc/codecs/wm8580.c
@@ -899,17 +899,19 @@ static int wm8580_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8580 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8580 = {
         .probe =        wm8580_probe,
         .remove =       wm8580_remove,
         .set_bias_level = wm8580_set_bias_level,
 
-        .controls = wm8580_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8580_snd_controls),
-        .dapm_widgets = wm8580_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8580_dapm_widgets),
-        .dapm_routes = wm8580_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8580_dapm_routes),
+        .component_driver = {
+                .controls               = wm8580_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8580_snd_controls),
+                .dapm_widgets           = wm8580_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8580_dapm_widgets),
+                .dapm_routes            = wm8580_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8580_dapm_routes),
+        },
 };
 
 static const struct of_device_id wm8580_of_match[] = {
diff --git a/sound/soc/codecs/wm8711.c b/sound/soc/codecs/wm8711.c
index c759ec068e97..2b376c9c99af 100644
--- a/sound/soc/codecs/wm8711.c
+++ b/sound/soc/codecs/wm8711.c
@@ -367,17 +367,19 @@ static int wm8711_probe(struct snd_soc_codec *codec)
 
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8711 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8711 = {
         .probe =        wm8711_probe,
         .set_bias_level = wm8711_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8711_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8711_snd_controls),
-        .dapm_widgets = wm8711_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8711_dapm_widgets),
-        .dapm_routes = wm8711_intercon,
-        .num_dapm_routes = ARRAY_SIZE(wm8711_intercon),
+        .component_driver = {
+                .controls               = wm8711_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8711_snd_controls),
+                .dapm_widgets           = wm8711_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8711_dapm_widgets),
+                .dapm_routes            = wm8711_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(wm8711_intercon),
+        },
 };
 
 static const struct of_device_id wm8711_of_match[] = {
diff --git a/sound/soc/codecs/wm8727.c b/sound/soc/codecs/wm8727.c
index bb25a75f92a2..7fde077a014b 100644
--- a/sound/soc/codecs/wm8727.c
+++ b/sound/soc/codecs/wm8727.c
@@ -53,11 +53,13 @@ static struct snd_soc_dai_driver wm8727_dai = {
                 },
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8727 = {
-        .dapm_widgets = wm8727_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8727_dapm_widgets),
-        .dapm_routes = wm8727_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8727_dapm_routes),
+static const struct snd_soc_codec_driver soc_codec_dev_wm8727 = {
+        .component_driver = {
+                .dapm_widgets           = wm8727_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8727_dapm_widgets),
+                .dapm_routes            = wm8727_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8727_dapm_routes),
+        },
 };
 
 static int wm8727_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm8728.c b/sound/soc/codecs/wm8728.c
index 1564e6926527..797cc6e7c70f 100644
--- a/sound/soc/codecs/wm8728.c
+++ b/sound/soc/codecs/wm8728.c
@@ -211,16 +211,18 @@ static struct snd_soc_dai_driver wm8728_dai = {
         .ops = &wm8728_dai_ops,
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8728 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8728 = {
         .set_bias_level = wm8728_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8728_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8728_snd_controls),
-        .dapm_widgets = wm8728_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8728_dapm_widgets),
-        .dapm_routes = wm8728_intercon,
-        .num_dapm_routes = ARRAY_SIZE(wm8728_intercon),
+        .component_driver = {
+                .controls               = wm8728_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8728_snd_controls),
+                .dapm_widgets           = wm8728_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8728_dapm_widgets),
+                .dapm_routes            = wm8728_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(wm8728_intercon),
+        },
 };
 
 static const struct of_device_id wm8728_of_match[] = {
diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
index d18261a44256..4f9a1eb28120 100644
--- a/sound/soc/codecs/wm8731.c
+++ b/sound/soc/codecs/wm8731.c
@@ -628,16 +628,18 @@ err_regulator_enable:
         return ret;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8731 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8731 = {
         .set_bias_level = wm8731_set_bias_level,
         .suspend_bias_off = true,
 
-        .dapm_widgets = wm8731_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8731_dapm_widgets),
-        .dapm_routes = wm8731_intercon,
-        .num_dapm_routes = ARRAY_SIZE(wm8731_intercon),
-        .controls =     wm8731_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8731_snd_controls),
+        .component_driver = {
+                .controls               = wm8731_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8731_snd_controls),
+                .dapm_widgets           = wm8731_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8731_dapm_widgets),
+                .dapm_routes            = wm8731_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(wm8731_intercon),
+        },
 };
 
 static const struct of_device_id wm8731_of_match[] = {
diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
index e7807601e675..f0cb1c4afe3c 100644
--- a/sound/soc/codecs/wm8737.c
+++ b/sound/soc/codecs/wm8737.c
@@ -573,17 +573,19 @@ err_get:
         return ret;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8737 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8737 = {
         .probe          = wm8737_probe,
         .set_bias_level = wm8737_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8737_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8737_snd_controls),
-        .dapm_widgets = wm8737_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8737_dapm_widgets),
-        .dapm_routes = intercon,
-        .num_dapm_routes = ARRAY_SIZE(intercon),
+        .component_driver = {
+                .controls               = wm8737_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8737_snd_controls),
+                .dapm_widgets           = wm8737_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8737_dapm_widgets),
+                .dapm_routes            = intercon,
+                .num_dapm_routes        = ARRAY_SIZE(intercon),
+        },
 };
 
 static const struct of_device_id wm8737_of_match[] = {
diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
index 36ef91fe0511..565d477cd790 100644
--- a/sound/soc/codecs/wm8741.c
+++ b/sound/soc/codecs/wm8741.c
@@ -497,15 +497,17 @@ static int wm8741_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8741 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8741 = {
         .probe =        wm8741_probe,
         .remove =       wm8741_remove,
         .resume =       wm8741_resume,
 
-        .dapm_widgets = wm8741_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8741_dapm_widgets),
-        .dapm_routes = wm8741_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8741_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = wm8741_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8741_dapm_widgets),
+                .dapm_routes            = wm8741_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8741_dapm_routes),
+        },
 };
 
 static const struct of_device_id wm8741_of_match[] = {
diff --git a/sound/soc/codecs/wm8750.c b/sound/soc/codecs/wm8750.c
index bd9dcd2161bc..0da2bbaf06d1 100644
--- a/sound/soc/codecs/wm8750.c
+++ b/sound/soc/codecs/wm8750.c
@@ -708,17 +708,19 @@ static int wm8750_probe(struct snd_soc_codec *codec)
         return ret;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8750 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8750 = {
         .probe =        wm8750_probe,
         .set_bias_level = wm8750_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8750_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8750_snd_controls),
-        .dapm_widgets = wm8750_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8750_dapm_widgets),
-        .dapm_routes = wm8750_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8750_dapm_routes),
+        .component_driver = {
+                .controls               = wm8750_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8750_snd_controls),
+                .dapm_widgets           = wm8750_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8750_dapm_widgets),
+                .dapm_routes            = wm8750_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8750_dapm_routes),
+        },
 };
 
 static const struct of_device_id wm8750_of_match[] = {
diff --git a/sound/soc/codecs/wm8753.c b/sound/soc/codecs/wm8753.c
index cdcc91282e8a..9bdf5447f6f6 100644
--- a/sound/soc/codecs/wm8753.c
+++ b/sound/soc/codecs/wm8753.c
@@ -1478,18 +1478,20 @@ static int wm8753_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8753 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8753 = {
         .probe =        wm8753_probe,
         .resume =       wm8753_resume,
         .set_bias_level = wm8753_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8753_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8753_snd_controls),
-        .dapm_widgets = wm8753_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8753_dapm_widgets),
-        .dapm_routes = wm8753_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8753_dapm_routes),
+        .component_driver = {
+                .controls               = wm8753_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8753_snd_controls),
+                .dapm_widgets           = wm8753_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8753_dapm_widgets),
+                .dapm_routes            = wm8753_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8753_dapm_routes),
+        },
 };
 
 static const struct of_device_id wm8753_of_match[] = {
diff --git a/sound/soc/codecs/wm8770.c b/sound/soc/codecs/wm8770.c
index df6178464b00..d6edcbbdec12 100644
--- a/sound/soc/codecs/wm8770.c
+++ b/sound/soc/codecs/wm8770.c
@@ -608,17 +608,19 @@ err_reg_enable:
         return ret;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8770 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8770 = {
         .probe = wm8770_probe,
         .set_bias_level = wm8770_set_bias_level,
         .idle_bias_off = true,
 
-        .controls = wm8770_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8770_snd_controls),
-        .dapm_widgets = wm8770_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8770_dapm_widgets),
-        .dapm_routes = wm8770_intercon,
-        .num_dapm_routes = ARRAY_SIZE(wm8770_intercon),
+        .component_driver = {
+                .controls               = wm8770_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8770_snd_controls),
+                .dapm_widgets           = wm8770_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8770_dapm_widgets),
+                .dapm_routes            = wm8770_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(wm8770_intercon),
+        },
 };
 
 static const struct of_device_id wm8770_of_match[] = {
diff --git a/sound/soc/codecs/wm8776.c b/sound/soc/codecs/wm8776.c
index 5af44f9a8cf2..ae30480b3976 100644
--- a/sound/soc/codecs/wm8776.c
+++ b/sound/soc/codecs/wm8776.c
@@ -425,17 +425,19 @@ static int wm8776_probe(struct snd_soc_codec *codec)
         return ret;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8776 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8776 = {
         .probe =        wm8776_probe,
         .set_bias_level = wm8776_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8776_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8776_snd_controls),
-        .dapm_widgets = wm8776_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8776_dapm_widgets),
-        .dapm_routes = routes,
-        .num_dapm_routes = ARRAY_SIZE(routes),
+        .component_driver = {
+                .controls               = wm8776_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8776_snd_controls),
+                .dapm_widgets           = wm8776_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8776_dapm_widgets),
+                .dapm_routes            = routes,
+                .num_dapm_routes        = ARRAY_SIZE(routes),
+        },
 };
 
 static const struct of_device_id wm8776_of_match[] = {
diff --git a/sound/soc/codecs/wm8782.c b/sound/soc/codecs/wm8782.c
index fb55fd845d27..bcda21018505 100644
--- a/sound/soc/codecs/wm8782.c
+++ b/sound/soc/codecs/wm8782.c
@@ -50,11 +50,13 @@ static struct snd_soc_dai_driver wm8782_dai = {
         },
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8782 = {
-        .dapm_widgets = wm8782_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8782_dapm_widgets),
-        .dapm_routes = wm8782_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8782_dapm_routes),
+static const struct snd_soc_codec_driver soc_codec_dev_wm8782 = {
+        .component_driver = {
+                .dapm_widgets           = wm8782_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8782_dapm_widgets),
+                .dapm_routes            = wm8782_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8782_dapm_routes),
+        },
 };
 
 static int wm8782_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm8804.c b/sound/soc/codecs/wm8804.c
index 8d914702cae4..af95d648265b 100644
--- a/sound/soc/codecs/wm8804.c
+++ b/sound/soc/codecs/wm8804.c
@@ -545,10 +545,12 @@ static struct snd_soc_dai_driver wm8804_dai = {
 static const struct snd_soc_codec_driver soc_codec_dev_wm8804 = {
         .idle_bias_off = true,
 
-        .dapm_widgets = wm8804_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8804_dapm_widgets),
-        .dapm_routes = wm8804_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8804_dapm_routes),
+        .component_driver = {
+                .dapm_widgets           = wm8804_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8804_dapm_widgets),
+                .dapm_routes            = wm8804_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8804_dapm_routes),
+        },
 };
 
 const struct regmap_config wm8804_regmap_config = {
diff --git a/sound/soc/codecs/wm8900.c b/sound/soc/codecs/wm8900.c
index 5d8dca88d612..c77b49a29311 100644
--- a/sound/soc/codecs/wm8900.c
+++ b/sound/soc/codecs/wm8900.c
@@ -1208,18 +1208,20 @@ static int wm8900_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8900 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8900 = {
         .probe =        wm8900_probe,
         .suspend =      wm8900_suspend,
         .resume =       wm8900_resume,
         .set_bias_level = wm8900_set_bias_level,
 
-        .controls = wm8900_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8900_snd_controls),
-        .dapm_widgets = wm8900_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8900_dapm_widgets),
-        .dapm_routes = wm8900_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8900_dapm_routes),
+        .component_driver = {
+                .controls               = wm8900_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8900_snd_controls),
+                .dapm_widgets           = wm8900_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8900_dapm_widgets),
+                .dapm_routes            = wm8900_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8900_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8900_regmap = {
diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
index a26ca490cf31..6e887c2c42b1 100644
--- a/sound/soc/codecs/wm8903.c
+++ b/sound/soc/codecs/wm8903.c
@@ -1830,7 +1830,7 @@ static void wm8903_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
                            !!value << WM8903_GP1_LVL_SHIFT);
 }
 
-static struct gpio_chip wm8903_template_chip = {
+static const struct gpio_chip wm8903_template_chip = {
         .label                  = "wm8903",
         .owner                  = THIS_MODULE,
         .request                = wm8903_gpio_request,
@@ -1874,18 +1874,20 @@ static void wm8903_free_gpio(struct wm8903_priv *wm8903)
 }
 #endif
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8903 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8903 = {
         .resume =       wm8903_resume,
         .set_bias_level = wm8903_set_bias_level,
         .seq_notifier = wm8903_seq_notifier,
         .suspend_bias_off = true,
 
-        .controls = wm8903_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8903_snd_controls),
-        .dapm_widgets = wm8903_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8903_dapm_widgets),
-        .dapm_routes = wm8903_intercon,
-        .num_dapm_routes = ARRAY_SIZE(wm8903_intercon),
+        .component_driver = {
+                .controls               = wm8903_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8903_snd_controls),
+                .dapm_widgets           = wm8903_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8903_dapm_widgets),
+                .dapm_routes            = wm8903_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(wm8903_intercon),
+        },
 };
 
 static const struct regmap_config wm8903_regmap = {
diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
index edd7a7709194..4fd350e8420d 100644
--- a/sound/soc/codecs/wm8904.c
+++ b/sound/soc/codecs/wm8904.c
@@ -2086,7 +2086,7 @@ static int wm8904_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8904 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8904 = {
         .probe =        wm8904_probe,
         .remove =       wm8904_remove,
         .set_bias_level = wm8904_set_bias_level,
diff --git a/sound/soc/codecs/wm8940.c b/sound/soc/codecs/wm8940.c
index 1c600819f768..b5935625feeb 100644
--- a/sound/soc/codecs/wm8940.c
+++ b/sound/soc/codecs/wm8940.c
@@ -723,17 +723,19 @@ static int wm8940_probe(struct snd_soc_codec *codec)
         return ret;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8940 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8940 = {
         .probe =        wm8940_probe,
         .set_bias_level = wm8940_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls =     wm8940_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8940_snd_controls),
-        .dapm_widgets = wm8940_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8940_dapm_widgets),
-        .dapm_routes =  wm8940_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8940_dapm_routes),
+        .component_driver = {
+                .controls               = wm8940_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8940_snd_controls),
+                .dapm_widgets           = wm8940_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8940_dapm_widgets),
+                .dapm_routes            = wm8940_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8940_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8940_regmap = {
diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
index 9db00d53abe7..1edc7b1df31d 100644
--- a/sound/soc/codecs/wm8955.c
+++ b/sound/soc/codecs/wm8955.c
@@ -940,17 +940,19 @@ err_enable:
         return ret;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8955 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8955 = {
         .probe =        wm8955_probe,
         .set_bias_level = wm8955_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls =     wm8955_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8955_snd_controls),
-        .dapm_widgets = wm8955_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8955_dapm_widgets),
-        .dapm_routes =  wm8955_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8955_dapm_routes),
+        .component_driver = {
+                .controls               = wm8955_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8955_snd_controls),
+                .dapm_widgets           = wm8955_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8955_dapm_widgets),
+                .dapm_routes            = wm8955_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8955_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8955_regmap = {
diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
index d7f444f87460..3bf081a7e450 100644
--- a/sound/soc/codecs/wm8960.c
+++ b/sound/soc/codecs/wm8960.c
@@ -226,11 +226,10 @@ static const DECLARE_TLV_DB_SCALE(dac_tlv, -12750, 50, 1);
 static const DECLARE_TLV_DB_SCALE(bypass_tlv, -2100, 300, 0);
 static const DECLARE_TLV_DB_SCALE(out_tlv, -12100, 100, 1);
 static const DECLARE_TLV_DB_SCALE(lineinboost_tlv, -1500, 300, 1);
-static const unsigned int micboost_tlv[] = {
-        TLV_DB_RANGE_HEAD(2),
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(micboost_tlv,
         0, 1, TLV_DB_SCALE_ITEM(0, 1300, 0),
         2, 3, TLV_DB_SCALE_ITEM(2000, 900, 0),
-};
+);
 
 static const struct snd_kcontrol_new wm8960_snd_controls[] = {
 SOC_DOUBLE_R_TLV("Capture Volume", WM8960_LINVOL, WM8960_RINVOL,
@@ -1264,7 +1263,7 @@ static int wm8960_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8960 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8960 = {
         .probe =        wm8960_probe,
         .set_bias_level = wm8960_set_bias_level,
         .suspend_bias_off = true,
diff --git a/sound/soc/codecs/wm8961.c b/sound/soc/codecs/wm8961.c
index e30446a04740..e23ceac76015 100644
--- a/sound/soc/codecs/wm8961.c
+++ b/sound/soc/codecs/wm8961.c
@@ -882,18 +882,20 @@ static int wm8961_resume(struct snd_soc_codec *codec)
 #define wm8961_resume NULL
 #endif
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8961 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8961 = {
         .probe =        wm8961_probe,
         .resume =       wm8961_resume,
         .set_bias_level = wm8961_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8961_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8961_snd_controls),
-        .dapm_widgets = wm8961_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8961_dapm_widgets),
-        .dapm_routes = audio_paths,
-        .num_dapm_routes = ARRAY_SIZE(audio_paths),
+        .component_driver = {
+                .controls               = wm8961_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8961_snd_controls),
+                .dapm_widgets           = wm8961_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8961_dapm_widgets),
+                .dapm_routes            = audio_paths,
+                .num_dapm_routes        = ARRAY_SIZE(audio_paths),
+        },
 };
 
 static const struct regmap_config wm8961_regmap = {
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index f3109da24769..fd2731d171dd 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -3357,7 +3357,7 @@ static int wm8962_gpio_direction_out(struct gpio_chip *chip,
         return 0;
 }
 
-static struct gpio_chip wm8962_template_chip = {
+static const struct gpio_chip wm8962_template_chip = {
         .label                  = "wm8962",
         .owner                  = THIS_MODULE,
         .request                = wm8962_gpio_request,
@@ -3479,7 +3479,7 @@ static int wm8962_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8962 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8962 = {
         .probe =        wm8962_probe,
         .remove =       wm8962_remove,
         .set_bias_level = wm8962_set_bias_level,
@@ -3713,7 +3713,7 @@ static int wm8962_i2c_probe(struct i2c_client *i2c,
                                             ARRAY_SIZE(wm8962_dc_measure));
                 if (ret != 0)
                         dev_err(&i2c->dev,
-                                "Failed to configure for DC mesurement: %d\n",
+                                "Failed to configure for DC measurement: %d\n",
                                 ret);
         }
 
diff --git a/sound/soc/codecs/wm8971.c b/sound/soc/codecs/wm8971.c
index 2cdde32c43c6..887d31cf3945 100644
--- a/sound/soc/codecs/wm8971.c
+++ b/sound/soc/codecs/wm8971.c
@@ -649,17 +649,19 @@ static int wm8971_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8971 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8971 = {
         .probe =        wm8971_probe,
         .set_bias_level = wm8971_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8971_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8971_snd_controls),
-        .dapm_widgets = wm8971_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8971_dapm_widgets),
-        .dapm_routes = wm8971_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8971_dapm_routes),
+        .component_driver = {
+                .controls               = wm8971_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8971_snd_controls),
+                .dapm_widgets           = wm8971_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8971_dapm_widgets),
+                .dapm_routes            = wm8971_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8971_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8971_regmap = {
diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
index dc8c3b1ebb6f..d414ddd6e197 100644
--- a/sound/soc/codecs/wm8974.c
+++ b/sound/soc/codecs/wm8974.c
@@ -676,17 +676,19 @@ static int wm8974_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8974 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8974 = {
         .probe =        wm8974_probe,
         .set_bias_level = wm8974_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8974_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8974_snd_controls),
-        .dapm_widgets = wm8974_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8974_dapm_widgets),
-        .dapm_routes = wm8974_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8974_dapm_routes),
+        .component_driver = {
+                .controls               = wm8974_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8974_snd_controls),
+                .dapm_widgets           = wm8974_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8974_dapm_widgets),
+                .dapm_routes            = wm8974_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8974_dapm_routes),
+        },
 };
 
 static int wm8974_i2c_probe(struct i2c_client *i2c,
diff --git a/sound/soc/codecs/wm8978.c b/sound/soc/codecs/wm8978.c
index d36d6001fbb7..90b2d418ef60 100644
--- a/sound/soc/codecs/wm8978.c
+++ b/sound/soc/codecs/wm8978.c
@@ -993,18 +993,20 @@ static int wm8978_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8978 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8978 = {
         .probe =        wm8978_probe,
         .suspend =      wm8978_suspend,
         .resume =       wm8978_resume,
         .set_bias_level = wm8978_set_bias_level,
 
-        .controls = wm8978_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8978_snd_controls),
-        .dapm_widgets = wm8978_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8978_dapm_widgets),
-        .dapm_routes = wm8978_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8978_dapm_routes),
+        .component_driver = {
+                .controls               = wm8978_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8978_snd_controls),
+                .dapm_widgets           = wm8978_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8978_dapm_widgets),
+                .dapm_routes            = wm8978_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8978_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8978_regmap_config = {
diff --git a/sound/soc/codecs/wm8983.c b/sound/soc/codecs/wm8983.c
index 0c002a5712cb..bfdbe72ee687 100644
--- a/sound/soc/codecs/wm8983.c
+++ b/sound/soc/codecs/wm8983.c
@@ -976,16 +976,18 @@ static struct snd_soc_dai_driver wm8983_dai = {
         .symmetric_rates = 1
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8983 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8983 = {
         .probe = wm8983_probe,
         .set_bias_level = wm8983_set_bias_level,
         .suspend_bias_off = true,
-        .controls = wm8983_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8983_snd_controls),
-        .dapm_widgets = wm8983_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8983_dapm_widgets),
-        .dapm_routes = wm8983_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(wm8983_audio_map),
+        .component_driver = {
+                .controls               = wm8983_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8983_snd_controls),
+                .dapm_widgets           = wm8983_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8983_dapm_widgets),
+                .dapm_routes            = wm8983_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(wm8983_audio_map),
+        },
 };
 
 static const struct regmap_config wm8983_regmap = {
diff --git a/sound/soc/codecs/wm8985.c b/sound/soc/codecs/wm8985.c
index 7347abff4b2c..05344f974ff3 100644
--- a/sound/soc/codecs/wm8985.c
+++ b/sound/soc/codecs/wm8985.c
@@ -1105,17 +1105,19 @@ static struct snd_soc_dai_driver wm8985_dai = {
         .symmetric_rates = 1
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8985 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8985 = {
         .probe = wm8985_probe,
         .set_bias_level = wm8985_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8985_common_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8985_common_snd_controls),
-        .dapm_widgets = wm8985_common_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8985_common_dapm_widgets),
-        .dapm_routes = wm8985_common_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8985_common_dapm_routes),
+        .component_driver = {
+                .controls               = wm8985_common_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8985_common_snd_controls),
+                .dapm_widgets           = wm8985_common_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8985_common_dapm_widgets),
+                .dapm_routes            = wm8985_common_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8985_common_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8985_regmap = {
diff --git a/sound/soc/codecs/wm8988.c b/sound/soc/codecs/wm8988.c
index 895721a256f0..b0d0219532f2 100644
--- a/sound/soc/codecs/wm8988.c
+++ b/sound/soc/codecs/wm8988.c
@@ -817,12 +817,14 @@ static const struct snd_soc_codec_driver soc_codec_dev_wm8988 = {
         .set_bias_level = wm8988_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8988_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8988_snd_controls),
-        .dapm_widgets = wm8988_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8988_dapm_widgets),
-        .dapm_routes = wm8988_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8988_dapm_routes),
+        .component_driver = {
+                .controls               = wm8988_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8988_snd_controls),
+                .dapm_widgets           = wm8988_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8988_dapm_widgets),
+                .dapm_routes            = wm8988_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8988_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8988_regmap = {
diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
index 23ecd30d8bca..a8945001e696 100644
--- a/sound/soc/codecs/wm8990.c
+++ b/sound/soc/codecs/wm8990.c
@@ -1294,17 +1294,19 @@ static int wm8990_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8990 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8990 = {
         .probe =        wm8990_probe,
         .set_bias_level = wm8990_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls =     wm8990_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8990_snd_controls),
-        .dapm_widgets = wm8990_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8990_dapm_widgets),
-        .dapm_routes =  wm8990_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8990_dapm_routes),
+        .component_driver = {
+                .controls               = wm8990_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8990_snd_controls),
+                .dapm_widgets           = wm8990_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8990_dapm_widgets),
+                .dapm_routes            = wm8990_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8990_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8990_regmap = {
diff --git a/sound/soc/codecs/wm8991.c b/sound/soc/codecs/wm8991.c
index c9ee0ac6a654..802c0694e5c3 100644
--- a/sound/soc/codecs/wm8991.c
+++ b/sound/soc/codecs/wm8991.c
@@ -111,14 +111,24 @@ static bool wm8991_volatile(struct device *dev, unsigned int reg)
         }
 }
 
-static const DECLARE_TLV_DB_LINEAR(rec_mix_tlv, -1500, 600);
-static const DECLARE_TLV_DB_LINEAR(in_pga_tlv, -1650, 3000);
-static const DECLARE_TLV_DB_LINEAR(out_mix_tlv, 0, -2100);
-static const DECLARE_TLV_DB_LINEAR(out_pga_tlv, -7300, 600);
-static const DECLARE_TLV_DB_LINEAR(out_omix_tlv, -600, 0);
-static const DECLARE_TLV_DB_LINEAR(out_dac_tlv, -7163, 0);
-static const DECLARE_TLV_DB_LINEAR(in_adc_tlv, -7163, 1763);
-static const DECLARE_TLV_DB_LINEAR(out_sidetone_tlv, -3600, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(in_pga_tlv, -1650, 150, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(out_mix_tlv, -2100, 300, 0);
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(out_pga_tlv,
+        0x00, 0x2f, SNDRV_CTL_TLVD_DB_SCALE_ITEM(SNDRV_CTL_TLVD_DB_GAIN_MUTE, 0, 1),
+        0x30, 0x7f, SNDRV_CTL_TLVD_DB_SCALE_ITEM(-7300, 100, 0),
+);
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(out_dac_tlv,
+        0x00, 0xbf, SNDRV_CTL_TLVD_DB_SCALE_ITEM(-71625, 375, 1),
+        0xc0, 0xff, SNDRV_CTL_TLVD_DB_SCALE_ITEM(0, 0, 0),
+);
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(in_adc_tlv,
+        0x00, 0xef, SNDRV_CTL_TLVD_DB_SCALE_ITEM(-71625, 375, 1),
+        0xf0, 0xff, SNDRV_CTL_TLVD_DB_SCALE_ITEM(17625, 0, 0),
+);
+static const SNDRV_CTL_TLVD_DECLARE_DB_RANGE(out_sidetone_tlv,
+        0x00, 0x0c, SNDRV_CTL_TLVD_DB_SCALE_ITEM(-3600, 300, 0),
+        0x0d, 0x0f, SNDRV_CTL_TLVD_DB_SCALE_ITEM(0, 0, 0),
+);
 
 static int wm899x_outpga_put_volsw_vu(struct snd_kcontrol *kcontrol,
                                       struct snd_ctl_elem_value *ucontrol)
@@ -398,7 +408,7 @@ static int outmixer_event(struct snd_soc_dapm_widget *w,
 }
 
 /* INMIX dB values */
-static const DECLARE_TLV_DB_LINEAR(in_mix_tlv, -1200, 600);
+static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(in_mix_tlv, -1200, 300, 1);
 
 /* Left In PGA Connections */
 static const struct snd_kcontrol_new wm8991_dapm_lin12_pga_controls[] = {
@@ -1232,16 +1242,18 @@ static struct snd_soc_dai_driver wm8991_dai = {
         .ops = &wm8991_ops
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8991 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8991 = {
         .set_bias_level = wm8991_set_bias_level,
         .suspend_bias_off = true,
 
-        .controls = wm8991_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8991_snd_controls),
-        .dapm_widgets = wm8991_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8991_dapm_widgets),
-        .dapm_routes = wm8991_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8991_dapm_routes),
+        .component_driver = {
+                .controls               = wm8991_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8991_snd_controls),
+                .dapm_widgets           = wm8991_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8991_dapm_widgets),
+                .dapm_routes            = wm8991_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8991_dapm_routes),
+        },
 };
 
 static const struct regmap_config wm8991_regmap = {
diff --git a/sound/soc/codecs/wm8993.c b/sound/soc/codecs/wm8993.c
index 8668c4c391b0..195f7bf6eb22 100644
--- a/sound/soc/codecs/wm8993.c
+++ b/sound/soc/codecs/wm8993.c
@@ -1613,7 +1613,7 @@ static const struct regmap_config wm8993_regmap = {
         .num_reg_defaults = ARRAY_SIZE(wm8993_reg_defaults),
 };
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8993 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8993 = {
         .probe =        wm8993_probe,
         .suspend =      wm8993_suspend,
         .resume =       wm8993_resume,
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index a18aecb49935..3896523b71e9 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -4439,7 +4439,7 @@ static struct regmap *wm8994_get_regmap(struct device *dev)
         return control->regmap;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8994 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8994 = {
         .probe =        wm8994_codec_probe,
         .remove =       wm8994_codec_remove,
         .suspend =      wm8994_codec_suspend,
diff --git a/sound/soc/codecs/wm8995.c b/sound/soc/codecs/wm8995.c
index 24500bafb0a8..19b08a5cae62 100644
--- a/sound/soc/codecs/wm8995.c
+++ b/sound/soc/codecs/wm8995.c
@@ -2192,12 +2192,14 @@ static const struct snd_soc_codec_driver soc_codec_dev_wm8995 = {
         .set_bias_level = wm8995_set_bias_level,
         .idle_bias_off = true,
 
-        .controls = wm8995_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8995_snd_controls),
-        .dapm_widgets = wm8995_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8995_dapm_widgets),
-        .dapm_routes = wm8995_intercon,
-        .num_dapm_routes = ARRAY_SIZE(wm8995_intercon),
+        .component_driver = {
+                .controls               = wm8995_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8995_snd_controls),
+                .dapm_widgets           = wm8995_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8995_dapm_widgets),
+                .dapm_routes            = wm8995_intercon,
+                .num_dapm_routes        = ARRAY_SIZE(wm8995_intercon),
+        },
 };
 
 static const struct regmap_config wm8995_regmap = {
diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
index a73044251218..8affa4969120 100644
--- a/sound/soc/codecs/wm8996.c
+++ b/sound/soc/codecs/wm8996.c
@@ -2184,7 +2184,7 @@ static int wm8996_gpio_direction_in(struct gpio_chip *chip, unsigned offset)
                                   (1 << WM8996_GP1_DIR_SHIFT));
 }
 
-static struct gpio_chip wm8996_template_chip = {
+static const struct gpio_chip wm8996_template_chip = {
         .label                  = "wm8996",
         .owner                  = THIS_MODULE,
         .direction_output       = wm8996_gpio_direction_out,
@@ -2684,18 +2684,20 @@ static int wm8996_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8996 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8996 = {
         .probe =        wm8996_probe,
         .remove =       wm8996_remove,
         .set_bias_level = wm8996_set_bias_level,
         .idle_bias_off  = true,
         .seq_notifier = wm8996_seq_notifier,
-        .controls = wm8996_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8996_snd_controls),
-        .dapm_widgets = wm8996_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8996_dapm_widgets),
-        .dapm_routes = wm8996_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8996_dapm_routes),
+        .component_driver = {
+                .controls               = wm8996_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8996_snd_controls),
+                .dapm_widgets           = wm8996_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8996_dapm_widgets),
+                .dapm_routes            = wm8996_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8996_dapm_routes),
+        },
         .set_pll = wm8996_set_fll,
 };
 
diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
index 6b0785b5a5c5..2f2821b3382f 100644
--- a/sound/soc/codecs/wm8997.c
+++ b/sound/soc/codecs/wm8997.c
@@ -1095,7 +1095,7 @@ static struct regmap *wm8997_get_regmap(struct device *dev)
         return priv->core.arizona->regmap;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8997 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8997 = {
         .probe = wm8997_codec_probe,
         .remove = wm8997_codec_remove,
         .get_regmap =   wm8997_get_regmap,
@@ -1105,12 +1105,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm8997 = {
         .set_sysclk = arizona_set_sysclk,
         .set_pll = wm8997_set_fll,
 
-        .controls = wm8997_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8997_snd_controls),
-        .dapm_widgets = wm8997_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8997_dapm_widgets),
-        .dapm_routes = wm8997_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8997_dapm_routes),
+        .component_driver = {
+                .controls               = wm8997_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8997_snd_controls),
+                .dapm_widgets           = wm8997_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8997_dapm_widgets),
+                .dapm_routes            = wm8997_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8997_dapm_routes),
+        },
 };
 
 static int wm8997_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c
index 3a5c896a2d13..bcc2e1060a6c 100644
--- a/sound/soc/codecs/wm8998.c
+++ b/sound/soc/codecs/wm8998.c
@@ -966,6 +966,16 @@ static const struct snd_soc_dapm_route wm8998_dapm_routes[] = {
         { "IN2A", NULL, "SYSCLK" },
         { "IN2B", NULL, "SYSCLK" },
 
+        { "ASRC1L", NULL, "SYSCLK" },
+        { "ASRC1R", NULL, "SYSCLK" },
+        { "ASRC2L", NULL, "SYSCLK" },
+        { "ASRC2R", NULL, "SYSCLK" },
+
+        { "ASRC1L", NULL, "ASYNCCLK" },
+        { "ASRC1R", NULL, "ASYNCCLK" },
+        { "ASRC2L", NULL, "ASYNCCLK" },
+        { "ASRC2R", NULL, "ASYNCCLK" },
+
         { "SPD1", NULL, "SYSCLK" },
         { "SPD1", NULL, "SPD1TX1" },
         { "SPD1", NULL, "SPD1TX2" },
@@ -1351,7 +1361,7 @@ static struct regmap *wm8998_get_regmap(struct device *dev)
         return priv->core.arizona->regmap;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm8998 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm8998 = {
         .probe = wm8998_codec_probe,
         .remove = wm8998_codec_remove,
         .get_regmap = wm8998_get_regmap,
@@ -1361,12 +1371,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm8998 = {
         .set_sysclk = arizona_set_sysclk,
         .set_pll = wm8998_set_fll,
 
-        .controls = wm8998_snd_controls,
-        .num_controls = ARRAY_SIZE(wm8998_snd_controls),
-        .dapm_widgets = wm8998_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm8998_dapm_widgets),
-        .dapm_routes = wm8998_dapm_routes,
-        .num_dapm_routes = ARRAY_SIZE(wm8998_dapm_routes),
+        .component_driver = {
+                .controls               = wm8998_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm8998_snd_controls),
+                .dapm_widgets           = wm8998_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm8998_dapm_widgets),
+                .dapm_routes            = wm8998_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(wm8998_dapm_routes),
+        },
 };
 
 static int wm8998_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm9081.c b/sound/soc/codecs/wm9081.c
index 363b3b667616..856867ec2813 100644
--- a/sound/soc/codecs/wm9081.c
+++ b/sound/soc/codecs/wm9081.c
@@ -1274,7 +1274,7 @@ static int wm9081_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm9081 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm9081 = {
         .probe =        wm9081_probe,
 
         .set_sysclk = wm9081_set_sysclk,
@@ -1282,12 +1282,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm9081 = {
 
         .idle_bias_off = true,
 
-        .controls         = wm9081_snd_controls,
-        .num_controls     = ARRAY_SIZE(wm9081_snd_controls),
-        .dapm_widgets     = wm9081_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm9081_dapm_widgets),
-        .dapm_routes     = wm9081_audio_paths,
-        .num_dapm_routes = ARRAY_SIZE(wm9081_audio_paths),
+        .component_driver = {
+                .controls               = wm9081_snd_controls,
+                .num_controls           = ARRAY_SIZE(wm9081_snd_controls),
+                .dapm_widgets           = wm9081_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm9081_dapm_widgets),
+                .dapm_routes            = wm9081_audio_paths,
+                .num_dapm_routes        = ARRAY_SIZE(wm9081_audio_paths),
+        },
 };
 
 static const struct regmap_config wm9081_regmap = {
diff --git a/sound/soc/codecs/wm9090.c b/sound/soc/codecs/wm9090.c
index 5d737290f547..5a131385cb2f 100644
--- a/sound/soc/codecs/wm9090.c
+++ b/sound/soc/codecs/wm9090.c
@@ -550,7 +550,7 @@ static int wm9090_probe(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm9090 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm9090 = {
         .probe =        wm9090_probe,
         .set_bias_level = wm9090_set_bias_level,
         .suspend_bias_off = true,
diff --git a/sound/soc/codecs/wm9705.c b/sound/soc/codecs/wm9705.c
index 744842c76a60..dcdd055db57b 100644
--- a/sound/soc/codecs/wm9705.c
+++ b/sound/soc/codecs/wm9705.c
@@ -352,7 +352,7 @@ static int wm9705_soc_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm9705 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm9705 = {
         .probe =        wm9705_soc_probe,
         .remove =       wm9705_soc_remove,
         .suspend =      wm9705_soc_suspend,
@@ -364,12 +364,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm9705 = {
         .reg_cache_step = 2,
         .reg_cache_default = wm9705_reg,
 
-        .controls = wm9705_snd_ac97_controls,
-        .num_controls = ARRAY_SIZE(wm9705_snd_ac97_controls),
-        .dapm_widgets = wm9705_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm9705_dapm_widgets),
-        .dapm_routes = wm9705_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(wm9705_audio_map),
+        .component_driver = {
+                .controls               = wm9705_snd_ac97_controls,
+                .num_controls           = ARRAY_SIZE(wm9705_snd_ac97_controls),
+                .dapm_widgets           = wm9705_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm9705_dapm_widgets),
+                .dapm_routes            = wm9705_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(wm9705_audio_map),
+        },
 };
 
 static int wm9705_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
index 488a92224249..557709eac698 100644
--- a/sound/soc/codecs/wm9712.c
+++ b/sound/soc/codecs/wm9712.c
@@ -669,7 +669,7 @@ static int wm9712_soc_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm9712 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm9712 = {
         .probe =        wm9712_soc_probe,
         .remove =       wm9712_soc_remove,
         .resume =       wm9712_soc_resume,
@@ -682,12 +682,14 @@ static struct snd_soc_codec_driver soc_codec_dev_wm9712 = {
         .reg_cache_step = 2,
         .reg_cache_default = wm9712_reg,
 
-        .controls = wm9712_snd_ac97_controls,
-        .num_controls = ARRAY_SIZE(wm9712_snd_ac97_controls),
-        .dapm_widgets = wm9712_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm9712_dapm_widgets),
-        .dapm_routes = wm9712_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(wm9712_audio_map),
+        .component_driver = {
+                .controls               = wm9712_snd_ac97_controls,
+                .num_controls           = ARRAY_SIZE(wm9712_snd_ac97_controls),
+                .dapm_widgets           = wm9712_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm9712_dapm_widgets),
+                .dapm_routes            = wm9712_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(wm9712_audio_map),
+        },
 };
 
 static int wm9712_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
index 9849643ef809..e4301ddb1b84 100644
--- a/sound/soc/codecs/wm9713.c
+++ b/sound/soc/codecs/wm9713.c
@@ -1235,19 +1235,21 @@ static int wm9713_soc_remove(struct snd_soc_codec *codec)
         return 0;
 }
 
-static struct snd_soc_codec_driver soc_codec_dev_wm9713 = {
+static const struct snd_soc_codec_driver soc_codec_dev_wm9713 = {
         .probe =        wm9713_soc_probe,
         .remove =       wm9713_soc_remove,
         .suspend =      wm9713_soc_suspend,
         .resume =       wm9713_soc_resume,
         .set_bias_level = wm9713_set_bias_level,
 
-        .controls = wm9713_snd_ac97_controls,
-        .num_controls = ARRAY_SIZE(wm9713_snd_ac97_controls),
-        .dapm_widgets = wm9713_dapm_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(wm9713_dapm_widgets),
-        .dapm_routes = wm9713_audio_map,
-        .num_dapm_routes = ARRAY_SIZE(wm9713_audio_map),
+        .component_driver = {
+                .controls               = wm9713_snd_ac97_controls,
+                .num_controls           = ARRAY_SIZE(wm9713_snd_ac97_controls),
+                .dapm_widgets           = wm9713_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(wm9713_dapm_widgets),
+                .dapm_routes            = wm9713_audio_map,
+                .num_dapm_routes        = ARRAY_SIZE(wm9713_audio_map),
+        },
 };
 
 static int wm9713_probe(struct platform_device *pdev)
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 21fbe7d07063..b943dde8dbe5 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -480,7 +480,7 @@ static ssize_t wm_adsp_debugfs_wmfw_read(struct file *file,
 
         mutex_lock(&dsp->pwr_lock);
 
-        if (!dsp->wmfw_file_name || !dsp->running)
+        if (!dsp->wmfw_file_name || !dsp->booted)
                 ret = 0;
         else
                 ret = simple_read_from_buffer(user_buf, count, ppos,
@@ -500,7 +500,7 @@ static ssize_t wm_adsp_debugfs_bin_read(struct file *file,
 
         mutex_lock(&dsp->pwr_lock);
 
-        if (!dsp->bin_file_name || !dsp->running)
+        if (!dsp->bin_file_name || !dsp->booted)
                 ret = 0;
         else
                 ret = simple_read_from_buffer(user_buf, count, ppos,
@@ -554,6 +554,9 @@ static void wm_adsp2_init_debugfs(struct wm_adsp *dsp,
         if (!root)
                 goto err;
 
+        if (!debugfs_create_bool("booted", S_IRUGO, root, &dsp->booted))
+                goto err;
+
         if (!debugfs_create_bool("running", S_IRUGO, root, &dsp->running))
                 goto err;
 
@@ -637,7 +640,7 @@ static int wm_adsp_fw_put(struct snd_kcontrol *kcontrol,
 
         mutex_lock(&dsp[e->shift_l].pwr_lock);
 
-        if (dsp[e->shift_l].running || dsp[e->shift_l].compr)
+        if (dsp[e->shift_l].booted || dsp[e->shift_l].compr)
                 ret = -EBUSY;
         else
                 dsp[e->shift_l].fw = ucontrol->value.enumerated.item[0];
@@ -789,7 +792,7 @@ static int wm_coeff_put(struct snd_kcontrol *kctl,
         memcpy(ctl->cache, p, ctl->len);
 
         ctl->set = 1;
-        if (ctl->enabled)
+        if (ctl->enabled && ctl->dsp->running)
                 ret = wm_coeff_write_control(ctl, p, ctl->len);
 
         mutex_unlock(&ctl->dsp->pwr_lock);
@@ -811,7 +814,7 @@ static int wm_coeff_tlv_put(struct snd_kcontrol *kctl,
                 ret = -EFAULT;
         } else {
                 ctl->set = 1;
-                if (ctl->enabled)
+                if (ctl->enabled && ctl->dsp->running)
                         ret = wm_coeff_write_control(ctl, ctl->cache, size);
         }
 
@@ -871,12 +874,12 @@ static int wm_coeff_get(struct snd_kcontrol *kctl,
         mutex_lock(&ctl->dsp->pwr_lock);
 
         if (ctl->flags & WMFW_CTL_FLAG_VOLATILE) {
-                if (ctl->enabled)
+                if (ctl->enabled && ctl->dsp->running)
                         ret = wm_coeff_read_control(ctl, p, ctl->len);
                 else
                         ret = -EPERM;
         } else {
-                if (!ctl->flags && ctl->enabled)
+                if (!ctl->flags && ctl->enabled && ctl->dsp->running)
                         ret = wm_coeff_read_control(ctl, ctl->cache, ctl->len);
 
                 memcpy(p, ctl->cache, ctl->len);
@@ -898,12 +901,12 @@ static int wm_coeff_tlv_get(struct snd_kcontrol *kctl,
         mutex_lock(&ctl->dsp->pwr_lock);
 
         if (ctl->flags & WMFW_CTL_FLAG_VOLATILE) {
-                if (ctl->enabled)
+                if (ctl->enabled && ctl->dsp->running)
                         ret = wm_coeff_read_control(ctl, ctl->cache, size);
                 else
                         ret = -EPERM;
         } else {
-                if (!ctl->flags && ctl->enabled)
+                if (!ctl->flags && ctl->enabled && ctl->dsp->running)
                         ret = wm_coeff_read_control(ctl, ctl->cache, size);
         }
 
@@ -2166,13 +2169,20 @@ int wm_adsp1_event(struct snd_soc_dapm_widget *w,
                 if (ret != 0)
                         goto err_ena;
 
+                dsp->booted = true;
+
                 /* Start the core running */
                 regmap_update_bits(dsp->regmap, dsp->base + ADSP1_CONTROL_30,
                                    ADSP1_CORE_ENA | ADSP1_START,
                                    ADSP1_CORE_ENA | ADSP1_START);
+
+                dsp->running = true;
                 break;
 
         case SND_SOC_DAPM_PRE_PMD:
+                dsp->running = false;
+                dsp->booted = false;
+
                 /* Halt the core */
                 regmap_update_bits(dsp->regmap, dsp->base + ADSP1_CONTROL_30,
                                    ADSP1_CORE_ENA | ADSP1_START, 0);
@@ -2227,7 +2237,7 @@ static int wm_adsp2_ena(struct wm_adsp *dsp)
                 if (val & ADSP2_RAM_RDY)
                         break;
 
-                msleep(1);
+                usleep_range(250, 500);
         }
 
         if (!(val & ADSP2_RAM_RDY)) {
@@ -2249,6 +2259,11 @@ static void wm_adsp2_boot_work(struct work_struct *work)
 
         mutex_lock(&dsp->pwr_lock);
 
+        ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                                 ADSP2_MEM_ENA, ADSP2_MEM_ENA);
+        if (ret != 0)
+                goto err_mutex;
+
         ret = wm_adsp2_ena(dsp);
         if (ret != 0)
                 goto err_mutex;
@@ -2270,13 +2285,14 @@ static void wm_adsp2_boot_work(struct work_struct *work)
         if (ret != 0)
                 goto err_ena;
 
-        /* Sync set controls */
-        ret = wm_coeff_sync_controls(dsp);
+        dsp->booted = true;
+
+        /* Turn DSP back off until we are ready to run */
+        ret = regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                                 ADSP2_SYS_ENA, 0);
         if (ret != 0)
                 goto err_ena;
 
-        dsp->running = true;
-
         mutex_unlock(&dsp->pwr_lock);
 
         return;
@@ -2307,6 +2323,7 @@ int wm_adsp2_early_event(struct snd_soc_dapm_widget *w,
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
         struct wm_adsp *dsps = snd_soc_codec_get_drvdata(codec);
         struct wm_adsp *dsp = &dsps[w->shift];
+        struct wm_coeff_ctl *ctl;
 
         dsp->card = codec->component.card;
 
@@ -2315,6 +2332,24 @@ int wm_adsp2_early_event(struct snd_soc_dapm_widget *w,
                 wm_adsp2_set_dspclk(dsp, freq);
                 queue_work(system_unbound_wq, &dsp->boot_work);
                 break;
+        case SND_SOC_DAPM_PRE_PMD:
+                wm_adsp_debugfs_clear(dsp);
+
+                dsp->fw_id = 0;
+                dsp->fw_id_version = 0;
+
+                dsp->booted = false;
+
+                regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
+                                   ADSP2_MEM_ENA, 0);
+
+                list_for_each_entry(ctl, &dsp->ctl_list, list)
+                        ctl->enabled = 0;
+
+                wm_adsp_free_alg_regions(dsp);
+
+                adsp_dbg(dsp, "Shutdown complete\n");
+                break;
         default:
                 break;
         }
@@ -2329,16 +2364,24 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
         struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm);
         struct wm_adsp *dsps = snd_soc_codec_get_drvdata(codec);
         struct wm_adsp *dsp = &dsps[w->shift];
-        struct wm_coeff_ctl *ctl;
         int ret;
 
         switch (event) {
         case SND_SOC_DAPM_POST_PMU:
                 flush_work(&dsp->boot_work);
 
-                if (!dsp->running)
+                if (!dsp->booted)
                         return -EIO;
 
+                ret = wm_adsp2_ena(dsp);
+                if (ret != 0)
+                        goto err;
+
+                /* Sync set controls */
+                ret = wm_coeff_sync_controls(dsp);
+                if (ret != 0)
+                        goto err;
+
                 ret = regmap_update_bits(dsp->regmap,
                                          dsp->base + ADSP2_CONTROL,
                                          ADSP2_CORE_ENA | ADSP2_START,
@@ -2346,6 +2389,8 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 if (ret != 0)
                         goto err;
 
+                dsp->running = true;
+
                 mutex_lock(&dsp->pwr_lock);
 
                 if (wm_adsp_fw[dsp->fw].num_caps != 0)
@@ -2361,10 +2406,6 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
 
                 mutex_lock(&dsp->pwr_lock);
 
-                wm_adsp_debugfs_clear(dsp);
-
-                dsp->fw_id = 0;
-                dsp->fw_id_version = 0;
                 dsp->running = false;
 
                 regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
@@ -2378,17 +2419,12 @@ int wm_adsp2_event(struct snd_soc_dapm_widget *w,
                 regmap_update_bits(dsp->regmap, dsp->base + ADSP2_CONTROL,
                                    ADSP2_SYS_ENA, 0);
 
-                list_for_each_entry(ctl, &dsp->ctl_list, list)
-                        ctl->enabled = 0;
-
-                wm_adsp_free_alg_regions(dsp);
-
                 if (wm_adsp_fw[dsp->fw].num_caps != 0)
                         wm_adsp_buffer_free(dsp);
 
                 mutex_unlock(&dsp->pwr_lock);
 
-                adsp_dbg(dsp, "Shutdown complete\n");
+                adsp_dbg(dsp, "Execution stopped\n");
                 break;
 
         default:
diff --git a/sound/soc/codecs/wm_adsp.h b/sound/soc/codecs/wm_adsp.h
index be3b5bcb7f17..362dd7ce60d8 100644
--- a/sound/soc/codecs/wm_adsp.h
+++ b/sound/soc/codecs/wm_adsp.h
@@ -61,6 +61,8 @@ struct wm_adsp {
 
         int fw;
         int fw_ver;
+
+        bool booted;
         bool running;
 
         struct list_head ctl_list;
@@ -85,9 +87,10 @@ struct wm_adsp {
                 wm_adsp1_event, SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD)
 
 #define WM_ADSP2(wname, num, event_fn) \
-{       .id = snd_soc_dapm_dai_link, .name = wname " Preloader", \
+{       .id = snd_soc_dapm_supply, .name = wname " Preloader", \
         .reg = SND_SOC_NOPM, .shift = num, .event = event_fn, \
-        .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD }, \
+        .event_flags = SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD, \
+        .subseq = 100, /* Ensure we run after SYSCLK supply widget */ }, \
 {       .id = snd_soc_dapm_out_drv, .name = wname, \
         .reg = SND_SOC_NOPM, .shift = num, .event = wm_adsp2_event, \
         .event_flags = SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD }
diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
index 05c2d33aa74d..3c5a9804d3f5 100644
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -1218,7 +1218,7 @@ static int davinci_mcasp_hw_rule_format(struct snd_pcm_hw_params *params,
 
         snd_mask_none(&nfmt);
 
-        for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) {
+        for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
                 if (snd_mask_test(fmt, i)) {
                         uint sbits = snd_pcm_format_width(i);
                         int ppm;
diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c
index dc97f4349e66..2998954a1c74 100644
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/designware_i2s.c
@@ -577,7 +577,6 @@ static int dw_configure_dai_by_dt(struct dw_i2s_dev *dev,
                 dev->capability |= DWC_I2S_PLAY;
                 dev->play_dma_data.dt.addr = res->start + I2S_TXDMA;
                 dev->play_dma_data.dt.addr_width = bus_widths[idx];
-                dev->play_dma_data.dt.chan_name = "TX";
                 dev->play_dma_data.dt.fifo_size = fifo_depth *
                         (fifo_width[idx2]) >> 8;
                 dev->play_dma_data.dt.maxburst = 16;
@@ -588,7 +587,6 @@ static int dw_configure_dai_by_dt(struct dw_i2s_dev *dev,
                 dev->capability |= DWC_I2S_RECORD;
                 dev->capture_dma_data.dt.addr = res->start + I2S_RXDMA;
                 dev->capture_dma_data.dt.addr_width = bus_widths[idx];
-                dev->capture_dma_data.dt.chan_name = "RX";
                 dev->capture_dma_data.dt.fifo_size = fifo_depth *
                         (fifo_width[idx2] >> 8);
                 dev->capture_dma_data.dt.maxburst = 16;
diff --git a/sound/soc/fsl/fsl_asrc.c b/sound/soc/fsl/fsl_asrc.c
index c1a0e01cb8e7..1d82f68305c3 100644
--- a/sound/soc/fsl/fsl_asrc.c
+++ b/sound/soc/fsl/fsl_asrc.c
@@ -726,7 +726,7 @@ static const struct regmap_config fsl_asrc_regmap_config = {
         .readable_reg = fsl_asrc_readable_reg,
         .volatile_reg = fsl_asrc_volatile_reg,
         .writeable_reg = fsl_asrc_writeable_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 
 /**
@@ -879,7 +879,7 @@ static int fsl_asrc_probe(struct platform_device *pdev)
                 }
         }
 
-        if (of_device_is_compatible(pdev->dev.of_node, "fsl,imx35-asrc")) {
+        if (of_device_is_compatible(np, "fsl,imx35-asrc")) {
                 asrc_priv->channel_bits = 3;
                 clk_map[IN] = input_clk_map_imx35;
                 clk_map[OUT] = output_clk_map_imx35;
@@ -892,7 +892,7 @@ static int fsl_asrc_probe(struct platform_device *pdev)
         ret = fsl_asrc_init(asrc_priv);
         if (ret) {
                 dev_err(&pdev->dev, "failed to init asrc %d\n", ret);
-                return -EINVAL;
+                return ret;
         }
 
         asrc_priv->channel_avail = 10;
@@ -901,14 +901,14 @@ static int fsl_asrc_probe(struct platform_device *pdev)
                                    &asrc_priv->asrc_rate);
         if (ret) {
                 dev_err(&pdev->dev, "failed to get output rate\n");
-                return -EINVAL;
+                return ret;
         }
 
         ret = of_property_read_u32(np, "fsl,asrc-width",
                                    &asrc_priv->asrc_width);
         if (ret) {
                 dev_err(&pdev->dev, "failed to get output width\n");
-                return -EINVAL;
+                return ret;
         }
 
         if (asrc_priv->asrc_width != 16 && asrc_priv->asrc_width != 24) {
@@ -933,8 +933,6 @@ static int fsl_asrc_probe(struct platform_device *pdev)
                 return ret;
         }
 
-        dev_info(&pdev->dev, "driver registered\n");
-
         return 0;
 }
 
diff --git a/sound/soc/fsl/fsl_asrc_dma.c b/sound/soc/fsl/fsl_asrc_dma.c
index ffc000bc1f15..dc30d780f874 100644
--- a/sound/soc/fsl/fsl_asrc_dma.c
+++ b/sound/soc/fsl/fsl_asrc_dma.c
@@ -322,7 +322,7 @@ static snd_pcm_uframes_t fsl_asrc_dma_pcm_pointer(struct snd_pcm_substream *subs
         return bytes_to_frames(substream->runtime, pair->pos);
 }
 
-static struct snd_pcm_ops fsl_asrc_dma_pcm_ops = {
+static const struct snd_pcm_ops fsl_asrc_dma_pcm_ops = {
         .ioctl          = snd_pcm_lib_ioctl,
         .hw_params      = fsl_asrc_dma_hw_params,
         .hw_free        = fsl_asrc_dma_hw_free,
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 26a90e12ede4..38bfd46f4ad8 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -77,19 +77,19 @@ static irqreturn_t esai_isr(int irq, void *devid)
         regmap_read(esai_priv->regmap, REG_ESAI_ESR, &esr);
 
         if (esr & ESAI_ESR_TINIT_MASK)
-                dev_dbg(&pdev->dev, "isr: Transmition Initialized\n");
+                dev_dbg(&pdev->dev, "isr: Transmission Initialized\n");
 
         if (esr & ESAI_ESR_RFF_MASK)
                 dev_warn(&pdev->dev, "isr: Receiving overrun\n");
 
         if (esr & ESAI_ESR_TFE_MASK)
-                dev_warn(&pdev->dev, "isr: Transmition underrun\n");
+                dev_warn(&pdev->dev, "isr: Transmission underrun\n");
 
         if (esr & ESAI_ESR_TLS_MASK)
                 dev_dbg(&pdev->dev, "isr: Just transmitted the last slot\n");
 
         if (esr & ESAI_ESR_TDE_MASK)
-                dev_dbg(&pdev->dev, "isr: Transmition data exception\n");
+                dev_dbg(&pdev->dev, "isr: Transmission data exception\n");
 
         if (esr & ESAI_ESR_TED_MASK)
                 dev_dbg(&pdev->dev, "isr: Transmitting even slots\n");
@@ -781,7 +781,7 @@ static const struct regmap_config fsl_esai_regmap_config = {
         .readable_reg = fsl_esai_readable_reg,
         .volatile_reg = fsl_esai_volatile_reg,
         .writeable_reg = fsl_esai_writeable_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 
 static int fsl_esai_probe(struct platform_device *pdev)
diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
index 2147994ab46f..9fadf7e31c5f 100644
--- a/sound/soc/fsl/fsl_sai.c
+++ b/sound/soc/fsl/fsl_sai.c
@@ -801,8 +801,8 @@ static int fsl_sai_probe(struct platform_device *pdev)
 
         sai->pdev = pdev;
 
-        if (of_device_is_compatible(pdev->dev.of_node, "fsl,imx6sx-sai") ||
-            of_device_is_compatible(pdev->dev.of_node, "fsl,imx6ul-sai"))
+        if (of_device_is_compatible(np, "fsl,imx6sx-sai") ||
+            of_device_is_compatible(np, "fsl,imx6ul-sai"))
                 sai->sai_on_imx = true;
 
         sai->is_lsb_first = of_property_read_bool(np, "lsb-first");
@@ -883,7 +883,7 @@ static int fsl_sai_probe(struct platform_device *pdev)
         }
 
         if (of_find_property(np, "fsl,sai-mclk-direction-output", NULL) &&
-            of_device_is_compatible(pdev->dev.of_node, "fsl,imx6ul-sai")) {
+            of_device_is_compatible(np, "fsl,imx6ul-sai")) {
                 gpr = syscon_regmap_lookup_by_compatible("fsl,imx6ul-iomuxc-gpr");
                 if (IS_ERR(gpr)) {
                         dev_err(&pdev->dev, "cannot find iomuxc registers\n");
diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c
index beec7934a265..1ff467c9598a 100644
--- a/sound/soc/fsl/fsl_spdif.c
+++ b/sound/soc/fsl/fsl_spdif.c
@@ -1103,7 +1103,7 @@ static const struct regmap_config fsl_spdif_regmap_config = {
         .readable_reg = fsl_spdif_readable_reg,
         .volatile_reg = fsl_spdif_volatile_reg,
         .writeable_reg = fsl_spdif_writeable_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 
 static u32 fsl_spdif_txclk_caldiv(struct fsl_spdif_priv *spdif_priv,
diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c
index bedec4a32581..50349437d961 100644
--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -182,7 +182,7 @@ static const struct regmap_config fsl_ssi_regconfig = {
         .volatile_reg = fsl_ssi_volatile_reg,
         .precious_reg = fsl_ssi_precious_reg,
         .writeable_reg = fsl_ssi_writeable_reg,
-        .cache_type = REGCACHE_RBTREE,
+        .cache_type = REGCACHE_FLAT,
 };
 
 struct fsl_ssi_soc_data {
diff --git a/sound/soc/generic/Kconfig b/sound/soc/generic/Kconfig
index c01c5dd68601..d023959b8cd6 100644
--- a/sound/soc/generic/Kconfig
+++ b/sound/soc/generic/Kconfig
@@ -6,3 +6,11 @@ config SND_SIMPLE_CARD
         select SND_SIMPLE_CARD_UTILS
         help
           This option enables generic simple sound card support
+
+config SND_SIMPLE_SCU_CARD
+        tristate "ASoC Simple SCU sound card support"
+        depends on OF
+        select SND_SIMPLE_CARD_UTILS
+        help
+          This option enables generic simple SCU sound card support.
+          It supports DPCM of multi CPU single Codec system.
diff --git a/sound/soc/generic/Makefile b/sound/soc/generic/Makefile
index 45602ca8536e..ee750f3023ba 100644
--- a/sound/soc/generic/Makefile
+++ b/sound/soc/generic/Makefile
@@ -1,5 +1,7 @@
-obj-$(CONFIG_SND_SIMPLE_CARD_UTILS) := simple-card-utils.o
-
+snd-soc-simple-card-utils-objs  := simple-card-utils.o
 snd-soc-simple-card-objs        := simple-card.o
+snd-soc-simple-scu-card-objs    := simple-scu-card.o
 
-obj-$(CONFIG_SND_SIMPLE_CARD)   += snd-soc-simple-card.o
+obj-$(CONFIG_SND_SIMPLE_CARD_UTILS)     += snd-soc-simple-card-utils.o
+obj-$(CONFIG_SND_SIMPLE_CARD)           += snd-soc-simple-card.o
+obj-$(CONFIG_SND_SIMPLE_SCU_CARD)       += snd-soc-simple-scu-card.o
diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c
index d89a9a1b2471..1cb39309f5d5 100644
--- a/sound/soc/generic/simple-card-utils.c
+++ b/sound/soc/generic/simple-card-utils.c
@@ -7,6 +7,8 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/clk.h>
+#include <linux/module.h>
 #include <linux/of.h>
 #include <sound/simple_card_utils.h>
 
@@ -95,3 +97,148 @@ int asoc_simple_card_parse_card_name(struct snd_soc_card *card,
         return 0;
 }
 EXPORT_SYMBOL_GPL(asoc_simple_card_parse_card_name);
+
+int asoc_simple_card_parse_clk(struct device_node *node,
+                               struct device_node *dai_of_node,
+                               struct asoc_simple_dai *simple_dai)
+{
+        struct clk *clk;
+        u32 val;
+
+        /*
+         * Parse dai->sysclk come from "clocks = <&xxx>"
+         * (if system has common clock)
+         *  or "system-clock-frequency = <xxx>"
+         *  or device's module clock.
+         */
+        clk = of_clk_get(node, 0);
+        if (!IS_ERR(clk)) {
+                simple_dai->sysclk = clk_get_rate(clk);
+                simple_dai->clk = clk;
+        } else if (!of_property_read_u32(node, "system-clock-frequency", &val)) {
+                simple_dai->sysclk = val;
+        } else {
+                clk = of_clk_get(dai_of_node, 0);
+                if (!IS_ERR(clk))
+                        simple_dai->sysclk = clk_get_rate(clk);
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_parse_clk);
+
+int asoc_simple_card_parse_dai(struct device_node *node,
+                                    struct device_node **dai_of_node,
+                                    const char **dai_name,
+                                    const char *list_name,
+                                    const char *cells_name,
+                                    int *is_single_link)
+{
+        struct of_phandle_args args;
+        int ret;
+
+        if (!node)
+                return 0;
+
+        /*
+         * Get node via "sound-dai = <&phandle port>"
+         * it will be used as xxx_of_node on soc_bind_dai_link()
+         */
+        ret = of_parse_phandle_with_args(node, list_name, cells_name, 0, &args);
+        if (ret)
+                return ret;
+
+        /* Get dai->name */
+        if (dai_name) {
+                ret = snd_soc_of_get_dai_name(node, dai_name);
+                if (ret < 0)
+                        return ret;
+        }
+
+        *dai_of_node = args.np;
+
+        if (is_single_link)
+                *is_single_link = !args.args_count;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_parse_dai);
+
+int asoc_simple_card_init_dai(struct snd_soc_dai *dai,
+                              struct asoc_simple_dai *simple_dai)
+{
+        int ret;
+
+        if (simple_dai->sysclk) {
+                ret = snd_soc_dai_set_sysclk(dai, 0, simple_dai->sysclk, 0);
+                if (ret && ret != -ENOTSUPP) {
+                        dev_err(dai->dev, "simple-card: set_sysclk error\n");
+                        return ret;
+                }
+        }
+
+        if (simple_dai->slots) {
+                ret = snd_soc_dai_set_tdm_slot(dai,
+                                               simple_dai->tx_slot_mask,
+                                               simple_dai->rx_slot_mask,
+                                               simple_dai->slots,
+                                               simple_dai->slot_width);
+                if (ret && ret != -ENOTSUPP) {
+                        dev_err(dai->dev, "simple-card: set_tdm_slot error\n");
+                        return ret;
+                }
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_init_dai);
+
+int asoc_simple_card_canonicalize_dailink(struct snd_soc_dai_link *dai_link)
+{
+        if (!dai_link->cpu_dai_name || !dai_link->codec_dai_name)
+                return -EINVAL;
+
+        /* Assumes platform == cpu */
+        if (!dai_link->platform_of_node)
+                dai_link->platform_of_node = dai_link->cpu_of_node;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_canonicalize_dailink);
+
+void asoc_simple_card_canonicalize_cpu(struct snd_soc_dai_link *dai_link,
+                                       int is_single_links)
+{
+        /*
+         * In soc_bind_dai_link() will check cpu name after
+         * of_node matching if dai_link has cpu_dai_name.
+         * but, it will never match if name was created by
+         * fmt_single_name() remove cpu_dai_name if cpu_args
+         * was 0. See:
+         *      fmt_single_name()
+         *      fmt_multiple_name()
+         */
+        if (is_single_links)
+                dai_link->cpu_dai_name = NULL;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_canonicalize_cpu);
+
+int asoc_simple_card_clean_reference(struct snd_soc_card *card)
+{
+        struct snd_soc_dai_link *dai_link;
+        int num_links;
+
+        for (num_links = 0, dai_link = card->dai_link;
+             num_links < card->num_links;
+             num_links++, dai_link++) {
+                of_node_put(dai_link->cpu_of_node);
+                of_node_put(dai_link->codec_of_node);
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(asoc_simple_card_clean_reference);
+
+/* Module information */
+MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
+MODULE_DESCRIPTION("ALSA SoC Simple Card Utils");
+MODULE_LICENSE("GPL v2");
diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
index 43295f024982..f608f8d23f3d 100644
--- a/sound/soc/generic/simple-card.c
+++ b/sound/soc/generic/simple-card.c
@@ -37,13 +37,15 @@ struct simple_card_data {
         unsigned int mclk_fs;
         struct asoc_simple_jack hp_jack;
         struct asoc_simple_jack mic_jack;
-        struct snd_soc_dai_link dai_link[];     /* dynamically allocated */
+        struct snd_soc_dai_link *dai_link;
 };
 
 #define simple_priv_to_dev(priv) ((priv)->snd_card.dev)
-#define simple_priv_to_link(priv, i) ((priv)->snd_card.dai_link + i)
-#define simple_priv_to_props(priv, i) ((priv)->dai_props + i)
+#define simple_priv_to_link(priv, i) ((priv)->snd_card.dai_link + (i))
+#define simple_priv_to_props(priv, i) ((priv)->dai_props + (i))
 
+#define DAI     "sound-dai"
+#define CELL    "#sound-dai-cells"
 #define PREFIX  "simple-audio-card,"
 
 #define asoc_simple_card_init_hp(card, sjack, prefix)\
@@ -112,13 +114,13 @@ static int asoc_simple_card_startup(struct snd_pcm_substream *substream)
         struct snd_soc_pcm_runtime *rtd = substream->private_data;
         struct simple_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
         struct simple_dai_props *dai_props =
-                &priv->dai_props[rtd->num];
+                simple_priv_to_props(priv, rtd->num);
         int ret;
 
         ret = clk_prepare_enable(dai_props->cpu_dai.clk);
         if (ret)
                 return ret;
-        
+
         ret = clk_prepare_enable(dai_props->codec_dai.clk);
         if (ret)
                 clk_disable_unprepare(dai_props->cpu_dai.clk);
@@ -131,7 +133,7 @@ static void asoc_simple_card_shutdown(struct snd_pcm_substream *substream)
         struct snd_soc_pcm_runtime *rtd = substream->private_data;
         struct simple_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
         struct simple_dai_props *dai_props =
-                &priv->dai_props[rtd->num];
+                simple_priv_to_props(priv, rtd->num);
 
         clk_disable_unprepare(dai_props->cpu_dai.clk);
 
@@ -145,7 +147,8 @@ static int asoc_simple_card_hw_params(struct snd_pcm_substream *substream,
         struct snd_soc_dai *codec_dai = rtd->codec_dai;
         struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
         struct simple_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
-        struct simple_dai_props *dai_props = &priv->dai_props[rtd->num];
+        struct simple_dai_props *dai_props =
+                simple_priv_to_props(priv, rtd->num);
         unsigned int mclk, mclk_fs = 0;
         int ret = 0;
 
@@ -177,51 +180,20 @@ static struct snd_soc_ops asoc_simple_card_ops = {
         .hw_params = asoc_simple_card_hw_params,
 };
 
-static int __asoc_simple_card_dai_init(struct snd_soc_dai *dai,
-                                       struct asoc_simple_dai *set)
-{
-        int ret;
-
-        if (set->sysclk) {
-                ret = snd_soc_dai_set_sysclk(dai, 0, set->sysclk, 0);
-                if (ret && ret != -ENOTSUPP) {
-                        dev_err(dai->dev, "simple-card: set_sysclk error\n");
-                        goto err;
-                }
-        }
-
-        if (set->slots) {
-                ret = snd_soc_dai_set_tdm_slot(dai,
-                                               set->tx_slot_mask,
-                                               set->rx_slot_mask,
-                                                set->slots,
-                                                set->slot_width);
-                if (ret && ret != -ENOTSUPP) {
-                        dev_err(dai->dev, "simple-card: set_tdm_slot error\n");
-                        goto err;
-                }
-        }
-
-        ret = 0;
-
-err:
-        return ret;
-}
-
 static int asoc_simple_card_dai_init(struct snd_soc_pcm_runtime *rtd)
 {
         struct simple_card_data *priv = snd_soc_card_get_drvdata(rtd->card);
         struct snd_soc_dai *codec = rtd->codec_dai;
         struct snd_soc_dai *cpu = rtd->cpu_dai;
-        struct simple_dai_props *dai_props;
+        struct simple_dai_props *dai_props =
+                simple_priv_to_props(priv, rtd->num);
         int ret;
 
-        dai_props = &priv->dai_props[rtd->num];
-        ret = __asoc_simple_card_dai_init(codec, &dai_props->codec_dai);
+        ret = asoc_simple_card_init_dai(codec, &dai_props->codec_dai);
         if (ret < 0)
                 return ret;
 
-        ret = __asoc_simple_card_dai_init(cpu, &dai_props->cpu_dai);
+        ret = asoc_simple_card_init_dai(cpu, &dai_props->cpu_dai);
         if (ret < 0)
                 return ret;
 
@@ -236,78 +208,6 @@ static int asoc_simple_card_dai_init(struct snd_soc_pcm_runtime *rtd)
         return 0;
 }
 
-static int
-asoc_simple_card_sub_parse_of(struct device_node *np,
-                              struct asoc_simple_dai *dai,
-                              struct device_node **p_node,
-                              const char **name,
-                              int *args_count)
-{
-        struct of_phandle_args args;
-        struct clk *clk;
-        u32 val;
-        int ret;
-
-        if (!np)
-                return 0;
-
-        /*
-         * Get node via "sound-dai = <&phandle port>"
-         * it will be used as xxx_of_node on soc_bind_dai_link()
-         */
-        ret = of_parse_phandle_with_args(np, "sound-dai",
-                                         "#sound-dai-cells", 0, &args);
-        if (ret)
-                return ret;
-
-        *p_node = args.np;
-
-        if (args_count)
-                *args_count = args.args_count;
-
-        /* Get dai->name */
-        if (name) {
-                ret = snd_soc_of_get_dai_name(np, name);
-                if (ret < 0)
-                        return ret;
-        }
-
-        if (!dai)
-                return 0;
-
-        /* Parse TDM slot */
-        ret = snd_soc_of_parse_tdm_slot(np, &dai->tx_slot_mask,
-                                        &dai->rx_slot_mask,
-                                        &dai->slots, &dai->slot_width);
-        if (ret)
-                return ret;
-
-        /*
-         * Parse dai->sysclk come from "clocks = <&xxx>"
-         * (if system has common clock)
-         *  or "system-clock-frequency = <xxx>"
-         *  or device's module clock.
-         */
-        if (of_property_read_bool(np, "clocks")) {
-                clk = of_clk_get(np, 0);
-                if (IS_ERR(clk)) {
-                        ret = PTR_ERR(clk);
-                        return ret;
-                }
-
-                dai->sysclk = clk_get_rate(clk);
-                dai->clk = clk;
-        } else if (!of_property_read_u32(np, "system-clock-frequency", &val)) {
-                dai->sysclk = val;
-        } else {
-                clk = of_clk_get(args.np, 0);
-                if (!IS_ERR(clk))
-                        dai->sysclk = clk_get_rate(clk);
-        }
-
-        return 0;
-}
-
 static int asoc_simple_card_dai_link_of(struct device_node *node,
                                         struct simple_card_data *priv,
                                         int idx,
@@ -316,13 +216,14 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
         struct device *dev = simple_priv_to_dev(priv);
         struct snd_soc_dai_link *dai_link = simple_priv_to_link(priv, idx);
         struct simple_dai_props *dai_props = simple_priv_to_props(priv, idx);
+        struct asoc_simple_dai *cpu_dai = &dai_props->cpu_dai;
+        struct asoc_simple_dai *codec_dai = &dai_props->codec_dai;
         struct device_node *cpu = NULL;
         struct device_node *plat = NULL;
         struct device_node *codec = NULL;
         char prop[128];
         char *prefix = "";
-        int ret, cpu_args;
-        u32 val;
+        int ret, single_cpu;
 
         /* For single DAI link & old style of DT node */
         if (is_top_level_node)
@@ -348,36 +249,46 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
         if (ret < 0)
                 goto dai_link_of_err;
 
-        if (!of_property_read_u32(node, "mclk-fs", &val))
-                dai_props->mclk_fs = val;
+        of_property_read_u32(node, "mclk-fs", &dai_props->mclk_fs);
 
-        ret = asoc_simple_card_sub_parse_of(cpu, &dai_props->cpu_dai,
-                                            &dai_link->cpu_of_node,
-                                            &dai_link->cpu_dai_name,
-                                            &cpu_args);
+        ret = asoc_simple_card_parse_cpu(cpu, dai_link,
+                                         DAI, CELL, &single_cpu);
         if (ret < 0)
                 goto dai_link_of_err;
 
-        ret = asoc_simple_card_sub_parse_of(codec, &dai_props->codec_dai,
-                                            &dai_link->codec_of_node,
-                                            &dai_link->codec_dai_name, NULL);
+        ret = asoc_simple_card_parse_codec(codec, dai_link, DAI, CELL);
         if (ret < 0)
                 goto dai_link_of_err;
 
-        ret = asoc_simple_card_sub_parse_of(plat, NULL,
-                                            &dai_link->platform_of_node,
-                                            NULL, NULL);
+        ret = asoc_simple_card_parse_platform(plat, dai_link, DAI, CELL);
         if (ret < 0)
                 goto dai_link_of_err;
 
-        if (!dai_link->cpu_dai_name || !dai_link->codec_dai_name) {
-                ret = -EINVAL;
+        ret = snd_soc_of_parse_tdm_slot(cpu,    &cpu_dai->tx_slot_mask,
+                                                &cpu_dai->rx_slot_mask,
+                                                &cpu_dai->slots,
+                                                &cpu_dai->slot_width);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = snd_soc_of_parse_tdm_slot(codec,  &codec_dai->tx_slot_mask,
+                                                &codec_dai->rx_slot_mask,
+                                                &codec_dai->slots,
+                                                &codec_dai->slot_width);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_parse_clk_cpu(cpu, dai_link, cpu_dai);
+        if (ret < 0)
                 goto dai_link_of_err;
-        }
 
-        /* Assumes platform == cpu */
-        if (!dai_link->platform_of_node)
-                dai_link->platform_of_node = dai_link->cpu_of_node;
+        ret = asoc_simple_card_parse_clk_codec(codec, dai_link, codec_dai);
+        if (ret < 0)
+                goto dai_link_of_err;
+
+        ret = asoc_simple_card_canonicalize_dailink(dai_link);
+        if (ret < 0)
+                goto dai_link_of_err;
 
         ret = asoc_simple_card_set_dailink_name(dev, dai_link,
                                                 "%s-%s",
@@ -398,17 +309,7 @@ static int asoc_simple_card_dai_link_of(struct device_node *node,
                 dai_link->codec_dai_name,
                 dai_props->codec_dai.sysclk);
 
-        /*
-         * In soc_bind_dai_link() will check cpu name after
-         * of_node matching if dai_link has cpu_dai_name.
-         * but, it will never match if name was created by
-         * fmt_single_name() remove cpu_dai_name if cpu_args
-         * was 0. See:
-         *      fmt_single_name()
-         *      fmt_multiple_name()
-         */
-        if (!cpu_args)
-                dai_link->cpu_dai_name = NULL;
+        asoc_simple_card_canonicalize_cpu(dai_link, single_cpu);
 
 dai_link_of_err:
         of_node_put(cpu);
@@ -417,22 +318,54 @@ dai_link_of_err:
         return ret;
 }
 
+static int asoc_simple_card_parse_aux_devs(struct device_node *node,
+                                           struct simple_card_data *priv)
+{
+        struct device *dev = simple_priv_to_dev(priv);
+        struct device_node *aux_node;
+        int i, n, len;
+
+        if (!of_find_property(node, PREFIX "aux-devs", &len))
+                return 0;               /* Ok to have no aux-devs */
+
+        n = len / sizeof(__be32);
+        if (n <= 0)
+                return -EINVAL;
+
+        priv->snd_card.aux_dev = devm_kzalloc(dev,
+                        n * sizeof(*priv->snd_card.aux_dev), GFP_KERNEL);
+        if (!priv->snd_card.aux_dev)
+                return -ENOMEM;
+
+        for (i = 0; i < n; i++) {
+                aux_node = of_parse_phandle(node, PREFIX "aux-devs", i);
+                if (!aux_node)
+                        return -EINVAL;
+                priv->snd_card.aux_dev[i].codec_of_node = aux_node;
+        }
+
+        priv->snd_card.num_aux_devs = n;
+        return 0;
+}
+
 static int asoc_simple_card_parse_of(struct device_node *node,
                                      struct simple_card_data *priv)
 {
         struct device *dev = simple_priv_to_dev(priv);
-        u32 val;
+        struct device_node *dai_link;
         int ret;
 
         if (!node)
                 return -EINVAL;
 
+        dai_link = of_get_child_by_name(node, PREFIX "dai-link");
+
         /* The off-codec widgets */
         if (of_property_read_bool(node, PREFIX "widgets")) {
                 ret = snd_soc_of_parse_audio_simple_widgets(&priv->snd_card,
                                         PREFIX "widgets");
                 if (ret)
-                        return ret;
+                        goto card_parse_end;
         }
 
         /* DAPM routes */
@@ -440,16 +373,14 @@ static int asoc_simple_card_parse_of(struct device_node *node,
                 ret = snd_soc_of_parse_audio_routing(&priv->snd_card,
                                         PREFIX "routing");
                 if (ret)
-                        return ret;
+                        goto card_parse_end;
         }
 
         /* Factor to mclk, used in hw_params() */
-        ret = of_property_read_u32(node, PREFIX "mclk-fs", &val);
-        if (ret == 0)
-                priv->mclk_fs = val;
+        of_property_read_u32(node, PREFIX "mclk-fs", &priv->mclk_fs);
 
         /* Single/Muti DAI link(s) & New style of DT node */
-        if (of_get_child_by_name(node, PREFIX "dai-link")) {
+        if (dai_link) {
                 struct device_node *np = NULL;
                 int i = 0;
 
@@ -459,7 +390,7 @@ static int asoc_simple_card_parse_of(struct device_node *node,
                                                            i, false);
                         if (ret < 0) {
                                 of_node_put(np);
-                                return ret;
+                                goto card_parse_end;
                         }
                         i++;
                 }
@@ -467,66 +398,55 @@ static int asoc_simple_card_parse_of(struct device_node *node,
                 /* For single DAI link & old style of DT node */
                 ret = asoc_simple_card_dai_link_of(node, priv, 0, true);
                 if (ret < 0)
-                        return ret;
+                        goto card_parse_end;
         }
 
         ret = asoc_simple_card_parse_card_name(&priv->snd_card, PREFIX);
-        if (ret)
-                return ret;
+        if (ret < 0)
+                goto card_parse_end;
 
-        return 0;
-}
+        ret = asoc_simple_card_parse_aux_devs(node, priv);
 
-/* Decrease the reference count of the device nodes */
-static int asoc_simple_card_unref(struct snd_soc_card *card)
-{
-        struct snd_soc_dai_link *dai_link;
-        int num_links;
+card_parse_end:
+        of_node_put(dai_link);
 
-        for (num_links = 0, dai_link = card->dai_link;
-             num_links < card->num_links;
-             num_links++, dai_link++) {
-                of_node_put(dai_link->cpu_of_node);
-                of_node_put(dai_link->codec_of_node);
-        }
-        return 0;
+        return ret;
 }
 
 static int asoc_simple_card_probe(struct platform_device *pdev)
 {
         struct simple_card_data *priv;
         struct snd_soc_dai_link *dai_link;
+        struct simple_dai_props *dai_props;
         struct device_node *np = pdev->dev.of_node;
         struct device *dev = &pdev->dev;
-        int num_links, ret;
+        int num, ret;
 
         /* Get the number of DAI links */
         if (np && of_get_child_by_name(np, PREFIX "dai-link"))
-                num_links = of_get_child_count(np);
+                num = of_get_child_count(np);
         else
-                num_links = 1;
+                num = 1;
 
         /* Allocate the private data and the DAI link array */
-        priv = devm_kzalloc(dev,
-                        sizeof(*priv) + sizeof(*dai_link) * num_links,
-                        GFP_KERNEL);
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
-        /* Init snd_soc_card */
-        priv->snd_card.owner = THIS_MODULE;
-        priv->snd_card.dev = dev;
-        dai_link = priv->dai_link;
-        priv->snd_card.dai_link = dai_link;
-        priv->snd_card.num_links = num_links;
-
-        /* Get room for the other properties */
-        priv->dai_props = devm_kzalloc(dev,
-                        sizeof(*priv->dai_props) * num_links,
-                        GFP_KERNEL);
-        if (!priv->dai_props)
+        dai_props = devm_kzalloc(dev, sizeof(*dai_props) * num, GFP_KERNEL);
+        dai_link  = devm_kzalloc(dev, sizeof(*dai_link)  * num, GFP_KERNEL);
+        if (!dai_props || !dai_link)
                 return -ENOMEM;
 
+        priv->dai_props                 = dai_props;
+        priv->dai_link                  = dai_link;
+
+        /* Init snd_soc_card */
+        priv->snd_card.owner            = THIS_MODULE;
+        priv->snd_card.dev              = dev;
+        priv->snd_card.dai_link         = priv->dai_link;
+        priv->snd_card.num_links        = num;
+
         if (np && of_device_is_available(np)) {
 
                 ret = asoc_simple_card_parse_of(np, priv);
@@ -567,7 +487,6 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
                                         sizeof(priv->dai_props->cpu_dai));
                 memcpy(&priv->dai_props->codec_dai, &cinfo->codec_dai,
                                         sizeof(priv->dai_props->codec_dai));
-
         }
 
         snd_soc_card_set_drvdata(&priv->snd_card, priv);
@@ -575,9 +494,9 @@ static int asoc_simple_card_probe(struct platform_device *pdev)
         ret = devm_snd_soc_register_card(&pdev->dev, &priv->snd_card);
         if (ret >= 0)
                 return ret;
-
 err:
-        asoc_simple_card_unref(&priv->snd_card);
+        asoc_simple_card_clean_reference(&priv->snd_card);
+
         return ret;
 }
 
@@ -589,7 +508,7 @@ static int asoc_simple_card_remove(struct platform_device *pdev)
         asoc_simple_card_remove_jack(&priv->hp_jack);
         asoc_simple_card_remove_jack(&priv->mic_jack);
 
-        return asoc_simple_card_unref(card);
+        return asoc_simple_card_clean_reference(card);
 }
 
 static const struct of_device_id asoc_simple_of_match[] = {
@@ -611,6 +530,6 @@ static struct platform_driver asoc_simple_card = {
 module_platform_driver(asoc_simple_card);
 
 MODULE_ALIAS("platform:asoc-simple-card");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
 MODULE_DESCRIPTION("ASoC Simple Sound Card");
 MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
diff --git a/sound/soc/generic/simple-scu-card.c b/sound/soc/generic/simple-scu-card.c
new file mode 100644
index 000000000000..b9973a56bcb0
--- /dev/null
+++ b/sound/soc/generic/simple-scu-card.c
@@ -0,0 +1,345 @@
+/*
+ * ASoC simple SCU sound card support
+ *
+ * Copyright (C) 2015 Renesas Solutions Corp.
+ * Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+ *
+ * based on ${LINUX}/sound/soc/generic/simple-card.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/platform_device.h>
+#include <linux/string.h>
+#include <sound/jack.h>
+#include <sound/soc.h>
+#include <sound/soc-dai.h>
+#include <sound/simple_card_utils.h>
+
+struct asoc_simple_card_priv {
+        struct snd_soc_card snd_card;
+        struct snd_soc_codec_conf codec_conf;
+        struct asoc_simple_dai *dai_props;
+        struct snd_soc_dai_link *dai_link;
+        u32 convert_rate;
+        u32 convert_channels;
+};
+
+#define simple_priv_to_dev(priv) ((priv)->snd_card.dev)
+#define simple_priv_to_link(priv, i) ((priv)->snd_card.dai_link + (i))
+#define simple_priv_to_props(priv, i) ((priv)->dai_props + (i))
+
+#define DAI     "sound-dai"
+#define CELL    "#sound-dai-cells"
+#define PREFIX  "simple-audio-card,"
+
+static int asoc_simple_card_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct asoc_simple_card_priv *priv =    snd_soc_card_get_drvdata(rtd->card);
+        struct asoc_simple_dai *dai_props =
+                simple_priv_to_props(priv, rtd->num);
+
+        return clk_prepare_enable(dai_props->clk);
+}
+
+static void asoc_simple_card_shutdown(struct snd_pcm_substream *substream)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct asoc_simple_card_priv *priv =    snd_soc_card_get_drvdata(rtd->card);
+        struct asoc_simple_dai *dai_props =
+                simple_priv_to_props(priv, rtd->num);
+
+        clk_disable_unprepare(dai_props->clk);
+}
+
+static struct snd_soc_ops asoc_simple_card_ops = {
+        .startup = asoc_simple_card_startup,
+        .shutdown = asoc_simple_card_shutdown,
+};
+
+static int asoc_simple_card_dai_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct asoc_simple_card_priv *priv = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_dai *dai;
+        struct snd_soc_dai_link *dai_link;
+        struct asoc_simple_dai *dai_props;
+        int num = rtd->num;
+
+        dai_link        = simple_priv_to_link(priv, num);
+        dai_props       = simple_priv_to_props(priv, num);
+        dai             = dai_link->dynamic ?
+                                rtd->cpu_dai :
+                                rtd->codec_dai;
+
+        return asoc_simple_card_init_dai(dai, dai_props);
+}
+
+static int asoc_simple_card_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
+                                        struct snd_pcm_hw_params *params)
+{
+        struct asoc_simple_card_priv *priv = snd_soc_card_get_drvdata(rtd->card);
+        struct snd_interval *rate = hw_param_interval(params,
+                                                      SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+
+        if (priv->convert_rate)
+                rate->min =
+                rate->max = priv->convert_rate;
+
+        if (priv->convert_channels)
+                channels->min =
+                channels->max = priv->convert_channels;
+
+        return 0;
+}
+
+static int asoc_simple_card_parse_links(struct device_node *np,
+                                        struct asoc_simple_card_priv *priv,
+                                        unsigned int daifmt,
+                                        int idx, bool is_fe)
+{
+        struct device *dev = simple_priv_to_dev(priv);
+        struct snd_soc_dai_link *dai_link = simple_priv_to_link(priv, idx);
+        struct asoc_simple_dai *dai_props = simple_priv_to_props(priv, idx);
+        int ret;
+
+        if (is_fe) {
+                int is_single_links = 0;
+
+                /* BE is dummy */
+                dai_link->codec_of_node         = NULL;
+                dai_link->codec_dai_name        = "snd-soc-dummy-dai";
+                dai_link->codec_name            = "snd-soc-dummy";
+
+                /* FE settings */
+                dai_link->dynamic               = 1;
+                dai_link->dpcm_merged_format    = 1;
+
+                ret = asoc_simple_card_parse_cpu(np, dai_link, DAI, CELL,
+                                                 &is_single_links);
+                if (ret)
+                        return ret;
+
+                ret = asoc_simple_card_parse_clk_cpu(np, dai_link, dai_props);
+                if (ret < 0)
+                        return ret;
+
+                ret = asoc_simple_card_set_dailink_name(dev, dai_link,
+                                                        "fe.%s",
+                                                        dai_link->cpu_dai_name);
+                if (ret < 0)
+                        return ret;
+
+                asoc_simple_card_canonicalize_cpu(dai_link, is_single_links);
+        } else {
+                /* FE is dummy */
+                dai_link->cpu_of_node           = NULL;
+                dai_link->cpu_dai_name          = "snd-soc-dummy-dai";
+                dai_link->cpu_name              = "snd-soc-dummy";
+
+                /* BE settings */
+                dai_link->no_pcm                = 1;
+                dai_link->be_hw_params_fixup    = asoc_simple_card_be_hw_params_fixup;
+
+                ret = asoc_simple_card_parse_codec(np, dai_link, DAI, CELL);
+                if (ret < 0)
+                        return ret;
+
+                ret = asoc_simple_card_parse_clk_codec(np, dai_link, dai_props);
+                if (ret < 0)
+                        return ret;
+
+                ret = asoc_simple_card_set_dailink_name(dev, dai_link,
+                                                        "be.%s",
+                                                        dai_link->codec_dai_name);
+                if (ret < 0)
+                        return ret;
+
+                snd_soc_of_parse_audio_prefix(&priv->snd_card,
+                                              &priv->codec_conf,
+                                              dai_link->codec_of_node,
+                                              PREFIX "prefix");
+        }
+
+        ret = snd_soc_of_parse_tdm_slot(np,
+                                        &dai_props->tx_slot_mask,
+                                        &dai_props->rx_slot_mask,
+                                        &dai_props->slots,
+                                        &dai_props->slot_width);
+        if (ret)
+                return ret;
+
+        ret = asoc_simple_card_canonicalize_dailink(dai_link);
+        if (ret < 0)
+                return ret;
+
+        dai_link->dai_fmt               = daifmt;
+        dai_link->dpcm_playback         = 1;
+        dai_link->dpcm_capture          = 1;
+        dai_link->ops                   = &asoc_simple_card_ops;
+        dai_link->init                  = asoc_simple_card_dai_init;
+
+        dev_dbg(dev, "\t%s / %04x / %d\n",
+                dai_link->name,
+                dai_link->dai_fmt,
+                dai_props->sysclk);
+
+        return 0;
+}
+
+static int asoc_simple_card_dai_link_of(struct device_node *node,
+                                 struct asoc_simple_card_priv *priv)
+{
+        struct device *dev = simple_priv_to_dev(priv);
+        struct device_node *np;
+        unsigned int daifmt = 0;
+        int ret, i;
+        bool is_fe;
+
+        /* find 1st codec */
+        np = of_get_child_by_name(node, PREFIX "codec");
+        if (!np)
+                return -ENODEV;
+
+        ret = asoc_simple_card_parse_daifmt(dev, node, np,
+                                            PREFIX, &daifmt);
+        if (ret < 0)
+                return ret;
+
+        i = 0;
+        for_each_child_of_node(node, np) {
+                is_fe = false;
+                if (strcmp(np->name, PREFIX "cpu") == 0)
+                        is_fe = true;
+
+                ret = asoc_simple_card_parse_links(np, priv, daifmt, i, is_fe);
+                if (ret < 0)
+                        return ret;
+                i++;
+        }
+
+        return 0;
+}
+
+static int asoc_simple_card_parse_of(struct device_node *node,
+                              struct asoc_simple_card_priv *priv,
+                              struct device *dev)
+{
+        struct asoc_simple_dai *props;
+        struct snd_soc_dai_link *links;
+        int ret;
+        int num;
+
+        if (!node)
+                return -EINVAL;
+
+        num = of_get_child_count(node);
+        props = devm_kzalloc(dev, sizeof(*props) * num, GFP_KERNEL);
+        links = devm_kzalloc(dev, sizeof(*links) * num, GFP_KERNEL);
+        if (!props || !links)
+                return -ENOMEM;
+
+        priv->dai_props = props;
+        priv->dai_link  = links;
+
+        /* Init snd_soc_card */
+        priv->snd_card.owner                    = THIS_MODULE;
+        priv->snd_card.dev                      = dev;
+        priv->snd_card.dai_link                 = priv->dai_link;
+        priv->snd_card.num_links                = num;
+        priv->snd_card.codec_conf               = &priv->codec_conf;
+        priv->snd_card.num_configs              = 1;
+
+        ret = snd_soc_of_parse_audio_routing(&priv->snd_card, PREFIX "routing");
+        if (ret < 0)
+                return ret;
+
+        /* sampling rate convert */
+        of_property_read_u32(node, PREFIX "convert-rate", &priv->convert_rate);
+
+        /* channels transfer */
+        of_property_read_u32(node, PREFIX "convert-channels", &priv->convert_channels);
+
+        ret = asoc_simple_card_dai_link_of(node, priv);
+        if (ret < 0)
+                return ret;
+
+        ret = asoc_simple_card_parse_card_name(&priv->snd_card, PREFIX);
+        if (ret < 0)
+                return ret;
+
+        dev_dbg(dev, "New card: %s\n",
+                priv->snd_card.name ? priv->snd_card.name : "");
+        dev_dbg(dev, "convert_rate     %d\n", priv->convert_rate);
+        dev_dbg(dev, "convert_channels %d\n", priv->convert_channels);
+
+        return 0;
+}
+
+static int asoc_simple_card_probe(struct platform_device *pdev)
+{
+        struct asoc_simple_card_priv *priv;
+        struct device_node *np = pdev->dev.of_node;
+        struct device *dev = &pdev->dev;
+        int ret;
+
+        /* Allocate the private data */
+        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
+        ret = asoc_simple_card_parse_of(np, priv, dev);
+        if (ret < 0) {
+                if (ret != -EPROBE_DEFER)
+                        dev_err(dev, "parse error %d\n", ret);
+                goto err;
+        }
+
+        snd_soc_card_set_drvdata(&priv->snd_card, priv);
+
+        ret = devm_snd_soc_register_card(&pdev->dev, &priv->snd_card);
+        if (ret >= 0)
+                return ret;
+err:
+        asoc_simple_card_clean_reference(&priv->snd_card);
+
+        return ret;
+}
+
+static int asoc_simple_card_remove(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+
+        return asoc_simple_card_clean_reference(card);
+}
+
+static const struct of_device_id asoc_simple_of_match[] = {
+        { .compatible = "renesas,rsrc-card", },
+        { .compatible = "simple-scu-audio-card", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, asoc_simple_of_match);
+
+static struct platform_driver asoc_simple_card = {
+        .driver = {
+                .name = "simple-scu-audio-card",
+                .of_match_table = asoc_simple_of_match,
+        },
+        .probe = asoc_simple_card_probe,
+        .remove = asoc_simple_card_remove,
+};
+
+module_platform_driver(asoc_simple_card);
+
+MODULE_ALIAS("platform:asoc-simple-scu-card");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("ASoC Simple SCU Sound Card");
+MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
diff --git a/sound/soc/img/pistachio-internal-dac.c b/sound/soc/img/pistachio-internal-dac.c
index 162a0fd68c7b..53e11c6d4e22 100644
--- a/sound/soc/img/pistachio-internal-dac.c
+++ b/sound/soc/img/pistachio-internal-dac.c
@@ -134,12 +134,14 @@ static int pistachio_internal_dac_codec_probe(struct snd_soc_codec *codec)
 static const struct snd_soc_codec_driver pistachio_internal_dac_driver = {
         .probe = pistachio_internal_dac_codec_probe,
         .idle_bias_off = true,
-        .controls = pistachio_internal_dac_snd_controls,
-        .num_controls = ARRAY_SIZE(pistachio_internal_dac_snd_controls),
-        .dapm_widgets = pistachio_internal_dac_widgets,
-        .num_dapm_widgets = ARRAY_SIZE(pistachio_internal_dac_widgets),
-        .dapm_routes = pistachio_internal_dac_routes,
-        .num_dapm_routes = ARRAY_SIZE(pistachio_internal_dac_routes),
+        .component_driver = {
+                .controls               = pistachio_internal_dac_snd_controls,
+                .num_controls           = ARRAY_SIZE(pistachio_internal_dac_snd_controls),
+                .dapm_widgets           = pistachio_internal_dac_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(pistachio_internal_dac_widgets),
+                .dapm_routes            = pistachio_internal_dac_routes,
+                .num_dapm_routes        = ARRAY_SIZE(pistachio_internal_dac_routes),
+        },
 };
 
 static int pistachio_internal_dac_probe(struct platform_device *pdev)
diff --git a/sound/soc/intel/Kconfig b/sound/soc/intel/Kconfig
index a20c3dfbcb5d..26eb5a0a5575 100644
--- a/sound/soc/intel/Kconfig
+++ b/sound/soc/intel/Kconfig
@@ -25,6 +25,7 @@ config SND_SST_IPC_ACPI
         tristate
         select SND_SST_IPC
         select SND_SOC_INTEL_SST
+        select IOSF_MBI
 
 config SND_SOC_INTEL_SST
         tristate
@@ -120,6 +121,17 @@ config SND_SOC_INTEL_BYT_MAX98090_MACH
           This adds audio driver for Intel Baytrail platform based boards
           with the MAX98090 audio codec.
 
+config SND_SOC_INTEL_BDW_RT5677_MACH
+        tristate "ASoC Audio driver for Intel Broadwell with RT5677 codec"
+        depends on X86_INTEL_LPSS && GPIOLIB && I2C && DW_DMAC
+        depends on DW_DMAC_CORE=y
+        select SND_SOC_INTEL_SST
+        select SND_SOC_INTEL_HASWELL
+        select SND_SOC_RT5677
+        help
+          This adds support for Intel Broadwell platform based boards with
+          the RT5677 audio codec.
+
 config SND_SOC_INTEL_BROADWELL_MACH
         tristate "ASoC Audio DSP support for Intel Broadwell Wildcatpoint"
         depends on X86_INTEL_LPSS && I2C && DW_DMAC && \
diff --git a/sound/soc/intel/atom/sst-atom-controls.c b/sound/soc/intel/atom/sst-atom-controls.c
index 98720a93de8a..0838478c4c3f 100644
--- a/sound/soc/intel/atom/sst-atom-controls.c
+++ b/sound/soc/intel/atom/sst-atom-controls.c
@@ -1,4 +1,4 @@
-/*
+ /*
  *  sst-atom-controls.c - Intel MID Platform driver DPCM ALSA controls for Mrfld
  *
  *  Copyright (C) 2013-14 Intel Corp
@@ -534,6 +534,7 @@ static const DECLARE_TLV_DB_SCALE(sst_gain_tlv_common, SST_GAIN_MIN_VALUE * 10,
 
 /* Look up table to convert MIXER SW bit regs to SWM inputs */
 static const uint swm_mixer_input_ids[SST_SWM_INPUT_COUNT] = {
+        [SST_IP_MODEM]          = SST_SWM_IN_MODEM,
         [SST_IP_CODEC0]         = SST_SWM_IN_CODEC0,
         [SST_IP_CODEC1]         = SST_SWM_IN_CODEC1,
         [SST_IP_LOOP0]          = SST_SWM_IN_SPROT_LOOP,
@@ -674,6 +675,7 @@ static int sst_swm_mixer_event(struct snd_soc_dapm_widget *w,
 /* SBA mixers - 16 inputs */
 #define SST_SBA_DECLARE_MIX_CONTROLS(kctl_name)                                                 \
         static const struct snd_kcontrol_new kctl_name[] = {                                    \
+                SOC_DAPM_SINGLE("modem_in Switch", SND_SOC_NOPM, SST_IP_MODEM, 1, 0),           \
                 SOC_DAPM_SINGLE("codec_in0 Switch", SND_SOC_NOPM, SST_IP_CODEC0, 1, 0),         \
                 SOC_DAPM_SINGLE("codec_in1 Switch", SND_SOC_NOPM, SST_IP_CODEC1, 1, 0),         \
                 SOC_DAPM_SINGLE("sprot_loop_in Switch", SND_SOC_NOPM, SST_IP_LOOP0, 1, 0),      \
@@ -684,6 +686,7 @@ static int sst_swm_mixer_event(struct snd_soc_dapm_widget *w,
         }
 
 #define SST_SBA_MIXER_GRAPH_MAP(mix_name)                       \
+        { mix_name, "modem_in Switch",  "modem_in" },           \
         { mix_name, "codec_in0 Switch", "codec_in0" },          \
         { mix_name, "codec_in1 Switch", "codec_in1" },          \
         { mix_name, "sprot_loop_in Switch",     "sprot_loop_in" },      \
@@ -713,6 +716,7 @@ SST_SBA_DECLARE_MIX_CONTROLS(sst_mix_media_l2_controls);
 SST_SBA_DECLARE_MIX_CONTROLS(sst_mix_voip_controls);
 SST_SBA_DECLARE_MIX_CONTROLS(sst_mix_codec0_controls);
 SST_SBA_DECLARE_MIX_CONTROLS(sst_mix_codec1_controls);
+SST_SBA_DECLARE_MIX_CONTROLS(sst_mix_modem_controls);
 
 /*
  * sst_handle_vb_timer - Start/Stop the DSP scheduler
@@ -931,17 +935,26 @@ void sst_fill_ssp_defaults(struct snd_soc_dai *dai)
 int send_ssp_cmd(struct snd_soc_dai *dai, const char *id, bool enable)
 {
         struct sst_data *drv = snd_soc_dai_get_drvdata(dai);
-        const struct sst_ssp_config *config;
+        int ssp_id;
 
         dev_info(dai->dev, "Enter: enable=%d port_name=%s\n", enable, id);
 
+        if (strcmp(id, "ssp0-port") == 0)
+                ssp_id = SSP_MODEM;
+        else if (strcmp(id, "ssp2-port") == 0)
+                ssp_id = SSP_CODEC;
+        else {
+                dev_dbg(dai->dev, "port %s is not supported\n", id);
+                return -1;
+        }
+
         SST_FILL_DEFAULT_DESTINATION(drv->ssp_cmd.header.dst);
         drv->ssp_cmd.header.command_id = SBA_HW_SET_SSP;
         drv->ssp_cmd.header.length = sizeof(struct sst_cmd_sba_hw_set_ssp)
                                 - sizeof(struct sst_dsp_header);
 
-        config = &sst_ssp_configs;
-        dev_dbg(dai->dev, "ssp_id: %u\n", config->ssp_id);
+        drv->ssp_cmd.selection = ssp_id;
+        dev_dbg(dai->dev, "ssp_id: %u\n", ssp_id);
 
         if (enable)
                 drv->ssp_cmd.switch_state = SST_SWITCH_ON;
@@ -1047,8 +1060,10 @@ static int sst_set_media_loop(struct snd_soc_dapm_widget *w,
 }
 
 static const struct snd_soc_dapm_widget sst_dapm_widgets[] = {
+        SST_AIF_IN("modem_in", sst_set_be_modules),
         SST_AIF_IN("codec_in0", sst_set_be_modules),
         SST_AIF_IN("codec_in1", sst_set_be_modules),
+        SST_AIF_OUT("modem_out", sst_set_be_modules),
         SST_AIF_OUT("codec_out0", sst_set_be_modules),
         SST_AIF_OUT("codec_out1", sst_set_be_modules),
 
@@ -1103,6 +1118,9 @@ static const struct snd_soc_dapm_widget sst_dapm_widgets[] = {
                       sst_mix_codec0_controls, sst_swm_mixer_event),
         SST_SWM_MIXER("codec_out1 mix 0", SND_SOC_NOPM, SST_TASK_SBA, SST_SWM_OUT_CODEC1,
                       sst_mix_codec1_controls, sst_swm_mixer_event),
+        SST_SWM_MIXER("modem_out mix 0", SND_SOC_NOPM, SST_TASK_SBA, SST_SWM_OUT_MODEM,
+                      sst_mix_modem_controls, sst_swm_mixer_event),
+
 };
 
 static const struct snd_soc_dapm_route intercon[] = {
@@ -1148,6 +1166,9 @@ static const struct snd_soc_dapm_route intercon[] = {
         SST_SBA_MIXER_GRAPH_MAP("codec_out0 mix 0"),
         {"codec_out1", NULL, "codec_out1 mix 0"},
         SST_SBA_MIXER_GRAPH_MAP("codec_out1 mix 0"),
+        {"modem_out", NULL, "modem_out mix 0"},
+        SST_SBA_MIXER_GRAPH_MAP("modem_out mix 0"),
+
 
 };
 static const char * const slot_names[] = {
@@ -1217,6 +1238,9 @@ static const struct snd_kcontrol_new sst_gain_controls[] = {
         SST_GAIN("media_loop2_out", SST_PATH_INDEX_MEDIA_LOOP2_OUT, SST_TASK_SBA, 0, &sst_gains[13]),
         SST_GAIN("sprot_loop_out", SST_PATH_INDEX_SPROT_LOOP_OUT, SST_TASK_SBA, 0, &sst_gains[14]),
         SST_VOLUME("media0_in", SST_PATH_INDEX_MEDIA0_IN, SST_TASK_MMX, 0, &sst_gains[15]),
+        SST_GAIN("modem_in", SST_PATH_INDEX_MODEM_IN, SST_TASK_SBA, 0, &sst_gains[16]),
+        SST_GAIN("modem_out", SST_PATH_INDEX_MODEM_OUT, SST_TASK_SBA, 0, &sst_gains[17]),
+
 };
 
 #define SST_GAIN_NUM_CONTROLS 3
diff --git a/sound/soc/intel/atom/sst-atom-controls.h b/sound/soc/intel/atom/sst-atom-controls.h
index e0113112f668..351d81469685 100644
--- a/sound/soc/intel/atom/sst-atom-controls.h
+++ b/sound/soc/intel/atom/sst-atom-controls.h
@@ -35,6 +35,8 @@ enum {
 /* define a bit for each mixer input */
 #define SST_MIX_IP(x)           (x)
 
+#define SST_IP_MODEM            SST_MIX_IP(0)
+#define SST_IP_BT               SST_MIX_IP(1)
 #define SST_IP_CODEC0           SST_MIX_IP(2)
 #define SST_IP_CODEC1           SST_MIX_IP(3)
 #define SST_IP_LOOP0            SST_MIX_IP(4)
@@ -63,6 +65,7 @@ enum {
  * Audio DSP Path Ids. Specified by the audio DSP FW
  */
 enum sst_path_index {
+        SST_PATH_INDEX_MODEM_OUT                = (0x00 << SST_PATH_ID_SHIFT),
         SST_PATH_INDEX_CODEC_OUT0               = (0x02 << SST_PATH_ID_SHIFT),
         SST_PATH_INDEX_CODEC_OUT1               = (0x03 << SST_PATH_ID_SHIFT),
 
@@ -80,6 +83,7 @@ enum sst_path_index {
 
 
         /* Start of input paths */
+        SST_PATH_INDEX_MODEM_IN                 = (0x80 << SST_PATH_ID_SHIFT),
         SST_PATH_INDEX_CODEC_IN0                = (0x82 << SST_PATH_ID_SHIFT),
         SST_PATH_INDEX_CODEC_IN1                = (0x83 << SST_PATH_ID_SHIFT),
 
@@ -105,6 +109,7 @@ enum sst_path_index {
  * path IDs
  */
 enum sst_swm_inputs {
+        SST_SWM_IN_MODEM        = (SST_PATH_INDEX_MODEM_IN        | SST_DEFAULT_CELL_NBR),
         SST_SWM_IN_CODEC0       = (SST_PATH_INDEX_CODEC_IN0       | SST_DEFAULT_CELL_NBR),
         SST_SWM_IN_CODEC1       = (SST_PATH_INDEX_CODEC_IN1       | SST_DEFAULT_CELL_NBR),
         SST_SWM_IN_SPROT_LOOP   = (SST_PATH_INDEX_SPROT_LOOP_IN   | SST_DEFAULT_CELL_NBR),
@@ -124,6 +129,7 @@ enum sst_swm_inputs {
  * path IDs
  */
 enum sst_swm_outputs {
+        SST_SWM_OUT_MODEM       = (SST_PATH_INDEX_MODEM_OUT       | SST_DEFAULT_CELL_NBR),
         SST_SWM_OUT_CODEC0      = (SST_PATH_INDEX_CODEC_OUT0      | SST_DEFAULT_CELL_NBR),
         SST_SWM_OUT_CODEC1      = (SST_PATH_INDEX_CODEC_OUT1      | SST_DEFAULT_CELL_NBR),
         SST_SWM_OUT_SPROT_LOOP  = (SST_PATH_INDEX_SPROT_LOOP_OUT  | SST_DEFAULT_CELL_NBR),
diff --git a/sound/soc/intel/atom/sst-mfld-platform-pcm.c b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
index 52ed434cbca6..25c6d87c818e 100644
--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c
+++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c
@@ -670,7 +670,7 @@ static snd_pcm_uframes_t sst_platform_pcm_pointer
         return str_info->buffer_ptr;
 }
 
-static struct snd_pcm_ops sst_platform_ops = {
+static const struct snd_pcm_ops sst_platform_ops = {
         .open = sst_platform_open,
         .ioctl = snd_pcm_lib_ioctl,
         .trigger = sst_platform_pcm_trigger,
diff --git a/sound/soc/intel/atom/sst/sst.c b/sound/soc/intel/atom/sst/sst.c
index a4b458e77089..9b6e27385dc9 100644
--- a/sound/soc/intel/atom/sst/sst.c
+++ b/sound/soc/intel/atom/sst/sst.c
@@ -190,7 +190,8 @@ int sst_driver_ops(struct intel_sst_drv *sst)
 
         default:
                 dev_err(sst->dev,
-                        "SST Driver capablities missing for dev_id: %x", sst->dev_id);
+                        "SST Driver capabilities missing for dev_id: %x",
+                        sst->dev_id);
                 return -EINVAL;
         };
 }
@@ -441,7 +442,7 @@ static int intel_sst_suspend(struct device *dev)
                 struct stream_info *stream = &ctx->streams[i];
 
                 if (stream->status == STREAM_RUNNING) {
-                        dev_err(dev, "stream %d is running, cant susupend, abort\n", i);
+                        dev_err(dev, "stream %d is running, can't suspend, abort\n", i);
                         return -EBUSY;
                 }
         }
diff --git a/sound/soc/intel/atom/sst/sst_acpi.c b/sound/soc/intel/atom/sst/sst_acpi.c
index 4d3184971227..ba5c0d71720a 100644
--- a/sound/soc/intel/atom/sst/sst_acpi.c
+++ b/sound/soc/intel/atom/sst/sst_acpi.c
@@ -39,6 +39,8 @@
 #include <acpi/platform/aclinux.h>
 #include <acpi/actypes.h>
 #include <acpi/acpi_bus.h>
+#include <asm/cpu_device_id.h>
+#include <asm/iosf_mbi.h>
 #include "../sst-mfld-platform.h"
 #include "../../common/sst-dsp.h"
 #include "../../common/sst-acpi.h"
@@ -113,6 +115,28 @@ static const struct sst_res_info byt_rvp_res_info = {
         .acpi_ipc_irq_index = 5,
 };
 
+/* BYTCR has different BIOS from BYT */
+static const struct sst_res_info bytcr_res_info = {
+        .shim_offset = 0x140000,
+        .shim_size = 0x000100,
+        .shim_phy_addr = SST_BYT_SHIM_PHY_ADDR,
+        .ssp0_offset = 0xa0000,
+        .ssp0_size = 0x1000,
+        .dma0_offset = 0x98000,
+        .dma0_size = 0x4000,
+        .dma1_offset = 0x9c000,
+        .dma1_size = 0x4000,
+        .iram_offset = 0x0c0000,
+        .iram_size = 0x14000,
+        .dram_offset = 0x100000,
+        .dram_size = 0x28000,
+        .mbox_offset = 0x144000,
+        .mbox_size = 0x1000,
+        .acpi_lpe_res_index = 0,
+        .acpi_ddr_index = 2,
+        .acpi_ipc_irq_index = 0
+};
+
 static struct sst_platform_info byt_rvp_platform_data = {
         .probe_data = &byt_fwparse_info,
         .ipc_info = &byt_ipc_info,
@@ -142,7 +166,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         rsrc = platform_get_resource(pdev, IORESOURCE_MEM,
                                         ctx->pdata->res_info->acpi_lpe_res_index);
         if (!rsrc) {
-                dev_err(ctx->dev, "Invalid SHIM base from IFWI");
+                dev_err(ctx->dev, "Invalid SHIM base from IFWI\n");
                 return -EIO;
         }
         dev_info(ctx->dev, "LPE base: %#x size:%#x", (unsigned int) rsrc->start,
@@ -154,7 +178,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         ctx->iram = devm_ioremap_nocache(ctx->dev, ctx->iram_base,
                                          ctx->pdata->res_info->iram_size);
         if (!ctx->iram) {
-                dev_err(ctx->dev, "unable to map IRAM");
+                dev_err(ctx->dev, "unable to map IRAM\n");
                 return -EIO;
         }
 
@@ -164,7 +188,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         ctx->dram = devm_ioremap_nocache(ctx->dev, ctx->dram_base,
                                          ctx->pdata->res_info->dram_size);
         if (!ctx->dram) {
-                dev_err(ctx->dev, "unable to map DRAM");
+                dev_err(ctx->dev, "unable to map DRAM\n");
                 return -EIO;
         }
 
@@ -173,7 +197,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         ctx->shim = devm_ioremap_nocache(ctx->dev, ctx->shim_phy_add,
                                         ctx->pdata->res_info->shim_size);
         if (!ctx->shim) {
-                dev_err(ctx->dev, "unable to map SHIM");
+                dev_err(ctx->dev, "unable to map SHIM\n");
                 return -EIO;
         }
 
@@ -186,7 +210,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         ctx->mailbox = devm_ioremap_nocache(ctx->dev, ctx->mailbox_add,
                                             ctx->pdata->res_info->mbox_size);
         if (!ctx->mailbox) {
-                dev_err(ctx->dev, "unable to map mailbox");
+                dev_err(ctx->dev, "unable to map mailbox\n");
                 return -EIO;
         }
 
@@ -196,7 +220,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         rsrc = platform_get_resource(pdev, IORESOURCE_MEM,
                                         ctx->pdata->res_info->acpi_ddr_index);
         if (!rsrc) {
-                dev_err(ctx->dev, "Invalid DDR base from IFWI");
+                dev_err(ctx->dev, "Invalid DDR base from IFWI\n");
                 return -EIO;
         }
         ctx->ddr_base = rsrc->start;
@@ -205,7 +229,7 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         ctx->ddr = devm_ioremap_nocache(ctx->dev, ctx->ddr_base,
                                         resource_size(rsrc));
         if (!ctx->ddr) {
-                dev_err(ctx->dev, "unable to map DDR");
+                dev_err(ctx->dev, "unable to map DDR\n");
                 return -EIO;
         }
 
@@ -215,6 +239,46 @@ static int sst_platform_get_resources(struct intel_sst_drv *ctx)
         return 0;
 }
 
+
+static int is_byt_cr(struct device *dev, bool *bytcr)
+{
+        int status = 0;
+
+        if (IS_ENABLED(CONFIG_IOSF_MBI)) {
+                static const struct x86_cpu_id cpu_ids[] = {
+                        { X86_VENDOR_INTEL, 6, 55 }, /* Valleyview, Bay Trail */
+                        {}
+                };
+                u32 bios_status;
+
+                if (!x86_match_cpu(cpu_ids) || !iosf_mbi_available()) {
+                        /* bail silently */
+                        return status;
+                }
+
+                status = iosf_mbi_read(BT_MBI_UNIT_PMC, /* 0x04 PUNIT */
+                                       MBI_REG_READ, /* 0x10 */
+                                       0x006, /* BIOS_CONFIG */
+                                       &bios_status);
+
+                if (status) {
+                        dev_err(dev, "could not read PUNIT BIOS_CONFIG\n");
+                } else {
+                        /* bits 26:27 mirror PMIC options */
+                        bios_status = (bios_status >> 26) & 3;
+
+                        if ((bios_status == 1) || (bios_status == 3))
+                                *bytcr = true;
+                        else
+                                dev_info(dev, "BYT-CR not detected\n");
+                }
+        } else {
+                dev_info(dev, "IOSF_MBI not enabled, no BYT-CR detection\n");
+        }
+        return status;
+}
+
+
 static int sst_acpi_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -226,11 +290,12 @@ static int sst_acpi_probe(struct platform_device *pdev)
         struct platform_device *plat_dev;
         struct sst_platform_info *pdata;
         unsigned int dev_id;
+        bool bytcr = false;
 
         id = acpi_match_device(dev->driver->acpi_match_table, dev);
         if (!id)
                 return -ENODEV;
-        dev_dbg(dev, "for %s", id->id);
+        dev_dbg(dev, "for %s\n", id->id);
 
         mach = (struct sst_acpi_mach *)id->driver_data;
         mach = sst_acpi_find_machine(mach);
@@ -251,6 +316,18 @@ static int sst_acpi_probe(struct platform_device *pdev)
 
         dev_dbg(dev, "ACPI device id: %x\n", dev_id);
 
+        ret = sst_alloc_drv_context(&ctx, dev, dev_id);
+        if (ret < 0)
+                return ret;
+
+        ret = is_byt_cr(dev, &bytcr);
+        if (!((ret < 0) || (bytcr == false))) {
+                dev_info(dev, "Detected Baytrail-CR platform\n");
+
+                /* override resource info */
+                byt_rvp_platform_data.res_info = &bytcr_res_info;
+        }
+
         plat_dev = platform_device_register_data(dev, pdata->platform, -1,
                                                 NULL, 0);
         if (IS_ERR(plat_dev)) {
@@ -271,10 +348,6 @@ static int sst_acpi_probe(struct platform_device *pdev)
                 return PTR_ERR(mdev);
         }
 
-        ret = sst_alloc_drv_context(&ctx, dev, dev_id);
-        if (ret < 0)
-                return ret;
-
         /* Fill sst platform data */
         ctx->pdata = pdata;
         strcpy(ctx->firmware_name, mach->fw_filename);
diff --git a/sound/soc/intel/atom/sst/sst_ipc.c b/sound/soc/intel/atom/sst/sst_ipc.c
index 8afa6fe7b0b0..bfc889950bb2 100644
--- a/sound/soc/intel/atom/sst/sst_ipc.c
+++ b/sound/soc/intel/atom/sst/sst_ipc.c
@@ -267,6 +267,9 @@ static void process_fw_async_msg(struct intel_sst_drv *sst_drv_ctx,
                                 "Period elapsed rcvd for pipe id 0x%x\n",
                                 pipe_id);
                         stream = &sst_drv_ctx->streams[str_id];
+                        /* If stream is dropped, skip processing this message*/
+                        if (stream->status == STREAM_INIT)
+                                break;
                         if (stream->period_elapsed)
                                 stream->period_elapsed(stream->pcm_substream);
                         if (stream->compr_cb)
diff --git a/sound/soc/intel/atom/sst/sst_pvt.c b/sound/soc/intel/atom/sst/sst_pvt.c
index adb32fefd693..b1e6b8f34a6a 100644
--- a/sound/soc/intel/atom/sst/sst_pvt.c
+++ b/sound/soc/intel/atom/sst/sst_pvt.c
@@ -279,17 +279,15 @@ int sst_prepare_and_post_msg(struct intel_sst_drv *sst,
 
         if (response) {
                 ret = sst_wait_timeout(sst, block);
-                if (ret < 0) {
+                if (ret < 0)
                         goto out;
-                } else if(block->data) {
-                        if (!data)
-                                goto out;
-                        *data = kzalloc(block->size, GFP_KERNEL);
-                        if (!(*data)) {
+
+                if (data && block->data) {
+                        *data = kmemdup(block->data, block->size, GFP_KERNEL);
+                        if (!*data) {
                                 ret = -ENOMEM;
                                 goto out;
-                        } else
-                                memcpy(data, (void *) block->data, block->size);
+                        }
                 }
         }
 out:
diff --git a/sound/soc/intel/boards/Makefile b/sound/soc/intel/boards/Makefile
index dac03a06bfd8..5639f10774e6 100644
--- a/sound/soc/intel/boards/Makefile
+++ b/sound/soc/intel/boards/Makefile
@@ -1,6 +1,7 @@
 snd-soc-sst-haswell-objs := haswell.o
 snd-soc-sst-byt-rt5640-mach-objs := byt-rt5640.o
 snd-soc-sst-byt-max98090-mach-objs := byt-max98090.o
+snd-soc-sst-bdw-rt5677-mach-objs := bdw-rt5677.o
 snd-soc-sst-broadwell-objs := broadwell.o
 snd-soc-sst-bxt-da7219_max98357a-objs := bxt_da7219_max98357a.o
 snd-soc-sst-bxt-rt298-objs := bxt_rt298.o
@@ -19,6 +20,7 @@ obj-$(CONFIG_SND_SOC_INTEL_BYT_MAX98090_MACH) += snd-soc-sst-byt-max98090-mach.o
 obj-$(CONFIG_SND_SOC_INTEL_BXT_DA7219_MAX98357A_MACH) += snd-soc-sst-bxt-da7219_max98357a.o
 obj-$(CONFIG_SND_SOC_INTEL_BXT_RT298_MACH) += snd-soc-sst-bxt-rt298.o
 obj-$(CONFIG_SND_SOC_INTEL_BROADWELL_MACH) += snd-soc-sst-broadwell.o
+obj-$(CONFIG_SND_SOC_INTEL_BDW_RT5677_MACH) += snd-soc-sst-bdw-rt5677-mach.o
 obj-$(CONFIG_SND_SOC_INTEL_BYTCR_RT5640_MACH) += snd-soc-sst-bytcr-rt5640.o
 obj-$(CONFIG_SND_SOC_INTEL_BYTCR_RT5651_MACH) += snd-soc-sst-bytcr-rt5651.o
 obj-$(CONFIG_SND_SOC_INTEL_CHT_BSW_RT5672_MACH) += snd-soc-sst-cht-bsw-rt5672.o
diff --git a/sound/soc/intel/boards/bdw-rt5677.c b/sound/soc/intel/boards/bdw-rt5677.c
new file mode 100644
index 000000000000..547e6705bf6d
--- /dev/null
+++ b/sound/soc/intel/boards/bdw-rt5677.c
@@ -0,0 +1,347 @@
+/*
+ * ASoC machine driver for Intel Broadwell platforms with RT5677 codec
+ *
+ * Copyright (c) 2014, The Chromium OS Authors.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/gpio/consumer.h>
+#include <linux/delay.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/soc.h>
+#include <sound/pcm_params.h>
+#include <sound/jack.h>
+
+#include "../common/sst-dsp.h"
+#include "../haswell/sst-haswell-ipc.h"
+
+#include "../../codecs/rt5677.h"
+
+struct bdw_rt5677_priv {
+        struct gpio_desc *gpio_hp_en;
+        struct snd_soc_codec *codec;
+};
+
+static int bdw_rt5677_event_hp(struct snd_soc_dapm_widget *w,
+                        struct snd_kcontrol *k, int event)
+{
+        struct snd_soc_dapm_context *dapm = w->dapm;
+        struct snd_soc_card *card = dapm->card;
+        struct bdw_rt5677_priv *bdw_rt5677 = snd_soc_card_get_drvdata(card);
+
+        if (SND_SOC_DAPM_EVENT_ON(event))
+                msleep(70);
+
+        gpiod_set_value_cansleep(bdw_rt5677->gpio_hp_en,
+                SND_SOC_DAPM_EVENT_ON(event));
+
+        return 0;
+}
+
+static const struct snd_soc_dapm_widget bdw_rt5677_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone", bdw_rt5677_event_hp),
+        SND_SOC_DAPM_SPK("Speaker", NULL),
+        SND_SOC_DAPM_MIC("Headset Mic", NULL),
+        SND_SOC_DAPM_MIC("Local DMICs", NULL),
+        SND_SOC_DAPM_MIC("Remote DMICs", NULL),
+};
+
+static const struct snd_soc_dapm_route bdw_rt5677_map[] = {
+        /* Speakers */
+        {"Speaker", NULL, "PDM1L"},
+        {"Speaker", NULL, "PDM1R"},
+
+        /* Headset jack connectors */
+        {"Headphone", NULL, "LOUT1"},
+        {"Headphone", NULL, "LOUT2"},
+        {"IN1P", NULL, "Headset Mic"},
+        {"IN1N", NULL, "Headset Mic"},
+
+        /* Digital MICs
+         * Local DMICs: the two DMICs on the mainboard
+         * Remote DMICs: the two DMICs on the camera module
+         */
+        {"DMIC L1", NULL, "Remote DMICs"},
+        {"DMIC R1", NULL, "Remote DMICs"},
+        {"DMIC L2", NULL, "Local DMICs"},
+        {"DMIC R2", NULL, "Local DMICs"},
+
+        /* CODEC BE connections */
+        {"SSP0 CODEC IN", NULL, "AIF1 Capture"},
+        {"AIF1 Playback", NULL, "SSP0 CODEC OUT"},
+};
+
+static const struct snd_kcontrol_new bdw_rt5677_controls[] = {
+        SOC_DAPM_PIN_SWITCH("Speaker"),
+        SOC_DAPM_PIN_SWITCH("Headphone"),
+        SOC_DAPM_PIN_SWITCH("Headset Mic"),
+        SOC_DAPM_PIN_SWITCH("Local DMICs"),
+        SOC_DAPM_PIN_SWITCH("Remote DMICs"),
+};
+
+
+static struct snd_soc_jack headphone_jack;
+static struct snd_soc_jack mic_jack;
+
+static struct snd_soc_jack_pin headphone_jack_pin = {
+        .pin    = "Headphone",
+        .mask   = SND_JACK_HEADPHONE,
+};
+
+static struct snd_soc_jack_pin mic_jack_pin = {
+        .pin    = "Headset Mic",
+        .mask   = SND_JACK_MICROPHONE,
+};
+
+static struct snd_soc_jack_gpio headphone_jack_gpio = {
+        .name                   = "plug-det",
+        .report                 = SND_JACK_HEADPHONE,
+        .debounce_time          = 200,
+};
+
+static struct snd_soc_jack_gpio mic_jack_gpio = {
+        .name                   = "mic-present",
+        .report                 = SND_JACK_MICROPHONE,
+        .debounce_time          = 200,
+        .invert                 = 1,
+};
+
+static int broadwell_ssp0_fixup(struct snd_soc_pcm_runtime *rtd,
+                        struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *rate = hw_param_interval(params,
+                        SNDRV_PCM_HW_PARAM_RATE);
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+
+        /* The ADSP will covert the FE rate to 48k, stereo */
+        rate->min = rate->max = 48000;
+        channels->min = channels->max = 2;
+
+        /* set SSP0 to 16 bit */
+        snd_mask_set(&params->masks[SNDRV_PCM_HW_PARAM_FORMAT -
+                                    SNDRV_PCM_HW_PARAM_FIRST_MASK],
+                                    SNDRV_PCM_FORMAT_S16_LE);
+        return 0;
+}
+
+static int bdw_rt5677_hw_params(struct snd_pcm_substream *substream,
+        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        ret = snd_soc_dai_set_sysclk(codec_dai, RT5677_SCLK_S_MCLK, 24576000,
+                SND_SOC_CLOCK_IN);
+        if (ret < 0) {
+                dev_err(rtd->dev, "can't set codec sysclk configuration\n");
+                return ret;
+        }
+
+        return ret;
+}
+
+static struct snd_soc_ops bdw_rt5677_ops = {
+        .hw_params = bdw_rt5677_hw_params,
+};
+
+static int bdw_rt5677_rtd_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct sst_pdata *pdata = dev_get_platdata(rtd->platform->dev);
+        struct sst_hsw *broadwell = pdata->dsp;
+        int ret;
+
+        /* Set ADSP SSP port settings */
+        ret = sst_hsw_device_set_config(broadwell, SST_HSW_DEVICE_SSP_0,
+                SST_HSW_DEVICE_MCLK_FREQ_24_MHZ,
+                SST_HSW_DEVICE_CLOCK_MASTER, 9);
+        if (ret < 0) {
+                dev_err(rtd->dev, "error: failed to set device config\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int bdw_rt5677_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct bdw_rt5677_priv *bdw_rt5677 =
+                        snd_soc_card_get_drvdata(rtd->card);
+        struct snd_soc_codec *codec = rtd->codec;
+        struct snd_soc_dapm_context *dapm = snd_soc_codec_get_dapm(codec);
+
+        /* Enable codec ASRC function for Stereo DAC/Stereo1 ADC/DMIC/I2S1.
+         * The ASRC clock source is clk_i2s1_asrc.
+         */
+        rt5677_sel_asrc_clk_src(codec, RT5677_DA_STEREO_FILTER |
+                        RT5677_AD_STEREO1_FILTER | RT5677_I2S1_SOURCE,
+                        RT5677_CLK_SEL_I2S1_ASRC);
+
+        /* Request rt5677 GPIO for headphone amp control */
+        bdw_rt5677->gpio_hp_en = devm_gpiod_get_index(codec->dev,
+                        "headphone-enable", 0, 0);
+        if (IS_ERR(bdw_rt5677->gpio_hp_en)) {
+                dev_err(codec->dev, "Can't find HP_AMP_SHDN_L gpio\n");
+                return PTR_ERR(bdw_rt5677->gpio_hp_en);
+        }
+        gpiod_direction_output(bdw_rt5677->gpio_hp_en, 0);
+
+        /* Create and initialize headphone jack */
+        if (!snd_soc_card_jack_new(rtd->card, "Headphone Jack",
+                        SND_JACK_HEADPHONE, &headphone_jack,
+                        &headphone_jack_pin, 1)) {
+                headphone_jack_gpio.gpiod_dev = codec->dev;
+                if (snd_soc_jack_add_gpios(&headphone_jack, 1,
+                                &headphone_jack_gpio))
+                        dev_err(codec->dev, "Can't add headphone jack gpio\n");
+        } else {
+                dev_err(codec->dev, "Can't create headphone jack\n");
+        }
+
+        /* Create and initialize mic jack */
+        if (!snd_soc_card_jack_new(rtd->card, "Mic Jack",
+                        SND_JACK_MICROPHONE, &mic_jack,
+                        &mic_jack_pin, 1)) {
+                mic_jack_gpio.gpiod_dev = codec->dev;
+                if (snd_soc_jack_add_gpios(&mic_jack, 1, &mic_jack_gpio))
+                        dev_err(codec->dev, "Can't add mic jack gpio\n");
+        } else {
+                dev_err(codec->dev, "Can't create mic jack\n");
+        }
+        bdw_rt5677->codec = codec;
+
+        snd_soc_dapm_force_enable_pin(dapm, "MICBIAS1");
+        return 0;
+}
+
+/* broadwell digital audio interface glue - connects codec <--> CPU */
+static struct snd_soc_dai_link bdw_rt5677_dais[] = {
+        /* Front End DAI links */
+        {
+                .name = "System PCM",
+                .stream_name = "System Playback/Capture",
+                .cpu_dai_name = "System Pin",
+                .platform_name = "haswell-pcm-audio",
+                .dynamic = 1,
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .init = bdw_rt5677_rtd_init,
+                .trigger = {
+                        SND_SOC_DPCM_TRIGGER_POST,
+                        SND_SOC_DPCM_TRIGGER_POST
+                },
+                .dpcm_capture = 1,
+                .dpcm_playback = 1,
+        },
+
+        /* Back End DAI links */
+        {
+                /* SSP0 - Codec */
+                .name = "Codec",
+                .id = 0,
+                .cpu_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "snd-soc-dummy",
+                .no_pcm = 1,
+                .codec_name = "i2c-RT5677CE:00",
+                .codec_dai_name = "rt5677-aif1",
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+                .ignore_suspend = 1,
+                .ignore_pmdown_time = 1,
+                .be_hw_params_fixup = broadwell_ssp0_fixup,
+                .ops = &bdw_rt5677_ops,
+                .dpcm_playback = 1,
+                .dpcm_capture = 1,
+                .init = bdw_rt5677_init,
+        },
+};
+
+static int bdw_rt5677_suspend_pre(struct snd_soc_card *card)
+{
+        struct bdw_rt5677_priv *bdw_rt5677 = snd_soc_card_get_drvdata(card);
+        struct snd_soc_dapm_context *dapm;
+
+        if (bdw_rt5677->codec) {
+                dapm = snd_soc_codec_get_dapm(bdw_rt5677->codec);
+                snd_soc_dapm_disable_pin(dapm, "MICBIAS1");
+        }
+        return 0;
+}
+
+static int bdw_rt5677_resume_post(struct snd_soc_card *card)
+{
+        struct bdw_rt5677_priv *bdw_rt5677 = snd_soc_card_get_drvdata(card);
+        struct snd_soc_dapm_context *dapm;
+
+        if (bdw_rt5677->codec) {
+                dapm = snd_soc_codec_get_dapm(bdw_rt5677->codec);
+                snd_soc_dapm_force_enable_pin(dapm, "MICBIAS1");
+        }
+        return 0;
+}
+
+/* ASoC machine driver for Broadwell DSP + RT5677 */
+static struct snd_soc_card bdw_rt5677_card = {
+        .name = "bdw-rt5677",
+        .owner = THIS_MODULE,
+        .dai_link = bdw_rt5677_dais,
+        .num_links = ARRAY_SIZE(bdw_rt5677_dais),
+        .dapm_widgets = bdw_rt5677_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(bdw_rt5677_widgets),
+        .dapm_routes = bdw_rt5677_map,
+        .num_dapm_routes = ARRAY_SIZE(bdw_rt5677_map),
+        .controls = bdw_rt5677_controls,
+        .num_controls = ARRAY_SIZE(bdw_rt5677_controls),
+        .fully_routed = true,
+        .suspend_pre = bdw_rt5677_suspend_pre,
+        .resume_post = bdw_rt5677_resume_post,
+};
+
+static int bdw_rt5677_probe(struct platform_device *pdev)
+{
+        struct bdw_rt5677_priv *bdw_rt5677;
+
+        bdw_rt5677_card.dev = &pdev->dev;
+
+        /* Allocate driver private struct */
+        bdw_rt5677 = devm_kzalloc(&pdev->dev, sizeof(struct bdw_rt5677_priv),
+                GFP_KERNEL);
+        if (!bdw_rt5677) {
+                dev_err(&pdev->dev, "Can't allocate bdw_rt5677\n");
+                return -ENOMEM;
+        }
+
+        snd_soc_card_set_drvdata(&bdw_rt5677_card, bdw_rt5677);
+
+        return devm_snd_soc_register_card(&pdev->dev, &bdw_rt5677_card);
+}
+
+static struct platform_driver bdw_rt5677_audio = {
+        .probe = bdw_rt5677_probe,
+        .driver = {
+                .name = "bdw-rt5677",
+        },
+};
+
+module_platform_driver(bdw_rt5677_audio)
+
+/* Module information */
+MODULE_AUTHOR("Ben Zhang");
+MODULE_DESCRIPTION("Intel Broadwell RT5677 machine driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:bdw-rt5677");
diff --git a/sound/soc/intel/boards/bxt_da7219_max98357a.c b/sound/soc/intel/boards/bxt_da7219_max98357a.c
index 3774b117d365..6532b8f0ab2f 100644
--- a/sound/soc/intel/boards/bxt_da7219_max98357a.c
+++ b/sound/soc/intel/boards/bxt_da7219_max98357a.c
@@ -37,6 +37,7 @@ enum {
         BXT_DPCM_AUDIO_PB = 0,
         BXT_DPCM_AUDIO_CP,
         BXT_DPCM_AUDIO_REF_CP,
+        BXT_DPCM_AUDIO_DMIC_CP,
         BXT_DPCM_AUDIO_HDMI1_PB,
         BXT_DPCM_AUDIO_HDMI2_PB,
         BXT_DPCM_AUDIO_HDMI3_PB,
@@ -252,10 +253,56 @@ static struct snd_soc_ops broxton_da7219_ops = {
         .hw_free = broxton_da7219_hw_free,
 };
 
+static int broxton_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
+                        struct snd_pcm_hw_params *params)
+{
+        struct snd_interval *channels = hw_param_interval(params,
+                                                SNDRV_PCM_HW_PARAM_CHANNELS);
+        channels->min = channels->max = DUAL_CHANNEL;
+
+        return 0;
+}
+
+static int broxton_dmic_startup(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime = substream->runtime;
+
+        runtime->hw.channels_max = DUAL_CHANNEL;
+        snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+                        &constraints_channels);
+
+        return snd_pcm_hw_constraint_list(substream->runtime, 0,
+                        SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
+}
+
+static const struct snd_soc_ops broxton_dmic_ops = {
+        .startup = broxton_dmic_startup,
+};
+
+static const unsigned int rates_16000[] = {
+        16000,
+};
+
+static const struct snd_pcm_hw_constraint_list constraints_16000 = {
+        .count = ARRAY_SIZE(rates_16000),
+        .list  = rates_16000,
+};
+
+static int broxton_refcap_startup(struct snd_pcm_substream *substream)
+{
+        return snd_pcm_hw_constraint_list(substream->runtime, 0,
+                        SNDRV_PCM_HW_PARAM_RATE,
+                        &constraints_16000);
+};
+
+static struct snd_soc_ops broxton_refcap_ops = {
+        .startup = broxton_refcap_startup,
+};
+
 /* broxton digital audio interface glue - connects codec <--> CPU */
 static struct snd_soc_dai_link broxton_dais[] = {
         /* Front End DAI links */
-        [BXT_DPCM_AUDIO_PB]
+        [BXT_DPCM_AUDIO_PB] =
         {
                 .name = "Bxt Audio Port",
                 .stream_name = "Audio",
@@ -271,7 +318,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
                 .dpcm_playback = 1,
                 .ops = &broxton_da7219_fe_ops,
         },
-        [BXT_DPCM_AUDIO_CP]
+        [BXT_DPCM_AUDIO_CP] =
         {
                 .name = "Bxt Audio Capture Port",
                 .stream_name = "Audio Record",
@@ -286,7 +333,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
                 .dpcm_capture = 1,
                 .ops = &broxton_da7219_fe_ops,
         },
-        [BXT_DPCM_AUDIO_REF_CP]
+        [BXT_DPCM_AUDIO_REF_CP] =
         {
                 .name = "Bxt Audio Reference cap",
                 .stream_name = "Refcap",
@@ -299,8 +346,23 @@ static struct snd_soc_dai_link broxton_dais[] = {
                 .ignore_suspend = 1,
                 .nonatomic = 1,
                 .dynamic = 1,
+                .ops = &broxton_refcap_ops,
+        },
+        [BXT_DPCM_AUDIO_DMIC_CP]
+        {
+                .name = "Bxt Audio DMIC cap",
+                .stream_name = "dmiccap",
+                .cpu_dai_name = "DMIC Pin",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+                .platform_name = "0000:00:0e.0",
+                .init = NULL,
+                .dpcm_capture = 1,
+                .nonatomic = 1,
+                .dynamic = 1,
+                .ops = &broxton_dmic_ops,
         },
-        [BXT_DPCM_AUDIO_HDMI1_PB]
+        [BXT_DPCM_AUDIO_HDMI1_PB] =
         {
                 .name = "Bxt HDMI Port1",
                 .stream_name = "Hdmi1",
@@ -313,7 +375,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
                 .nonatomic = 1,
                 .dynamic = 1,
         },
-        [BXT_DPCM_AUDIO_HDMI2_PB]
+        [BXT_DPCM_AUDIO_HDMI2_PB] =
         {
                 .name = "Bxt HDMI Port2",
                 .stream_name = "Hdmi2",
@@ -326,7 +388,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
                 .nonatomic = 1,
                 .dynamic = 1,
         },
-        [BXT_DPCM_AUDIO_HDMI3_PB]
+        [BXT_DPCM_AUDIO_HDMI3_PB] =
         {
                 .name = "Bxt HDMI Port3",
                 .stream_name = "Hdmi3",
@@ -382,6 +444,7 @@ static struct snd_soc_dai_link broxton_dais[] = {
                 .codec_dai_name = "dmic-hifi",
                 .platform_name = "0000:00:0e.0",
                 .ignore_suspend = 1,
+                .be_hw_params_fixup = broxton_dmic_fixup,
                 .dpcm_capture = 1,
                 .no_pcm = 1,
         },
diff --git a/sound/soc/intel/boards/bxt_rt298.c b/sound/soc/intel/boards/bxt_rt298.c
index 253d7bfbf511..d610bdca1608 100644
--- a/sound/soc/intel/boards/bxt_rt298.c
+++ b/sound/soc/intel/boards/bxt_rt298.c
@@ -271,7 +271,7 @@ static const struct snd_soc_ops broxton_rt286_fe_ops = {
 /* broxton digital audio interface glue - connects codec <--> CPU */
 static struct snd_soc_dai_link broxton_rt298_dais[] = {
         /* Front End DAI links */
-        [BXT_DPCM_AUDIO_PB]
+        [BXT_DPCM_AUDIO_PB] =
         {
                 .name = "Bxt Audio Port",
                 .stream_name = "Audio",
@@ -286,7 +286,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
                 .dpcm_playback = 1,
                 .ops = &broxton_rt286_fe_ops,
         },
-        [BXT_DPCM_AUDIO_CP]
+        [BXT_DPCM_AUDIO_CP] =
         {
                 .name = "Bxt Audio Capture Port",
                 .stream_name = "Audio Record",
@@ -300,7 +300,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
                 .dpcm_capture = 1,
                 .ops = &broxton_rt286_fe_ops,
         },
-        [BXT_DPCM_AUDIO_REF_CP]
+        [BXT_DPCM_AUDIO_REF_CP] =
         {
                 .name = "Bxt Audio Reference cap",
                 .stream_name = "refcap",
@@ -313,7 +313,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
                 .nonatomic = 1,
                 .dynamic = 1,
         },
-        [BXT_DPCM_AUDIO_DMIC_CP]
+        [BXT_DPCM_AUDIO_DMIC_CP] =
         {
                 .name = "Bxt Audio DMIC cap",
                 .stream_name = "dmiccap",
@@ -327,7 +327,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
                 .dynamic = 1,
                 .ops = &broxton_dmic_ops,
         },
-        [BXT_DPCM_AUDIO_HDMI1_PB]
+        [BXT_DPCM_AUDIO_HDMI1_PB] =
         {
                 .name = "Bxt HDMI Port1",
                 .stream_name = "Hdmi1",
@@ -340,7 +340,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
                 .nonatomic = 1,
                 .dynamic = 1,
         },
-        [BXT_DPCM_AUDIO_HDMI2_PB]
+        [BXT_DPCM_AUDIO_HDMI2_PB] =
         {
                 .name = "Bxt HDMI Port2",
                 .stream_name = "Hdmi2",
@@ -353,7 +353,7 @@ static struct snd_soc_dai_link broxton_rt298_dais[] = {
                 .nonatomic = 1,
                 .dynamic = 1,
         },
-        [BXT_DPCM_AUDIO_HDMI3_PB]
+        [BXT_DPCM_AUDIO_HDMI3_PB] =
         {
                 .name = "Bxt HDMI Port3",
                 .stream_name = "Hdmi3",
diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 88efb62439ba..bff77a1f27fc 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -24,6 +24,9 @@
 #include <linux/device.h>
 #include <linux/dmi.h>
 #include <linux/slab.h>
+#include <asm/cpu_device_id.h>
+#include <asm/platform_sst_audio.h>
+#include <linux/clk.h>
 #include <sound/pcm.h>
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
@@ -31,42 +34,153 @@
 #include "../../codecs/rt5640.h"
 #include "../atom/sst-atom-controls.h"
 #include "../common/sst-acpi.h"
+#include "../common/sst-dsp.h"
 
 enum {
         BYT_RT5640_DMIC1_MAP,
         BYT_RT5640_DMIC2_MAP,
         BYT_RT5640_IN1_MAP,
+        BYT_RT5640_IN3_MAP,
 };
 
 #define BYT_RT5640_MAP(quirk)   ((quirk) & 0xff)
 #define BYT_RT5640_DMIC_EN      BIT(16)
+#define BYT_RT5640_MONO_SPEAKER BIT(17)
+#define BYT_RT5640_DIFF_MIC     BIT(18) /* defaut is single-ended */
+#define BYT_RT5640_SSP2_AIF2     BIT(19) /* default is using AIF1  */
+#define BYT_RT5640_SSP0_AIF1     BIT(20)
+#define BYT_RT5640_SSP0_AIF2     BIT(21)
+#define BYT_RT5640_MCLK_EN      BIT(22)
+#define BYT_RT5640_MCLK_25MHZ   BIT(23)
+
+struct byt_rt5640_private {
+        struct clk *mclk;
+};
 
 static unsigned long byt_rt5640_quirk = BYT_RT5640_DMIC1_MAP |
-                                        BYT_RT5640_DMIC_EN;
+                                        BYT_RT5640_DMIC_EN |
+                                        BYT_RT5640_MCLK_EN;
+
+static void log_quirks(struct device *dev)
+{
+        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_DMIC1_MAP)
+                dev_info(dev, "quirk DMIC1_MAP enabled");
+        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_DMIC2_MAP)
+                dev_info(dev, "quirk DMIC2_MAP enabled");
+        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_IN1_MAP)
+                dev_info(dev, "quirk IN1_MAP enabled");
+        if (BYT_RT5640_MAP(byt_rt5640_quirk) == BYT_RT5640_IN3_MAP)
+                dev_info(dev, "quirk IN3_MAP enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_DMIC_EN)
+                dev_info(dev, "quirk DMIC enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER)
+                dev_info(dev, "quirk MONO_SPEAKER enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC)
+                dev_info(dev, "quirk DIFF_MIC enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2)
+                dev_info(dev, "quirk SSP2_AIF2 enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1)
+                dev_info(dev, "quirk SSP0_AIF1 enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2)
+                dev_info(dev, "quirk SSP0_AIF2 enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_MCLK_EN)
+                dev_info(dev, "quirk MCLK_EN enabled");
+        if (byt_rt5640_quirk & BYT_RT5640_MCLK_25MHZ)
+                dev_info(dev, "quirk MCLK_25MHZ enabled");
+}
+
+
+#define BYT_CODEC_DAI1  "rt5640-aif1"
+#define BYT_CODEC_DAI2  "rt5640-aif2"
+
+static inline struct snd_soc_dai *byt_get_codec_dai(struct snd_soc_card *card)
+{
+        struct snd_soc_pcm_runtime *rtd;
+
+        list_for_each_entry(rtd, &card->rtd_list, list) {
+                if (!strncmp(rtd->codec_dai->name, BYT_CODEC_DAI1,
+                             strlen(BYT_CODEC_DAI1)))
+                        return rtd->codec_dai;
+                if (!strncmp(rtd->codec_dai->name, BYT_CODEC_DAI2,
+                                strlen(BYT_CODEC_DAI2)))
+                        return rtd->codec_dai;
+
+        }
+        return NULL;
+}
+
+static int platform_clock_control(struct snd_soc_dapm_widget *w,
+                                  struct snd_kcontrol *k, int  event)
+{
+        struct snd_soc_dapm_context *dapm = w->dapm;
+        struct snd_soc_card *card = dapm->card;
+        struct snd_soc_dai *codec_dai;
+        struct byt_rt5640_private *priv = snd_soc_card_get_drvdata(card);
+        int ret;
+
+        codec_dai = byt_get_codec_dai(card);
+        if (!codec_dai) {
+                dev_err(card->dev,
+                        "Codec dai not found; Unable to set platform clock\n");
+                return -EIO;
+        }
+
+        if (SND_SOC_DAPM_EVENT_ON(event)) {
+                if ((byt_rt5640_quirk & BYT_RT5640_MCLK_EN) && priv->mclk) {
+                        ret = clk_prepare_enable(priv->mclk);
+                        if (ret < 0) {
+                                dev_err(card->dev,
+                                        "could not configure MCLK state");
+                                return ret;
+                        }
+                }
+                ret = snd_soc_dai_set_sysclk(codec_dai, RT5640_SCLK_S_PLL1,
+                                             48000 * 512,
+                                             SND_SOC_CLOCK_IN);
+        } else {
+                /*
+                 * Set codec clock source to internal clock before
+                 * turning off the platform clock. Codec needs clock
+                 * for Jack detection and button press
+                 */
+                ret = snd_soc_dai_set_sysclk(codec_dai, RT5640_SCLK_S_RCCLK,
+                                             0,
+                                             SND_SOC_CLOCK_IN);
+                if (!ret) {
+                        if ((byt_rt5640_quirk & BYT_RT5640_MCLK_EN) && priv->mclk)
+                                clk_disable_unprepare(priv->mclk);
+                }
+        }
+
+        if (ret < 0) {
+                dev_err(card->dev, "can't set codec sysclk: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
 
 static const struct snd_soc_dapm_widget byt_rt5640_widgets[] = {
         SND_SOC_DAPM_HP("Headphone", NULL),
         SND_SOC_DAPM_MIC("Headset Mic", NULL),
         SND_SOC_DAPM_MIC("Internal Mic", NULL),
         SND_SOC_DAPM_SPK("Speaker", NULL),
+        SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0,
+                            platform_clock_control, SND_SOC_DAPM_PRE_PMU |
+                            SND_SOC_DAPM_POST_PMD),
+
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_audio_map[] = {
-        {"AIF1 Playback", NULL, "ssp2 Tx"},
-        {"ssp2 Tx", NULL, "codec_out0"},
-        {"ssp2 Tx", NULL, "codec_out1"},
-        {"codec_in0", NULL, "ssp2 Rx"},
-        {"codec_in1", NULL, "ssp2 Rx"},
-        {"ssp2 Rx", NULL, "AIF1 Capture"},
+        {"Headphone", NULL, "Platform Clock"},
+        {"Headset Mic", NULL, "Platform Clock"},
+        {"Internal Mic", NULL, "Platform Clock"},
+        {"Speaker", NULL, "Platform Clock"},
 
         {"Headset Mic", NULL, "MICBIAS1"},
         {"IN2P", NULL, "Headset Mic"},
         {"Headphone", NULL, "HPOL"},
         {"Headphone", NULL, "HPOR"},
-        {"Speaker", NULL, "SPOLP"},
-        {"Speaker", NULL, "SPOLN"},
-        {"Speaker", NULL, "SPORP"},
-        {"Speaker", NULL, "SPORN"},
 };
 
 static const struct snd_soc_dapm_route byt_rt5640_intmic_dmic1_map[] = {
@@ -82,6 +196,59 @@ static const struct snd_soc_dapm_route byt_rt5640_intmic_in1_map[] = {
         {"IN1P", NULL, "Internal Mic"},
 };
 
+static const struct snd_soc_dapm_route byt_rt5640_intmic_in3_map[] = {
+        {"Internal Mic", NULL, "MICBIAS1"},
+        {"IN3P", NULL, "Internal Mic"},
+};
+
+static const struct snd_soc_dapm_route byt_rt5640_ssp2_aif1_map[] = {
+        {"ssp2 Tx", NULL, "codec_out0"},
+        {"ssp2 Tx", NULL, "codec_out1"},
+        {"codec_in0", NULL, "ssp2 Rx"},
+        {"codec_in1", NULL, "ssp2 Rx"},
+
+        {"AIF1 Playback", NULL, "ssp2 Tx"},
+        {"ssp2 Rx", NULL, "AIF1 Capture"},
+};
+
+static const struct snd_soc_dapm_route byt_rt5640_ssp2_aif2_map[] = {
+        {"ssp2 Tx", NULL, "codec_out0"},
+        {"ssp2 Tx", NULL, "codec_out1"},
+        {"codec_in0", NULL, "ssp2 Rx"},
+        {"codec_in1", NULL, "ssp2 Rx"},
+
+        {"AIF2 Playback", NULL, "ssp2 Tx"},
+        {"ssp2 Rx", NULL, "AIF2 Capture"},
+};
+
+static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif1_map[] = {
+        {"ssp0 Tx", NULL, "modem_out"},
+        {"modem_in", NULL, "ssp0 Rx"},
+
+        {"AIF1 Playback", NULL, "ssp0 Tx"},
+        {"ssp0 Rx", NULL, "AIF1 Capture"},
+};
+
+static const struct snd_soc_dapm_route byt_rt5640_ssp0_aif2_map[] = {
+        {"ssp0 Tx", NULL, "modem_out"},
+        {"modem_in", NULL, "ssp0 Rx"},
+
+        {"AIF2 Playback", NULL, "ssp0 Tx"},
+        {"ssp0 Rx", NULL, "AIF2 Capture"},
+};
+
+static const struct snd_soc_dapm_route byt_rt5640_stereo_spk_map[] = {
+        {"Speaker", NULL, "SPOLP"},
+        {"Speaker", NULL, "SPOLN"},
+        {"Speaker", NULL, "SPORP"},
+        {"Speaker", NULL, "SPORN"},
+};
+
+static const struct snd_soc_dapm_route byt_rt5640_mono_spk_map[] = {
+        {"Speaker", NULL, "SPOLP"},
+        {"Speaker", NULL, "SPOLN"},
+};
+
 static const struct snd_kcontrol_new byt_rt5640_controls[] = {
         SOC_DAPM_PIN_SWITCH("Headphone"),
         SOC_DAPM_PIN_SWITCH("Headset Mic"),
@@ -96,19 +263,46 @@ static int byt_rt5640_aif1_hw_params(struct snd_pcm_substream *substream,
         struct snd_soc_dai *codec_dai = rtd->codec_dai;
         int ret;
 
-        snd_soc_dai_set_bclk_ratio(codec_dai, 50);
-
         ret = snd_soc_dai_set_sysclk(codec_dai, RT5640_SCLK_S_PLL1,
                                      params_rate(params) * 512,
                                      SND_SOC_CLOCK_IN);
+
         if (ret < 0) {
                 dev_err(rtd->dev, "can't set codec clock %d\n", ret);
                 return ret;
         }
 
-        ret = snd_soc_dai_set_pll(codec_dai, 0, RT5640_PLL1_S_BCLK1,
-                                  params_rate(params) * 50,
-                                  params_rate(params) * 512);
+        if (!(byt_rt5640_quirk & BYT_RT5640_MCLK_EN)) {
+                /* use bitclock as PLL input */
+                if ((byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) ||
+                        (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2)) {
+
+                        /* 2x16 bit slots on SSP0 */
+                        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                                                RT5640_PLL1_S_BCLK1,
+                                                params_rate(params) * 32,
+                                                params_rate(params) * 512);
+                } else {
+                        /* 2x15 bit slots on SSP2 */
+                        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                                                RT5640_PLL1_S_BCLK1,
+                                                params_rate(params) * 50,
+                                                params_rate(params) * 512);
+                }
+        } else {
+                if (byt_rt5640_quirk & BYT_RT5640_MCLK_25MHZ) {
+                        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                                                RT5640_PLL1_S_MCLK,
+                                                25000000,
+                                                params_rate(params) * 512);
+                } else {
+                        ret = snd_soc_dai_set_pll(codec_dai, 0,
+                                                RT5640_PLL1_S_MCLK,
+                                                19200000,
+                                                params_rate(params) * 512);
+                }
+        }
+
         if (ret < 0) {
                 dev_err(rtd->dev, "can't set codec pll: %d\n", ret);
                 return ret;
@@ -127,27 +321,73 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
         {
                 .callback = byt_rt5640_quirk_cb,
                 .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "T100TA"),
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"),
+                },
+                .driver_data = (unsigned long *)(BYT_RT5640_IN1_MAP |
+                                                 BYT_RT5640_MCLK_EN),
+        },
+        {
+                .callback = byt_rt5640_quirk_cb,
+                .matches = {
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TAF"),
                 },
-                .driver_data = (unsigned long *)BYT_RT5640_IN1_MAP,
+                .driver_data = (unsigned long *)(BYT_RT5640_IN1_MAP |
+                                                 BYT_RT5640_MONO_SPEAKER |
+                                                 BYT_RT5640_DIFF_MIC |
+                                                 BYT_RT5640_SSP0_AIF2 |
+                                                 BYT_RT5640_MCLK_EN
+                                                 ),
         },
         {
                 .callback = byt_rt5640_quirk_cb,
                 .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "DellInc."),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Venue 8 Pro 5830"),
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "DellInc."),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Venue 8 Pro 5830"),
                 },
                 .driver_data = (unsigned long *)(BYT_RT5640_DMIC2_MAP |
+                                                 BYT_RT5640_DMIC_EN |
+                                                 BYT_RT5640_MCLK_EN),
+        },
+        {
+                .callback = byt_rt5640_quirk_cb,
+                .matches = {
+                        DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP ElitePad 1000 G2"),
+                },
+                .driver_data = (unsigned long *)(BYT_RT5640_IN1_MAP |
+                                                 BYT_RT5640_MCLK_EN),
+        },
+        {
+                .callback = byt_rt5640_quirk_cb,
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Circuitco"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Minnowboard Max B3 PLATFORM"),
+                },
+                .driver_data = (unsigned long *)(BYT_RT5640_DMIC1_MAP |
                                                  BYT_RT5640_DMIC_EN),
         },
         {
                 .callback = byt_rt5640_quirk_cb,
                 .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "HP ElitePad 1000 G2"),
+                        DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"),
+                        DMI_MATCH(DMI_BOARD_NAME, "tPAD"),
                 },
-                .driver_data = (unsigned long *)BYT_RT5640_IN1_MAP,
+                .driver_data = (unsigned long *)(BYT_RT5640_IN3_MAP |
+                                                BYT_RT5640_MCLK_EN |
+                                                BYT_RT5640_SSP0_AIF1),
+        },
+        {
+                .callback = byt_rt5640_quirk_cb,
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
+                },
+                .driver_data = (unsigned long *)(BYT_RT5640_IN1_MAP |
+                                                 BYT_RT5640_MCLK_EN |
+                                                 BYT_RT5640_SSP0_AIF1),
+
         },
         {}
 };
@@ -158,13 +398,18 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime)
         struct snd_soc_codec *codec = runtime->codec;
         struct snd_soc_card *card = runtime->card;
         const struct snd_soc_dapm_route *custom_map;
+        struct byt_rt5640_private *priv = snd_soc_card_get_drvdata(card);
         int num_routes;
 
         card->dapm.idle_bias_off = true;
 
         rt5640_sel_asrc_clk_src(codec,
                                 RT5640_DA_STEREO_FILTER |
-                                RT5640_AD_STEREO_FILTER,
+                                RT5640_DA_MONO_L_FILTER |
+                                RT5640_DA_MONO_R_FILTER |
+                                RT5640_AD_STEREO_FILTER |
+                                RT5640_AD_MONO_L_FILTER |
+                                RT5640_AD_MONO_R_FILTER,
                                 RT5640_CLK_SEL_ASRC);
 
         ret = snd_soc_add_card_controls(card, byt_rt5640_controls,
@@ -179,6 +424,10 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime)
                 custom_map = byt_rt5640_intmic_in1_map;
                 num_routes = ARRAY_SIZE(byt_rt5640_intmic_in1_map);
                 break;
+        case BYT_RT5640_IN3_MAP:
+                custom_map = byt_rt5640_intmic_in3_map;
+                num_routes = ARRAY_SIZE(byt_rt5640_intmic_in3_map);
+                break;
         case BYT_RT5640_DMIC2_MAP:
                 custom_map = byt_rt5640_intmic_dmic2_map;
                 num_routes = ARRAY_SIZE(byt_rt5640_intmic_dmic2_map);
@@ -192,6 +441,43 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime)
         if (ret)
                 return ret;
 
+        if (byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2) {
+                ret = snd_soc_dapm_add_routes(&card->dapm,
+                                        byt_rt5640_ssp2_aif2_map,
+                                        ARRAY_SIZE(byt_rt5640_ssp2_aif2_map));
+        } else if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) {
+                ret = snd_soc_dapm_add_routes(&card->dapm,
+                                        byt_rt5640_ssp0_aif1_map,
+                                        ARRAY_SIZE(byt_rt5640_ssp0_aif1_map));
+        } else if (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2) {
+                ret = snd_soc_dapm_add_routes(&card->dapm,
+                                        byt_rt5640_ssp0_aif2_map,
+                                        ARRAY_SIZE(byt_rt5640_ssp0_aif2_map));
+        } else {
+                ret = snd_soc_dapm_add_routes(&card->dapm,
+                                        byt_rt5640_ssp2_aif1_map,
+                                        ARRAY_SIZE(byt_rt5640_ssp2_aif1_map));
+        }
+        if (ret)
+                return ret;
+
+        if (byt_rt5640_quirk & BYT_RT5640_MONO_SPEAKER) {
+                ret = snd_soc_dapm_add_routes(&card->dapm,
+                                        byt_rt5640_mono_spk_map,
+                                        ARRAY_SIZE(byt_rt5640_mono_spk_map));
+        } else {
+                ret = snd_soc_dapm_add_routes(&card->dapm,
+                                        byt_rt5640_stereo_spk_map,
+                                        ARRAY_SIZE(byt_rt5640_stereo_spk_map));
+        }
+        if (ret)
+                return ret;
+
+        if (byt_rt5640_quirk & BYT_RT5640_DIFF_MIC) {
+                snd_soc_update_bits(codec,  RT5640_IN1_IN2, RT5640_IN_DF1,
+                                    RT5640_IN_DF1);
+        }
+
         if (byt_rt5640_quirk & BYT_RT5640_DMIC_EN) {
                 ret = rt5640_dmic_enable(codec, 0, 0);
                 if (ret)
@@ -201,6 +487,30 @@ static int byt_rt5640_init(struct snd_soc_pcm_runtime *runtime)
         snd_soc_dapm_ignore_suspend(&card->dapm, "Headphone");
         snd_soc_dapm_ignore_suspend(&card->dapm, "Speaker");
 
+        if ((byt_rt5640_quirk & BYT_RT5640_MCLK_EN) && priv->mclk) {
+                /*
+                 * The firmware might enable the clock at
+                 * boot (this information may or may not
+                 * be reflected in the enable clock register).
+                 * To change the rate we must disable the clock
+                 * first to cover these cases. Due to common
+                 * clock framework restrictions that do not allow
+                 * to disable a clock that has not been enabled,
+                 * we need to enable the clock first.
+                 */
+                ret = clk_prepare_enable(priv->mclk);
+                if (!ret)
+                        clk_disable_unprepare(priv->mclk);
+
+                if (byt_rt5640_quirk & BYT_RT5640_MCLK_25MHZ)
+                        ret = clk_set_rate(priv->mclk, 25000000);
+                else
+                        ret = clk_set_rate(priv->mclk, 19200000);
+
+                if (ret)
+                        dev_err(card->dev, "unable to set MCLK rate\n");
+        }
+
         return ret;
 }
 
@@ -221,34 +531,63 @@ static int byt_rt5640_codec_fixup(struct snd_soc_pcm_runtime *rtd,
                                                 SNDRV_PCM_HW_PARAM_CHANNELS);
         int ret;
 
-        /* The DSP will covert the FE rate to 48k, stereo, 24bits */
+        /* The DSP will covert the FE rate to 48k, stereo */
         rate->min = rate->max = 48000;
         channels->min = channels->max = 2;
 
-        /* set SSP2 to 24-bit */
-        params_set_format(params, SNDRV_PCM_FORMAT_S24_LE);
+        if ((byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) ||
+                (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2)) {
+
+                /* set SSP0 to 16-bit */
+                params_set_format(params, SNDRV_PCM_FORMAT_S16_LE);
+
+                /*
+                 * Default mode for SSP configuration is TDM 4 slot, override config
+                 * with explicit setting to I2S 2ch 16-bit. The word length is set with
+                 * dai_set_tdm_slot() since there is no other API exposed
+                 */
+                ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+                                        SND_SOC_DAIFMT_I2S     |
+                                        SND_SOC_DAIFMT_NB_IF   |
+                                        SND_SOC_DAIFMT_CBS_CFS
+                        );
+                if (ret < 0) {
+                        dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
+                        return ret;
+                }
 
-        /*
-         * Default mode for SSP configuration is TDM 4 slot, override config
-         * with explicit setting to I2S 2ch 24-bit. The word length is set with
-         * dai_set_tdm_slot() since there is no other API exposed
-         */
-        ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
-                                  SND_SOC_DAIFMT_I2S     |
-                                  SND_SOC_DAIFMT_NB_IF   |
-                                  SND_SOC_DAIFMT_CBS_CFS
-                                  );
-        if (ret < 0) {
-                dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
-                return ret;
-        }
+                ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 16);
+                if (ret < 0) {
+                        dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
+                        return ret;
+                }
 
-        ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 24);
-        if (ret < 0) {
-                dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
-                return ret;
-        }
+        } else {
+
+                /* set SSP2 to 24-bit */
+                params_set_format(params, SNDRV_PCM_FORMAT_S24_LE);
+
+                /*
+                 * Default mode for SSP configuration is TDM 4 slot, override config
+                 * with explicit setting to I2S 2ch 24-bit. The word length is set with
+                 * dai_set_tdm_slot() since there is no other API exposed
+                 */
+                ret = snd_soc_dai_set_fmt(rtd->cpu_dai,
+                                        SND_SOC_DAIFMT_I2S     |
+                                        SND_SOC_DAIFMT_NB_IF   |
+                                        SND_SOC_DAIFMT_CBS_CFS
+                        );
+                if (ret < 0) {
+                        dev_err(rtd->dev, "can't set format to I2S, err %d\n", ret);
+                        return ret;
+                }
 
+                ret = snd_soc_dai_set_tdm_slot(rtd->cpu_dai, 0x3, 0x3, 2, 24);
+                if (ret < 0) {
+                        dev_err(rtd->dev, "can't set I2S config, err %d\n", ret);
+                        return ret;
+                }
+        }
         return 0;
 }
 
@@ -305,10 +644,10 @@ static struct snd_soc_dai_link byt_rt5640_dais[] = {
         {
                 .name = "SSP2-Codec",
                 .id = 1,
-                .cpu_dai_name = "ssp2-port",
+                .cpu_dai_name = "ssp2-port", /* overwritten for ssp0 routing */
                 .platform_name = "sst-mfld-platform",
                 .no_pcm = 1,
-                .codec_dai_name = "rt5640-aif1",
+                .codec_dai_name = "rt5640-aif1", /* changed w/ quirk */
                 .codec_name = "i2c-10EC5640:00", /* overwritten with HID */
                 .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
                                                 | SND_SOC_DAIFMT_CBS_CFS,
@@ -335,6 +674,21 @@ static struct snd_soc_card byt_rt5640_card = {
 };
 
 static char byt_rt5640_codec_name[16]; /* i2c-<HID>:00 with HID being 8 chars */
+static char byt_rt5640_codec_aif_name[12]; /*  = "rt5640-aif[1|2]" */
+static char byt_rt5640_cpu_dai_name[10]; /*  = "ssp[0|2]-port" */
+
+static bool is_valleyview(void)
+{
+        static const struct x86_cpu_id cpu_ids[] = {
+                { X86_VENDOR_INTEL, 6, 55 }, /* Valleyview, Bay Trail */
+                {}
+        };
+
+        if (!x86_match_cpu(cpu_ids))
+                return false;
+        return true;
+}
+
 
 static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
 {
@@ -343,10 +697,16 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
         const char *i2c_name = NULL;
         int i;
         int dai_index;
+        struct byt_rt5640_private *priv;
+
+        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_ATOMIC);
+        if (!priv)
+                return -ENOMEM;
 
         /* register the soc card */
         byt_rt5640_card.dev = &pdev->dev;
         mach = byt_rt5640_card.dev->platform_data;
+        snd_soc_card_set_drvdata(&byt_rt5640_card, priv);
 
         /* fix index of codec dai */
         dai_index = MERR_DPCM_COMPR + 1;
@@ -366,8 +726,57 @@ static int snd_byt_rt5640_mc_probe(struct platform_device *pdev)
                 byt_rt5640_dais[dai_index].codec_name = byt_rt5640_codec_name;
         }
 
+        /*
+         * swap SSP0 if bytcr is detected
+         * (will be overridden if DMI quirk is detected)
+         */
+        if (is_valleyview()) {
+                struct sst_platform_info *p_info = mach->pdata;
+                const struct sst_res_info *res_info = p_info->res_info;
+
+                /* TODO: use CHAN package info from BIOS to detect AIF1/AIF2 */
+                if (res_info->acpi_ipc_irq_index == 0) {
+                        byt_rt5640_quirk |= BYT_RT5640_SSP0_AIF2;
+                }
+        }
+
         /* check quirks before creating card */
         dmi_check_system(byt_rt5640_quirk_table);
+        log_quirks(&pdev->dev);
+
+        if ((byt_rt5640_quirk & BYT_RT5640_SSP2_AIF2) ||
+            (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2)) {
+
+                /* fixup codec aif name */
+                snprintf(byt_rt5640_codec_aif_name,
+                        sizeof(byt_rt5640_codec_aif_name),
+                        "%s", "rt5640-aif2");
+
+                byt_rt5640_dais[dai_index].codec_dai_name =
+                        byt_rt5640_codec_aif_name;
+        }
+
+        if ((byt_rt5640_quirk & BYT_RT5640_SSP0_AIF1) ||
+            (byt_rt5640_quirk & BYT_RT5640_SSP0_AIF2)) {
+
+                /* fixup cpu dai name name */
+                snprintf(byt_rt5640_cpu_dai_name,
+                        sizeof(byt_rt5640_cpu_dai_name),
+                        "%s", "ssp0-port");
+
+                byt_rt5640_dais[dai_index].cpu_dai_name =
+                        byt_rt5640_cpu_dai_name;
+        }
+
+        if ((byt_rt5640_quirk & BYT_RT5640_MCLK_EN) && (is_valleyview())) {
+                priv->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
+                if (IS_ERR(priv->mclk)) {
+                        dev_err(&pdev->dev,
+                                "Failed to get MCLK from pmc_plt_clk_3: %ld\n",
+                                PTR_ERR(priv->mclk));
+                        return PTR_ERR(priv->mclk);
+                }
+        }
 
         ret_val = devm_snd_soc_register_card(&pdev->dev, &byt_rt5640_card);
 
diff --git a/sound/soc/intel/common/sst-acpi.c b/sound/soc/intel/common/sst-acpi.c
index 2c5eda14d510..1285cc597b6b 100644
--- a/sound/soc/intel/common/sst-acpi.c
+++ b/sound/soc/intel/common/sst-acpi.c
@@ -199,6 +199,7 @@ static struct sst_acpi_desc sst_acpi_haswell_desc = {
 
 static struct sst_acpi_mach broadwell_machines[] = {
         { "INT343A", "broadwell-audio", "intel/IntcSST2.bin", NULL, NULL, NULL },
+        { "RT5677CE", "bdw-rt5677", "intel/IntcSST2.bin", NULL, NULL, NULL },
         {}
 };
 
diff --git a/sound/soc/intel/haswell/sst-haswell-pcm.c b/sound/soc/intel/haswell/sst-haswell-pcm.c
index 3154525c2b83..9e4094e2c6e3 100644
--- a/sound/soc/intel/haswell/sst-haswell-pcm.c
+++ b/sound/soc/intel/haswell/sst-haswell-pcm.c
@@ -871,7 +871,7 @@ out:
         return ret;
 }
 
-static struct snd_pcm_ops hsw_pcm_ops = {
+static const struct snd_pcm_ops hsw_pcm_ops = {
         .open           = hsw_pcm_open,
         .close          = hsw_pcm_close,
         .ioctl          = snd_pcm_lib_ioctl,
diff --git a/sound/soc/intel/skylake/bxt-sst.c b/sound/soc/intel/skylake/bxt-sst.c
index 2663781278aa..1d251d59bcb9 100644
--- a/sound/soc/intel/skylake/bxt-sst.c
+++ b/sound/soc/intel/skylake/bxt-sst.c
@@ -23,6 +23,7 @@
 #include "../common/sst-dsp.h"
 #include "../common/sst-dsp-priv.h"
 #include "skl-sst-ipc.h"
+#include "skl-tplg-interface.h"
 
 #define BXT_BASEFW_TIMEOUT      3000
 #define BXT_INIT_TIMEOUT        500
@@ -40,11 +41,73 @@
 #define BXT_INSTANCE_ID 0
 #define BXT_BASE_FW_MODULE_ID 0
 
+#define BXT_ADSP_FW_BIN_HDR_OFFSET 0x2000
+
 static unsigned int bxt_get_errorcode(struct sst_dsp *ctx)
 {
          return sst_dsp_shim_read(ctx, BXT_ADSP_ERROR_CODE);
 }
 
+static int
+bxt_load_library(struct sst_dsp *ctx, struct skl_dfw_manifest *minfo)
+{
+        struct snd_dma_buffer dmab;
+        struct skl_sst *skl = ctx->thread_context;
+        const struct firmware *fw = NULL;
+        struct firmware stripped_fw;
+        int ret = 0, i, dma_id, stream_tag;
+
+        /* library indices start from 1 to N. 0 represents base FW */
+        for (i = 1; i < minfo->lib_count; i++) {
+                ret = request_firmware(&fw, minfo->lib[i].name, ctx->dev);
+                if (ret < 0) {
+                        dev_err(ctx->dev, "Request lib %s failed:%d\n",
+                                        minfo->lib[i].name, ret);
+                        return ret;
+                }
+
+                if (skl->is_first_boot) {
+                        ret = snd_skl_parse_uuids(ctx, fw,
+                                        BXT_ADSP_FW_BIN_HDR_OFFSET, i);
+                        if (ret < 0)
+                                goto load_library_failed;
+                }
+
+                stripped_fw.data = fw->data;
+                stripped_fw.size = fw->size;
+                skl_dsp_strip_extended_manifest(&stripped_fw);
+
+                stream_tag = ctx->dsp_ops.prepare(ctx->dev, 0x40,
+                                        stripped_fw.size, &dmab);
+                if (stream_tag <= 0) {
+                        dev_err(ctx->dev, "Lib prepare DMA err: %x\n",
+                                        stream_tag);
+                        ret = stream_tag;
+                        goto load_library_failed;
+                }
+
+                dma_id = stream_tag - 1;
+                memcpy(dmab.area, stripped_fw.data, stripped_fw.size);
+
+                ctx->dsp_ops.trigger(ctx->dev, true, stream_tag);
+                ret = skl_sst_ipc_load_library(&skl->ipc, dma_id, i);
+                if (ret < 0)
+                        dev_err(ctx->dev, "IPC Load Lib for %s fail: %d\n",
+                                        minfo->lib[i].name, ret);
+
+                ctx->dsp_ops.trigger(ctx->dev, false, stream_tag);
+                ctx->dsp_ops.cleanup(ctx->dev, &dmab, stream_tag);
+                release_firmware(fw);
+                fw = NULL;
+        }
+
+        return ret;
+
+load_library_failed:
+        release_firmware(fw);
+        return ret;
+}
+
 /*
  * First boot sequence has some extra steps. Core 0 waits for power
  * status on core 1, so power up core 1 also momentarily, keep it in
@@ -157,8 +220,6 @@ static int sst_transfer_fw_host_dma(struct sst_dsp *ctx)
         return ret;
 }
 
-#define BXT_ADSP_FW_BIN_HDR_OFFSET 0x2000
-
 static int bxt_load_base_firmware(struct sst_dsp *ctx)
 {
         struct firmware stripped_fw;
@@ -175,9 +236,12 @@ static int bxt_load_base_firmware(struct sst_dsp *ctx)
         if (ctx->fw == NULL)
                 goto sst_load_base_firmware_failed;
 
-        ret = snd_skl_parse_uuids(ctx, BXT_ADSP_FW_BIN_HDR_OFFSET);
-        if (ret < 0)
-                goto sst_load_base_firmware_failed;
+        /* prase uuids on first boot */
+        if (skl->is_first_boot) {
+                ret = snd_skl_parse_uuids(ctx, ctx->fw, BXT_ADSP_FW_BIN_HDR_OFFSET, 0);
+                if (ret < 0)
+                        goto sst_load_base_firmware_failed;
+        }
 
         stripped_fw.data = ctx->fw->data;
         stripped_fw.size = ctx->fw->size;
@@ -230,12 +294,23 @@ static int bxt_set_dsp_D0(struct sst_dsp *ctx, unsigned int core_id)
         int ret;
         struct skl_ipc_dxstate_info dx;
         unsigned int core_mask = SKL_DSP_CORE_MASK(core_id);
+        struct skl_dfw_manifest *minfo = &skl->manifest;
 
         if (skl->fw_loaded == false) {
                 skl->boot_complete = false;
                 ret = bxt_load_base_firmware(ctx);
-                if (ret < 0)
+                if (ret < 0) {
                         dev_err(ctx->dev, "reload fw failed: %d\n", ret);
+                        return ret;
+                }
+
+                if (minfo->lib_count > 1) {
+                        ret = bxt_load_library(ctx, minfo);
+                        if (ret < 0) {
+                                dev_err(ctx->dev, "reload libs failed: %d\n", ret);
+                                return ret;
+                        }
+                }
                 return ret;
         }
 
@@ -329,7 +404,7 @@ static int bxt_set_dsp_D3(struct sst_dsp *ctx, unsigned int core_id)
 
         ret = skl_dsp_disable_core(ctx, core_mask);
         if (ret < 0) {
-                dev_err(ctx->dev, "Failed to disable core %d", ret);
+                dev_err(ctx->dev, "Failed to disable core %d\n", ret);
                 return ret;
         }
         skl->cores.state[core_id] = SKL_DSP_RESET;
@@ -341,6 +416,7 @@ static struct skl_dsp_fw_ops bxt_fw_ops = {
         .set_state_D3 = bxt_set_dsp_D3,
         .load_fw = bxt_load_base_firmware,
         .get_fw_errcode = bxt_get_errorcode,
+        .load_library = bxt_load_library,
 };
 
 static struct sst_ops skl_ops = {
@@ -397,22 +473,40 @@ int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
         skl->cores.count = 2;
         skl->boot_complete = false;
         init_waitqueue_head(&skl->boot_wait);
+        skl->is_first_boot = true;
+
+        if (dsp)
+                *dsp = skl;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(bxt_sst_dsp_init);
+
+int bxt_sst_init_fw(struct device *dev, struct skl_sst *ctx)
+{
+        int ret;
+        struct sst_dsp *sst = ctx->dsp;
 
         ret = sst->fw_ops.load_fw(sst);
         if (ret < 0) {
-                dev_err(dev, "Load base fw failed: %x", ret);
+                dev_err(dev, "Load base fw failed: %x\n", ret);
                 return ret;
         }
 
         skl_dsp_init_core_state(sst);
 
-        if (dsp)
-                *dsp = skl;
+        if (ctx->manifest.lib_count > 1) {
+                ret = sst->fw_ops.load_library(sst, &ctx->manifest);
+                if (ret < 0) {
+                        dev_err(dev, "Load Library failed : %x\n", ret);
+                        return ret;
+                }
+        }
+        ctx->is_first_boot = false;
 
         return 0;
 }
-EXPORT_SYMBOL_GPL(bxt_sst_dsp_init);
-
+EXPORT_SYMBOL_GPL(bxt_sst_init_fw);
 
 void bxt_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx)
 {
diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c
index 44ab595ce21a..805b7f2173f3 100644
--- a/sound/soc/intel/skylake/skl-messages.c
+++ b/sound/soc/intel/skylake/skl-messages.c
@@ -203,32 +203,35 @@ static const struct skl_dsp_ops dsp_ops[] = {
                 .id = 0x9d70,
                 .loader_ops = skl_get_loader_ops,
                 .init = skl_sst_dsp_init,
+                .init_fw = skl_sst_init_fw,
                 .cleanup = skl_sst_dsp_cleanup
         },
         {
                 .id = 0x9d71,
                 .loader_ops = skl_get_loader_ops,
                 .init = skl_sst_dsp_init,
+                .init_fw = skl_sst_init_fw,
                 .cleanup = skl_sst_dsp_cleanup
         },
         {
                 .id = 0x5a98,
                 .loader_ops = bxt_get_loader_ops,
                 .init = bxt_sst_dsp_init,
+                .init_fw = bxt_sst_init_fw,
                 .cleanup = bxt_sst_dsp_cleanup
         },
 };
 
-static int skl_get_dsp_ops(int pci_id)
+const struct skl_dsp_ops *skl_get_dsp_ops(int pci_id)
 {
         int i;
 
         for (i = 0; i < ARRAY_SIZE(dsp_ops); i++) {
                 if (dsp_ops[i].id == pci_id)
-                        return i;
+                        return &dsp_ops[i];
         }
 
-        return -EINVAL;
+        return NULL;
 }
 
 int skl_init_dsp(struct skl *skl)
@@ -238,7 +241,8 @@ int skl_init_dsp(struct skl *skl)
         struct hdac_bus *bus = ebus_to_hbus(ebus);
         struct skl_dsp_loader_ops loader_ops;
         int irq = bus->irq;
-        int ret, index;
+        const struct skl_dsp_ops *ops;
+        int ret;
 
         /* enable ppcap interrupt */
         snd_hdac_ext_bus_ppcap_enable(&skl->ebus, true);
@@ -251,18 +255,18 @@ int skl_init_dsp(struct skl *skl)
                 return -ENXIO;
         }
 
-        index  = skl_get_dsp_ops(skl->pci->device);
-        if (index  < 0)
-                return -EINVAL;
+        ops = skl_get_dsp_ops(skl->pci->device);
+        if (!ops)
+                return -EIO;
 
-        loader_ops = dsp_ops[index].loader_ops();
-        ret = dsp_ops[index].init(bus->dev, mmio_base, irq,
-                        skl->fw_name, loader_ops, &skl->skl_sst);
+        loader_ops = ops->loader_ops();
+        ret = ops->init(bus->dev, mmio_base, irq,
+                                skl->fw_name, loader_ops,
+                                &skl->skl_sst);
 
         if (ret < 0)
                 return ret;
 
-        skl_dsp_enable_notification(skl->skl_sst, false);
         dev_dbg(bus->dev, "dsp registration status=%d\n", ret);
 
         return ret;
@@ -273,16 +277,16 @@ int skl_free_dsp(struct skl *skl)
         struct hdac_ext_bus *ebus = &skl->ebus;
         struct hdac_bus *bus = ebus_to_hbus(ebus);
         struct skl_sst *ctx = skl->skl_sst;
-        int index;
+        const struct skl_dsp_ops *ops;
 
         /* disable  ppcap interrupt */
         snd_hdac_ext_bus_ppcap_int_enable(&skl->ebus, false);
 
-        index = skl_get_dsp_ops(skl->pci->device);
-        if (index  < 0)
+        ops = skl_get_dsp_ops(skl->pci->device);
+        if (!ops)
                 return -EIO;
 
-        dsp_ops[index].cleanup(bus->dev, ctx);
+        ops->cleanup(bus->dev, ctx);
 
         if (ctx->dsp->addr.lpe)
                 iounmap(ctx->dsp->addr.lpe);
@@ -296,7 +300,7 @@ int skl_suspend_dsp(struct skl *skl)
         int ret;
 
         /* if ppcap is not supported return 0 */
-        if (!skl->ebus.ppcap)
+        if (!skl->ebus.bus.ppcap)
                 return 0;
 
         ret = skl_dsp_sleep(ctx->dsp);
@@ -316,13 +320,17 @@ int skl_resume_dsp(struct skl *skl)
         int ret;
 
         /* if ppcap is not supported return 0 */
-        if (!skl->ebus.ppcap)
+        if (!skl->ebus.bus.ppcap)
                 return 0;
 
         /* enable ppcap interrupt */
         snd_hdac_ext_bus_ppcap_enable(&skl->ebus, true);
         snd_hdac_ext_bus_ppcap_int_enable(&skl->ebus, true);
 
+        /* check if DSP 1st boot is done */
+        if (skl->skl_sst->is_first_boot == true)
+                return 0;
+
         ret = skl_dsp_wake(ctx->dsp);
         if (ret < 0)
                 return ret;
@@ -672,6 +680,7 @@ static u16 skl_get_module_param_size(struct skl_sst *ctx,
                 return param_size;
 
         case SKL_MODULE_TYPE_BASE_OUTFMT:
+        case SKL_MODULE_TYPE_KPB:
                 return sizeof(struct skl_base_outfmt_cfg);
 
         default:
@@ -725,6 +734,7 @@ static int skl_set_module_format(struct skl_sst *ctx,
                 break;
 
         case SKL_MODULE_TYPE_BASE_OUTFMT:
+        case SKL_MODULE_TYPE_KPB:
                 skl_set_base_outfmt_format(ctx, module_config, *param_data);
                 break;
 
@@ -779,6 +789,7 @@ static int skl_alloc_queue(struct skl_module_pin *mpin,
                                 mpin[i].in_use = true;
                                 mpin[i].id.module_id = id.module_id;
                                 mpin[i].id.instance_id = id.instance_id;
+                                mpin[i].id.pvt_id = id.pvt_id;
                                 mpin[i].tgt_mcfg = tgt_cfg;
                                 return i;
                         }
@@ -802,6 +813,7 @@ static void skl_free_queue(struct skl_module_pin *mpin, int q_index)
                 mpin[q_index].in_use = false;
                 mpin[q_index].id.module_id = 0;
                 mpin[q_index].id.instance_id = 0;
+                mpin[q_index].id.pvt_id = 0;
         }
         mpin[q_index].pin_state = SKL_PIN_UNBIND;
         mpin[q_index].tgt_mcfg = NULL;
@@ -842,7 +854,7 @@ int skl_init_module(struct skl_sst *ctx,
         struct skl_ipc_init_instance_msg msg;
 
         dev_dbg(ctx->dev, "%s: module_id = %d instance=%d\n", __func__,
-                 mconfig->id.module_id, mconfig->id.instance_id);
+                 mconfig->id.module_id, mconfig->id.pvt_id);
 
         if (mconfig->pipe->state != SKL_PIPE_CREATED) {
                 dev_err(ctx->dev, "Pipe not created state= %d pipe_id= %d\n",
@@ -858,10 +870,11 @@ int skl_init_module(struct skl_sst *ctx,
         }
 
         msg.module_id = mconfig->id.module_id;
-        msg.instance_id = mconfig->id.instance_id;
+        msg.instance_id = mconfig->id.pvt_id;
         msg.ppl_instance_id = mconfig->pipe->ppl_id;
         msg.param_data_size = module_config_size;
         msg.core_id = mconfig->core_id;
+        msg.domain = mconfig->domain;
 
         ret = skl_ipc_init_instance(&ctx->ipc, &msg, param_data);
         if (ret < 0) {
@@ -878,9 +891,9 @@ static void skl_dump_bind_info(struct skl_sst *ctx, struct skl_module_cfg
         *src_module, struct skl_module_cfg *dst_module)
 {
         dev_dbg(ctx->dev, "%s: src module_id = %d  src_instance=%d\n",
-                __func__, src_module->id.module_id, src_module->id.instance_id);
+                __func__, src_module->id.module_id, src_module->id.pvt_id);
         dev_dbg(ctx->dev, "%s: dst_module=%d dst_instacne=%d\n", __func__,
-                 dst_module->id.module_id, dst_module->id.instance_id);
+                 dst_module->id.module_id, dst_module->id.pvt_id);
 
         dev_dbg(ctx->dev, "src_module state = %d dst module state = %d\n",
                 src_module->m_state, dst_module->m_state);
@@ -927,9 +940,9 @@ int skl_unbind_modules(struct skl_sst *ctx,
                 return 0;
 
         msg.module_id = src_mcfg->id.module_id;
-        msg.instance_id = src_mcfg->id.instance_id;
+        msg.instance_id = src_mcfg->id.pvt_id;
         msg.dst_module_id = dst_mcfg->id.module_id;
-        msg.dst_instance_id = dst_mcfg->id.instance_id;
+        msg.dst_instance_id = dst_mcfg->id.pvt_id;
         msg.bind = false;
 
         ret = skl_ipc_bind_unbind(&ctx->ipc, &msg);
@@ -988,9 +1001,9 @@ int skl_bind_modules(struct skl_sst *ctx,
                          msg.src_queue, msg.dst_queue);
 
         msg.module_id = src_mcfg->id.module_id;
-        msg.instance_id = src_mcfg->id.instance_id;
+        msg.instance_id = src_mcfg->id.pvt_id;
         msg.dst_module_id = dst_mcfg->id.module_id;
-        msg.dst_instance_id = dst_mcfg->id.instance_id;
+        msg.dst_instance_id = dst_mcfg->id.pvt_id;
         msg.bind = true;
 
         ret = skl_ipc_bind_unbind(&ctx->ipc, &msg);
@@ -1168,7 +1181,7 @@ int skl_set_module_params(struct skl_sst *ctx, u32 *params, int size,
         struct skl_ipc_large_config_msg msg;
 
         msg.module_id = mcfg->id.module_id;
-        msg.instance_id = mcfg->id.instance_id;
+        msg.instance_id = mcfg->id.pvt_id;
         msg.param_data_size = size;
         msg.large_param_id = param_id;
 
@@ -1181,7 +1194,7 @@ int skl_get_module_params(struct skl_sst *ctx, u32 *params, int size,
         struct skl_ipc_large_config_msg msg;
 
         msg.module_id = mcfg->id.module_id;
-        msg.instance_id = mcfg->id.instance_id;
+        msg.instance_id = mcfg->id.pvt_id;
         msg.param_data_size = size;
         msg.large_param_id = param_id;
 
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 6e05bf8622f7..58c728662600 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -106,7 +106,7 @@ static void skl_set_pcm_constrains(struct hdac_ext_bus *ebus,
 
 static enum hdac_ext_stream_type skl_get_host_stream_type(struct hdac_ext_bus *ebus)
 {
-        if (ebus->ppcap)
+        if ((ebus_to_hbus(ebus))->ppcap)
                 return HDAC_EXT_STREAM_TYPE_HOST;
         else
                 return HDAC_EXT_STREAM_TYPE_COUPLED;
@@ -188,7 +188,7 @@ static int skl_get_format(struct snd_pcm_substream *substream,
         struct hdac_ext_bus *ebus = dev_get_drvdata(dai->dev);
         int format_val = 0;
 
-        if (ebus->ppcap) {
+        if ((ebus_to_hbus(ebus))->ppcap) {
                 struct snd_pcm_runtime *runtime = substream->runtime;
 
                 format_val = snd_hdac_calc_stream_format(runtime->rate,
@@ -648,7 +648,8 @@ static struct snd_soc_dai_driver skl_platform_dai[] = {
                 .channels_min = HDA_MONO,
                 .channels_max = HDA_STEREO,
                 .rates = SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_16000 | SNDRV_PCM_RATE_8000,
-                .formats = SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE,
+                .formats = SNDRV_PCM_FMTBIT_S16_LE |
+                        SNDRV_PCM_FMTBIT_S24_LE | SNDRV_PCM_FMTBIT_S32_LE,
         },
         .capture = {
                 .stream_name = "System Capture",
@@ -1020,7 +1021,7 @@ static int skl_platform_pcm_trigger(struct snd_pcm_substream *substream,
 {
         struct hdac_ext_bus *ebus = get_bus_ctx(substream);
 
-        if (!ebus->ppcap)
+        if (!(ebus_to_hbus(ebus))->ppcap)
                 return skl_coupled_trigger(substream, cmd);
 
         return 0;
@@ -1093,7 +1094,7 @@ static int skl_get_time_info(struct snd_pcm_substream *substream,
         return 0;
 }
 
-static struct snd_pcm_ops skl_platform_ops = {
+static const struct snd_pcm_ops skl_platform_ops = {
         .open = skl_platform_open,
         .ioctl = snd_pcm_lib_ioctl,
         .trigger = skl_platform_pcm_trigger,
@@ -1138,20 +1139,67 @@ static int skl_pcm_new(struct snd_soc_pcm_runtime *rtd)
         return retval;
 }
 
+static int skl_populate_modules(struct skl *skl)
+{
+        struct skl_pipeline *p;
+        struct skl_pipe_module *m;
+        struct snd_soc_dapm_widget *w;
+        struct skl_module_cfg *mconfig;
+        int ret;
+
+        list_for_each_entry(p, &skl->ppl_list, node) {
+                list_for_each_entry(m, &p->pipe->w_list, node) {
+
+                        w = m->w;
+                        mconfig = w->priv;
+
+                        ret = snd_skl_get_module_info(skl->skl_sst, mconfig);
+                        if (ret < 0) {
+                                dev_err(skl->skl_sst->dev,
+                                        "query module info failed:%d\n", ret);
+                                goto err;
+                        }
+                }
+        }
+err:
+        return ret;
+}
+
 static int skl_platform_soc_probe(struct snd_soc_platform *platform)
 {
         struct hdac_ext_bus *ebus = dev_get_drvdata(platform->dev);
         struct skl *skl = ebus_to_skl(ebus);
+        const struct skl_dsp_ops *ops;
         int ret;
 
-        if (ebus->ppcap) {
+        pm_runtime_get_sync(platform->dev);
+        if ((ebus_to_hbus(ebus))->ppcap) {
                 ret = skl_tplg_init(platform, ebus);
                 if (ret < 0) {
                         dev_err(platform->dev, "Failed to init topology!\n");
                         return ret;
                 }
                 skl->platform = platform;
+
+                /* load the firmwares, since all is set */
+                ops = skl_get_dsp_ops(skl->pci->device);
+                if (!ops)
+                        return -EIO;
+
+                if (skl->skl_sst->is_first_boot == false) {
+                        dev_err(platform->dev, "DSP reports first boot done!!!\n");
+                        return -EIO;
+                }
+
+                ret = ops->init_fw(platform->dev, skl->skl_sst);
+                if (ret < 0) {
+                        dev_err(platform->dev, "Failed to boot first fw: %d\n", ret);
+                        return ret;
+                }
+                skl_populate_modules(skl);
         }
+        pm_runtime_mark_last_busy(platform->dev);
+        pm_runtime_put_autosuspend(platform->dev);
 
         return 0;
 }
diff --git a/sound/soc/intel/skylake/skl-sst-cldma.c b/sound/soc/intel/skylake/skl-sst-cldma.c
index da2329d17f4d..efa2532114ba 100644
--- a/sound/soc/intel/skylake/skl-sst-cldma.c
+++ b/sound/soc/intel/skylake/skl-sst-cldma.c
@@ -341,14 +341,14 @@ int skl_cldma_prepare(struct sst_dsp *ctx)
         ret = ctx->dsp_ops.alloc_dma_buf(ctx->dev,
                         &ctx->cl_dev.dmab_data, ctx->cl_dev.bufsize);
         if (ret < 0) {
-                dev_err(ctx->dev, "Alloc buffer for base fw failed: %x", ret);
+                dev_err(ctx->dev, "Alloc buffer for base fw failed: %x\n", ret);
                 return ret;
         }
         /* Setup Code loader BDL */
         ret = ctx->dsp_ops.alloc_dma_buf(ctx->dev,
                         &ctx->cl_dev.dmab_bdl, PAGE_SIZE);
         if (ret < 0) {
-                dev_err(ctx->dev, "Alloc buffer for blde failed: %x", ret);
+                dev_err(ctx->dev, "Alloc buffer for blde failed: %x\n", ret);
                 ctx->dsp_ops.free_dma_buf(ctx->dev, &ctx->cl_dev.dmab_data);
                 return ret;
         }
diff --git a/sound/soc/intel/skylake/skl-sst-dsp.h b/sound/soc/intel/skylake/skl-sst-dsp.h
index 0f8629ef79ac..b9e71d051fb1 100644
--- a/sound/soc/intel/skylake/skl-sst-dsp.h
+++ b/sound/soc/intel/skylake/skl-sst-dsp.h
@@ -20,6 +20,7 @@
 #include <sound/memalloc.h>
 #include "skl-sst-cldma.h"
 #include "skl-tplg-interface.h"
+#include "skl-topology.h"
 
 struct sst_dsp;
 struct skl_sst;
@@ -133,6 +134,8 @@ enum skl_dsp_states {
 struct skl_dsp_fw_ops {
         int (*load_fw)(struct sst_dsp  *ctx);
         /* FW module parser/loader */
+        int (*load_library)(struct sst_dsp *ctx,
+                struct skl_dfw_manifest *minfo);
         int (*parse_fw)(struct sst_dsp *ctx);
         int (*set_state_D0)(struct sst_dsp *ctx, unsigned int core_id);
         int (*set_state_D3)(struct sst_dsp *ctx, unsigned int core_id);
@@ -203,12 +206,21 @@ int skl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
 int bxt_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
                 const char *fw_name, struct skl_dsp_loader_ops dsp_ops,
                 struct skl_sst **dsp);
+int skl_sst_init_fw(struct device *dev, struct skl_sst *ctx);
+int bxt_sst_init_fw(struct device *dev, struct skl_sst *ctx);
 void skl_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx);
 void bxt_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx);
 
-int snd_skl_get_module_info(struct skl_sst *ctx, u8 *uuid,
-                struct skl_dfw_module *dfw_config);
-int snd_skl_parse_uuids(struct sst_dsp *ctx, unsigned int offset);
+int snd_skl_get_module_info(struct skl_sst *ctx,
+                                struct skl_module_cfg *mconfig);
+int snd_skl_parse_uuids(struct sst_dsp *ctx, const struct firmware *fw,
+                                unsigned int offset, int index);
+int skl_get_pvt_id(struct skl_sst *ctx,
+                                struct skl_module_cfg *mconfig);
+int skl_put_pvt_id(struct skl_sst *ctx,
+                                struct skl_module_cfg *mconfig);
+int skl_get_pvt_instance_id_map(struct skl_sst *ctx,
+                                int module_id, int instance_id);
 void skl_freeup_uuid_list(struct skl_sst *ctx);
 
 int skl_dsp_strip_extended_manifest(struct firmware *fw);
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c
index 96f2f6889b18..0bd01e62622c 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.c
+++ b/sound/soc/intel/skylake/skl-sst-ipc.c
@@ -114,6 +114,11 @@
 #define IPC_CORE_ID(x)                  (((x) & IPC_CORE_ID_MASK) \
                                         << IPC_CORE_ID_SHIFT)
 
+#define IPC_DOMAIN_SHIFT                28
+#define IPC_DOMAIN_MASK                 0x1
+#define IPC_DOMAIN(x)                   (((x) & IPC_DOMAIN_MASK) \
+                                        << IPC_DOMAIN_SHIFT)
+
 /* Bind/Unbind message extension register */
 #define IPC_DST_MOD_ID_SHIFT            0
 #define IPC_DST_MOD_ID(x)               (((x) & IPC_MOD_ID_MASK) \
@@ -190,6 +195,7 @@ enum skl_ipc_glb_type {
         IPC_GLB_GET_PPL_CONTEXT_SIZE = 21,
         IPC_GLB_SAVE_PPL = 22,
         IPC_GLB_RESTORE_PPL = 23,
+        IPC_GLB_LOAD_LIBRARY = 24,
         IPC_GLB_NOTIFY = 26,
         IPC_GLB_MAX_IPC_MSG_NUMBER = 31 /* Maximum message number */
 };
@@ -338,7 +344,7 @@ static int skl_ipc_process_notification(struct sst_generic_ipc *ipc,
                         break;
 
                 default:
-                        dev_err(ipc->dev, "ipc: Unhandled error msg=%x",
+                        dev_err(ipc->dev, "ipc: Unhandled error msg=%x\n",
                                                 header.primary);
                         break;
                 }
@@ -379,13 +385,13 @@ static void skl_ipc_process_reply(struct sst_generic_ipc *ipc,
                 break;
 
         default:
-                dev_err(ipc->dev, "Unknown ipc reply: 0x%x", reply);
+                dev_err(ipc->dev, "Unknown ipc reply: 0x%x\n", reply);
                 msg->errno = -EINVAL;
                 break;
         }
 
         if (reply != IPC_GLB_REPLY_SUCCESS) {
-                dev_err(ipc->dev, "ipc FW reply: reply=%d", reply);
+                dev_err(ipc->dev, "ipc FW reply: reply=%d\n", reply);
                 dev_err(ipc->dev, "FW Error Code: %u\n",
                         ipc->dsp->fw_ops.get_fw_errcode(ipc->dsp));
         }
@@ -434,9 +440,9 @@ irqreturn_t skl_dsp_irq_thread_handler(int irq, void *context)
                 hipcte = sst_dsp_shim_read_unlocked(dsp, SKL_ADSP_REG_HIPCTE);
                 header.primary = hipct;
                 header.extension = hipcte;
-                dev_dbg(dsp->dev, "IPC irq: Firmware respond primary:%x",
+                dev_dbg(dsp->dev, "IPC irq: Firmware respond primary:%x\n",
                                                 header.primary);
-                dev_dbg(dsp->dev, "IPC irq: Firmware respond extension:%x",
+                dev_dbg(dsp->dev, "IPC irq: Firmware respond extension:%x\n",
                                                 header.extension);
 
                 if (IPC_GLB_NOTIFY_RSP_TYPE(header.primary)) {
@@ -704,6 +710,7 @@ int skl_ipc_init_instance(struct sst_generic_ipc *ipc,
         header.extension = IPC_CORE_ID(msg->core_id);
         header.extension |= IPC_PPL_INSTANCE_ID(msg->ppl_instance_id);
         header.extension |= IPC_PARAM_BLOCK_SIZE(param_block_size);
+        header.extension |= IPC_DOMAIN(msg->domain);
 
         dev_dbg(ipc->dev, "In %s primary =%x ext=%x\n", __func__,
                          header.primary, header.extension);
@@ -742,7 +749,7 @@ int skl_ipc_bind_unbind(struct sst_generic_ipc *ipc,
                          header.extension);
         ret = sst_ipc_tx_message_wait(ipc, *ipc_header, NULL, 0, NULL, 0);
         if (ret < 0) {
-                dev_err(ipc->dev, "ipc: bind/unbind faileden");
+                dev_err(ipc->dev, "ipc: bind/unbind failed\n");
                 return ret;
         }
 
@@ -902,3 +909,25 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc,
         return ret;
 }
 EXPORT_SYMBOL_GPL(skl_ipc_get_large_config);
+
+int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
+                                u8 dma_id, u8 table_id)
+{
+        struct skl_ipc_header header = {0};
+        u64 *ipc_header = (u64 *)(&header);
+        int ret = 0;
+
+        header.primary = IPC_MSG_TARGET(IPC_FW_GEN_MSG);
+        header.primary |= IPC_MSG_DIR(IPC_MSG_REQUEST);
+        header.primary |= IPC_GLB_TYPE(IPC_GLB_LOAD_LIBRARY);
+        header.primary |= IPC_MOD_INSTANCE_ID(table_id);
+        header.primary |= IPC_MOD_ID(dma_id);
+
+        ret = sst_ipc_tx_message_wait(ipc, *ipc_header, NULL, 0, NULL, 0);
+
+        if (ret < 0)
+                dev_err(ipc->dev, "ipc: load lib failed\n");
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(skl_sst_ipc_load_library);
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.h b/sound/soc/intel/skylake/skl-sst-ipc.h
index 2e3d4e80ef97..0334ed4af031 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.h
+++ b/sound/soc/intel/skylake/skl-sst-ipc.h
@@ -66,7 +66,7 @@ struct skl_sst {
 
         /* callback for miscbdge */
         void (*enable_miscbdcge)(struct device *dev, bool enable);
-        /*Is CGCTL.MISCBDCGE disabled*/
+        /* Is CGCTL.MISCBDCGE disabled */
         bool miscbdcg_disabled;
 
         /* Populate module information */
@@ -75,8 +75,14 @@ struct skl_sst {
         /* Is firmware loaded */
         bool fw_loaded;
 
+        /* first boot ? */
+        bool is_first_boot;
+
         /* multi-core */
         struct skl_dsp_cores cores;
+
+        /* tplg manifest */
+        struct skl_dfw_manifest manifest;
 };
 
 struct skl_ipc_init_instance_msg {
@@ -85,6 +91,7 @@ struct skl_ipc_init_instance_msg {
         u16 param_data_size;
         u8 ppl_instance_id;
         u8 core_id;
+        u8 domain;
 };
 
 struct skl_ipc_bind_unbind_msg {
@@ -145,6 +152,9 @@ int skl_ipc_set_large_config(struct sst_generic_ipc *ipc,
 int skl_ipc_get_large_config(struct sst_generic_ipc *ipc,
                 struct skl_ipc_large_config_msg *msg, u32 *param);
 
+int skl_sst_ipc_load_library(struct sst_generic_ipc *ipc,
+                        u8 dma_id, u8 table_id);
+
 void skl_ipc_int_enable(struct sst_dsp *dsp);
 void skl_ipc_op_int_enable(struct sst_dsp *ctx);
 void skl_ipc_op_int_disable(struct sst_dsp *ctx);
diff --git a/sound/soc/intel/skylake/skl-sst-utils.c b/sound/soc/intel/skylake/skl-sst-utils.c
index 25fcb796bd86..8dc03039b311 100644
--- a/sound/soc/intel/skylake/skl-sst-utils.c
+++ b/sound/soc/intel/skylake/skl-sst-utils.c
@@ -28,11 +28,6 @@
 /* FW Extended Manifest Header id = $AE1 */
 #define SKL_EXT_MANIFEST_HEADER_MAGIC   0x31454124
 
-struct skl_dfw_module_mod {
-        char name[100];
-        struct skl_dfw_module skl_dfw_mod;
-};
-
 struct UUID {
         u8 id[16];
 };
@@ -99,10 +94,15 @@ struct adsp_fw_hdr {
         u32 load_offset;
 } __packed;
 
+#define MAX_INSTANCE_BUFF 2
+
 struct uuid_module {
         uuid_le uuid;
         int id;
         int is_loadable;
+        int max_instance;
+        u64 pvt_id[MAX_INSTANCE_BUFF];
+        int *instance_id;
 
         struct list_head list;
 };
@@ -115,18 +115,23 @@ struct skl_ext_manifest_hdr {
         u32 entries;
 };
 
-int snd_skl_get_module_info(struct skl_sst *ctx, u8 *uuid,
-                        struct skl_dfw_module *dfw_config)
+int snd_skl_get_module_info(struct skl_sst *ctx,
+                                struct skl_module_cfg *mconfig)
 {
         struct uuid_module *module;
         uuid_le *uuid_mod;
 
-        uuid_mod = (uuid_le *)uuid;
+        uuid_mod = (uuid_le *)mconfig->guid;
+
+        if (list_empty(&ctx->uuid_list)) {
+                dev_err(ctx->dev, "Module list is empty\n");
+                return -EINVAL;
+        }
 
         list_for_each_entry(module, &ctx->uuid_list, list) {
                 if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
-                        dfw_config->module_id = module->id;
-                        dfw_config->is_loadable = module->is_loadable;
+                        mconfig->id.module_id = module->id;
+                        mconfig->is_loadable = module->is_loadable;
 
                         return 0;
                 }
@@ -136,15 +141,154 @@ int snd_skl_get_module_info(struct skl_sst *ctx, u8 *uuid,
 }
 EXPORT_SYMBOL_GPL(snd_skl_get_module_info);
 
+static int skl_get_pvtid_map(struct uuid_module *module, int instance_id)
+{
+        int pvt_id;
+
+        for (pvt_id = 0; pvt_id < module->max_instance; pvt_id++) {
+                if (module->instance_id[pvt_id] == instance_id)
+                        return pvt_id;
+        }
+        return -EINVAL;
+}
+
+int skl_get_pvt_instance_id_map(struct skl_sst *ctx,
+                                int module_id, int instance_id)
+{
+        struct uuid_module *module;
+
+        list_for_each_entry(module, &ctx->uuid_list, list) {
+                if (module->id == module_id)
+                        return skl_get_pvtid_map(module, instance_id);
+        }
+
+        return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(skl_get_pvt_instance_id_map);
+
+static inline int skl_getid_32(struct uuid_module *module, u64 *val,
+                                int word1_mask, int word2_mask)
+{
+        int index, max_inst, pvt_id;
+        u32 mask_val;
+
+        max_inst =  module->max_instance;
+        mask_val = (u32)(*val >> word1_mask);
+
+        if (mask_val != 0xffffffff) {
+                index = ffz(mask_val);
+                pvt_id = index + word1_mask + word2_mask;
+                if (pvt_id <= (max_inst - 1)) {
+                        *val |= 1 << (index + word1_mask);
+                        return pvt_id;
+                }
+        }
+
+        return -EINVAL;
+}
+
+static inline int skl_pvtid_128(struct uuid_module *module)
+{
+        int j, i, word1_mask, word2_mask = 0, pvt_id;
+
+        for (j = 0; j < MAX_INSTANCE_BUFF; j++) {
+                word1_mask = 0;
+
+                for (i = 0; i < 2; i++) {
+                        pvt_id = skl_getid_32(module, &module->pvt_id[j],
+                                                word1_mask, word2_mask);
+                        if (pvt_id >= 0)
+                                return pvt_id;
+
+                        word1_mask += 32;
+                        if ((word1_mask + word2_mask) >= module->max_instance)
+                                return -EINVAL;
+                }
+
+                word2_mask += 64;
+                if (word2_mask >= module->max_instance)
+                        return -EINVAL;
+        }
+
+        return -EINVAL;
+}
+
+/**
+ * skl_get_pvt_id: generate a private id for use as module id
+ *
+ * @ctx: driver context
+ * @mconfig: module configuration data
+ *
+ * This generates a 128 bit private unique id for a module TYPE so that
+ * module instance is unique
+ */
+int skl_get_pvt_id(struct skl_sst *ctx, struct skl_module_cfg *mconfig)
+{
+        struct uuid_module *module;
+        uuid_le *uuid_mod;
+        int pvt_id;
+
+        uuid_mod = (uuid_le *)mconfig->guid;
+
+        list_for_each_entry(module, &ctx->uuid_list, list) {
+                if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
+
+                        pvt_id = skl_pvtid_128(module);
+                        if (pvt_id >= 0) {
+                                module->instance_id[pvt_id] =
+                                                mconfig->id.instance_id;
+                                return pvt_id;
+                        }
+                }
+        }
+
+        return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(skl_get_pvt_id);
+
+/**
+ * skl_put_pvt_id: free up the private id allocated
+ *
+ * @ctx: driver context
+ * @mconfig: module configuration data
+ *
+ * This frees a 128 bit private unique id previously generated
+ */
+int skl_put_pvt_id(struct skl_sst *ctx, struct skl_module_cfg *mconfig)
+{
+        int i;
+        uuid_le *uuid_mod;
+        struct uuid_module *module;
+
+        uuid_mod = (uuid_le *)mconfig->guid;
+        list_for_each_entry(module, &ctx->uuid_list, list) {
+                if (uuid_le_cmp(*uuid_mod, module->uuid) == 0) {
+
+                        if (mconfig->id.pvt_id != 0)
+                                i = (mconfig->id.pvt_id) / 64;
+                        else
+                                i = 0;
+
+                        module->pvt_id[i] &= ~(1 << (mconfig->id.pvt_id));
+                        mconfig->id.pvt_id = -1;
+                        return 0;
+                }
+        }
+
+        return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(skl_put_pvt_id);
+
 /*
  * Parse the firmware binary to get the UUID, module id
  * and loadable flags
  */
-int snd_skl_parse_uuids(struct sst_dsp *ctx, unsigned int offset)
+int snd_skl_parse_uuids(struct sst_dsp *ctx, const struct firmware *fw,
+                        unsigned int offset, int index)
 {
         struct adsp_fw_hdr *adsp_hdr;
         struct adsp_module_entry *mod_entry;
-        int i, num_entry;
+        int i, num_entry, size;
         uuid_le *uuid_bin;
         const char *buf;
         struct skl_sst *skl = ctx->thread_context;
@@ -153,8 +297,8 @@ int snd_skl_parse_uuids(struct sst_dsp *ctx, unsigned int offset)
         unsigned int safe_file;
 
         /* Get the FW pointer to derive ADSP header */
-        stripped_fw.data = ctx->fw->data;
-        stripped_fw.size = ctx->fw->size;
+        stripped_fw.data = fw->data;
+        stripped_fw.size = fw->size;
 
         skl_dsp_strip_extended_manifest(&stripped_fw);
 
@@ -205,8 +349,15 @@ int snd_skl_parse_uuids(struct sst_dsp *ctx, unsigned int offset)
                 uuid_bin = (uuid_le *)mod_entry->uuid.id;
                 memcpy(&module->uuid, uuid_bin, sizeof(module->uuid));
 
-                module->id = i;
+                module->id = (i | (index << 12));
                 module->is_loadable = mod_entry->type.load_type;
+                module->max_instance = mod_entry->instance_max_count;
+                size = sizeof(int) * mod_entry->instance_max_count;
+                module->instance_id = devm_kzalloc(ctx->dev, size, GFP_KERNEL);
+                if (!module->instance_id) {
+                        kfree(module);
+                        return -ENOMEM;
+                }
 
                 list_add_tail(&module->list, &skl->uuid_list);
 
diff --git a/sound/soc/intel/skylake/skl-sst.c b/sound/soc/intel/skylake/skl-sst.c
index 588f899ceb65..8fc3178bc79c 100644
--- a/sound/soc/intel/skylake/skl-sst.c
+++ b/sound/soc/intel/skylake/skl-sst.c
@@ -88,13 +88,15 @@ static int skl_load_base_firmware(struct sst_dsp *ctx)
                 }
         }
 
-        ret = snd_skl_parse_uuids(ctx, SKL_ADSP_FW_BIN_HDR_OFFSET);
-        if (ret < 0) {
-                dev_err(ctx->dev,
-                                "UUID parsing err: %d\n", ret);
-                release_firmware(ctx->fw);
-                skl_dsp_disable_core(ctx, SKL_DSP_CORE0_MASK);
-                return ret;
+        /* prase uuids on first boot */
+        if (skl->is_first_boot) {
+                ret = snd_skl_parse_uuids(ctx, ctx->fw, SKL_ADSP_FW_BIN_HDR_OFFSET, 0);
+                if (ret < 0) {
+                        dev_err(ctx->dev, "UUID parsing err: %d\n", ret);
+                        release_firmware(ctx->fw);
+                        skl_dsp_disable_core(ctx, SKL_DSP_CORE0_MASK);
+                        return ret;
+                }
         }
 
         /* check for extended manifest */
@@ -105,13 +107,13 @@ static int skl_load_base_firmware(struct sst_dsp *ctx)
 
         ret = skl_dsp_boot(ctx);
         if (ret < 0) {
-                dev_err(ctx->dev, "Boot dsp core failed ret: %d", ret);
+                dev_err(ctx->dev, "Boot dsp core failed ret: %d\n", ret);
                 goto skl_load_base_firmware_failed;
         }
 
         ret = skl_cldma_prepare(ctx);
         if (ret < 0) {
-                dev_err(ctx->dev, "CL dma prepare failed : %d", ret);
+                dev_err(ctx->dev, "CL dma prepare failed : %d\n", ret);
                 goto skl_load_base_firmware_failed;
         }
 
@@ -484,25 +486,32 @@ int skl_sst_dsp_init(struct device *dev, void __iomem *mmio_base, int irq,
                 return ret;
 
         skl->cores.count = 2;
+        skl->is_first_boot = true;
+
+        if (dsp)
+                *dsp = skl;
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(skl_sst_dsp_init);
+
+int skl_sst_init_fw(struct device *dev, struct skl_sst *ctx)
+{
+        int ret;
+        struct sst_dsp *sst = ctx->dsp;
 
         ret = sst->fw_ops.load_fw(sst);
         if (ret < 0) {
-                dev_err(dev, "Load base fw failed : %d", ret);
-                goto cleanup;
+                dev_err(dev, "Load base fw failed : %d\n", ret);
+                return ret;
         }
 
         skl_dsp_init_core_state(sst);
+        ctx->is_first_boot = false;
 
-        if (dsp)
-                *dsp = skl;
-
-        return ret;
-
-cleanup:
-        skl_sst_dsp_cleanup(dev, skl);
-        return ret;
+        return 0;
 }
-EXPORT_SYMBOL_GPL(skl_sst_dsp_init);
+EXPORT_SYMBOL_GPL(skl_sst_init_fw);
 
 void skl_sst_dsp_cleanup(struct device *dev, struct skl_sst *ctx)
 {
diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index cc0150fc2601..b5b1934d8550 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -21,6 +21,7 @@
 #include <linux/firmware.h>
 #include <sound/soc.h>
 #include <sound/soc-topology.h>
+#include <uapi/sound/snd_sst_tokens.h>
 #include "skl-sst-dsp.h"
 #include "skl-sst-ipc.h"
 #include "skl-topology.h"
@@ -32,6 +33,8 @@
 #define SKL_CH_FIXUP_MASK               (1 << 0)
 #define SKL_RATE_FIXUP_MASK             (1 << 1)
 #define SKL_FMT_FIXUP_MASK              (1 << 2)
+#define SKL_IN_DIR_BIT_MASK             BIT(0)
+#define SKL_PIN_COUNT_MASK              GENMASK(7, 4)
 
 /*
  * SKL DSP driver modelling uses only few DAPM widgets so for rest we will
@@ -473,6 +476,14 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
                 w = w_module->w;
                 mconfig = w->priv;
 
+                /* check if module ids are populated */
+                if (mconfig->id.module_id < 0) {
+                        dev_err(skl->skl_sst->dev,
+                                        "module %pUL id not populated\n",
+                                        (uuid_le *)mconfig->guid);
+                        return -EIO;
+                }
+
                 /* check resource available */
                 if (!skl_is_pipe_mcps_avail(skl, mconfig))
                         return -ENOMEM;
@@ -494,12 +505,15 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
                  * FE/BE params
                  */
                 skl_tplg_update_module_params(w, ctx);
-
+                mconfig->id.pvt_id = skl_get_pvt_id(ctx, mconfig);
+                if (mconfig->id.pvt_id < 0)
+                        return ret;
                 skl_tplg_set_module_init_data(w);
                 ret = skl_init_module(ctx, mconfig);
-                if (ret < 0)
+                if (ret < 0) {
+                        skl_put_pvt_id(ctx, mconfig);
                         return ret;
-
+                }
                 skl_tplg_alloc_pipe_mcps(skl, mconfig);
                 ret = skl_tplg_set_module_params(w, ctx);
                 if (ret < 0)
@@ -512,6 +526,7 @@ skl_tplg_init_pipe_modules(struct skl *skl, struct skl_pipe *pipe)
 static int skl_tplg_unload_pipe_modules(struct skl_sst *ctx,
          struct skl_pipe *pipe)
 {
+        int ret;
         struct skl_pipe_module *w_module = NULL;
         struct skl_module_cfg *mconfig = NULL;
 
@@ -519,9 +534,13 @@ static int skl_tplg_unload_pipe_modules(struct skl_sst *ctx,
                 mconfig  = w_module->w->priv;
 
                 if (mconfig->is_loadable && ctx->dsp->fw_ops.unload_mod &&
-                        mconfig->m_state > SKL_MODULE_UNINIT)
-                        return ctx->dsp->fw_ops.unload_mod(ctx->dsp,
+                        mconfig->m_state > SKL_MODULE_UNINIT) {
+                        ret = ctx->dsp->fw_ops.unload_mod(ctx->dsp,
                                                 mconfig->id.module_id);
+                        if (ret < 0)
+                                return -EIO;
+                }
+                skl_put_pvt_id(ctx, mconfig);
         }
 
         /* no modules to unload in this path, so return */
@@ -588,6 +607,26 @@ static int skl_tplg_mixer_dapm_pre_pmu_event(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
+static int skl_fill_sink_instance_id(struct skl_sst *ctx,
+                                struct skl_algo_data *alg_data)
+{
+        struct skl_kpb_params *params = (struct skl_kpb_params *)alg_data->params;
+        struct skl_mod_inst_map *inst;
+        int i, pvt_id;
+
+        inst = params->map;
+
+        for (i = 0; i < params->num_modules; i++) {
+                pvt_id = skl_get_pvt_instance_id_map(ctx,
+                                        inst->mod_id, inst->inst_id);
+                if (pvt_id < 0)
+                        return -EINVAL;
+                inst->inst_id = pvt_id;
+                inst++;
+        }
+        return 0;
+}
+
 /*
  * Some modules require params to be set after the module is bound to
  * all pins connected.
@@ -636,6 +675,8 @@ static int skl_tplg_set_module_bind_params(struct snd_soc_dapm_widget *w,
                         bc = (struct skl_algo_data *)sb->dobj.private;
 
                         if (bc->set_params == SKL_PARAM_BIND) {
+                                if (mconfig->m_type == SKL_MODULE_TYPE_KPB)
+                                        skl_fill_sink_instance_id(ctx, bc);
                                 ret = skl_set_module_params(ctx,
                                                 (u32 *)bc->params, bc->max,
                                                 bc->param_id, mconfig);
@@ -1460,85 +1501,570 @@ static const struct snd_soc_tplg_bytes_ext_ops skl_tlv_ops[] = {
                                         skl_tplg_tlv_control_set},
 };
 
-/*
- * The topology binary passes the pin info for a module so initialize the pin
- * info passed into module instance
- */
-static void skl_fill_module_pin_info(struct skl_dfw_module_pin *dfw_pin,
-                                                struct skl_module_pin *m_pin,
-                                                bool is_dynamic, int max_pin)
+static int skl_tplg_fill_pipe_tkn(struct device *dev,
+                        struct skl_pipe *pipe, u32 tkn,
+                        u32 tkn_val)
 {
-        int i;
 
-        for (i = 0; i < max_pin; i++) {
-                m_pin[i].id.module_id = dfw_pin[i].module_id;
-                m_pin[i].id.instance_id = dfw_pin[i].instance_id;
-                m_pin[i].in_use = false;
-                m_pin[i].is_dynamic = is_dynamic;
-                m_pin[i].pin_state = SKL_PIN_UNBIND;
+        switch (tkn) {
+        case SKL_TKN_U32_PIPE_CONN_TYPE:
+                pipe->conn_type = tkn_val;
+                break;
+
+        case SKL_TKN_U32_PIPE_PRIORITY:
+                pipe->pipe_priority = tkn_val;
+                break;
+
+        case SKL_TKN_U32_PIPE_MEM_PGS:
+                pipe->memory_pages = tkn_val;
+                break;
+
+        default:
+                dev_err(dev, "Token not handled %d\n", tkn);
+                return -EINVAL;
         }
+
+        return 0;
 }
 
 /*
- * Add pipeline from topology binary into driver pipeline list
- *
- * If already added we return that instance
- * Otherwise we create a new instance and add into driver list
+ * Add pipeline by parsing the relevant tokens
+ * Return an existing pipe if the pipe already exists.
  */
-static struct skl_pipe *skl_tplg_add_pipe(struct device *dev,
-                        struct skl *skl, struct skl_dfw_pipe *dfw_pipe)
+static int skl_tplg_add_pipe(struct device *dev,
+                struct skl_module_cfg *mconfig, struct skl *skl,
+                struct snd_soc_tplg_vendor_value_elem *tkn_elem)
 {
         struct skl_pipeline *ppl;
         struct skl_pipe *pipe;
         struct skl_pipe_params *params;
 
         list_for_each_entry(ppl, &skl->ppl_list, node) {
-                if (ppl->pipe->ppl_id == dfw_pipe->pipe_id)
-                        return ppl->pipe;
+                if (ppl->pipe->ppl_id == tkn_elem->value) {
+                        mconfig->pipe = ppl->pipe;
+                        return EEXIST;
+                }
         }
 
         ppl = devm_kzalloc(dev, sizeof(*ppl), GFP_KERNEL);
         if (!ppl)
-                return NULL;
+                return -ENOMEM;
 
         pipe = devm_kzalloc(dev, sizeof(*pipe), GFP_KERNEL);
         if (!pipe)
-                return NULL;
+                return -ENOMEM;
 
         params = devm_kzalloc(dev, sizeof(*params), GFP_KERNEL);
         if (!params)
-                return NULL;
+                return -ENOMEM;
 
-        pipe->ppl_id = dfw_pipe->pipe_id;
-        pipe->memory_pages = dfw_pipe->memory_pages;
-        pipe->pipe_priority = dfw_pipe->pipe_priority;
-        pipe->conn_type = dfw_pipe->conn_type;
-        pipe->state = SKL_PIPE_INVALID;
         pipe->p_params = params;
+        pipe->ppl_id = tkn_elem->value;
         INIT_LIST_HEAD(&pipe->w_list);
 
         ppl->pipe = pipe;
         list_add(&ppl->node, &skl->ppl_list);
 
-        return ppl->pipe;
+        mconfig->pipe = pipe;
+        mconfig->pipe->state = SKL_PIPE_INVALID;
+
+        return 0;
+}
+
+static int skl_tplg_fill_pin(struct device *dev, u32 tkn,
+                        struct skl_module_pin *m_pin,
+                        int pin_index, u32 value)
+{
+        switch (tkn) {
+        case SKL_TKN_U32_PIN_MOD_ID:
+                m_pin[pin_index].id.module_id = value;
+                break;
+
+        case SKL_TKN_U32_PIN_INST_ID:
+                m_pin[pin_index].id.instance_id = value;
+                break;
+
+        default:
+                dev_err(dev, "%d Not a pin token\n", value);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+/*
+ * Parse for pin config specific tokens to fill up the
+ * module private data
+ */
+static int skl_tplg_fill_pins_info(struct device *dev,
+                struct skl_module_cfg *mconfig,
+                struct snd_soc_tplg_vendor_value_elem *tkn_elem,
+                int dir, int pin_count)
+{
+        int ret;
+        struct skl_module_pin *m_pin;
+
+        switch (dir) {
+        case SKL_DIR_IN:
+                m_pin = mconfig->m_in_pin;
+                break;
+
+        case SKL_DIR_OUT:
+                m_pin = mconfig->m_out_pin;
+                break;
+
+        default:
+                dev_err(dev, "Invalid direction value\n");
+                return -EINVAL;
+        }
+
+        ret = skl_tplg_fill_pin(dev, tkn_elem->token,
+                        m_pin, pin_count, tkn_elem->value);
+
+        if (ret < 0)
+                return ret;
+
+        m_pin[pin_count].in_use = false;
+        m_pin[pin_count].pin_state = SKL_PIN_UNBIND;
+
+        return 0;
+}
+
+/*
+ * Fill up input/output module config format based
+ * on the direction
+ */
+static int skl_tplg_fill_fmt(struct device *dev,
+                struct skl_module_cfg *mconfig, u32 tkn,
+                u32 value, u32 dir, u32 pin_count)
+{
+        struct skl_module_fmt *dst_fmt;
+
+        switch (dir) {
+        case SKL_DIR_IN:
+                dst_fmt = mconfig->in_fmt;
+                dst_fmt += pin_count;
+                break;
+
+        case SKL_DIR_OUT:
+                dst_fmt = mconfig->out_fmt;
+                dst_fmt += pin_count;
+                break;
+
+        default:
+                dev_err(dev, "Invalid direction value\n");
+                return -EINVAL;
+        }
+
+        switch (tkn) {
+        case SKL_TKN_U32_FMT_CH:
+                dst_fmt->channels  = value;
+                break;
+
+        case SKL_TKN_U32_FMT_FREQ:
+                dst_fmt->s_freq = value;
+                break;
+
+        case SKL_TKN_U32_FMT_BIT_DEPTH:
+                dst_fmt->bit_depth = value;
+                break;
+
+        case SKL_TKN_U32_FMT_SAMPLE_SIZE:
+                dst_fmt->valid_bit_depth = value;
+                break;
+
+        case SKL_TKN_U32_FMT_CH_CONFIG:
+                dst_fmt->ch_cfg = value;
+                break;
+
+        case SKL_TKN_U32_FMT_INTERLEAVE:
+                dst_fmt->interleaving_style = value;
+                break;
+
+        case SKL_TKN_U32_FMT_SAMPLE_TYPE:
+                dst_fmt->sample_type = value;
+                break;
+
+        case SKL_TKN_U32_FMT_CH_MAP:
+                dst_fmt->ch_map = value;
+                break;
+
+        default:
+                dev_err(dev, "Invalid token %d\n", tkn);
+                return -EINVAL;
+        }
+
+        return 0;
 }
 
-static void skl_tplg_fill_fmt(struct skl_module_fmt *dst_fmt,
-                                struct skl_dfw_module_fmt *src_fmt,
-                                int pins)
+static int skl_tplg_get_uuid(struct device *dev, struct skl_module_cfg *mconfig,
+              struct snd_soc_tplg_vendor_uuid_elem *uuid_tkn)
+{
+        if (uuid_tkn->token == SKL_TKN_UUID)
+                memcpy(&mconfig->guid, &uuid_tkn->uuid, 16);
+        else {
+                dev_err(dev, "Not an UUID token tkn %d\n", uuid_tkn->token);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static void skl_tplg_fill_pin_dynamic_val(
+                struct skl_module_pin *mpin, u32 pin_count, u32 value)
 {
         int i;
 
-        for (i = 0; i < pins; i++) {
-                dst_fmt[i].channels  = src_fmt[i].channels;
-                dst_fmt[i].s_freq = src_fmt[i].freq;
-                dst_fmt[i].bit_depth = src_fmt[i].bit_depth;
-                dst_fmt[i].valid_bit_depth = src_fmt[i].valid_bit_depth;
-                dst_fmt[i].ch_cfg = src_fmt[i].ch_cfg;
-                dst_fmt[i].ch_map = src_fmt[i].ch_map;
-                dst_fmt[i].interleaving_style = src_fmt[i].interleaving_style;
-                dst_fmt[i].sample_type = src_fmt[i].sample_type;
+        for (i = 0; i < pin_count; i++)
+                mpin[i].is_dynamic = value;
+}
+
+/*
+ * Parse tokens to fill up the module private data
+ */
+static int skl_tplg_get_token(struct device *dev,
+                struct snd_soc_tplg_vendor_value_elem *tkn_elem,
+                struct skl *skl, struct skl_module_cfg *mconfig)
+{
+        int tkn_count = 0;
+        int ret;
+        static int is_pipe_exists;
+        static int pin_index, dir;
+
+        if (tkn_elem->token > SKL_TKN_MAX)
+                return -EINVAL;
+
+        switch (tkn_elem->token) {
+        case SKL_TKN_U8_IN_QUEUE_COUNT:
+                mconfig->max_in_queue = tkn_elem->value;
+                mconfig->m_in_pin = devm_kzalloc(dev, mconfig->max_in_queue *
+                                        sizeof(*mconfig->m_in_pin),
+                                        GFP_KERNEL);
+                if (!mconfig->m_in_pin)
+                        return -ENOMEM;
+
+                break;
+
+        case SKL_TKN_U8_OUT_QUEUE_COUNT:
+                mconfig->max_out_queue = tkn_elem->value;
+                mconfig->m_out_pin = devm_kzalloc(dev, mconfig->max_out_queue *
+                                        sizeof(*mconfig->m_out_pin),
+                                        GFP_KERNEL);
+
+                if (!mconfig->m_out_pin)
+                        return -ENOMEM;
+
+                break;
+
+        case SKL_TKN_U8_DYN_IN_PIN:
+                if (!mconfig->m_in_pin)
+                        return -ENOMEM;
+
+                skl_tplg_fill_pin_dynamic_val(mconfig->m_in_pin,
+                        mconfig->max_in_queue, tkn_elem->value);
+
+                break;
+
+        case SKL_TKN_U8_DYN_OUT_PIN:
+                if (!mconfig->m_out_pin)
+                        return -ENOMEM;
+
+                skl_tplg_fill_pin_dynamic_val(mconfig->m_out_pin,
+                        mconfig->max_out_queue, tkn_elem->value);
+
+                break;
+
+        case SKL_TKN_U8_TIME_SLOT:
+                mconfig->time_slot = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U8_CORE_ID:
+                mconfig->core_id = tkn_elem->value;
+
+        case SKL_TKN_U8_MOD_TYPE:
+                mconfig->m_type = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U8_DEV_TYPE:
+                mconfig->dev_type = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U8_HW_CONN_TYPE:
+                mconfig->hw_conn_type = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U16_MOD_INST_ID:
+                mconfig->id.instance_id =
+                tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_MEM_PAGES:
+                mconfig->mem_pages = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_MAX_MCPS:
+                mconfig->mcps = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_OBS:
+                mconfig->obs = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_IBS:
+                mconfig->ibs = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_VBUS_ID:
+                mconfig->vbus_id = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_PARAMS_FIXUP:
+                mconfig->params_fixup = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_CONVERTER:
+                mconfig->converter = tkn_elem->value;
+                break;
+
+        case SKL_TKN_U32_PIPE_ID:
+                ret = skl_tplg_add_pipe(dev,
+                                mconfig, skl, tkn_elem);
+
+                if (ret < 0)
+                        return is_pipe_exists;
+
+                if (ret == EEXIST)
+                        is_pipe_exists = 1;
+
+                break;
+
+        case SKL_TKN_U32_PIPE_CONN_TYPE:
+        case SKL_TKN_U32_PIPE_PRIORITY:
+        case SKL_TKN_U32_PIPE_MEM_PGS:
+                if (is_pipe_exists) {
+                        ret = skl_tplg_fill_pipe_tkn(dev, mconfig->pipe,
+                                        tkn_elem->token, tkn_elem->value);
+                        if (ret < 0)
+                                return ret;
+                }
+
+                break;
+
+        /*
+         * SKL_TKN_U32_DIR_PIN_COUNT token has the value for both
+         * direction and the pin count. The first four bits represent
+         * direction and next four the pin count.
+         */
+        case SKL_TKN_U32_DIR_PIN_COUNT:
+                dir = tkn_elem->value & SKL_IN_DIR_BIT_MASK;
+                pin_index = (tkn_elem->value &
+                        SKL_PIN_COUNT_MASK) >> 4;
+
+                break;
+
+        case SKL_TKN_U32_FMT_CH:
+        case SKL_TKN_U32_FMT_FREQ:
+        case SKL_TKN_U32_FMT_BIT_DEPTH:
+        case SKL_TKN_U32_FMT_SAMPLE_SIZE:
+        case SKL_TKN_U32_FMT_CH_CONFIG:
+        case SKL_TKN_U32_FMT_INTERLEAVE:
+        case SKL_TKN_U32_FMT_SAMPLE_TYPE:
+        case SKL_TKN_U32_FMT_CH_MAP:
+                ret = skl_tplg_fill_fmt(dev, mconfig, tkn_elem->token,
+                                tkn_elem->value, dir, pin_index);
+
+                if (ret < 0)
+                        return ret;
+
+                break;
+
+        case SKL_TKN_U32_PIN_MOD_ID:
+        case SKL_TKN_U32_PIN_INST_ID:
+                ret = skl_tplg_fill_pins_info(dev,
+                                mconfig, tkn_elem, dir,
+                                pin_index);
+                if (ret < 0)
+                        return ret;
+
+                break;
+
+        case SKL_TKN_U32_CAPS_SIZE:
+                mconfig->formats_config.caps_size =
+                        tkn_elem->value;
+
+                break;
+
+        case SKL_TKN_U32_PROC_DOMAIN:
+                mconfig->domain =
+                        tkn_elem->value;
+
+                break;
+
+        case SKL_TKN_U8_IN_PIN_TYPE:
+        case SKL_TKN_U8_OUT_PIN_TYPE:
+        case SKL_TKN_U8_CONN_TYPE:
+                break;
+
+        default:
+                dev_err(dev, "Token %d not handled\n",
+                                tkn_elem->token);
+                return -EINVAL;
+        }
+
+        tkn_count++;
+
+        return tkn_count;
+}
+
+/*
+ * Parse the vendor array for specific tokens to construct
+ * module private data
+ */
+static int skl_tplg_get_tokens(struct device *dev,
+                char *pvt_data, struct skl *skl,
+                struct skl_module_cfg *mconfig, int block_size)
+{
+        struct snd_soc_tplg_vendor_array *array;
+        struct snd_soc_tplg_vendor_value_elem *tkn_elem;
+        int tkn_count = 0, ret;
+        int off = 0, tuple_size = 0;
+
+        if (block_size <= 0)
+                return -EINVAL;
+
+        while (tuple_size < block_size) {
+                array = (struct snd_soc_tplg_vendor_array *)(pvt_data + off);
+
+                off += array->size;
+
+                switch (array->type) {
+                case SND_SOC_TPLG_TUPLE_TYPE_STRING:
+                        dev_warn(dev, "no string tokens expected for skl tplg\n");
+                        continue;
+
+                case SND_SOC_TPLG_TUPLE_TYPE_UUID:
+                        ret = skl_tplg_get_uuid(dev, mconfig, array->uuid);
+                        if (ret < 0)
+                                return ret;
+
+                        tuple_size += sizeof(*array->uuid);
+
+                        continue;
+
+                default:
+                        tkn_elem = array->value;
+                        tkn_count = 0;
+                        break;
+                }
+
+                while (tkn_count <= (array->num_elems - 1)) {
+                        ret = skl_tplg_get_token(dev, tkn_elem,
+                                        skl, mconfig);
+
+                        if (ret < 0)
+                                return ret;
+
+                        tkn_count = tkn_count + ret;
+                        tkn_elem++;
+                }
+
+                tuple_size += tkn_count * sizeof(*tkn_elem);
+        }
+
+        return 0;
+}
+
+/*
+ * Every data block is preceded by a descriptor to read the number
+ * of data blocks, they type of the block and it's size
+ */
+static int skl_tplg_get_desc_blocks(struct device *dev,
+                struct snd_soc_tplg_vendor_array *array)
+{
+        struct snd_soc_tplg_vendor_value_elem *tkn_elem;
+
+        tkn_elem = array->value;
+
+        switch (tkn_elem->token) {
+        case SKL_TKN_U8_NUM_BLOCKS:
+        case SKL_TKN_U8_BLOCK_TYPE:
+        case SKL_TKN_U16_BLOCK_SIZE:
+                return tkn_elem->value;
+
+        default:
+                dev_err(dev, "Invalid descriptor token %d\n", tkn_elem->token);
+                break;
+        }
+
+        return -EINVAL;
+}
+
+/*
+ * Parse the private data for the token and corresponding value.
+ * The private data can have multiple data blocks. So, a data block
+ * is preceded by a descriptor for number of blocks and a descriptor
+ * for the type and size of the suceeding data block.
+ */
+static int skl_tplg_get_pvt_data(struct snd_soc_tplg_dapm_widget *tplg_w,
+                                struct skl *skl, struct device *dev,
+                                struct skl_module_cfg *mconfig)
+{
+        struct snd_soc_tplg_vendor_array *array;
+        int num_blocks, block_size = 0, block_type, off = 0;
+        char *data;
+        int ret;
+
+        /* Read the NUM_DATA_BLOCKS descriptor */
+        array = (struct snd_soc_tplg_vendor_array *)tplg_w->priv.data;
+        ret = skl_tplg_get_desc_blocks(dev, array);
+        if (ret < 0)
+                return ret;
+        num_blocks = ret;
+
+        off += array->size;
+        array = (struct snd_soc_tplg_vendor_array *)(tplg_w->priv.data + off);
+
+        /* Read the BLOCK_TYPE and BLOCK_SIZE descriptor */
+        while (num_blocks > 0) {
+                ret = skl_tplg_get_desc_blocks(dev, array);
+
+                if (ret < 0)
+                        return ret;
+                block_type = ret;
+                off += array->size;
+
+                array = (struct snd_soc_tplg_vendor_array *)
+                        (tplg_w->priv.data + off);
+
+                ret = skl_tplg_get_desc_blocks(dev, array);
+
+                if (ret < 0)
+                        return ret;
+                block_size = ret;
+                off += array->size;
+
+                array = (struct snd_soc_tplg_vendor_array *)
+                        (tplg_w->priv.data + off);
+
+                data = (tplg_w->priv.data + off);
+
+                if (block_type == SKL_TYPE_TUPLE) {
+                        ret = skl_tplg_get_tokens(dev, data,
+                                        skl, mconfig, block_size);
+
+                        if (ret < 0)
+                                return ret;
+
+                        --num_blocks;
+                } else {
+                        if (mconfig->formats_config.caps_size > 0)
+                                memcpy(mconfig->formats_config.caps, data,
+                                        mconfig->formats_config.caps_size);
+                        --num_blocks;
+                }
         }
+
+        return 0;
 }
 
 static void skl_clear_pin_config(struct snd_soc_platform *platform,
@@ -1606,9 +2132,6 @@ static int skl_tplg_widget_load(struct snd_soc_component *cmpnt,
         struct skl *skl = ebus_to_skl(ebus);
         struct hdac_bus *bus = ebus_to_hbus(ebus);
         struct skl_module_cfg *mconfig;
-        struct skl_pipe *pipe;
-        struct skl_dfw_module *dfw_config =
-                                (struct skl_dfw_module *)tplg_w->priv.data;
 
         if (!tplg_w->priv.size)
                 goto bind_event;
@@ -1619,76 +2142,17 @@ static int skl_tplg_widget_load(struct snd_soc_component *cmpnt,
                 return -ENOMEM;
 
         w->priv = mconfig;
-        memcpy(&mconfig->guid, &dfw_config->uuid, 16);
 
-        ret = snd_skl_get_module_info(skl->skl_sst, mconfig->guid, dfw_config);
+        /*
+         * module binary can be loaded later, so set it to query when
+         * module is load for a use case
+         */
+        mconfig->id.module_id = -1;
+
+        /* Parse private data for tuples */
+        ret = skl_tplg_get_pvt_data(tplg_w, skl, bus->dev, mconfig);
         if (ret < 0)
                 return ret;
-
-        mconfig->id.module_id = dfw_config->module_id;
-        mconfig->id.instance_id = dfw_config->instance_id;
-        mconfig->mcps = dfw_config->max_mcps;
-        mconfig->ibs = dfw_config->ibs;
-        mconfig->obs = dfw_config->obs;
-        mconfig->core_id = dfw_config->core_id;
-        mconfig->max_in_queue = dfw_config->max_in_queue;
-        mconfig->max_out_queue = dfw_config->max_out_queue;
-        mconfig->is_loadable = dfw_config->is_loadable;
-        skl_tplg_fill_fmt(mconfig->in_fmt, dfw_config->in_fmt,
-                                                MODULE_MAX_IN_PINS);
-        skl_tplg_fill_fmt(mconfig->out_fmt, dfw_config->out_fmt,
-                                                MODULE_MAX_OUT_PINS);
-
-        mconfig->params_fixup = dfw_config->params_fixup;
-        mconfig->converter = dfw_config->converter;
-        mconfig->m_type = dfw_config->module_type;
-        mconfig->vbus_id = dfw_config->vbus_id;
-        mconfig->mem_pages = dfw_config->mem_pages;
-
-        pipe = skl_tplg_add_pipe(bus->dev, skl, &dfw_config->pipe);
-        if (pipe)
-                mconfig->pipe = pipe;
-
-        mconfig->dev_type = dfw_config->dev_type;
-        mconfig->hw_conn_type = dfw_config->hw_conn_type;
-        mconfig->time_slot = dfw_config->time_slot;
-        mconfig->formats_config.caps_size = dfw_config->caps.caps_size;
-
-        mconfig->m_in_pin = devm_kzalloc(bus->dev, (mconfig->max_in_queue) *
-                                                sizeof(*mconfig->m_in_pin),
-                                                GFP_KERNEL);
-        if (!mconfig->m_in_pin)
-                return -ENOMEM;
-
-        mconfig->m_out_pin = devm_kzalloc(bus->dev, (mconfig->max_out_queue) *
-                                                sizeof(*mconfig->m_out_pin),
-                                                GFP_KERNEL);
-        if (!mconfig->m_out_pin)
-                return -ENOMEM;
-
-        skl_fill_module_pin_info(dfw_config->in_pin, mconfig->m_in_pin,
-                                                dfw_config->is_dynamic_in_pin,
-                                                mconfig->max_in_queue);
-
-        skl_fill_module_pin_info(dfw_config->out_pin, mconfig->m_out_pin,
-                                                 dfw_config->is_dynamic_out_pin,
-                                                        mconfig->max_out_queue);
-
-
-        if (mconfig->formats_config.caps_size == 0)
-                goto bind_event;
-
-        mconfig->formats_config.caps = (u32 *)devm_kzalloc(bus->dev,
-                        mconfig->formats_config.caps_size, GFP_KERNEL);
-
-        if (mconfig->formats_config.caps == NULL)
-                return -ENOMEM;
-
-        memcpy(mconfig->formats_config.caps, dfw_config->caps.caps,
-                                                 dfw_config->caps.caps_size);
-        mconfig->formats_config.param_id = dfw_config->caps.param_id;
-        mconfig->formats_config.set_params = dfw_config->caps.set_params;
-
 bind_event:
         if (tplg_w->event_type == 0) {
                 dev_dbg(bus->dev, "ASoC: No event handler required\n");
@@ -1767,11 +2231,229 @@ static int skl_tplg_control_load(struct snd_soc_component *cmpnt,
         return 0;
 }
 
+static int skl_tplg_fill_str_mfest_tkn(struct device *dev,
+                struct snd_soc_tplg_vendor_string_elem *str_elem,
+                struct skl_dfw_manifest *minfo)
+{
+        int tkn_count = 0;
+        static int ref_count;
+
+        switch (str_elem->token) {
+        case SKL_TKN_STR_LIB_NAME:
+                if (ref_count > minfo->lib_count - 1) {
+                        ref_count = 0;
+                        return -EINVAL;
+                }
+
+                strncpy(minfo->lib[ref_count].name, str_elem->string,
+                                ARRAY_SIZE(minfo->lib[ref_count].name));
+                ref_count++;
+                tkn_count++;
+                break;
+
+        default:
+                dev_err(dev, "Not a string token %d\n", str_elem->token);
+                break;
+        }
+
+        return tkn_count;
+}
+
+static int skl_tplg_get_str_tkn(struct device *dev,
+                struct snd_soc_tplg_vendor_array *array,
+                struct skl_dfw_manifest *minfo)
+{
+        int tkn_count = 0, ret;
+        struct snd_soc_tplg_vendor_string_elem *str_elem;
+
+        str_elem = (struct snd_soc_tplg_vendor_string_elem *)array->value;
+        while (tkn_count < array->num_elems) {
+                ret = skl_tplg_fill_str_mfest_tkn(dev, str_elem, minfo);
+                str_elem++;
+
+                if (ret < 0)
+                        return ret;
+
+                tkn_count = tkn_count + ret;
+        }
+
+        return tkn_count;
+}
+
+static int skl_tplg_get_int_tkn(struct device *dev,
+                struct snd_soc_tplg_vendor_value_elem *tkn_elem,
+                struct skl_dfw_manifest *minfo)
+{
+        int tkn_count = 0;
+
+        switch (tkn_elem->token) {
+        case SKL_TKN_U32_LIB_COUNT:
+                minfo->lib_count = tkn_elem->value;
+                tkn_count++;
+                break;
+
+        default:
+                dev_err(dev, "Not a manifest token %d\n", tkn_elem->token);
+                return -EINVAL;
+        }
+
+        return tkn_count;
+}
+
+/*
+ * Fill the manifest structure by parsing the tokens based on the
+ * type.
+ */
+static int skl_tplg_get_manifest_tkn(struct device *dev,
+                char *pvt_data, struct skl_dfw_manifest *minfo,
+                int block_size)
+{
+        int tkn_count = 0, ret;
+        int off = 0, tuple_size = 0;
+        struct snd_soc_tplg_vendor_array *array;
+        struct snd_soc_tplg_vendor_value_elem *tkn_elem;
+
+        if (block_size <= 0)
+                return -EINVAL;
+
+        while (tuple_size < block_size) {
+                array = (struct snd_soc_tplg_vendor_array *)(pvt_data + off);
+                off += array->size;
+                switch (array->type) {
+                case SND_SOC_TPLG_TUPLE_TYPE_STRING:
+                        ret = skl_tplg_get_str_tkn(dev, array, minfo);
+
+                        if (ret < 0)
+                                return ret;
+                        tkn_count += ret;
+
+                        tuple_size += tkn_count *
+                                sizeof(struct snd_soc_tplg_vendor_string_elem);
+                        continue;
+
+                case SND_SOC_TPLG_TUPLE_TYPE_UUID:
+                        dev_warn(dev, "no uuid tokens for skl tplf manifest\n");
+                        continue;
+
+                default:
+                        tkn_elem = array->value;
+                        tkn_count = 0;
+                        break;
+                }
+
+                while (tkn_count <= array->num_elems - 1) {
+                        ret = skl_tplg_get_int_tkn(dev,
+                                        tkn_elem, minfo);
+                        if (ret < 0)
+                                return ret;
+
+                        tkn_count = tkn_count + ret;
+                        tkn_elem++;
+                        tuple_size += tkn_count *
+                                sizeof(struct snd_soc_tplg_vendor_value_elem);
+                        break;
+                }
+                tkn_count = 0;
+        }
+
+        return 0;
+}
+
+/*
+ * Parse manifest private data for tokens. The private data block is
+ * preceded by descriptors for type and size of data block.
+ */
+static int skl_tplg_get_manifest_data(struct snd_soc_tplg_manifest *manifest,
+                        struct device *dev, struct skl_dfw_manifest *minfo)
+{
+        struct snd_soc_tplg_vendor_array *array;
+        int num_blocks, block_size = 0, block_type, off = 0;
+        char *data;
+        int ret;
+
+        /* Read the NUM_DATA_BLOCKS descriptor */
+        array = (struct snd_soc_tplg_vendor_array *)manifest->priv.data;
+        ret = skl_tplg_get_desc_blocks(dev, array);
+        if (ret < 0)
+                return ret;
+        num_blocks = ret;
+
+        off += array->size;
+        array = (struct snd_soc_tplg_vendor_array *)
+                        (manifest->priv.data + off);
+
+        /* Read the BLOCK_TYPE and BLOCK_SIZE descriptor */
+        while (num_blocks > 0) {
+                ret = skl_tplg_get_desc_blocks(dev, array);
+
+                if (ret < 0)
+                        return ret;
+                block_type = ret;
+                off += array->size;
+
+                array = (struct snd_soc_tplg_vendor_array *)
+                        (manifest->priv.data + off);
+
+                ret = skl_tplg_get_desc_blocks(dev, array);
+
+                if (ret < 0)
+                        return ret;
+                block_size = ret;
+                off += array->size;
+
+                array = (struct snd_soc_tplg_vendor_array *)
+                        (manifest->priv.data + off);
+
+                data = (manifest->priv.data + off);
+
+                if (block_type == SKL_TYPE_TUPLE) {
+                        ret = skl_tplg_get_manifest_tkn(dev, data, minfo,
+                                        block_size);
+
+                        if (ret < 0)
+                                return ret;
+
+                        --num_blocks;
+                } else {
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+static int skl_manifest_load(struct snd_soc_component *cmpnt,
+                                struct snd_soc_tplg_manifest *manifest)
+{
+        struct skl_dfw_manifest *minfo;
+        struct hdac_ext_bus *ebus = snd_soc_component_get_drvdata(cmpnt);
+        struct hdac_bus *bus = ebus_to_hbus(ebus);
+        struct skl *skl = ebus_to_skl(ebus);
+        int ret = 0;
+
+        /* proceed only if we have private data defined */
+        if (manifest->priv.size == 0)
+                return 0;
+
+        minfo = &skl->skl_sst->manifest;
+
+        skl_tplg_get_manifest_data(manifest, bus->dev, minfo);
+
+        if (minfo->lib_count > HDA_MAX_LIB) {
+                dev_err(bus->dev, "Exceeding max Library count. Got:%d\n",
+                                        minfo->lib_count);
+                ret = -EINVAL;
+        }
+
+        return ret;
+}
+
 static struct snd_soc_tplg_ops skl_tplg_ops  = {
         .widget_load = skl_tplg_widget_load,
         .control_load = skl_tplg_control_load,
         .bytes_ext_ops = skl_tlv_ops,
         .bytes_ext_ops_count = ARRAY_SIZE(skl_tlv_ops),
+        .manifest = skl_manifest_load,
 };
 
 /*
diff --git a/sound/soc/intel/skylake/skl-topology.h b/sound/soc/intel/skylake/skl-topology.h
index 22d3ef83817d..a519360f42a6 100644
--- a/sound/soc/intel/skylake/skl-topology.h
+++ b/sound/soc/intel/skylake/skl-topology.h
@@ -133,7 +133,7 @@ struct skl_i2s_config_blob {
 struct skl_dma_control {
         u32 node_id;
         u32 config_length;
-        u32 config_data[1];
+        u32 config_data[0];
 } __packed;
 
 struct skl_cpr_cfg {
@@ -215,9 +215,20 @@ struct skl_module_fmt {
 
 struct skl_module_cfg;
 
+struct skl_mod_inst_map {
+        u16 mod_id;
+        u16 inst_id;
+};
+
+struct skl_kpb_params {
+        u32 num_modules;
+        struct skl_mod_inst_map map[0];
+};
+
 struct skl_module_inst_id {
-        u32 module_id;
+        int module_id;
         u32 instance_id;
+        int pvt_id;
 };
 
 enum skl_module_pin_state {
diff --git a/sound/soc/intel/skylake/skl-tplg-interface.h b/sound/soc/intel/skylake/skl-tplg-interface.h
index a32e5e9cc530..2f6281e056d6 100644
--- a/sound/soc/intel/skylake/skl-tplg-interface.h
+++ b/sound/soc/intel/skylake/skl-tplg-interface.h
@@ -80,7 +80,8 @@ enum skl_module_type {
         SKL_MODULE_TYPE_UPDWMIX,
         SKL_MODULE_TYPE_SRCINT,
         SKL_MODULE_TYPE_ALGO,
-        SKL_MODULE_TYPE_BASE_OUTFMT
+        SKL_MODULE_TYPE_BASE_OUTFMT,
+        SKL_MODULE_TYPE_KPB,
 };
 
 enum skl_core_affinity {
@@ -148,84 +149,34 @@ enum skl_module_param_type {
         SKL_PARAM_BIND
 };
 
-struct skl_dfw_module_pin {
-        u16 module_id;
-        u16 instance_id;
-} __packed;
-
-struct skl_dfw_module_fmt {
-        u32 channels;
-        u32 freq;
-        u32 bit_depth;
-        u32 valid_bit_depth;
-        u32 ch_cfg;
-        u32 interleaving_style;
-        u32 sample_type;
-        u32 ch_map;
-} __packed;
-
-struct skl_dfw_module_caps {
+struct skl_dfw_algo_data {
         u32 set_params:2;
         u32 rsvd:30;
         u32 param_id;
-        u32 caps_size;
-        u32 caps[HDA_SST_CFG_MAX];
-};
-
-struct skl_dfw_pipe {
-        u8 pipe_id;
-        u8 pipe_priority;
-        u16 conn_type:4;
-        u16 rsvd:4;
-        u16 memory_pages:8;
+        u32 max;
+        char params[0];
 } __packed;
 
-struct skl_dfw_module {
-        u8 uuid[16];
-
-        u16 module_id;
-        u16 instance_id;
-        u32 max_mcps;
-        u32 mem_pages;
-        u32 obs;
-        u32 ibs;
-        u32 vbus_id;
-
-        u32 max_in_queue:8;
-        u32 max_out_queue:8;
-        u32 time_slot:8;
-        u32 core_id:4;
-        u32 rsvd1:4;
-
-        u32 module_type:8;
-        u32 conn_type:4;
-        u32 dev_type:4;
-        u32 hw_conn_type:4;
-        u32 rsvd2:12;
-
-        u32 params_fixup:8;
-        u32 converter:8;
-        u32 input_pin_type:1;
-        u32 output_pin_type:1;
-        u32 is_dynamic_in_pin:1;
-        u32 is_dynamic_out_pin:1;
-        u32 is_loadable:1;
-        u32 rsvd3:11;
-
-        struct skl_dfw_pipe pipe;
-        struct skl_dfw_module_fmt in_fmt[MAX_IN_QUEUE];
-        struct skl_dfw_module_fmt out_fmt[MAX_OUT_QUEUE];
-        struct skl_dfw_module_pin in_pin[MAX_IN_QUEUE];
-        struct skl_dfw_module_pin out_pin[MAX_OUT_QUEUE];
-        struct skl_dfw_module_caps caps;
+#define LIB_NAME_LENGTH 128
+#define HDA_MAX_LIB     16
+
+struct lib_info {
+        char name[LIB_NAME_LENGTH];
 } __packed;
 
-struct skl_dfw_algo_data {
-        u32 set_params:2;
-        u32 rsvd:30;
-        u32 param_id;
-        u32 max;
-        char params[0];
+struct skl_dfw_manifest {
+        u32 lib_count;
+        struct lib_info lib[HDA_MAX_LIB];
 } __packed;
 
+enum skl_tkn_dir {
+        SKL_DIR_IN,
+        SKL_DIR_OUT
+};
+
+enum skl_tuple_type {
+        SKL_TYPE_TUPLE,
+        SKL_TYPE_DATA
+};
+
 #endif
diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
index cd59536a761d..2989c164dafe 100644
--- a/sound/soc/intel/skylake/skl.c
+++ b/sound/soc/intel/skylake/skl.c
@@ -587,7 +587,7 @@ static int skl_first_init(struct hdac_ext_bus *ebus)
                 return -ENXIO;
         }
 
-        snd_hdac_ext_bus_parse_capabilities(ebus);
+        snd_hdac_bus_parse_capabilities(bus);
 
         if (skl_acquire_irq(ebus, 0) < 0)
                 return -EBUSY;
@@ -672,8 +672,10 @@ static int skl_probe(struct pci_dev *pci,
 
         skl->nhlt = skl_nhlt_init(bus->dev);
 
-        if (skl->nhlt == NULL)
+        if (skl->nhlt == NULL) {
+                err = -ENODEV;
                 goto out_free;
+        }
 
         skl_nhlt_update_topology_bin(skl);
 
@@ -682,7 +684,7 @@ static int skl_probe(struct pci_dev *pci,
         skl_dmic_data.dmic_num = skl_get_dmic_geo(skl);
 
         /* check if dsp is there */
-        if (ebus->ppcap) {
+        if (bus->ppcap) {
                 err = skl_machine_device_register(skl,
                                   (void *)pci_id->driver_data);
                 if (err < 0)
@@ -696,7 +698,7 @@ static int skl_probe(struct pci_dev *pci,
                 skl->skl_sst->enable_miscbdcge = skl_enable_miscbdcge;
 
         }
-        if (ebus->mlcap)
+        if (bus->mlcap)
                 snd_hdac_ext_bus_get_ml_capabilities(ebus);
 
         /* create device for soc dmic */
diff --git a/sound/soc/intel/skylake/skl.h b/sound/soc/intel/skylake/skl.h
index 9064e5b0d676..5d4fbb094c48 100644
--- a/sound/soc/intel/skylake/skl.h
+++ b/sound/soc/intel/skylake/skl.h
@@ -105,6 +105,7 @@ struct skl_dsp_ops {
                         int irq, const char *fw_name,
                         struct skl_dsp_loader_ops loader_ops,
                         struct skl_sst **skl_sst);
+        int (*init_fw)(struct device *dev, struct skl_sst *ctx);
         void (*cleanup)(struct device *dev, struct skl_sst *ctx);
 };
 
@@ -123,4 +124,5 @@ int skl_free_dsp(struct skl *skl);
 int skl_suspend_dsp(struct skl *skl);
 int skl_resume_dsp(struct skl *skl);
 void skl_cleanup_resources(struct skl *skl);
+const struct skl_dsp_ops *skl_get_dsp_ops(int pci_id);
 #endif /* __SOUND_SOC_SKL_H */
diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
index dbfdfe99c69d..dafd22e874e9 100644
--- a/sound/soc/kirkwood/kirkwood-dma.c
+++ b/sound/soc/kirkwood/kirkwood-dma.c
@@ -242,7 +242,7 @@ static snd_pcm_uframes_t kirkwood_dma_pointer(struct snd_pcm_substream
         return count;
 }
 
-static struct snd_pcm_ops kirkwood_dma_ops = {
+static const struct snd_pcm_ops kirkwood_dma_ops = {
         .open =         kirkwood_dma_open,
         .close =        kirkwood_dma_close,
         .ioctl =        snd_pcm_lib_ioctl,
diff --git a/sound/soc/mediatek/common/mtk-afe-fe-dai.c b/sound/soc/mediatek/common/mtk-afe-fe-dai.c
index b788791b0a35..ac231d33d8fe 100644
--- a/sound/soc/mediatek/common/mtk-afe-fe-dai.c
+++ b/sound/soc/mediatek/common/mtk-afe-fe-dai.c
@@ -23,7 +23,8 @@
 
 #define AFE_BASE_END_OFFSET 8
 
-int mtk_regmap_update_bits(struct regmap *map, int reg, unsigned int mask,
+static int mtk_regmap_update_bits(struct regmap *map, int reg,
+                           unsigned int mask,
                            unsigned int val)
 {
         if (reg < 0)
@@ -31,7 +32,7 @@ int mtk_regmap_update_bits(struct regmap *map, int reg, unsigned int mask,
         return regmap_update_bits(map, reg, mask, val);
 }
 
-int mtk_regmap_write(struct regmap *map, int reg, unsigned int val)
+static int mtk_regmap_write(struct regmap *map, int reg, unsigned int val)
 {
         if (reg < 0)
                 return 0;
diff --git a/sound/soc/omap/mcbsp.c b/sound/soc/omap/mcbsp.c
index 76ce33199bf9..06fec5699cc8 100644
--- a/sound/soc/omap/mcbsp.c
+++ b/sound/soc/omap/mcbsp.c
@@ -221,7 +221,8 @@ void omap_mcbsp_config(struct omap_mcbsp *mcbsp,
 
         /* Enable TX/RX sync error interrupts by default */
         if (mcbsp->irq)
-                MCBSP_WRITE(mcbsp, IRQEN, RSYNCERREN | XSYNCERREN);
+                MCBSP_WRITE(mcbsp, IRQEN, RSYNCERREN | XSYNCERREN |
+                            RUNDFLEN | ROVFLEN | XUNDFLEN | XOVFLEN);
 }
 
 /**
diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
index 0843a68f277c..89fe95e877db 100644
--- a/sound/soc/omap/omap-abe-twl6040.c
+++ b/sound/soc/omap/omap-abe-twl6040.c
@@ -38,10 +38,10 @@
 struct abe_twl6040 {
         int     jack_detection; /* board can detect jack events */
         int     mclk_freq;      /* MCLK frequency speed for twl6040 */
-
-        struct platform_device *dmic_codec_dev;
 };
 
+struct platform_device *dmic_codec_dev;
+
 static int omap_abe_hw_params(struct snd_pcm_substream *substream,
         struct snd_pcm_hw_params *params)
 {
@@ -258,8 +258,6 @@ static int omap_abe_probe(struct platform_device *pdev)
         if (priv == NULL)
                 return -ENOMEM;
 
-        priv->dmic_codec_dev = ERR_PTR(-EINVAL);
-
         if (snd_soc_of_parse_card_name(card, "ti,model")) {
                 dev_err(&pdev->dev, "Card name is not provided\n");
                 return -ENODEV;
@@ -284,13 +282,6 @@ static int omap_abe_probe(struct platform_device *pdev)
                 num_links = 2;
                 abe_twl6040_dai_links[1].cpu_of_node = dai_node;
                 abe_twl6040_dai_links[1].platform_of_node = dai_node;
-
-                priv->dmic_codec_dev = platform_device_register_simple(
-                                                "dmic-codec", -1, NULL, 0);
-                if (IS_ERR(priv->dmic_codec_dev)) {
-                        dev_err(&pdev->dev, "Can't instantiate dmic-codec\n");
-                        return PTR_ERR(priv->dmic_codec_dev);
-                }
         } else {
                 num_links = 1;
         }
@@ -299,16 +290,14 @@ static int omap_abe_probe(struct platform_device *pdev)
         of_property_read_u32(node, "ti,mclk-freq", &priv->mclk_freq);
         if (!priv->mclk_freq) {
                 dev_err(&pdev->dev, "MCLK frequency not provided\n");
-                ret = -EINVAL;
-                goto err_unregister;
+                return -EINVAL;
         }
 
         card->fully_routed = 1;
 
         if (!priv->mclk_freq) {
                 dev_err(&pdev->dev, "MCLK frequency missing\n");
-                ret = -ENODEV;
-                goto err_unregister;
+                return -ENODEV;
         }
 
         card->dai_link = abe_twl6040_dai_links;
@@ -316,35 +305,14 @@ static int omap_abe_probe(struct platform_device *pdev)
 
         snd_soc_card_set_drvdata(card, priv);
 
-        ret = snd_soc_register_card(card);
-        if (ret) {
-                dev_err(&pdev->dev, "snd_soc_register_card() failed: %d\n",
+        ret = devm_snd_soc_register_card(&pdev->dev, card);
+        if (ret)
+                dev_err(&pdev->dev, "devm_snd_soc_register_card() failed: %d\n",
                         ret);
-                goto err_unregister;
-        }
-
-        return 0;
-
-err_unregister:
-        if (!IS_ERR(priv->dmic_codec_dev))
-                platform_device_unregister(priv->dmic_codec_dev);
 
         return ret;
 }
 
-static int omap_abe_remove(struct platform_device *pdev)
-{
-        struct snd_soc_card *card = platform_get_drvdata(pdev);
-        struct abe_twl6040 *priv = snd_soc_card_get_drvdata(card);
-
-        snd_soc_unregister_card(card);
-
-        if (!IS_ERR(priv->dmic_codec_dev))
-                platform_device_unregister(priv->dmic_codec_dev);
-
-        return 0;
-}
-
 static const struct of_device_id omap_abe_of_match[] = {
         {.compatible = "ti,abe-twl6040", },
         { },
@@ -358,10 +326,35 @@ static struct platform_driver omap_abe_driver = {
                 .of_match_table = omap_abe_of_match,
         },
         .probe = omap_abe_probe,
-        .remove = omap_abe_remove,
 };
 
-module_platform_driver(omap_abe_driver);
+static int __init omap_abe_init(void)
+{
+        int ret;
+
+        dmic_codec_dev = platform_device_register_simple("dmic-codec", -1, NULL,
+                                                         0);
+        if (IS_ERR(dmic_codec_dev)) {
+                pr_err("%s: dmic-codec device registration failed\n", __func__);
+                return PTR_ERR(dmic_codec_dev);
+        }
+
+        ret = platform_driver_register(&omap_abe_driver);
+        if (ret) {
+                pr_err("%s: platform driver registration failed\n", __func__);
+                platform_device_unregister(dmic_codec_dev);
+        }
+
+        return ret;
+}
+module_init(omap_abe_init);
+
+static void __exit omap_abe_exit(void)
+{
+        platform_driver_unregister(&omap_abe_driver);
+        platform_device_unregister(dmic_codec_dev);
+}
+module_exit(omap_abe_exit);
 
 MODULE_AUTHOR("Misael Lopez Cruz <misael.lopez@ti.com>");
 MODULE_DESCRIPTION("ALSA SoC for OMAP boards with ABE and twl6040 codec");
diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
index e7cdc51fd806..64609c77a79d 100644
--- a/sound/soc/omap/omap-mcpdm.c
+++ b/sound/soc/omap/omap-mcpdm.c
@@ -31,7 +31,6 @@
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/irq.h>
-#include <linux/clk.h>
 #include <linux/slab.h>
 #include <linux/pm_runtime.h>
 #include <linux/of_device.h>
@@ -55,7 +54,6 @@ struct omap_mcpdm {
         unsigned long phys_base;
         void __iomem *io_base;
         int irq;
-        struct clk *pdmclk;
 
         struct mutex mutex;
 
@@ -390,15 +388,14 @@ static int omap_mcpdm_probe(struct snd_soc_dai *dai)
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
         int ret;
 
-        clk_prepare_enable(mcpdm->pdmclk);
         pm_runtime_enable(mcpdm->dev);
 
         /* Disable lines while request is ongoing */
         pm_runtime_get_sync(mcpdm->dev);
         omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00);
 
-        ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler,
-                                0, "McPDM", (void *)mcpdm);
+        ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM",
+                          (void *)mcpdm);
 
         pm_runtime_put_sync(mcpdm->dev);
 
@@ -423,9 +420,9 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
 
+        free_irq(mcpdm->irq, (void *)mcpdm);
         pm_runtime_disable(mcpdm->dev);
 
-        clk_disable_unprepare(mcpdm->pdmclk);
         return 0;
 }
 
@@ -445,8 +442,6 @@ static int omap_mcpdm_suspend(struct snd_soc_dai *dai)
                 mcpdm->pm_active_count++;
         }
 
-        clk_disable_unprepare(mcpdm->pdmclk);
-
         return 0;
 }
 
@@ -454,8 +449,6 @@ static int omap_mcpdm_resume(struct snd_soc_dai *dai)
 {
         struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
 
-        clk_prepare_enable(mcpdm->pdmclk);
-
         if (mcpdm->pm_active_count) {
                 while (mcpdm->pm_active_count--)
                         pm_runtime_get_sync(mcpdm->dev);
@@ -549,15 +542,6 @@ static int asoc_mcpdm_probe(struct platform_device *pdev)
 
         mcpdm->dev = &pdev->dev;
 
-        mcpdm->pdmclk = devm_clk_get(&pdev->dev, "pdmclk");
-        if (IS_ERR(mcpdm->pdmclk)) {
-                if (PTR_ERR(mcpdm->pdmclk) == -EPROBE_DEFER)
-                        return -EPROBE_DEFER;
-                dev_warn(&pdev->dev, "Error getting pdmclk (%ld)!\n",
-                         PTR_ERR(mcpdm->pdmclk));
-                mcpdm->pdmclk = NULL;
-        }
-
         ret =  devm_snd_soc_register_component(&pdev->dev,
                                                &omap_mcpdm_component,
                                                &omap_mcpdm_dai, 1);
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index a84f677234f0..94e9ff791f3a 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -58,7 +58,7 @@ static void omap_pcm_limit_supported_formats(void)
 {
         int i;
 
-        for (i = 0; i < SNDRV_PCM_FORMAT_LAST; i++) {
+        for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
                 switch (snd_pcm_format_physical_width(i)) {
                 case 8:
                 case 16:
diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
index 1289543c8fb2..07f91e918b23 100644
--- a/sound/soc/qcom/apq8016_sbc.c
+++ b/sound/soc/qcom/apq8016_sbc.c
@@ -85,6 +85,15 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
                 return ERR_PTR(ret);
         }
 
+        /* DAPM routes */
+        if (of_property_read_bool(node, "qcom,audio-routing")) {
+                ret = snd_soc_of_parse_audio_routing(card,
+                                        "qcom,audio-routing");
+                if (ret)
+                        return ERR_PTR(ret);
+        }
+
+
         /* Populate links */
         num_links = of_get_child_count(node);
 
@@ -147,6 +156,15 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
         return data;
 }
 
+static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
+
+        SND_SOC_DAPM_MIC("Handset Mic", NULL),
+        SND_SOC_DAPM_MIC("Headset Mic", NULL),
+        SND_SOC_DAPM_MIC("Secondary Mic", NULL),
+        SND_SOC_DAPM_MIC("Digital Mic1", NULL),
+        SND_SOC_DAPM_MIC("Digital Mic2", NULL),
+};
+
 static int apq8016_sbc_platform_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -159,6 +177,8 @@ static int apq8016_sbc_platform_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         card->dev = dev;
+        card->dapm_widgets = apq8016_sbc_dapm_widgets;
+        card->num_dapm_widgets = ARRAY_SIZE(apq8016_sbc_dapm_widgets);
         data = apq8016_sbc_parse_of(card);
         if (IS_ERR(data)) {
                 dev_err(&pdev->dev, "Error resolving dai links: %ld\n",
diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
index db000c6987a1..e2ff538a8aa5 100644
--- a/sound/soc/qcom/lpass-platform.c
+++ b/sound/soc/qcom/lpass-platform.c
@@ -84,9 +84,9 @@ static int lpass_platform_pcmops_hw_params(struct snd_pcm_substream *substream,
                 struct snd_pcm_hw_params *params)
 {
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct lpass_pcm_data *pcm_data = snd_soc_pcm_get_drvdata(soc_runtime);
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
+        struct lpass_pcm_data *pcm_data = drvdata->private_data;
         struct lpass_variant *v = drvdata->variant;
         snd_pcm_format_t format = params_format(params);
         unsigned int channels = params_channels(params);
@@ -177,9 +177,9 @@ static int lpass_platform_pcmops_hw_params(struct snd_pcm_substream *substream,
 static int lpass_platform_pcmops_hw_free(struct snd_pcm_substream *substream)
 {
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct lpass_pcm_data *pcm_data = snd_soc_pcm_get_drvdata(soc_runtime);
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
+        struct lpass_pcm_data *pcm_data = drvdata->private_data;
         struct lpass_variant *v = drvdata->variant;
         unsigned int reg;
         int ret;
@@ -201,9 +201,9 @@ static int lpass_platform_pcmops_prepare(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct lpass_pcm_data *pcm_data = snd_soc_pcm_get_drvdata(soc_runtime);
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
+        struct lpass_pcm_data *pcm_data = drvdata->private_data;
         struct lpass_variant *v = drvdata->variant;
         int ret, ch, dir = substream->stream;
 
@@ -255,9 +255,9 @@ static int lpass_platform_pcmops_trigger(struct snd_pcm_substream *substream,
                 int cmd)
 {
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct lpass_pcm_data *pcm_data = snd_soc_pcm_get_drvdata(soc_runtime);
         struct lpass_data *drvdata =
                 snd_soc_platform_get_drvdata(soc_runtime->platform);
+        struct lpass_pcm_data *pcm_data = drvdata->private_data;
         struct lpass_variant *v = drvdata->variant;
         int ret, ch, dir = substream->stream;
 
@@ -331,9 +331,9 @@ static snd_pcm_uframes_t lpass_platform_pcmops_pointer(
                 struct snd_pcm_substream *substream)
 {
         struct snd_soc_pcm_runtime *soc_runtime = substream->private_data;
-        struct lpass_pcm_data *pcm_data = snd_soc_pcm_get_drvdata(soc_runtime);
         struct lpass_data *drvdata =
                         snd_soc_platform_get_drvdata(soc_runtime->platform);
+        struct lpass_pcm_data *pcm_data = drvdata->private_data;
         struct lpass_variant *v = drvdata->variant;
         unsigned int base_addr, curr_addr;
         int ret, ch, dir = substream->stream;
@@ -372,7 +372,7 @@ static int lpass_platform_pcmops_mmap(struct snd_pcm_substream *substream,
                         runtime->dma_bytes);
 }
 
-static struct snd_pcm_ops lpass_platform_pcm_ops = {
+static const struct snd_pcm_ops lpass_platform_pcm_ops = {
         .open           = lpass_platform_pcmops_open,
         .ioctl          = snd_pcm_lib_ioctl,
         .hw_params      = lpass_platform_pcmops_hw_params,
@@ -483,7 +483,7 @@ static int lpass_platform_pcm_new(struct snd_soc_pcm_runtime *soc_runtime)
                 return -ENOMEM;
 
         data->i2s_port = cpu_dai->driver->id;
-        snd_soc_pcm_set_drvdata(soc_runtime, data);
+        drvdata->private_data = data;
 
         psubstream = pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream;
         if (psubstream) {
@@ -570,8 +570,8 @@ static void lpass_platform_pcm_free(struct snd_pcm *pcm)
                 substream = pcm->streams[i].substream;
                 if (substream) {
                         rt = substream->private_data;
-                        data = snd_soc_pcm_get_drvdata(rt);
                         drvdata = snd_soc_platform_get_drvdata(rt->platform);
+                        data = drvdata->private_data;
 
                         ch = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
                                 ? data->rdma_ch
diff --git a/sound/soc/qcom/lpass.h b/sound/soc/qcom/lpass.h
index 30714ad1e138..35b3cea8207d 100644
--- a/sound/soc/qcom/lpass.h
+++ b/sound/soc/qcom/lpass.h
@@ -58,6 +58,8 @@ struct lpass_data {
         /* 8016 specific */
         struct clk *pcnoc_mport_clk;
         struct clk *pcnoc_sway_clk;
+
+        void *private_data;
 };
 
 /* Vairant data per each SOC */
diff --git a/sound/soc/rockchip/Kconfig b/sound/soc/rockchip/Kconfig
index f1e0c703e0d2..c783f9a22595 100644
--- a/sound/soc/rockchip/Kconfig
+++ b/sound/soc/rockchip/Kconfig
@@ -41,3 +41,15 @@ config SND_SOC_ROCKCHIP_RT5645
         help
           Say Y or M here if you want to add support for SoC audio on Rockchip
           boards using the RT5645/RT5650 codec, such as Veyron.
+
+config SND_SOC_RK3399_GRU_SOUND
+        tristate "ASoC support multiple codecs for Rockchip RK3399 GRU boards"
+        depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && CLKDEV_LOOKUP && SPI
+        select SND_SOC_ROCKCHIP_I2S
+        select SND_SOC_MAX98357A
+        select SND_SOC_RT5514
+        select SND_SOC_DA7219
+        select SND_SOC_RT5514_SPI
+        help
+          Say Y or M here if you want to add support multiple codecs for SoC
+          audio on Rockchip RK3399 GRU boards.
diff --git a/sound/soc/rockchip/Makefile b/sound/soc/rockchip/Makefile
index c0bf560125f3..84e5c7c700e7 100644
--- a/sound/soc/rockchip/Makefile
+++ b/sound/soc/rockchip/Makefile
@@ -7,6 +7,8 @@ obj-$(CONFIG_SND_SOC_ROCKCHIP_SPDIF) += snd-soc-rockchip-spdif.o
 
 snd-soc-rockchip-max98090-objs := rockchip_max98090.o
 snd-soc-rockchip-rt5645-objs := rockchip_rt5645.o
+snd-soc-rk3399-gru-sound-objs := rk3399_gru_sound.o
 
 obj-$(CONFIG_SND_SOC_ROCKCHIP_MAX98090) += snd-soc-rockchip-max98090.o
 obj-$(CONFIG_SND_SOC_ROCKCHIP_RT5645) += snd-soc-rockchip-rt5645.o
+obj-$(CONFIG_SND_SOC_RK3399_GRU_SOUND) += snd-soc-rk3399-gru-sound.o
diff --git a/sound/soc/rockchip/rk3399_gru_sound.c b/sound/soc/rockchip/rk3399_gru_sound.c
new file mode 100644
index 000000000000..9ed735a6cf49
--- /dev/null
+++ b/sound/soc/rockchip/rk3399_gru_sound.c
@@ -0,0 +1,397 @@
+/*
+ * Rockchip machine ASoC driver for boards using MAX98357A/RT5514/DA7219
+ *
+ * Copyright (c) 2016, ROCKCHIP CORPORATION.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+#include <linux/delay.h>
+#include <linux/spi/spi.h>
+#include <linux/input.h>
+#include <sound/core.h>
+#include <sound/jack.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+#include "rockchip_i2s.h"
+#include "../codecs/da7219.h"
+#include "../codecs/da7219-aad.h"
+#include "../codecs/rt5514.h"
+
+#define DRV_NAME "rk3399-gru-sound"
+
+#define SOUND_FS        256
+
+unsigned int rt5514_dmic_delay;
+
+static struct snd_soc_jack rockchip_sound_jack;
+
+static const struct snd_soc_dapm_widget rockchip_dapm_widgets[] = {
+        SND_SOC_DAPM_HP("Headphones", NULL),
+        SND_SOC_DAPM_SPK("Speakers", NULL),
+        SND_SOC_DAPM_MIC("Headset Mic", NULL),
+        SND_SOC_DAPM_MIC("Int Mic", NULL),
+};
+
+static const struct snd_soc_dapm_route rockchip_dapm_routes[] = {
+        /* Input Lines */
+        {"MIC", NULL, "Headset Mic"},
+        {"DMIC1L", NULL, "Int Mic"},
+        {"DMIC1R", NULL, "Int Mic"},
+
+        /* Output Lines */
+        {"Headphones", NULL, "HPL"},
+        {"Headphones", NULL, "HPR"},
+        {"Speakers", NULL, "Speaker"},
+};
+
+static const struct snd_kcontrol_new rockchip_controls[] = {
+        SOC_DAPM_PIN_SWITCH("Headphones"),
+        SOC_DAPM_PIN_SWITCH("Speakers"),
+        SOC_DAPM_PIN_SWITCH("Headset Mic"),
+        SOC_DAPM_PIN_SWITCH("Int Mic"),
+};
+
+static int rockchip_sound_max98357a_hw_params(struct snd_pcm_substream *substream,
+                             struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        unsigned int mclk;
+        int ret;
+
+        /* max98357a supports these sample rates */
+        switch (params_rate(params)) {
+        case 8000:
+        case 16000:
+        case 48000:
+        case 96000:
+                mclk = params_rate(params) * SOUND_FS;
+                break;
+        default:
+                dev_err(rtd->card->dev, "%s() doesn't support this sample rate: %d\n",
+                                __func__, params_rate(params));
+                return -EINVAL;
+        }
+
+        ret = snd_soc_dai_set_sysclk(rtd->cpu_dai, 0, mclk, 0);
+        if (ret) {
+                dev_err(rtd->card->dev, "%s() error setting sysclk to %u: %d\n",
+                                __func__, mclk, ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int rockchip_sound_rt5514_hw_params(struct snd_pcm_substream *substream,
+                             struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        unsigned int mclk;
+        int ret;
+
+        mclk = params_rate(params) * SOUND_FS;
+
+        ret = snd_soc_dai_set_sysclk(cpu_dai, 0, mclk,
+                                     SND_SOC_CLOCK_OUT);
+        if (ret < 0) {
+                dev_err(rtd->card->dev, "Can't set cpu clock out %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_sysclk(codec_dai, RT5514_SCLK_S_MCLK,
+                                     mclk, SND_SOC_CLOCK_IN);
+        if (ret) {
+                dev_err(rtd->card->dev, "%s() error setting sysclk to %u: %d\n",
+                                __func__, params_rate(params) * 512, ret);
+                return ret;
+        }
+
+        /* Wait for DMIC stable */
+        msleep(rt5514_dmic_delay);
+
+        return 0;
+}
+
+static int rockchip_sound_da7219_hw_params(struct snd_pcm_substream *substream,
+                             struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int mclk, ret;
+
+        /* in bypass mode, the mclk has to be one of the frequencies below */
+        switch (params_rate(params)) {
+        case 8000:
+        case 16000:
+        case 24000:
+        case 32000:
+        case 48000:
+        case 64000:
+        case 96000:
+                mclk = 12288000;
+                break;
+        case 11025:
+        case 22050:
+        case 44100:
+        case 88200:
+                mclk = 11289600;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        ret = snd_soc_dai_set_sysclk(cpu_dai, 0, mclk,
+                                     SND_SOC_CLOCK_OUT);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "Can't set cpu clock out %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_sysclk(codec_dai, 0, mclk,
+                                     SND_SOC_CLOCK_IN);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "Can't set codec clock in %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_pll(codec_dai, 0, DA7219_SYSCLK_MCLK, 0, 0);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "Can't set pll sysclk mclk %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static int rockchip_sound_da7219_init(struct snd_soc_pcm_runtime *rtd)
+{
+        struct snd_soc_codec *codec = rtd->codec_dais[0]->codec;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        int ret;
+
+        /* We need default MCLK and PLL settings for the accessory detection */
+        ret = snd_soc_dai_set_sysclk(codec_dai, 0, 12288000,
+                                     SND_SOC_CLOCK_IN);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "Init can't set codec clock in %d\n", ret);
+                return ret;
+        }
+
+        ret = snd_soc_dai_set_pll(codec_dai, 0, DA7219_SYSCLK_MCLK, 0, 0);
+        if (ret < 0) {
+                dev_err(codec_dai->dev, "Init can't set pll sysclk mclk %d\n", ret);
+                return ret;
+        }
+
+        /* Enable Headset and 4 Buttons Jack detection */
+        ret = snd_soc_card_jack_new(rtd->card, "Headset Jack",
+                                    SND_JACK_HEADSET | SND_JACK_LINEOUT |
+                                    SND_JACK_BTN_0 | SND_JACK_BTN_1 |
+                                    SND_JACK_BTN_2 | SND_JACK_BTN_3,
+                                    &rockchip_sound_jack, NULL, 0);
+
+        if (ret) {
+                dev_err(rtd->card->dev, "New Headset Jack failed! (%d)\n", ret);
+                return ret;
+        }
+
+        snd_jack_set_key(rockchip_sound_jack.jack, SND_JACK_BTN_0, KEY_MEDIA);
+        snd_jack_set_key(
+                rockchip_sound_jack.jack, SND_JACK_BTN_1, KEY_VOLUMEUP);
+        snd_jack_set_key(
+                rockchip_sound_jack.jack, SND_JACK_BTN_2, KEY_VOLUMEDOWN);
+        snd_jack_set_key(
+                rockchip_sound_jack.jack, SND_JACK_BTN_3, KEY_VOICECOMMAND);
+
+        da7219_aad_jack_det(codec, &rockchip_sound_jack);
+
+        return 0;
+}
+
+static struct snd_soc_ops rockchip_sound_max98357a_ops = {
+        .hw_params = rockchip_sound_max98357a_hw_params,
+};
+
+static struct snd_soc_ops rockchip_sound_rt5514_ops = {
+        .hw_params = rockchip_sound_rt5514_hw_params,
+};
+
+static struct snd_soc_ops rockchip_sound_da7219_ops = {
+        .hw_params = rockchip_sound_da7219_hw_params,
+};
+
+enum {
+        DAILINK_MAX98357A,
+        DAILINK_RT5514,
+        DAILINK_DA7219,
+        DAILINK_RT5514_DSP,
+};
+
+#define DAILINK_ENTITIES        (DAILINK_DA7219 + 1)
+
+static struct snd_soc_dai_link rockchip_dailinks[] = {
+        [DAILINK_MAX98357A] = {
+                .name = "MAX98357A",
+                .stream_name = "MAX98357A PCM",
+                .codec_dai_name = "HiFi",
+                .ops = &rockchip_sound_max98357a_ops,
+                /* set max98357a as slave */
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+        },
+        [DAILINK_RT5514] = {
+                .name = "RT5514",
+                .stream_name = "RT5514 PCM",
+                .codec_dai_name = "rt5514-aif1",
+                .ops = &rockchip_sound_rt5514_ops,
+                /* set rt5514 as slave */
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+        },
+        [DAILINK_DA7219] = {
+                .name = "DA7219",
+                .stream_name = "DA7219 PCM",
+                .codec_dai_name = "da7219-hifi",
+                .init = rockchip_sound_da7219_init,
+                .ops = &rockchip_sound_da7219_ops,
+                /* set da7219 as slave */
+                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+        },
+        /* RT5514 DSP for voice wakeup via spi bus */
+        [DAILINK_RT5514_DSP] = {
+                .name = "RT5514 DSP",
+                .stream_name = "Wake on Voice",
+                .codec_name = "snd-soc-dummy",
+                .codec_dai_name = "snd-soc-dummy-dai",
+        },
+};
+
+static struct snd_soc_card rockchip_sound_card = {
+        .name = "rk3399-gru-sound",
+        .owner = THIS_MODULE,
+        .dai_link = rockchip_dailinks,
+        .num_links =  ARRAY_SIZE(rockchip_dailinks),
+        .dapm_widgets = rockchip_dapm_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(rockchip_dapm_widgets),
+        .dapm_routes = rockchip_dapm_routes,
+        .num_dapm_routes = ARRAY_SIZE(rockchip_dapm_routes),
+        .controls = rockchip_controls,
+        .num_controls = ARRAY_SIZE(rockchip_controls),
+};
+
+static int rockchip_sound_match_stub(struct device *dev, void *data)
+{
+        return 1;
+}
+
+static int rockchip_sound_probe(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = &rockchip_sound_card;
+        struct device_node *cpu_node;
+        struct device *dev;
+        struct device_driver *drv;
+        int i, ret;
+
+        cpu_node = of_parse_phandle(pdev->dev.of_node, "rockchip,cpu", 0);
+        if (!cpu_node) {
+                dev_err(&pdev->dev, "Property 'rockchip,cpu' missing or invalid\n");
+                return -EINVAL;
+        }
+
+        for (i = 0; i < DAILINK_ENTITIES; i++) {
+                rockchip_dailinks[i].platform_of_node = cpu_node;
+                rockchip_dailinks[i].cpu_of_node = cpu_node;
+
+                rockchip_dailinks[i].codec_of_node =
+                        of_parse_phandle(pdev->dev.of_node, "rockchip,codec", i);
+                if (!rockchip_dailinks[i].codec_of_node) {
+                        dev_err(&pdev->dev,
+                                "Property[%d] 'rockchip,codec' missing or invalid\n", i);
+                        return -EINVAL;
+                }
+        }
+
+        /**
+         * To acquire the spi driver of the rt5514 and set the dai-links names
+         * for soc_bind_dai_link
+         */
+        drv = driver_find("rt5514", &spi_bus_type);
+        if (!drv) {
+                dev_err(&pdev->dev, "Can not find the rt5514 driver at the spi bus\n");
+                return -EINVAL;
+        }
+
+        dev = driver_find_device(drv, NULL, NULL, rockchip_sound_match_stub);
+        if (!dev) {
+                dev_err(&pdev->dev, "Can not find the rt5514 device\n");
+                return -ENODEV;
+        }
+
+        /* Set DMIC delay */
+        ret = device_property_read_u32(&pdev->dev, "dmic-delay",
+                                        &rt5514_dmic_delay);
+        if (ret) {
+                rt5514_dmic_delay = 0;
+                dev_dbg(&pdev->dev,
+                        "no optional property 'dmic-delay' found, default: no delay\n");
+        }
+
+        rockchip_dailinks[DAILINK_RT5514_DSP].cpu_name = kstrdup_const(dev_name(dev), GFP_KERNEL);
+        rockchip_dailinks[DAILINK_RT5514_DSP].cpu_dai_name = kstrdup_const(dev_name(dev), GFP_KERNEL);
+        rockchip_dailinks[DAILINK_RT5514_DSP].platform_name = kstrdup_const(dev_name(dev), GFP_KERNEL);
+
+        card->dev = &pdev->dev;
+        platform_set_drvdata(pdev, card);
+
+        ret = devm_snd_soc_register_card(&pdev->dev, card);
+        if (ret)
+                dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n",
+                        __func__, ret);
+
+        return ret;
+}
+
+static const struct of_device_id rockchip_sound_of_match[] = {
+        { .compatible = "rockchip,rk3399-gru-sound", },
+        {},
+};
+
+static struct platform_driver rockchip_sound_driver = {
+        .probe = rockchip_sound_probe,
+        .driver = {
+                .name = DRV_NAME,
+                .of_match_table = rockchip_sound_of_match,
+#ifdef CONFIG_PM
+                .pm = &snd_soc_pm_ops,
+#endif
+        },
+};
+
+module_platform_driver(rockchip_sound_driver);
+
+MODULE_AUTHOR("Xing Zheng <zhengxing@rock-chips.com>");
+MODULE_DESCRIPTION("Rockchip ASoC Machine Driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" DRV_NAME);
+MODULE_DEVICE_TABLE(of, rockchip_sound_of_match);
diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
index 652e8c5ea166..974915cb4c4f 100644
--- a/sound/soc/rockchip/rockchip_i2s.c
+++ b/sound/soc/rockchip/rockchip_i2s.c
@@ -57,6 +57,7 @@ static int i2s_runtime_suspend(struct device *dev)
 {
         struct rk_i2s_dev *i2s = dev_get_drvdata(dev);
 
+        regcache_cache_only(i2s->regmap, true);
         clk_disable_unprepare(i2s->mclk);
 
         return 0;
@@ -73,7 +74,14 @@ static int i2s_runtime_resume(struct device *dev)
                 return ret;
         }
 
-        return 0;
+        regcache_cache_only(i2s->regmap, false);
+        regcache_mark_dirty(i2s->regmap);
+
+        ret = regcache_sync(i2s->regmap);
+        if (ret)
+                clk_disable_unprepare(i2s->mclk);
+
+        return ret;
 }
 
 static inline struct rk_i2s_dev *to_info(struct snd_soc_dai *dai)
diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c
index 4ca265737eda..fa8101d1e16f 100644
--- a/sound/soc/rockchip/rockchip_spdif.c
+++ b/sound/soc/rockchip/rockchip_spdif.c
@@ -65,6 +65,7 @@ static int __maybe_unused rk_spdif_runtime_suspend(struct device *dev)
 {
         struct rk_spdif_dev *spdif = dev_get_drvdata(dev);
 
+        regcache_cache_only(spdif->regmap, true);
         clk_disable_unprepare(spdif->mclk);
         clk_disable_unprepare(spdif->hclk);
 
@@ -88,7 +89,16 @@ static int __maybe_unused rk_spdif_runtime_resume(struct device *dev)
                 return ret;
         }
 
-        return 0;
+        regcache_cache_only(spdif->regmap, false);
+        regcache_mark_dirty(spdif->regmap);
+
+        ret = regcache_sync(spdif->regmap);
+        if (ret) {
+                clk_disable_unprepare(spdif->mclk);
+                clk_disable_unprepare(spdif->hclk);
+        }
+
+        return ret;
 }
 
 static int rk_spdif_hw_params(struct snd_pcm_substream *substream,
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index 7b722b0094d9..f6023b46c107 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -1,12 +1,14 @@
-config SND_SOC_SAMSUNG
+menuconfig SND_SOC_SAMSUNG
         tristate "ASoC support for Samsung"
         depends on (PLAT_SAMSUNG || ARCH_EXYNOS)
         select SND_SOC_GENERIC_DMAENGINE_PCM
-        help
+        ---help---
           Say Y or M if you want to add support for codecs attached to
           the Samsung SoCs' Audio interfaces. You will also need to
           select the audio interfaces to support below.
 
+if SND_SOC_SAMSUNG
+
 config SND_S3C24XX_I2S
         tristate
 
@@ -18,22 +20,22 @@ config SND_S3C2412_SOC_I2S
         select SND_S3C_I2SV2_SOC
 
 config SND_SAMSUNG_PCM
-        tristate
+        tristate "Samsung PCM interface support"
 
 config SND_SAMSUNG_AC97
         tristate
         select SND_SOC_AC97_BUS
 
 config SND_SAMSUNG_SPDIF
-        tristate
+        tristate "Samsung SPDIF transmitter support"
         select SND_SOC_SPDIF
 
 config SND_SAMSUNG_I2S
-        tristate
+        tristate "Samsung I2S interface support"
 
 config SND_SOC_SAMSUNG_NEO1973_WM8753
         tristate "Audio support for Openmoko Neo1973 Smartphones (GTA02)"
-        depends on SND_SOC_SAMSUNG && MACH_NEO1973_GTA02
+        depends on MACH_NEO1973_GTA02
         select SND_S3C24XX_I2S
         select SND_SOC_WM8753
         select SND_SOC_BT_SCO
@@ -43,7 +45,7 @@ config SND_SOC_SAMSUNG_NEO1973_WM8753
 
 config SND_SOC_SAMSUNG_JIVE_WM8750
         tristate "SoC I2S Audio support for Jive"
-        depends on SND_SOC_SAMSUNG && MACH_JIVE && I2C
+        depends on MACH_JIVE && I2C
         select SND_SOC_WM8750
         select SND_S3C2412_SOC_I2S
         help
@@ -51,7 +53,7 @@ config SND_SOC_SAMSUNG_JIVE_WM8750
 
 config SND_SOC_SAMSUNG_SMDK_WM8580
         tristate "SoC I2S Audio support for WM8580 on SMDK"
-        depends on SND_SOC_SAMSUNG && (MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110)
+        depends on MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110
         depends on I2C
         select SND_SOC_WM8580
         select SND_SAMSUNG_I2S
@@ -60,7 +62,6 @@ config SND_SOC_SAMSUNG_SMDK_WM8580
 
 config SND_SOC_SAMSUNG_SMDK_WM8994
         tristate "SoC I2S Audio support for WM8994 on SMDK"
-        depends on SND_SOC_SAMSUNG
         depends on I2C=y
         select MFD_WM8994
         select SND_SOC_WM8994
@@ -70,7 +71,7 @@ config SND_SOC_SAMSUNG_SMDK_WM8994
 
 config SND_SOC_SAMSUNG_SMDK2443_WM9710
         tristate "SoC AC97 Audio support for SMDK2443 - WM9710"
-        depends on SND_SOC_SAMSUNG && MACH_SMDK2443
+        depends on MACH_SMDK2443
         select AC97_BUS
         select SND_SOC_AC97_CODEC
         select SND_SAMSUNG_AC97
@@ -80,7 +81,7 @@ config SND_SOC_SAMSUNG_SMDK2443_WM9710
 
 config SND_SOC_SAMSUNG_LN2440SBC_ALC650
         tristate "SoC AC97 Audio support for LN2440SBC - ALC650"
-        depends on SND_SOC_SAMSUNG && ARCH_S3C24XX
+        depends on ARCH_S3C24XX
         select AC97_BUS
         select SND_SOC_AC97_CODEC
         select SND_SAMSUNG_AC97
@@ -90,7 +91,7 @@ config SND_SOC_SAMSUNG_LN2440SBC_ALC650
 
 config SND_SOC_SAMSUNG_S3C24XX_UDA134X
         tristate "SoC I2S Audio support UDA134X wired to a S3C24XX"
-        depends on SND_SOC_SAMSUNG && ARCH_S3C24XX
+        depends on ARCH_S3C24XX
         select SND_S3C24XX_I2S
         select SND_SOC_L3
         select SND_SOC_UDA134X
@@ -102,21 +103,21 @@ config SND_SOC_SAMSUNG_SIMTEC
 
 config SND_SOC_SAMSUNG_SIMTEC_TLV320AIC23
         tristate "SoC I2S Audio support for TLV320AIC23 on Simtec boards"
-        depends on SND_SOC_SAMSUNG && ARCH_S3C24XX && I2C
+        depends on ARCH_S3C24XX && I2C
         select SND_S3C24XX_I2S
         select SND_SOC_TLV320AIC23_I2C
         select SND_SOC_SAMSUNG_SIMTEC
 
 config SND_SOC_SAMSUNG_SIMTEC_HERMES
         tristate "SoC I2S Audio support for Simtec Hermes board"
-        depends on SND_SOC_SAMSUNG && ARCH_S3C24XX && I2C
+        depends on ARCH_S3C24XX && I2C
         select SND_S3C24XX_I2S
         select SND_SOC_TLV320AIC3X
         select SND_SOC_SAMSUNG_SIMTEC
 
 config SND_SOC_SAMSUNG_H1940_UDA1380
         tristate "Audio support for the HP iPAQ H1940"
-        depends on SND_SOC_SAMSUNG && ARCH_H1940 && I2C
+        depends on ARCH_H1940 && I2C
         select SND_S3C24XX_I2S
         select SND_SOC_UDA1380
         help
@@ -124,7 +125,7 @@ config SND_SOC_SAMSUNG_H1940_UDA1380
 
 config SND_SOC_SAMSUNG_RX1950_UDA1380
         tristate "Audio support for the HP iPAQ RX1950"
-        depends on SND_SOC_SAMSUNG && MACH_RX1950 && I2C
+        depends on MACH_RX1950 && I2C
         select SND_S3C24XX_I2S
         select SND_SOC_UDA1380
         help
@@ -132,7 +133,7 @@ config SND_SOC_SAMSUNG_RX1950_UDA1380
 
 config SND_SOC_SAMSUNG_SMDK_WM9713
         tristate "SoC AC97 Audio support for SMDK with WM9713"
-        depends on SND_SOC_SAMSUNG && (MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110)
+        depends on MACH_SMDK6410 || MACH_SMDKC100 || MACH_SMDKV210 || MACH_SMDKC110
         select SND_SOC_WM9713
         select SND_SAMSUNG_AC97
         help
@@ -140,20 +141,19 @@ config SND_SOC_SAMSUNG_SMDK_WM9713
 
 config SND_SOC_SMARTQ
         tristate "SoC I2S Audio support for SmartQ board"
-        depends on SND_SOC_SAMSUNG && MACH_SMARTQ && I2C
+        depends on MACH_SMARTQ && I2C
         select SND_SAMSUNG_I2S
         select SND_SOC_WM8750
 
 config SND_SOC_SAMSUNG_SMDK_SPDIF
         tristate "SoC S/PDIF Audio support for SMDK"
-        depends on SND_SOC_SAMSUNG
         select SND_SAMSUNG_SPDIF
         help
           Say Y if you want to add support for SoC S/PDIF audio on the SMDK.
 
 config SND_SOC_SMDK_WM8580_PCM
         tristate "SoC PCM Audio support for WM8580 on SMDK"
-        depends on SND_SOC_SAMSUNG && (MACH_SMDKV210 || MACH_SMDKC110)
+        depends on MACH_SMDKV210 || MACH_SMDKC110
         depends on I2C
         select SND_SOC_WM8580
         select SND_SAMSUNG_PCM
@@ -162,7 +162,6 @@ config SND_SOC_SMDK_WM8580_PCM
 
 config SND_SOC_SMDK_WM8994_PCM
         tristate "SoC PCM Audio support for WM8994 on SMDK"
-        depends on SND_SOC_SAMSUNG
         depends on I2C=y
         select MFD_WM8994
         select SND_SOC_WM8994
@@ -172,7 +171,7 @@ config SND_SOC_SMDK_WM8994_PCM
 
 config SND_SOC_SPEYSIDE
         tristate "Audio support for Wolfson Speyside"
-        depends on SND_SOC_SAMSUNG && I2C && SPI_MASTER
+        depends on I2C && SPI_MASTER
         depends on MACH_WLF_CRAGG_6410 || COMPILE_TEST
         select SND_SAMSUNG_I2S
         select SND_SOC_WM8996
@@ -182,14 +181,14 @@ config SND_SOC_SPEYSIDE
 
 config SND_SOC_TOBERMORY
         tristate "Audio support for Wolfson Tobermory"
-        depends on SND_SOC_SAMSUNG && INPUT && I2C
+        depends on INPUT && I2C
         depends on MACH_WLF_CRAGG_6410 || COMPILE_TEST
         select SND_SAMSUNG_I2S
         select SND_SOC_WM8962
 
 config SND_SOC_BELLS
         tristate "Audio support for Wolfson Bells"
-        depends on SND_SOC_SAMSUNG && MFD_ARIZONA && I2C && SPI_MASTER
+        depends on MFD_ARIZONA && I2C && SPI_MASTER
         depends on MACH_WLF_CRAGG_6410 || COMPILE_TEST
         select SND_SAMSUNG_I2S
         select SND_SOC_WM5102
@@ -200,7 +199,7 @@ config SND_SOC_BELLS
 
 config SND_SOC_LOWLAND
         tristate "Audio support for Wolfson Lowland"
-        depends on SND_SOC_SAMSUNG && I2C
+        depends on I2C
         depends on MACH_WLF_CRAGG_6410 || COMPILE_TEST
         select SND_SAMSUNG_I2S
         select SND_SOC_WM5100
@@ -208,7 +207,7 @@ config SND_SOC_LOWLAND
 
 config SND_SOC_LITTLEMILL
         tristate "Audio support for Wolfson Littlemill"
-        depends on SND_SOC_SAMSUNG && I2C
+        depends on I2C
         depends on MACH_WLF_CRAGG_6410 || COMPILE_TEST
         select SND_SAMSUNG_I2S
         select MFD_WM8994
@@ -216,7 +215,7 @@ config SND_SOC_LITTLEMILL
 
 config SND_SOC_SNOW
         tristate "Audio support for Google Snow boards"
-        depends on SND_SOC_SAMSUNG && I2C
+        depends on I2C
         select SND_SOC_MAX98090
         select SND_SOC_MAX98095
         select SND_SAMSUNG_I2S
@@ -226,6 +225,8 @@ config SND_SOC_SNOW
 
 config SND_SOC_ARNDALE_RT5631_ALC5631
         tristate "Audio support for RT5631(ALC5631) on Arndale Board"
-        depends on SND_SOC_SAMSUNG && I2C
+        depends on I2C
         select SND_SAMSUNG_I2S
         select SND_SOC_RT5631
+
+endif #SND_SOC_SAMSUNG
diff --git a/sound/soc/samsung/ac97.c b/sound/soc/samsung/ac97.c
index 547d31032088..97d6700b1009 100644
--- a/sound/soc/samsung/ac97.c
+++ b/sound/soc/samsung/ac97.c
@@ -38,16 +38,16 @@ struct s3c_ac97_info {
 };
 static struct s3c_ac97_info s3c_ac97;
 
-static struct s3c_dma_params s3c_ac97_pcm_out = {
-        .dma_size       = 4,
+static struct snd_dmaengine_dai_dma_data s3c_ac97_pcm_out = {
+        .addr_width     = 4,
 };
 
-static struct s3c_dma_params s3c_ac97_pcm_in = {
-        .dma_size       = 4,
+static struct snd_dmaengine_dai_dma_data s3c_ac97_pcm_in = {
+        .addr_width     = 4,
 };
 
-static struct s3c_dma_params s3c_ac97_mic_in = {
-        .dma_size       = 4,
+static struct snd_dmaengine_dai_dma_data s3c_ac97_mic_in = {
+        .addr_width     = 4,
 };
 
 static void s3c_ac97_activate(struct snd_ac97 *ac97)
@@ -74,7 +74,7 @@ static void s3c_ac97_activate(struct snd_ac97 *ac97)
         writel(ac_glbctrl, s3c_ac97.regs + S3C_AC97_GLBCTRL);
 
         if (!wait_for_completion_timeout(&s3c_ac97.done, HZ))
-                pr_err("AC97: Unable to activate!");
+                pr_err("AC97: Unable to activate!\n");
 }
 
 static unsigned short s3c_ac97_read(struct snd_ac97 *ac97,
@@ -100,7 +100,7 @@ static unsigned short s3c_ac97_read(struct snd_ac97 *ac97,
         writel(ac_glbctrl, s3c_ac97.regs + S3C_AC97_GLBCTRL);
 
         if (!wait_for_completion_timeout(&s3c_ac97.done, HZ))
-                pr_err("AC97: Unable to read!");
+                pr_err("AC97: Unable to read!\n");
 
         stat = readl(s3c_ac97.regs + S3C_AC97_STAT);
         addr = (stat >> 16) & 0x7f;
@@ -137,7 +137,7 @@ static void s3c_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
         writel(ac_glbctrl, s3c_ac97.regs + S3C_AC97_GLBCTRL);
 
         if (!wait_for_completion_timeout(&s3c_ac97.done, HZ))
-                pr_err("AC97: Unable to write!");
+                pr_err("AC97: Unable to write!\n");
 
         ac_codec_cmd = readl(s3c_ac97.regs + S3C_AC97_CODEC_CMD);
         ac_codec_cmd |= S3C_AC97_CODEC_CMD_READ;
@@ -273,14 +273,14 @@ static const struct snd_soc_dai_ops s3c_ac97_mic_dai_ops = {
 
 static int s3c_ac97_dai_probe(struct snd_soc_dai *dai)
 {
-        samsung_asoc_init_dma_data(dai, &s3c_ac97_pcm_out, &s3c_ac97_pcm_in);
+        snd_soc_dai_init_dma_data(dai, &s3c_ac97_pcm_out, &s3c_ac97_pcm_in);
 
         return 0;
 }
 
 static int s3c_ac97_mic_dai_probe(struct snd_soc_dai *dai)
 {
-        samsung_asoc_init_dma_data(dai, NULL, &s3c_ac97_mic_in);
+        snd_soc_dai_init_dma_data(dai, NULL, &s3c_ac97_mic_in);
 
         return 0;
 }
@@ -346,12 +346,12 @@ static int s3c_ac97_probe(struct platform_device *pdev)
         if (IS_ERR(s3c_ac97.regs))
                 return PTR_ERR(s3c_ac97.regs);
 
-        s3c_ac97_pcm_out.slave = ac97_pdata->dma_playback;
-        s3c_ac97_pcm_out.dma_addr = mem_res->start + S3C_AC97_PCM_DATA;
-        s3c_ac97_pcm_in.slave = ac97_pdata->dma_capture;
-        s3c_ac97_pcm_in.dma_addr = mem_res->start + S3C_AC97_PCM_DATA;
-        s3c_ac97_mic_in.slave = ac97_pdata->dma_capture_mic;
-        s3c_ac97_mic_in.dma_addr = mem_res->start + S3C_AC97_MIC_DATA;
+        s3c_ac97_pcm_out.filter_data = ac97_pdata->dma_playback;
+        s3c_ac97_pcm_out.addr = mem_res->start + S3C_AC97_PCM_DATA;
+        s3c_ac97_pcm_in.filter_data = ac97_pdata->dma_capture;
+        s3c_ac97_pcm_in.addr = mem_res->start + S3C_AC97_PCM_DATA;
+        s3c_ac97_mic_in.filter_data = ac97_pdata->dma_capture_mic;
+        s3c_ac97_mic_in.addr = mem_res->start + S3C_AC97_MIC_DATA;
 
         init_completion(&s3c_ac97.done);
         mutex_init(&s3c_ac97.lock);
diff --git a/sound/soc/samsung/dma.h b/sound/soc/samsung/dma.h
index 3830f297e0b6..7ae580d677c8 100644
--- a/sound/soc/samsung/dma.h
+++ b/sound/soc/samsung/dma.h
@@ -1,6 +1,4 @@
 /*
- *  dma.h --
- *
  *  This program is free software; you can redistribute  it and/or modify it
  *  under  the terms of  the GNU General  Public License as published by the
  *  Free Software Foundation;  either version 2 of the  License, or (at your
@@ -9,27 +7,15 @@
  *  ALSA PCM interface for the Samsung SoC
  */
 
-#ifndef _S3C_AUDIO_H
-#define _S3C_AUDIO_H
+#ifndef _SAMSUNG_DMA_H
+#define _SAMSUNG_DMA_H
 
 #include <sound/dmaengine_pcm.h>
-#include <linux/dmaengine.h>
-
-struct s3c_dma_params {
-        void *slave;                            /* Channel ID */
-        dma_addr_t dma_addr;
-        int dma_size;                   /* Size of the DMA transfer */
-        char *ch_name;
-        struct snd_dmaengine_dai_dma_data dma_data;
-};
 
-void samsung_asoc_init_dma_data(struct snd_soc_dai *dai,
-                                struct s3c_dma_params *playback,
-                                struct s3c_dma_params *capture);
 /*
  * @tx, @rx arguments can be NULL if the DMA channel names are "tx", "rx",
  * otherwise actual DMA channel names must be passed to this function.
  */
 int samsung_asoc_dma_platform_register(struct device *dev, dma_filter_fn filter,
                                        const char *tx, const char *rx);
-#endif
+#endif /* _SAMSUNG_DMA_H */
diff --git a/sound/soc/samsung/dmaengine.c b/sound/soc/samsung/dmaengine.c
index 2c87f380bfc4..9104c98deeb7 100644
--- a/sound/soc/samsung/dmaengine.c
+++ b/sound/soc/samsung/dmaengine.c
@@ -16,49 +16,18 @@
  */
 
 #include <linux/module.h>
-#include <linux/amba/pl08x.h>
-#include <linux/platform_data/dma-s3c24xx.h>
-
 #include <sound/core.h>
 #include <sound/pcm.h>
 #include <sound/pcm_params.h>
 #include <sound/dmaengine_pcm.h>
 #include <sound/soc.h>
-#include <sound/soc-dai.h>
 
 #include "dma.h"
 
-void samsung_asoc_init_dma_data(struct snd_soc_dai *dai,
-                                struct s3c_dma_params *playback,
-                                struct s3c_dma_params *capture)
-{
-        struct snd_dmaengine_dai_dma_data *playback_data = NULL;
-        struct snd_dmaengine_dai_dma_data *capture_data = NULL;
-
-        if (playback) {
-                playback_data = &playback->dma_data;
-                playback_data->filter_data = playback->slave;
-                playback_data->chan_name = playback->ch_name;
-                playback_data->addr = playback->dma_addr;
-                playback_data->addr_width = playback->dma_size;
-        }
-        if (capture) {
-                capture_data = &capture->dma_data;
-                capture_data->filter_data = capture->slave;
-                capture_data->chan_name = capture->ch_name;
-                capture_data->addr = capture->dma_addr;
-                capture_data->addr_width = capture->dma_size;
-        }
-
-        snd_soc_dai_init_dma_data(dai, playback_data, capture_data);
-}
-EXPORT_SYMBOL_GPL(samsung_asoc_init_dma_data);
-
 int samsung_asoc_dma_platform_register(struct device *dev, dma_filter_fn filter,
                                        const char *tx, const char *rx)
 {
         unsigned int flags = SND_DMAENGINE_PCM_FLAG_COMPAT;
-
         struct snd_dmaengine_pcm_config *pcm_conf;
 
         pcm_conf = devm_kzalloc(dev, sizeof(*pcm_conf), GFP_KERNEL);
diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
index 50635ee8ff20..7e32cf4581f8 100644
--- a/sound/soc/samsung/i2s.c
+++ b/sound/soc/samsung/i2s.c
@@ -87,9 +87,9 @@ struct i2s_dai {
         /* Driver for this DAI */
         struct snd_soc_dai_driver i2s_dai_drv;
         /* DMA parameters */
-        struct s3c_dma_params dma_playback;
-        struct s3c_dma_params dma_capture;
-        struct s3c_dma_params idma_playback;
+        struct snd_dmaengine_dai_dma_data dma_playback;
+        struct snd_dmaengine_dai_dma_data dma_capture;
+        struct snd_dmaengine_dai_dma_data idma_playback;
         dma_filter_fn filter;
         u32     quirks;
         u32     suspend_i2smod;
@@ -692,15 +692,15 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
                 break;
         case 2:
                 if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                        i2s->dma_playback.dma_size = 4;
+                        i2s->dma_playback.addr_width = 4;
                 else
-                        i2s->dma_capture.dma_size = 4;
+                        i2s->dma_capture.addr_width = 4;
                 break;
         case 1:
                 if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
-                        i2s->dma_playback.dma_size = 2;
+                        i2s->dma_playback.addr_width = 2;
                 else
-                        i2s->dma_capture.dma_size = 2;
+                        i2s->dma_capture.addr_width = 2;
 
                 break;
         default:
@@ -754,7 +754,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
         writel(mod, i2s->addr + I2SMOD);
         spin_unlock_irqrestore(i2s->lock, flags);
 
-        samsung_asoc_init_dma_data(dai, &i2s->dma_playback, &i2s->dma_capture);
+        snd_soc_dai_init_dma_data(dai, &i2s->dma_playback, &i2s->dma_capture);
 
         i2s->frmclk = params_rate(params);
 
@@ -991,10 +991,10 @@ static int samsung_i2s_dai_probe(struct snd_soc_dai *dai)
         unsigned long flags;
 
         if (is_secondary(i2s)) { /* If this is probe on the secondary DAI */
-                samsung_asoc_init_dma_data(dai, &other->sec_dai->dma_playback,
+                snd_soc_dai_init_dma_data(dai, &other->sec_dai->dma_playback,
                                            NULL);
         } else {
-                samsung_asoc_init_dma_data(dai, &i2s->dma_playback,
+                snd_soc_dai_init_dma_data(dai, &i2s->dma_playback,
                                            &i2s->dma_capture);
 
                 if (i2s->quirks & QUIRK_NEED_RSTCLR)
@@ -1002,7 +1002,7 @@ static int samsung_i2s_dai_probe(struct snd_soc_dai *dai)
 
                 if (i2s->quirks & QUIRK_SUPPORTS_IDMA)
                         idma_reg_addr_init(i2s->addr,
-                                        i2s->sec_dai->idma_playback.dma_addr);
+                                        i2s->sec_dai->idma_playback.addr);
         }
 
         /* Reset any constraint on RFS and BFS */
@@ -1262,8 +1262,8 @@ static int samsung_i2s_probe(struct platform_device *pdev)
                         return -EINVAL;
                 }
 
-                pri_dai->dma_playback.slave = i2s_pdata->dma_playback;
-                pri_dai->dma_capture.slave = i2s_pdata->dma_capture;
+                pri_dai->dma_playback.filter_data = i2s_pdata->dma_playback;
+                pri_dai->dma_capture.filter_data = i2s_pdata->dma_capture;
                 pri_dai->filter = i2s_pdata->dma_filter;
 
                 if (&i2s_pdata->type)
@@ -1302,12 +1302,12 @@ static int samsung_i2s_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "failed to enable clock: %d\n", ret);
                 return ret;
         }
-        pri_dai->dma_playback.dma_addr = regs_base + I2STXD;
-        pri_dai->dma_capture.dma_addr = regs_base + I2SRXD;
-        pri_dai->dma_playback.ch_name = "tx";
-        pri_dai->dma_capture.ch_name = "rx";
-        pri_dai->dma_playback.dma_size = 4;
-        pri_dai->dma_capture.dma_size = 4;
+        pri_dai->dma_playback.addr = regs_base + I2STXD;
+        pri_dai->dma_capture.addr = regs_base + I2SRXD;
+        pri_dai->dma_playback.chan_name = "tx";
+        pri_dai->dma_capture.chan_name = "rx";
+        pri_dai->dma_playback.addr_width = 4;
+        pri_dai->dma_capture.addr_width = 4;
         pri_dai->quirks = quirks;
         pri_dai->variant_regs = i2s_dai_data->i2s_variant_regs;
 
@@ -1318,31 +1318,33 @@ static int samsung_i2s_probe(struct platform_device *pdev)
                 sec_dai = i2s_alloc_dai(pdev, true);
                 if (!sec_dai) {
                         dev_err(&pdev->dev, "Unable to alloc I2S_sec\n");
-                        return -ENOMEM;
+                        ret = -ENOMEM;
+                        goto err_disable_clk;
                 }
 
                 sec_dai->lock = &pri_dai->spinlock;
                 sec_dai->variant_regs = pri_dai->variant_regs;
-                sec_dai->dma_playback.dma_addr = regs_base + I2STXDS;
-                sec_dai->dma_playback.ch_name = "tx-sec";
+                sec_dai->dma_playback.addr = regs_base + I2STXDS;
+                sec_dai->dma_playback.chan_name = "tx-sec";
 
                 if (!np) {
-                        sec_dai->dma_playback.slave = i2s_pdata->dma_play_sec;
+                        sec_dai->dma_playback.filter_data = i2s_pdata->dma_play_sec;
                         sec_dai->filter = i2s_pdata->dma_filter;
                 }
 
-                sec_dai->dma_playback.dma_size = 4;
+                sec_dai->dma_playback.addr_width = 4;
                 sec_dai->addr = pri_dai->addr;
                 sec_dai->clk = pri_dai->clk;
                 sec_dai->quirks = quirks;
-                sec_dai->idma_playback.dma_addr = idma_addr;
+                sec_dai->idma_playback.addr = idma_addr;
                 sec_dai->pri_dai = pri_dai;
                 pri_dai->sec_dai = sec_dai;
         }
 
         if (i2s_pdata && i2s_pdata->cfg_gpio && i2s_pdata->cfg_gpio(pdev)) {
                 dev_err(&pdev->dev, "Unable to configure gpio\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_disable_clk;
         }
 
         ret = devm_snd_soc_register_component(&pri_dai->pdev->dev,
@@ -1366,6 +1368,8 @@ static int samsung_i2s_probe(struct platform_device *pdev)
 err_free_dai:
         if (sec_dai)
                 i2s_free_sec_dai(sec_dai);
+err_disable_clk:
+        clk_disable_unprepare(pri_dai->clk);
         return ret;
 }
 
diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c
index 4ed29ffc1c54..3e408158625d 100644
--- a/sound/soc/samsung/idma.c
+++ b/sound/soc/samsung/idma.c
@@ -22,7 +22,6 @@
 
 #include "i2s.h"
 #include "idma.h"
-#include "dma.h"
 #include "i2s-regs.h"
 
 #define ST_RUNNING              (1<<0)
diff --git a/sound/soc/samsung/pcm.c b/sound/soc/samsung/pcm.c
index 490c1a87fd66..43e367a9acc3 100644
--- a/sound/soc/samsung/pcm.c
+++ b/sound/soc/samsung/pcm.c
@@ -127,25 +127,25 @@ struct s3c_pcm_info {
         struct clk      *pclk;
         struct clk      *cclk;
 
-        struct s3c_dma_params   *dma_playback;
-        struct s3c_dma_params   *dma_capture;
+        struct snd_dmaengine_dai_dma_data *dma_playback;
+        struct snd_dmaengine_dai_dma_data *dma_capture;
 };
 
-static struct s3c_dma_params s3c_pcm_stereo_out[] = {
+static struct snd_dmaengine_dai_dma_data s3c_pcm_stereo_out[] = {
         [0] = {
-                .dma_size       = 4,
+                .addr_width     = 4,
         },
         [1] = {
-                .dma_size       = 4,
+                .addr_width     = 4,
         },
 };
 
-static struct s3c_dma_params s3c_pcm_stereo_in[] = {
+static struct snd_dmaengine_dai_dma_data s3c_pcm_stereo_in[] = {
         [0] = {
-                .dma_size       = 4,
+                .addr_width     = 4,
         },
         [1] = {
-                .dma_size       = 4,
+                .addr_width     = 4,
         },
 };
 
@@ -552,15 +552,13 @@ static int s3c_pcm_dev_probe(struct platform_device *pdev)
         }
         clk_prepare_enable(pcm->pclk);
 
-        s3c_pcm_stereo_in[pdev->id].dma_addr = mem_res->start
-                                                        + S3C_PCM_RXFIFO;
-        s3c_pcm_stereo_out[pdev->id].dma_addr = mem_res->start
-                                                        + S3C_PCM_TXFIFO;
+        s3c_pcm_stereo_in[pdev->id].addr = mem_res->start + S3C_PCM_RXFIFO;
+        s3c_pcm_stereo_out[pdev->id].addr = mem_res->start + S3C_PCM_TXFIFO;
 
         filter = NULL;
         if (pcm_pdata) {
-                s3c_pcm_stereo_in[pdev->id].slave = pcm_pdata->dma_capture;
-                s3c_pcm_stereo_out[pdev->id].slave = pcm_pdata->dma_playback;
+                s3c_pcm_stereo_in[pdev->id].filter_data = pcm_pdata->dma_capture;
+                s3c_pcm_stereo_out[pdev->id].filter_data = pcm_pdata->dma_playback;
                 filter = pcm_pdata->dma_filter;
         }
 
diff --git a/sound/soc/samsung/s3c-i2s-v2.c b/sound/soc/samsung/s3c-i2s-v2.c
index bf8ae79b0fd2..644f186fd35c 100644
--- a/sound/soc/samsung/s3c-i2s-v2.c
+++ b/sound/soc/samsung/s3c-i2s-v2.c
@@ -24,7 +24,6 @@
 
 #include "regs-i2s-v2.h"
 #include "s3c-i2s-v2.h"
-#include "dma.h"
 
 #undef S3C_IIS_V2_SUPPORTED
 
@@ -302,7 +301,7 @@ static int s3c_i2sv2_hw_params(struct snd_pcm_substream *substream,
                                  struct snd_soc_dai *dai)
 {
         struct s3c_i2sv2_info *i2s = to_info(dai);
-        struct s3c_dma_params *dma_data;
+        struct snd_dmaengine_dai_dma_data *dma_data;
         u32 iismod;
 
         pr_debug("Entered %s\n", __func__);
diff --git a/sound/soc/samsung/s3c-i2s-v2.h b/sound/soc/samsung/s3c-i2s-v2.h
index d0684145ed1f..182d80564e37 100644
--- a/sound/soc/samsung/s3c-i2s-v2.h
+++ b/sound/soc/samsung/s3c-i2s-v2.h
@@ -60,8 +60,8 @@ struct s3c_i2sv2_info {
 
         unsigned char    master;
 
-        struct s3c_dma_params   *dma_playback;
-        struct s3c_dma_params   *dma_capture;
+        struct snd_dmaengine_dai_dma_data *dma_playback;
+        struct snd_dmaengine_dai_dma_data *dma_capture;
 
         u32              suspend_iismod;
         u32              suspend_iiscon;
diff --git a/sound/soc/samsung/s3c2412-i2s.c b/sound/soc/samsung/s3c2412-i2s.c
index d45dffb297d8..3e89fbc0c51d 100644
--- a/sound/soc/samsung/s3c2412-i2s.c
+++ b/sound/soc/samsung/s3c2412-i2s.c
@@ -34,14 +34,14 @@
 
 #include <linux/platform_data/asoc-s3c.h>
 
-static struct s3c_dma_params s3c2412_i2s_pcm_stereo_out = {
-        .ch_name        = "tx",
-        .dma_size       = 4,
+static struct snd_dmaengine_dai_dma_data s3c2412_i2s_pcm_stereo_out = {
+        .chan_name      = "tx",
+        .addr_width     = 4,
 };
 
-static struct s3c_dma_params s3c2412_i2s_pcm_stereo_in = {
-        .ch_name        = "rx",
-        .dma_size       = 4,
+static struct snd_dmaengine_dai_dma_data s3c2412_i2s_pcm_stereo_in = {
+        .chan_name      = "rx",
+        .addr_width     = 4,
 };
 
 static struct s3c_i2sv2_info s3c2412_i2s;
@@ -52,8 +52,8 @@ static int s3c2412_i2s_probe(struct snd_soc_dai *dai)
 
         pr_debug("Entered %s\n", __func__);
 
-        samsung_asoc_init_dma_data(dai, &s3c2412_i2s_pcm_stereo_out,
-                &s3c2412_i2s_pcm_stereo_in);
+        snd_soc_dai_init_dma_data(dai, &s3c2412_i2s_pcm_stereo_out,
+                                        &s3c2412_i2s_pcm_stereo_in);
 
         ret = s3c_i2sv2_probe(dai, &s3c2412_i2s, S3C2410_PA_IIS);
         if (ret)
@@ -163,10 +163,10 @@ static int s3c2412_iis_dev_probe(struct platform_device *pdev)
         if (IS_ERR(s3c2412_i2s.regs))
                 return PTR_ERR(s3c2412_i2s.regs);
 
-        s3c2412_i2s_pcm_stereo_out.dma_addr = res->start + S3C2412_IISTXD;
-        s3c2412_i2s_pcm_stereo_out.slave = pdata->dma_playback;
-        s3c2412_i2s_pcm_stereo_in.dma_addr = res->start + S3C2412_IISRXD;
-        s3c2412_i2s_pcm_stereo_in.slave = pdata->dma_capture;
+        s3c2412_i2s_pcm_stereo_out.addr = res->start + S3C2412_IISTXD;
+        s3c2412_i2s_pcm_stereo_out.filter_data = pdata->dma_playback;
+        s3c2412_i2s_pcm_stereo_in.addr = res->start + S3C2412_IISRXD;
+        s3c2412_i2s_pcm_stereo_in.filter_data = pdata->dma_capture;
 
         ret = s3c_i2sv2_register_component(&pdev->dev, -1,
                                            &s3c2412_i2s_component,
diff --git a/sound/soc/samsung/s3c24xx-i2s.c b/sound/soc/samsung/s3c24xx-i2s.c
index 3e76f2a75a24..c78a936a3099 100644
--- a/sound/soc/samsung/s3c24xx-i2s.c
+++ b/sound/soc/samsung/s3c24xx-i2s.c
@@ -32,14 +32,14 @@
 
 #include <linux/platform_data/asoc-s3c.h>
 
-static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_out = {
-        .ch_name        = "tx",
-        .dma_size       = 2,
+static struct snd_dmaengine_dai_dma_data s3c24xx_i2s_pcm_stereo_out = {
+        .chan_name      = "tx",
+        .addr_width     = 2,
 };
 
-static struct s3c_dma_params s3c24xx_i2s_pcm_stereo_in = {
-        .ch_name        = "rx",
-        .dma_size       = 2,
+static struct snd_dmaengine_dai_dma_data s3c24xx_i2s_pcm_stereo_in = {
+        .chan_name      = "rx",
+        .addr_width     = 2,
 };
 
 struct s3c24xx_i2s_info {
@@ -360,8 +360,8 @@ static int s3c24xx_i2s_probe(struct snd_soc_dai *dai)
 {
         pr_debug("Entered %s\n", __func__);
 
-        samsung_asoc_init_dma_data(dai, &s3c24xx_i2s_pcm_stereo_out,
-                &s3c24xx_i2s_pcm_stereo_in);
+        snd_soc_dai_init_dma_data(dai, &s3c24xx_i2s_pcm_stereo_out,
+                                        &s3c24xx_i2s_pcm_stereo_in);
 
         s3c24xx_i2s.iis_clk = devm_clk_get(dai->dev, "iis");
         if (IS_ERR(s3c24xx_i2s.iis_clk)) {
@@ -469,10 +469,10 @@ static int s3c24xx_iis_dev_probe(struct platform_device *pdev)
         if (IS_ERR(s3c24xx_i2s.regs))
                 return PTR_ERR(s3c24xx_i2s.regs);
 
-        s3c24xx_i2s_pcm_stereo_out.dma_addr = res->start + S3C2410_IISFIFO;
-        s3c24xx_i2s_pcm_stereo_out.slave = pdata->dma_playback;
-        s3c24xx_i2s_pcm_stereo_in.dma_addr = res->start + S3C2410_IISFIFO;
-        s3c24xx_i2s_pcm_stereo_in.slave = pdata->dma_capture;
+        s3c24xx_i2s_pcm_stereo_out.addr = res->start + S3C2410_IISFIFO;
+        s3c24xx_i2s_pcm_stereo_out.filter_data = pdata->dma_playback;
+        s3c24xx_i2s_pcm_stereo_in.addr = res->start + S3C2410_IISFIFO;
+        s3c24xx_i2s_pcm_stereo_in.filter_data = pdata->dma_capture;
 
         ret = devm_snd_soc_register_component(&pdev->dev,
                         &s3c24xx_i2s_component, &s3c24xx_i2s_dai, 1);
diff --git a/sound/soc/samsung/s3c24xx_uda134x.c b/sound/soc/samsung/s3c24xx_uda134x.c
index 50849e137fc0..7853fbe6ccc9 100644
--- a/sound/soc/samsung/s3c24xx_uda134x.c
+++ b/sound/soc/samsung/s3c24xx_uda134x.c
@@ -54,28 +54,27 @@ static struct snd_pcm_hw_constraint_list hw_constraints_rates = {
 };
 #endif
 
-static struct platform_device *s3c24xx_uda134x_snd_device;
-
 static int s3c24xx_uda134x_startup(struct snd_pcm_substream *substream)
 {
-        int ret = 0;
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *cpu_dai = rtd->cpu_dai;
 #ifdef ENFORCE_RATES
         struct snd_pcm_runtime *runtime = substream->runtime;
 #endif
+        int ret = 0;
 
         mutex_lock(&clk_lock);
-        pr_debug("%s %d\n", __func__, clk_users);
+
         if (clk_users == 0) {
-                xtal = clk_get(&s3c24xx_uda134x_snd_device->dev, "xtal");
+                xtal = clk_get(rtd->dev, "xtal");
                 if (IS_ERR(xtal)) {
-                        printk(KERN_ERR "%s cannot get xtal\n", __func__);
+                        dev_err(rtd->dev, "%s cannot get xtal\n", __func__);
                         ret = PTR_ERR(xtal);
                 } else {
-                        pclk = clk_get(&s3c24xx_uda134x_snd_device->dev,
-                                       "pclk");
+                        pclk = clk_get(cpu_dai->dev, "iis");
                         if (IS_ERR(pclk)) {
-                                printk(KERN_ERR "%s cannot get pclk\n",
-                                       __func__);
+                                dev_err(rtd->dev, "%s cannot get pclk\n",
+                                        __func__);
                                 clk_put(xtal);
                                 ret = PTR_ERR(pclk);
                         }
@@ -101,8 +100,8 @@ static int s3c24xx_uda134x_startup(struct snd_pcm_substream *substream)
                                                  SNDRV_PCM_HW_PARAM_RATE,
                                                  &hw_constraints_rates);
                 if (ret < 0)
-                        printk(KERN_ERR "%s cannot set constraints\n",
-                               __func__);
+                        dev_err(rtd->dev, "%s cannot set constraints\n",
+                                __func__);
 #endif
         }
         return ret;
@@ -111,7 +110,6 @@ static int s3c24xx_uda134x_startup(struct snd_pcm_substream *substream)
 static void s3c24xx_uda134x_shutdown(struct snd_pcm_substream *substream)
 {
         mutex_lock(&clk_lock);
-        pr_debug("%s %d\n", __func__, clk_users);
         clk_users -= 1;
         if (clk_users == 0) {
                 clk_put(xtal);
@@ -158,18 +156,19 @@ static int s3c24xx_uda134x_hw_params(struct snd_pcm_substream *substream,
                 clk_source = S3C24XX_CLKSRC_PCLK;
                 div = bi % 33;
         }
-        pr_debug("%s desired rate %lu, %d\n", __func__, rate, bi);
+
+        dev_dbg(rtd->dev, "%s desired rate %lu, %d\n", __func__, rate, bi);
 
         clk = (fs_mode == S3C2410_IISMOD_384FS ? 384 : 256) * rate;
-        pr_debug("%s will use: %s %s %d sysclk %d err %ld\n", __func__,
-                 fs_mode == S3C2410_IISMOD_384FS ? "384FS" : "256FS",
-                 clk_source == S3C24XX_CLKSRC_MPLL ? "MPLLin" : "PCLK",
-                 div, clk, err);
+
+        dev_dbg(rtd->dev, "%s will use: %s %s %d sysclk %d err %ld\n", __func__,
+                fs_mode == S3C2410_IISMOD_384FS ? "384FS" : "256FS",
+                clk_source == S3C24XX_CLKSRC_MPLL ? "MPLLin" : "PCLK",
+                div, clk, err);
 
         if ((err * 100 / rate) > 5) {
-                printk(KERN_ERR "S3C24XX_UDA134X: effective frequency "
-                       "too different from desired (%ld%%)\n",
-                       err * 100 / rate);
+                dev_err(rtd->dev, "effective frequency too different "
+                                  "from desired (%ld%%)\n", err * 100 / rate);
                 return -EINVAL;
         }
 
@@ -226,115 +225,27 @@ static struct snd_soc_card snd_soc_s3c24xx_uda134x = {
         .num_links = 1,
 };
 
-static struct s3c24xx_uda134x_platform_data *s3c24xx_uda134x_l3_pins;
-
-static void setdat(int v)
-{
-        gpio_set_value(s3c24xx_uda134x_l3_pins->l3_data, v > 0);
-}
-
-static void setclk(int v)
-{
-        gpio_set_value(s3c24xx_uda134x_l3_pins->l3_clk, v > 0);
-}
-
-static void setmode(int v)
-{
-        gpio_set_value(s3c24xx_uda134x_l3_pins->l3_mode, v > 0);
-}
-
-/* FIXME - This must be codec platform data but in which board file ?? */
-static struct uda134x_platform_data s3c24xx_uda134x = {
-        .l3 = {
-                .setdat = setdat,
-                .setclk = setclk,
-                .setmode = setmode,
-                .data_hold = 1,
-                .data_setup = 1,
-                .clock_high = 1,
-                .mode_hold = 1,
-                .mode = 1,
-                .mode_setup = 1,
-        },
-};
-
-static int s3c24xx_uda134x_setup_pin(int pin, char *fun)
-{
-        if (gpio_request(pin, "s3c24xx_uda134x") < 0) {
-                printk(KERN_ERR "S3C24XX_UDA134X SoC Audio: "
-                       "l3 %s pin already in use", fun);
-                return -EBUSY;
-        }
-        gpio_direction_output(pin, 0);
-        return 0;
-}
-
 static int s3c24xx_uda134x_probe(struct platform_device *pdev)
 {
+        struct snd_soc_card *card = &snd_soc_s3c24xx_uda134x;
         int ret;
 
-        printk(KERN_INFO "S3C24XX_UDA134X SoC Audio driver\n");
+        platform_set_drvdata(pdev, card);
+        card->dev = &pdev->dev;
 
-        s3c24xx_uda134x_l3_pins = pdev->dev.platform_data;
-        if (s3c24xx_uda134x_l3_pins == NULL) {
-                printk(KERN_ERR "S3C24XX_UDA134X SoC Audio: "
-                       "unable to find platform data\n");
-                return -ENODEV;
-        }
-        s3c24xx_uda134x.power = s3c24xx_uda134x_l3_pins->power;
-        s3c24xx_uda134x.model = s3c24xx_uda134x_l3_pins->model;
-
-        if (s3c24xx_uda134x_setup_pin(s3c24xx_uda134x_l3_pins->l3_data,
-                                      "data") < 0)
-                return -EBUSY;
-        if (s3c24xx_uda134x_setup_pin(s3c24xx_uda134x_l3_pins->l3_clk,
-                                      "clk") < 0) {
-                gpio_free(s3c24xx_uda134x_l3_pins->l3_data);
-                return -EBUSY;
-        }
-        if (s3c24xx_uda134x_setup_pin(s3c24xx_uda134x_l3_pins->l3_mode,
-                                      "mode") < 0) {
-                gpio_free(s3c24xx_uda134x_l3_pins->l3_data);
-                gpio_free(s3c24xx_uda134x_l3_pins->l3_clk);
-                return -EBUSY;
-        }
-
-        s3c24xx_uda134x_snd_device = platform_device_alloc("soc-audio", -1);
-        if (!s3c24xx_uda134x_snd_device) {
-                printk(KERN_ERR "S3C24XX_UDA134X SoC Audio: "
-                       "Unable to register\n");
-                return -ENOMEM;
-        }
-
-        platform_set_drvdata(s3c24xx_uda134x_snd_device,
-                             &snd_soc_s3c24xx_uda134x);
-        platform_device_add_data(s3c24xx_uda134x_snd_device, &s3c24xx_uda134x, sizeof(s3c24xx_uda134x));
-        ret = platform_device_add(s3c24xx_uda134x_snd_device);
-        if (ret) {
-                printk(KERN_ERR "S3C24XX_UDA134X SoC Audio: Unable to add\n");
-                platform_device_put(s3c24xx_uda134x_snd_device);
-        }
+        ret = devm_snd_soc_register_card(&pdev->dev, card);
+        if (ret)
+                dev_err(&pdev->dev, "failed to register card: %d\n", ret);
 
         return ret;
 }
 
-static int s3c24xx_uda134x_remove(struct platform_device *pdev)
-{
-        platform_device_unregister(s3c24xx_uda134x_snd_device);
-        gpio_free(s3c24xx_uda134x_l3_pins->l3_data);
-        gpio_free(s3c24xx_uda134x_l3_pins->l3_clk);
-        gpio_free(s3c24xx_uda134x_l3_pins->l3_mode);
-        return 0;
-}
-
 static struct platform_driver s3c24xx_uda134x_driver = {
         .probe  = s3c24xx_uda134x_probe,
-        .remove = s3c24xx_uda134x_remove,
         .driver = {
                 .name = "s3c24xx_uda134x",
         },
 };
-
 module_platform_driver(s3c24xx_uda134x_driver);
 
 MODULE_AUTHOR("Zoltan Devai, Christian Pellegrin <chripell@evolware.org>");
diff --git a/sound/soc/samsung/smdk_wm8580pcm.c b/sound/soc/samsung/smdk_wm8580pcm.c
index 6deec5234c92..a6d223310c67 100644
--- a/sound/soc/samsung/smdk_wm8580pcm.c
+++ b/sound/soc/samsung/smdk_wm8580pcm.c
@@ -16,7 +16,6 @@
 #include <asm/mach-types.h>
 
 #include "../codecs/wm8580.h"
-#include "dma.h"
 #include "pcm.h"
 
 /*
diff --git a/sound/soc/samsung/smdk_wm8994pcm.c b/sound/soc/samsung/smdk_wm8994pcm.c
index b1c89ec2d999..2e621496be8b 100644
--- a/sound/soc/samsung/smdk_wm8994pcm.c
+++ b/sound/soc/samsung/smdk_wm8994pcm.c
@@ -15,7 +15,6 @@
 #include <sound/pcm_params.h>
 
 #include "../codecs/wm8994.h"
-#include "dma.h"
 #include "pcm.h"
 
 /*
diff --git a/sound/soc/samsung/spdif.c b/sound/soc/samsung/spdif.c
index 0cb9c8567546..26c1fbed4d35 100644
--- a/sound/soc/samsung/spdif.c
+++ b/sound/soc/samsung/spdif.c
@@ -90,10 +90,10 @@ struct samsung_spdif_info {
         u32             saved_clkcon;
         u32             saved_con;
         u32             saved_cstas;
-        struct s3c_dma_params   *dma_playback;
+        struct snd_dmaengine_dai_dma_data *dma_playback;
 };
 
-static struct s3c_dma_params spdif_stereo_out;
+static struct snd_dmaengine_dai_dma_data spdif_stereo_out;
 static struct samsung_spdif_info spdif_info;
 
 static inline struct samsung_spdif_info *to_info(struct snd_soc_dai *cpu_dai)
@@ -179,7 +179,7 @@ static int spdif_hw_params(struct snd_pcm_substream *substream,
         struct snd_soc_pcm_runtime *rtd = substream->private_data;
         struct samsung_spdif_info *spdif = to_info(rtd->cpu_dai);
         void __iomem *regs = spdif->regs;
-        struct s3c_dma_params *dma_data;
+        struct snd_dmaengine_dai_dma_data *dma_data;
         u32 con, clkcon, cstas;
         unsigned long flags;
         int i, ratio;
@@ -425,11 +425,11 @@ static int spdif_probe(struct platform_device *pdev)
                 goto err4;
         }
 
-        spdif_stereo_out.dma_size = 2;
-        spdif_stereo_out.dma_addr = mem_res->start + DATA_OUTBUF;
+        spdif_stereo_out.addr_width = 2;
+        spdif_stereo_out.addr = mem_res->start + DATA_OUTBUF;
         filter = NULL;
         if (spdif_pdata) {
-                spdif_stereo_out.slave = spdif_pdata->dma_playback;
+                spdif_stereo_out.filter_data = spdif_pdata->dma_playback;
                 filter = spdif_pdata->dma_filter;
         }
 
diff --git a/sound/soc/sh/Kconfig b/sound/soc/sh/Kconfig
index 9311f119feb5..6db6405d952f 100644
--- a/sound/soc/sh/Kconfig
+++ b/sound/soc/sh/Kconfig
@@ -42,12 +42,6 @@ config SND_SOC_RCAR
         help
           This option enables R-Car SRU/SCU/SSIU/SSI sound support
 
-config SND_SOC_RSRC_CARD
-        tristate "Renesas Sampling Rate Convert Sound Card"
-        select SND_SIMPLE_CARD_UTILS
-        help
-          This option enables simple sound if you need sampling rate convert
-
 ##
 ## Boards
 ##
diff --git a/sound/soc/sh/rcar/Makefile b/sound/soc/sh/rcar/Makefile
index a89ddf758695..9c3d5aed99d1 100644
--- a/sound/soc/sh/rcar/Makefile
+++ b/sound/soc/sh/rcar/Makefile
@@ -1,5 +1,2 @@
 snd-soc-rcar-objs       := core.o gen.o dma.o adg.o ssi.o ssiu.o src.o ctu.o mix.o dvc.o cmd.o
 obj-$(CONFIG_SND_SOC_RCAR)      += snd-soc-rcar.o
-
-snd-soc-rsrc-card-objs  := rsrc-card.o
-obj-$(CONFIG_SND_SOC_RSRC_CARD) += snd-soc-rsrc-card.o
diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
index 3351a701c60e..f18141098b50 100644
--- a/sound/soc/sh/rcar/core.c
+++ b/sound/soc/sh/rcar/core.c
@@ -110,6 +110,7 @@ MODULE_DEVICE_TABLE(of, rsnd_of_match);
 /*
  *      rsnd_mod functions
  */
+#ifdef DEBUG
 void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type)
 {
         if (mod->type != type) {
@@ -120,6 +121,7 @@ void rsnd_mod_make_sure(struct rsnd_mod *mod, enum rsnd_mod_type type)
                          rsnd_mod_name(mod), rsnd_mod_id(mod));
         }
 }
+#endif
 
 char *rsnd_mod_name(struct rsnd_mod *mod)
 {
@@ -574,6 +576,7 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd,
 
         switch (cmd) {
         case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
                 rsnd_dai_stream_init(io, substream);
 
                 ret = rsnd_dai_call(init, io, priv);
@@ -590,6 +593,7 @@ static int rsnd_soc_dai_trigger(struct snd_pcm_substream *substream, int cmd,
 
                 break;
         case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_SUSPEND:
                 ret = rsnd_dai_call(irq, io, priv, 0);
 
                 ret |= rsnd_dai_call(stop, io, priv);
diff --git a/sound/soc/sh/rcar/rsrc-card.c b/sound/soc/sh/rcar/rsrc-card.c
deleted file mode 100644
index fa37f842b62f..000000000000
--- a/sound/soc/sh/rcar/rsrc-card.c
+++ /dev/null
@@ -1,486 +0,0 @@
-/*
- * Renesas Sampling Rate Convert Sound Card for DPCM
- *
- * Copyright (C) 2015 Renesas Solutions Corp.
- * Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
- *
- * based on ${LINUX}/sound/soc/generic/simple-card.c
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#include <linux/clk.h>
-#include <linux/device.h>
-#include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_device.h>
-#include <linux/platform_device.h>
-#include <linux/string.h>
-#include <sound/jack.h>
-#include <sound/soc.h>
-#include <sound/soc-dai.h>
-#include <sound/simple_card_utils.h>
-
-struct rsrc_card_of_data {
-        const char *prefix;
-        const struct snd_soc_dapm_route *routes;
-        int num_routes;
-};
-
-static const struct snd_soc_dapm_route routes_ssi0_ak4642[] = {
-        {"ak4642 Playback", NULL, "DAI0 Playback"},
-        {"DAI0 Capture", NULL, "ak4642 Capture"},
-};
-
-static const struct rsrc_card_of_data routes_of_ssi0_ak4642 = {
-        .prefix         = "ak4642",
-        .routes         = routes_ssi0_ak4642,
-        .num_routes     = ARRAY_SIZE(routes_ssi0_ak4642),
-};
-
-static const struct of_device_id rsrc_card_of_match[] = {
-        { .compatible = "renesas,rsrc-card,lager",      .data = &routes_of_ssi0_ak4642 },
-        { .compatible = "renesas,rsrc-card,koelsch",    .data = &routes_of_ssi0_ak4642 },
-        { .compatible = "renesas,rsrc-card", },
-        {},
-};
-MODULE_DEVICE_TABLE(of, rsrc_card_of_match);
-
-#define IDX_CPU         0
-#define IDX_CODEC       1
-struct rsrc_card_priv {
-        struct snd_soc_card snd_card;
-        struct snd_soc_codec_conf codec_conf;
-        struct asoc_simple_dai *dai_props;
-        struct snd_soc_dai_link *dai_link;
-        u32 convert_rate;
-        u32 convert_channels;
-};
-
-#define rsrc_priv_to_dev(priv) ((priv)->snd_card.dev)
-#define rsrc_priv_to_link(priv, i) ((priv)->snd_card.dai_link + (i))
-#define rsrc_priv_to_props(priv, i) ((priv)->dai_props + (i))
-
-static int rsrc_card_startup(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct rsrc_card_priv *priv =   snd_soc_card_get_drvdata(rtd->card);
-        struct asoc_simple_dai *dai_props =
-                rsrc_priv_to_props(priv, rtd->num);
-
-        return clk_prepare_enable(dai_props->clk);
-}
-
-static void rsrc_card_shutdown(struct snd_pcm_substream *substream)
-{
-        struct snd_soc_pcm_runtime *rtd = substream->private_data;
-        struct rsrc_card_priv *priv =   snd_soc_card_get_drvdata(rtd->card);
-        struct asoc_simple_dai *dai_props =
-                rsrc_priv_to_props(priv, rtd->num);
-
-        clk_disable_unprepare(dai_props->clk);
-}
-
-static struct snd_soc_ops rsrc_card_ops = {
-        .startup = rsrc_card_startup,
-        .shutdown = rsrc_card_shutdown,
-};
-
-static int rsrc_card_dai_init(struct snd_soc_pcm_runtime *rtd)
-{
-        struct rsrc_card_priv *priv = snd_soc_card_get_drvdata(rtd->card);
-        struct snd_soc_dai *dai;
-        struct snd_soc_dai_link *dai_link;
-        struct asoc_simple_dai *dai_props;
-        int num = rtd->num;
-        int ret;
-
-        dai_link        = rsrc_priv_to_link(priv, num);
-        dai_props       = rsrc_priv_to_props(priv, num);
-        dai             = dai_link->dynamic ?
-                                rtd->cpu_dai :
-                                rtd->codec_dai;
-
-        if (dai_props->sysclk) {
-                ret = snd_soc_dai_set_sysclk(dai, 0, dai_props->sysclk, 0);
-                if (ret && ret != -ENOTSUPP) {
-                        dev_err(dai->dev, "set_sysclk error\n");
-                        goto err;
-                }
-        }
-
-        if (dai_props->slots) {
-                ret = snd_soc_dai_set_tdm_slot(dai,
-                                               dai_props->tx_slot_mask,
-                                               dai_props->rx_slot_mask,
-                                               dai_props->slots,
-                                               dai_props->slot_width);
-                if (ret && ret != -ENOTSUPP) {
-                        dev_err(dai->dev, "set_tdm_slot error\n");
-                        goto err;
-                }
-        }
-
-        ret = 0;
-
-err:
-        return ret;
-}
-
-static int rsrc_card_be_hw_params_fixup(struct snd_soc_pcm_runtime *rtd,
-                                        struct snd_pcm_hw_params *params)
-{
-        struct rsrc_card_priv *priv = snd_soc_card_get_drvdata(rtd->card);
-        struct snd_interval *rate = hw_param_interval(params,
-                                                      SNDRV_PCM_HW_PARAM_RATE);
-        struct snd_interval *channels = hw_param_interval(params,
-                                                SNDRV_PCM_HW_PARAM_CHANNELS);
-
-        if (priv->convert_rate)
-                rate->min =
-                rate->max = priv->convert_rate;
-
-        if (priv->convert_channels)
-                channels->min =
-                channels->max = priv->convert_channels;
-
-        return 0;
-}
-
-static int rsrc_card_parse_links(struct device_node *np,
-                                 struct rsrc_card_priv *priv,
-                                 int idx, bool is_fe)
-{
-        struct device *dev = rsrc_priv_to_dev(priv);
-        struct snd_soc_dai_link *dai_link = rsrc_priv_to_link(priv, idx);
-        struct asoc_simple_dai *dai_props = rsrc_priv_to_props(priv, idx);
-        struct of_phandle_args args;
-        int ret;
-
-        /*
-         * Get node via "sound-dai = <&phandle port>"
-         * it will be used as xxx_of_node on soc_bind_dai_link()
-         */
-        ret = of_parse_phandle_with_args(np, "sound-dai",
-                                         "#sound-dai-cells", 0, &args);
-        if (ret)
-                return ret;
-
-        /* Parse TDM slot */
-        ret = snd_soc_of_parse_tdm_slot(np,
-                                        &dai_props->tx_slot_mask,
-                                        &dai_props->rx_slot_mask,
-                                        &dai_props->slots,
-                                        &dai_props->slot_width);
-        if (ret)
-                return ret;
-
-        if (is_fe) {
-                /* BE is dummy */
-                dai_link->codec_of_node         = NULL;
-                dai_link->codec_dai_name        = "snd-soc-dummy-dai";
-                dai_link->codec_name            = "snd-soc-dummy";
-
-                /* FE settings */
-                dai_link->dynamic               = 1;
-                dai_link->dpcm_merged_format    = 1;
-                dai_link->cpu_of_node           = args.np;
-                ret = snd_soc_of_get_dai_name(np, &dai_link->cpu_dai_name);
-                if (ret < 0)
-                        return ret;
-
-                ret = asoc_simple_card_set_dailink_name(dev, dai_link,
-                                                        "fe.%s",
-                                                        dai_link->cpu_dai_name);
-                if (ret < 0)
-                        return ret;
-
-                /*
-                 * In soc_bind_dai_link() will check cpu name after
-                 * of_node matching if dai_link has cpu_dai_name.
-                 * but, it will never match if name was created by
-                 * fmt_single_name() remove cpu_dai_name if cpu_args
-                 * was 0. See:
-                 *      fmt_single_name()
-                 *      fmt_multiple_name()
-                 */
-                if (!args.args_count)
-                        dai_link->cpu_dai_name = NULL;
-        } else {
-                const struct rsrc_card_of_data *of_data;
-
-                of_data = of_device_get_match_data(dev);
-
-                /* FE is dummy */
-                dai_link->cpu_of_node           = NULL;
-                dai_link->cpu_dai_name          = "snd-soc-dummy-dai";
-                dai_link->cpu_name              = "snd-soc-dummy";
-
-                /* BE settings */
-                dai_link->no_pcm                = 1;
-                dai_link->be_hw_params_fixup    = rsrc_card_be_hw_params_fixup;
-                dai_link->codec_of_node         = args.np;
-                ret = snd_soc_of_get_dai_name(np, &dai_link->codec_dai_name);
-                if (ret < 0)
-                        return ret;
-
-                ret = asoc_simple_card_set_dailink_name(dev, dai_link,
-                                                        "be.%s",
-                                                        dai_link->codec_dai_name);
-                if (ret < 0)
-                        return ret;
-
-                /* additional name prefix */
-                if (of_data) {
-                        priv->codec_conf.of_node = dai_link->codec_of_node;
-                        priv->codec_conf.name_prefix = of_data->prefix;
-                } else {
-                        snd_soc_of_parse_audio_prefix(&priv->snd_card,
-                                                      &priv->codec_conf,
-                                                      dai_link->codec_of_node,
-                                                      "audio-prefix");
-                }
-        }
-
-        /* Simple Card assumes platform == cpu */
-        dai_link->platform_of_node      = dai_link->cpu_of_node;
-        dai_link->dpcm_playback         = 1;
-        dai_link->dpcm_capture          = 1;
-        dai_link->ops                   = &rsrc_card_ops;
-        dai_link->init                  = rsrc_card_dai_init;
-
-        return 0;
-}
-
-static int rsrc_card_parse_clk(struct device_node *np,
-                               struct rsrc_card_priv *priv,
-                               int idx, bool is_fe)
-{
-        struct snd_soc_dai_link *dai_link = rsrc_priv_to_link(priv, idx);
-        struct asoc_simple_dai *dai_props = rsrc_priv_to_props(priv, idx);
-        struct clk *clk;
-        struct device_node *of_np = is_fe ?     dai_link->cpu_of_node :
-                                                dai_link->codec_of_node;
-        u32 val;
-
-        /*
-         * Parse dai->sysclk come from "clocks = <&xxx>"
-         * (if system has common clock)
-         *  or "system-clock-frequency = <xxx>"
-         *  or device's module clock.
-         */
-        if (of_property_read_bool(np, "clocks")) {
-                clk = of_clk_get(np, 0);
-                if (IS_ERR(clk))
-                        return PTR_ERR(clk);
-
-                dai_props->sysclk = clk_get_rate(clk);
-                dai_props->clk = clk;
-        } else if (!of_property_read_u32(np, "system-clock-frequency", &val)) {
-                dai_props->sysclk = val;
-        } else {
-                clk = of_clk_get(of_np, 0);
-                if (!IS_ERR(clk))
-                        dai_props->sysclk = clk_get_rate(clk);
-        }
-
-        return 0;
-}
-
-static int rsrc_card_dai_sub_link_of(struct device_node *node,
-                                     struct device_node *np,
-                                     struct rsrc_card_priv *priv,
-                                     int idx, bool is_fe)
-{
-        struct device *dev = rsrc_priv_to_dev(priv);
-        struct snd_soc_dai_link *dai_link = rsrc_priv_to_link(priv, idx);
-        struct asoc_simple_dai *dai_props = rsrc_priv_to_props(priv, idx);
-        int ret;
-
-        ret = rsrc_card_parse_links(np, priv, idx, is_fe);
-        if (ret < 0)
-                return ret;
-
-        ret = rsrc_card_parse_clk(np, priv, idx, is_fe);
-        if (ret < 0)
-                return ret;
-
-        dev_dbg(dev, "\t%s / %04x / %d\n",
-                dai_link->name,
-                dai_link->dai_fmt,
-                dai_props->sysclk);
-
-        return ret;
-}
-
-static int rsrc_card_dai_link_of(struct device_node *node,
-                                 struct rsrc_card_priv *priv)
-{
-        struct device *dev = rsrc_priv_to_dev(priv);
-        struct snd_soc_dai_link *dai_link;
-        struct device_node *np;
-        unsigned int daifmt = 0;
-        int ret, i;
-        bool is_fe;
-
-        /* find 1st codec */
-        i = 0;
-        for_each_child_of_node(node, np) {
-                dai_link = rsrc_priv_to_link(priv, i);
-
-                if (strcmp(np->name, "codec") == 0) {
-                        ret = asoc_simple_card_parse_daifmt(dev, node, np,
-                                                            NULL, &daifmt);
-                        if (ret < 0)
-                                return ret;
-                        break;
-                }
-                i++;
-        }
-
-        i = 0;
-        for_each_child_of_node(node, np) {
-                dai_link = rsrc_priv_to_link(priv, i);
-                dai_link->dai_fmt = daifmt;
-
-                is_fe = false;
-                if (strcmp(np->name, "cpu") == 0)
-                        is_fe = true;
-
-                ret = rsrc_card_dai_sub_link_of(node, np, priv, i, is_fe);
-                if (ret < 0)
-                        return ret;
-                i++;
-        }
-
-        return 0;
-}
-
-static int rsrc_card_parse_of(struct device_node *node,
-                              struct rsrc_card_priv *priv,
-                              struct device *dev)
-{
-        const struct rsrc_card_of_data *of_data = of_device_get_match_data(dev);
-        struct asoc_simple_dai *props;
-        struct snd_soc_dai_link *links;
-        int ret;
-        int num;
-
-        if (!node)
-                return -EINVAL;
-
-        num = of_get_child_count(node);
-        props = devm_kzalloc(dev, sizeof(*props) * num, GFP_KERNEL);
-        links = devm_kzalloc(dev, sizeof(*links) * num, GFP_KERNEL);
-        if (!props || !links)
-                return -ENOMEM;
-
-        priv->dai_props = props;
-        priv->dai_link  = links;
-
-        /* Init snd_soc_card */
-        priv->snd_card.owner                    = THIS_MODULE;
-        priv->snd_card.dev                      = dev;
-        priv->snd_card.dai_link                 = priv->dai_link;
-        priv->snd_card.num_links                = num;
-        priv->snd_card.codec_conf               = &priv->codec_conf;
-        priv->snd_card.num_configs              = 1;
-
-        if (of_data) {
-                priv->snd_card.of_dapm_routes           = of_data->routes;
-                priv->snd_card.num_of_dapm_routes       = of_data->num_routes;
-        } else {
-                snd_soc_of_parse_audio_routing(&priv->snd_card,
-                                               "audio-routing");
-        }
-
-        /* sampling rate convert */
-        of_property_read_u32(node, "convert-rate", &priv->convert_rate);
-
-        /* channels transfer */
-        of_property_read_u32(node, "convert-channels", &priv->convert_channels);
-
-        dev_dbg(dev, "New rsrc-audio-card: %s\n",
-                priv->snd_card.name ? priv->snd_card.name : "");
-        dev_dbg(dev, "SRC : convert_rate     %d\n", priv->convert_rate);
-        dev_dbg(dev, "CTU : convert_channels %d\n", priv->convert_channels);
-
-        ret = rsrc_card_dai_link_of(node, priv);
-        if (ret < 0)
-                return ret;
-
-        ret = asoc_simple_card_parse_card_name(&priv->snd_card, "card-");
-        if (ret < 0)
-                return ret;
-
-        return 0;
-}
-
-/* Decrease the reference count of the device nodes */
-static int rsrc_card_unref(struct snd_soc_card *card)
-{
-        struct snd_soc_dai_link *dai_link;
-        int num_links;
-
-        for (num_links = 0, dai_link = card->dai_link;
-             num_links < card->num_links;
-             num_links++, dai_link++) {
-                of_node_put(dai_link->cpu_of_node);
-                of_node_put(dai_link->codec_of_node);
-        }
-        return 0;
-}
-
-static int rsrc_card_probe(struct platform_device *pdev)
-{
-        struct rsrc_card_priv *priv;
-        struct device_node *np = pdev->dev.of_node;
-        struct device *dev = &pdev->dev;
-        int ret;
-
-        /* Allocate the private data */
-        priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
-        if (!priv)
-                return -ENOMEM;
-
-        ret = rsrc_card_parse_of(np, priv, dev);
-        if (ret < 0) {
-                if (ret != -EPROBE_DEFER)
-                        dev_err(dev, "parse error %d\n", ret);
-                goto err;
-        }
-
-        snd_soc_card_set_drvdata(&priv->snd_card, priv);
-
-        ret = devm_snd_soc_register_card(&pdev->dev, &priv->snd_card);
-        if (ret >= 0)
-                return ret;
-err:
-        rsrc_card_unref(&priv->snd_card);
-
-        return ret;
-}
-
-static int rsrc_card_remove(struct platform_device *pdev)
-{
-        struct snd_soc_card *card = platform_get_drvdata(pdev);
-
-        return rsrc_card_unref(card);
-}
-
-static struct platform_driver rsrc_card = {
-        .driver = {
-                .name = "renesas-src-audio-card",
-                .of_match_table = rsrc_card_of_match,
-        },
-        .probe = rsrc_card_probe,
-        .remove = rsrc_card_remove,
-};
-
-module_platform_driver(rsrc_card);
-
-MODULE_ALIAS("platform:renesas-src-audio-card");
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("Renesas Sampling Rate Convert Sound Card");
-MODULE_AUTHOR("Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>");
diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
index e39f916d0f2f..969a5169de25 100644
--- a/sound/soc/sh/rcar/src.c
+++ b/sound/soc/sh/rcar/src.c
@@ -226,8 +226,12 @@ static void rsnd_src_set_convert_rate(struct rsnd_dai_stream *io,
         ifscr = 0;
         fsrate = 0;
         if (fin != fout) {
+                u64 n;
+
                 ifscr = 1;
-                fsrate = 0x0400000 / fout * fin;
+                n = (u64)0x0400000 * fin;
+                do_div(n, fout);
+                fsrate = n;
         }
 
         /*
diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
index 5f848f054745..6cb6db005fc4 100644
--- a/sound/soc/sh/rcar/ssi.c
+++ b/sound/soc/sh/rcar/ssi.c
@@ -928,7 +928,7 @@ int rsnd_ssi_probe(struct rsnd_priv *priv)
                 }
 
                 ops = &rsnd_ssi_non_ops;
-                if (of_get_property(np, "pio-transfer", NULL))
+                if (of_property_read_bool(np, "pio-transfer"))
                         ops = &rsnd_ssi_pio_ops;
                 else
                         ops = &rsnd_ssi_dma_ops;
diff --git a/sound/soc/soc-ac97.c b/sound/soc/soc-ac97.c
index bc4a55bb3fd9..6c8b0b0c56ec 100644
--- a/sound/soc/soc-ac97.c
+++ b/sound/soc/soc-ac97.c
@@ -116,7 +116,7 @@ static int snd_soc_ac97_gpio_direction_out(struct gpio_chip *chip,
         return snd_soc_update_bits(codec, AC97_GPIO_CFG, 1 << offset, 0);
 }
 
-static struct gpio_chip snd_soc_ac97_gpio_chip = {
+static const struct gpio_chip snd_soc_ac97_gpio_chip = {
         .label                  = "snd_soc_ac97",
         .owner                  = THIS_MODULE,
         .request                = snd_soc_ac97_gpio_request,
diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c
index d2df46c14c68..bf7b52fce597 100644
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -121,7 +121,7 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
 
                 dpcm_be_disconnect(fe, stream);
                 fe->dpcm[stream].runtime = NULL;
-                goto fe_err;
+                goto path_err;
         }
 
         dpcm_clear_pending_state(fe, stream);
@@ -136,6 +136,8 @@ static int soc_compr_open_fe(struct snd_compr_stream *cstream)
 
         return 0;
 
+path_err:
+        dpcm_path_put(&list);
 fe_err:
         if (fe->dai_link->compr_ops && fe->dai_link->compr_ops->shutdown)
                 fe->dai_link->compr_ops->shutdown(cstream);
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 16369cad4803..c0bbcd903261 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1056,7 +1056,7 @@ static int soc_bind_dai_link(struct snd_soc_card *card,
         if (!rtd->platform) {
                 dev_err(card->dev, "ASoC: platform %s not registered\n",
                         dai_link->platform_name);
-                return -EPROBE_DEFER;
+                goto _err_defer;
         }
 
         soc_add_pcm_runtime(card, rtd);
@@ -2083,14 +2083,13 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card)
         /* remove auxiliary devices */
         soc_remove_aux_devices(card);
 
+        snd_soc_dapm_free(&card->dapm);
         soc_cleanup_card_debugfs(card);
 
         /* remove the card */
         if (card->remove)
                 card->remove(card);
 
-        snd_soc_dapm_free(&card->dapm);
-
         snd_card_free(card->snd_card);
         return 0;
 
@@ -3333,19 +3332,6 @@ int snd_soc_register_codec(struct device *dev,
         if (ret)
                 goto err_free;
 
-        if (codec_drv->controls) {
-                codec->component.controls = codec_drv->controls;
-                codec->component.num_controls = codec_drv->num_controls;
-        }
-        if (codec_drv->dapm_widgets) {
-                codec->component.dapm_widgets = codec_drv->dapm_widgets;
-                codec->component.num_dapm_widgets = codec_drv->num_dapm_widgets;
-        }
-        if (codec_drv->dapm_routes) {
-                codec->component.dapm_routes = codec_drv->dapm_routes;
-                codec->component.num_dapm_routes = codec_drv->num_dapm_routes;
-        }
-
         if (codec_drv->probe)
                 codec->component.probe = snd_soc_codec_drv_probe;
         if (codec_drv->remove)
@@ -3733,7 +3719,7 @@ unsigned int snd_soc_of_parse_daifmt(struct device_node *np,
          * SND_SOC_DAIFMT_CLOCK_MASK area
          */
         snprintf(prop, sizeof(prop), "%scontinuous-clock", prefix);
-        if (of_get_property(np, prop, NULL))
+        if (of_property_read_bool(np, prop))
                 format |= SND_SOC_DAIFMT_CONT;
         else
                 format |= SND_SOC_DAIFMT_GATED;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 8698c26773b3..3bbe32ee4630 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -823,6 +823,7 @@ static int dapm_create_or_share_kcontrol(struct snd_soc_dapm_widget *w,
                         case snd_soc_dapm_switch:
                         case snd_soc_dapm_mixer:
                         case snd_soc_dapm_pga:
+                        case snd_soc_dapm_out_drv:
                                 wname_in_long_name = true;
                                 kcname_in_long_name = true;
                                 break;
@@ -1169,7 +1170,7 @@ static int is_connected_input_ep(struct snd_soc_dapm_widget *widget,
  * @custom_stop_condition: (optional) a function meant to stop the widget graph
  *                         walk based on custom logic.
  *
- * Queries DAPM graph as to whether an valid audio stream path exists for
+ * Queries DAPM graph as to whether a valid audio stream path exists for
  * the initial stream specified by name. This takes into account
  * current mixer and mux kcontrol settings. Creates list of valid widgets.
  *
@@ -1294,8 +1295,7 @@ static int dapm_widget_power_check(struct snd_soc_dapm_widget *w)
         return w->new_power;
 }
 
-/* Generic check to see if a widget should be powered.
- */
+/* Generic check to see if a widget should be powered. */
 static int dapm_generic_check_power(struct snd_soc_dapm_widget *w)
 {
         int in, out;
@@ -1646,7 +1646,7 @@ static void dapm_pre_sequence_async(void *data, async_cookie_t cookie)
         struct snd_soc_dapm_context *d = data;
         int ret;
 
-        /* If we're off and we're not supposed to be go into STANDBY */
+        /* If we're off and we're not supposed to go into STANDBY */
         if (d->bias_level == SND_SOC_BIAS_OFF &&
             d->target_bias_level != SND_SOC_BIAS_OFF) {
                 if (d->dev)
@@ -1798,7 +1798,7 @@ static bool dapm_idle_bias_off(struct snd_soc_dapm_context *dapm)
  * A complete path is a route that has valid endpoints i.e.:-
  *
  *  o DAC to output pin.
- *  o Input Pin to ADC.
+ *  o Input pin to ADC.
  *  o Input pin to Output pin (bypass, sidetone)
  *  o DAC to ADC (loopback).
  */
@@ -2114,7 +2114,7 @@ static inline void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm)
  * soc_dapm_connect_path() - Connects or disconnects a path
  * @path: The path to update
  * @connect: The new connect state of the path. True if the path is connected,
- *  false if it is disconneted.
+ *  false if it is disconnected.
  * @reason: The reason why the path changed (for debugging only)
  */
 static void soc_dapm_connect_path(struct snd_soc_dapm_path *path,
@@ -2233,7 +2233,7 @@ static ssize_t dapm_widget_show_component(struct snd_soc_component *cmpnt,
                 if (w->dapm != dapm)
                         continue;
 
-                /* only display widgets that burnm power */
+                /* only display widgets that burn power */
                 switch (w->id) {
                 case snd_soc_dapm_hp:
                 case snd_soc_dapm_mic:
@@ -2461,7 +2461,7 @@ static void dapm_update_widget_flags(struct snd_soc_dapm_widget *w)
 
         switch (w->id) {
         case snd_soc_dapm_input:
-                /* On a fully routed card a input is never a source */
+                /* On a fully routed card an input is never a source */
                 if (w->dapm->card->fully_routed)
                         return;
                 ep = SND_SOC_DAPM_EP_SOURCE;
@@ -3049,6 +3049,9 @@ int snd_soc_dapm_get_volsw(struct snd_kcontrol *kcontrol,
         }
         mutex_unlock(&card->dapm_mutex);
 
+        if (ret)
+                return ret;
+
         if (invert)
                 ucontrol->value.integer.value[0] = max - val;
         else
@@ -3200,7 +3203,7 @@ int snd_soc_dapm_put_enum_double(struct snd_kcontrol *kcontrol,
         if (e->shift_l != e->shift_r) {
                 if (item[1] > e->items)
                         return -EINVAL;
-                val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_l;
+                val |= snd_soc_enum_item_to_val(e, item[1]) << e->shift_r;
                 mask |= e->mask << e->shift_r;
         }
 
@@ -3445,7 +3448,7 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
                 w->endpoints[dir] = -1;
         }
 
-        /* machine layer set ups unconnected pins and insertions */
+        /* machine layer sets up unconnected pins and insertions */
         w->connected = 1;
         return w;
 }
@@ -3493,6 +3496,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
         const struct snd_soc_pcm_stream *config = w->params + w->params_select;
         struct snd_pcm_substream substream;
         struct snd_pcm_hw_params *params = NULL;
+        struct snd_pcm_runtime *runtime = NULL;
         u64 fmt;
         int ret;
 
@@ -3541,6 +3545,14 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
 
         memset(&substream, 0, sizeof(substream));
 
+        /* Allocate a dummy snd_pcm_runtime for startup() and other ops() */
+        runtime = kzalloc(sizeof(*runtime), GFP_KERNEL);
+        if (!runtime) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        substream.runtime = runtime;
+
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
                 substream.stream = SNDRV_PCM_STREAM_CAPTURE;
@@ -3606,6 +3618,7 @@ static int snd_soc_dai_link_event(struct snd_soc_dapm_widget *w,
         }
 
 out:
+        kfree(runtime);
         kfree(params);
         return ret;
 }
diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
index a513a34a51d2..9fc1a7bb8b95 100644
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -77,7 +77,7 @@ int snd_soc_get_enum_double(struct snd_kcontrol *kcontrol,
         item = snd_soc_enum_val_to_item(e, val);
         ucontrol->value.enumerated.item[0] = item;
         if (e->shift_l != e->shift_r) {
-                val = (reg_val >> e->shift_l) & e->mask;
+                val = (reg_val >> e->shift_r) & e->mask;
                 item = snd_soc_enum_val_to_item(e, val);
                 ucontrol->value.enumerated.item[1] = item;
         }
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index 60d702f8b9f0..d56a16a0f6fa 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1694,6 +1694,9 @@ static int dpcm_apply_symmetry(struct snd_pcm_substream *fe_substream,
                 struct snd_soc_pcm_runtime *rtd = be_substream->private_data;
                 int i;
 
+                if (rtd->dai_link->be_hw_params_fixup)
+                        continue;
+
                 if (soc_pcm_has_symmetry(be_substream))
                         be_substream->runtime->hw.info |= SNDRV_PCM_INFO_JOINT_DUPLEX;
 
@@ -1790,7 +1793,7 @@ int dpcm_be_dai_shutdown(struct snd_soc_pcm_runtime *fe, int stream)
                         continue;
 
                 dev_dbg(be->dev, "ASoC: close BE %s\n",
-                        dpcm->fe->dai_link->name);
+                        be->dai_link->name);
 
                 soc_pcm_close(be_substream);
                 be_substream->runtime = NULL;
@@ -1856,7 +1859,7 @@ int dpcm_be_dai_hw_free(struct snd_soc_pcm_runtime *fe, int stream)
                         continue;
 
                 dev_dbg(be->dev, "ASoC: hw_free BE %s\n",
-                        dpcm->fe->dai_link->name);
+                        be->dai_link->name);
 
                 soc_pcm_hw_free(be_substream);
 
@@ -1934,7 +1937,7 @@ int dpcm_be_dai_hw_params(struct snd_soc_pcm_runtime *fe, int stream)
                         continue;
 
                 dev_dbg(be->dev, "ASoC: hw_params BE %s\n",
-                        dpcm->fe->dai_link->name);
+                        be->dai_link->name);
 
                 ret = soc_pcm_hw_params(be_substream, &dpcm->hw_params);
                 if (ret < 0) {
@@ -2014,7 +2017,7 @@ static int dpcm_do_trigger(struct snd_soc_dpcm *dpcm,
         int ret;
 
         dev_dbg(dpcm->be->dev, "ASoC: trigger BE %s cmd %d\n",
-                        dpcm->fe->dai_link->name, cmd);
+                        dpcm->be->dai_link->name, cmd);
 
         ret = soc_pcm_trigger(substream, cmd);
         if (ret < 0)
@@ -2229,7 +2232,7 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)
                         continue;
 
                 dev_dbg(be->dev, "ASoC: prepare BE %s\n",
-                        dpcm->fe->dai_link->name);
+                        be->dai_link->name);
 
                 ret = soc_pcm_prepare(be_substream);
                 if (ret < 0) {
diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
index ee7f15aa46fc..6b05047a4134 100644
--- a/sound/soc/soc-topology.c
+++ b/sound/soc/soc-topology.c
@@ -48,9 +48,10 @@
 #define SOC_TPLG_PASS_PCM_DAI           4
 #define SOC_TPLG_PASS_GRAPH             5
 #define SOC_TPLG_PASS_PINS              6
+#define SOC_TPLG_PASS_BE_DAI            7
 
 #define SOC_TPLG_PASS_START     SOC_TPLG_PASS_MANIFEST
-#define SOC_TPLG_PASS_END       SOC_TPLG_PASS_PINS
+#define SOC_TPLG_PASS_END       SOC_TPLG_PASS_BE_DAI
 
 struct soc_tplg {
         const struct firmware *fw;
@@ -1475,6 +1476,7 @@ widget:
         if (widget == NULL) {
                 dev_err(tplg->dev, "ASoC: failed to create widget %s controls\n",
                         w->name);
+                ret = -ENOMEM;
                 goto hdr_err;
         }
 
@@ -1554,6 +1556,25 @@ static void set_stream_info(struct snd_soc_pcm_stream *stream,
         stream->rate_min = caps->rate_min;
         stream->rate_max = caps->rate_max;
         stream->formats = caps->formats;
+        stream->sig_bits = caps->sig_bits;
+}
+
+static void set_dai_flags(struct snd_soc_dai_driver *dai_drv,
+                          unsigned int flag_mask, unsigned int flags)
+{
+        if (flag_mask & SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_RATES)
+                dai_drv->symmetric_rates =
+                        flags & SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_RATES ? 1 : 0;
+
+        if (flag_mask & SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_CHANNELS)
+                dai_drv->symmetric_channels =
+                        flags & SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_CHANNELS ?
+                        1 : 0;
+
+        if (flag_mask & SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_SAMPLEBITS)
+                dai_drv->symmetric_samplebits =
+                        flags & SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_SAMPLEBITS ?
+                        1 : 0;
 }
 
 static int soc_tplg_dai_create(struct soc_tplg *tplg,
@@ -1690,8 +1711,96 @@ static int soc_tplg_pcm_elems_load(struct soc_tplg *tplg,
         return 0;
 }
 
+/* *
+ * soc_tplg_be_dai_config - Find and configure an existing BE DAI.
+ * @tplg: topology context
+ * @be: topology BE DAI configs.
+ *
+ * The BE dai should already be registered by the platform driver. The
+ * platform driver should specify the BE DAI name and ID for matching.
+ */
+static int soc_tplg_be_dai_config(struct soc_tplg *tplg,
+                                  struct snd_soc_tplg_be_dai *be)
+{
+        struct snd_soc_dai_link_component dai_component = {0};
+        struct snd_soc_dai *dai;
+        struct snd_soc_dai_driver *dai_drv;
+        struct snd_soc_pcm_stream *stream;
+        struct snd_soc_tplg_stream_caps *caps;
+        int ret;
+
+        dai_component.dai_name = be->dai_name;
+        dai = snd_soc_find_dai(&dai_component);
+        if (!dai) {
+                dev_err(tplg->dev, "ASoC: BE DAI %s not registered\n",
+                        be->dai_name);
+                return -EINVAL;
+        }
+
+        if (be->dai_id != dai->id) {
+                dev_err(tplg->dev, "ASoC: BE DAI %s id mismatch\n",
+                        be->dai_name);
+                return -EINVAL;
+        }
+
+        dai_drv = dai->driver;
+        if (!dai_drv)
+                return -EINVAL;
+
+        if (be->playback) {
+                stream = &dai_drv->playback;
+                caps = &be->caps[SND_SOC_TPLG_STREAM_PLAYBACK];
+                set_stream_info(stream, caps);
+        }
+
+        if (be->capture) {
+                stream = &dai_drv->capture;
+                caps = &be->caps[SND_SOC_TPLG_STREAM_CAPTURE];
+                set_stream_info(stream, caps);
+        }
+
+        if (be->flag_mask)
+                set_dai_flags(dai_drv, be->flag_mask, be->flags);
+
+        /* pass control to component driver for optional further init */
+        ret = soc_tplg_dai_load(tplg, dai_drv);
+        if (ret < 0) {
+                dev_err(tplg->comp->dev, "ASoC: DAI loading failed\n");
+                return ret;
+        }
+
+        return 0;
+}
+
+static int soc_tplg_be_dai_elems_load(struct soc_tplg *tplg,
+                                      struct snd_soc_tplg_hdr *hdr)
+{
+        struct snd_soc_tplg_be_dai *be;
+        int count = hdr->count;
+        int i;
+
+        if (tplg->pass != SOC_TPLG_PASS_BE_DAI)
+                return 0;
+
+        /* config the existing BE DAIs */
+        for (i = 0; i < count; i++) {
+                be = (struct snd_soc_tplg_be_dai *)tplg->pos;
+                if (be->size != sizeof(*be)) {
+                        dev_err(tplg->dev, "ASoC: invalid BE DAI size\n");
+                        return -EINVAL;
+                }
+
+                soc_tplg_be_dai_config(tplg, be);
+                tplg->pos += (sizeof(*be) + be->priv.size);
+        }
+
+        dev_dbg(tplg->dev, "ASoC: Configure %d BE DAIs\n", count);
+        return 0;
+}
+
+
 static int soc_tplg_manifest_load(struct soc_tplg *tplg,
-        struct snd_soc_tplg_hdr *hdr)
+                                  struct snd_soc_tplg_hdr *hdr)
 {
         struct snd_soc_tplg_manifest *manifest;
 
@@ -1793,6 +1902,8 @@ static int soc_tplg_load_header(struct soc_tplg *tplg,
                 return soc_tplg_dapm_widget_elems_load(tplg, hdr);
         case SND_SOC_TPLG_TYPE_PCM:
                 return soc_tplg_pcm_elems_load(tplg, hdr);
+        case SND_SOC_TPLG_TYPE_BE_DAI:
+                return soc_tplg_be_dai_elems_load(tplg, hdr);
         case SND_SOC_TPLG_TYPE_MANIFEST:
                 return soc_tplg_manifest_load(tplg, hdr);
         default:
diff --git a/sound/soc/soc-utils.c b/sound/soc/soc-utils.c
index 53dd085d3ee2..393e8f0fe2cc 100644
--- a/sound/soc/soc-utils.c
+++ b/sound/soc/soc-utils.c
@@ -80,7 +80,7 @@ static int dummy_dma_open(struct snd_pcm_substream *substream)
         return 0;
 }
 
-static struct snd_pcm_ops dummy_dma_ops = {
+static const struct snd_pcm_ops dummy_dma_ops = {
         .open           = dummy_dma_open,
         .ioctl          = snd_pcm_lib_ioctl,
 };
diff --git a/sound/soc/sti/sti_uniperif.c b/sound/soc/sti/sti_uniperif.c
index 488ef4ed8fba..549fac349fa0 100644
--- a/sound/soc/sti/sti_uniperif.c
+++ b/sound/soc/sti/sti_uniperif.c
@@ -19,6 +19,84 @@
 #define UNIPERIF_MAX_FRAME_SZ 0x20
 #define UNIPERIF_ALLOWED_FRAME_SZ (0x08 | 0x10 | 0x18 | UNIPERIF_MAX_FRAME_SZ)
 
+struct sti_uniperiph_dev_data {
+        unsigned int id; /* Nb available player instances */
+        unsigned int version; /* player IP version */
+        unsigned int stream;
+        const char *dai_names;
+        enum uniperif_type type;
+};
+
+static const struct sti_uniperiph_dev_data sti_uniplayer_hdmi = {
+        .id = 0,
+        .version = SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0,
+        .stream = SNDRV_PCM_STREAM_PLAYBACK,
+        .dai_names = "Uni Player #0 (HDMI)",
+        .type = SND_ST_UNIPERIF_TYPE_HDMI
+};
+
+static const struct sti_uniperiph_dev_data sti_uniplayer_pcm_out = {
+        .id = 1,
+        .version = SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0,
+        .stream = SNDRV_PCM_STREAM_PLAYBACK,
+        .dai_names = "Uni Player #1 (PCM OUT)",
+        .type = SND_ST_UNIPERIF_TYPE_PCM | SND_ST_UNIPERIF_TYPE_TDM,
+};
+
+static const struct sti_uniperiph_dev_data sti_uniplayer_dac = {
+        .id = 2,
+        .version = SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0,
+        .stream = SNDRV_PCM_STREAM_PLAYBACK,
+        .dai_names = "Uni Player #2 (DAC)",
+        .type = SND_ST_UNIPERIF_TYPE_PCM,
+};
+
+static const struct sti_uniperiph_dev_data sti_uniplayer_spdif = {
+        .id = 3,
+        .version = SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0,
+        .stream = SNDRV_PCM_STREAM_PLAYBACK,
+        .dai_names = "Uni Player #3 (SPDIF)",
+        .type = SND_ST_UNIPERIF_TYPE_SPDIF
+};
+
+static const struct sti_uniperiph_dev_data sti_unireader_pcm_in = {
+        .id = 0,
+        .version = SND_ST_UNIPERIF_VERSION_UNI_RDR_1_0,
+        .stream = SNDRV_PCM_STREAM_CAPTURE,
+        .dai_names = "Uni Reader #0 (PCM IN)",
+        .type = SND_ST_UNIPERIF_TYPE_PCM | SND_ST_UNIPERIF_TYPE_TDM,
+};
+
+static const struct sti_uniperiph_dev_data sti_unireader_hdmi_in = {
+        .id = 1,
+        .version = SND_ST_UNIPERIF_VERSION_UNI_RDR_1_0,
+        .stream = SNDRV_PCM_STREAM_CAPTURE,
+        .dai_names = "Uni Reader #1 (HDMI IN)",
+        .type = SND_ST_UNIPERIF_TYPE_PCM,
+};
+
+static const struct of_device_id snd_soc_sti_match[] = {
+        { .compatible = "st,stih407-uni-player-hdmi",
+          .data = &sti_uniplayer_hdmi
+        },
+        { .compatible = "st,stih407-uni-player-pcm-out",
+          .data = &sti_uniplayer_pcm_out
+        },
+        { .compatible = "st,stih407-uni-player-dac",
+          .data = &sti_uniplayer_dac
+        },
+        { .compatible = "st,stih407-uni-player-spdif",
+          .data = &sti_uniplayer_spdif
+        },
+        { .compatible = "st,stih407-uni-reader-pcm_in",
+          .data = &sti_unireader_pcm_in
+        },
+        { .compatible = "st,stih407-uni-reader-hdmi",
+          .data = &sti_unireader_hdmi_in
+        },
+        {},
+};
+
 int sti_uniperiph_set_tdm_slot(struct snd_soc_dai *dai, unsigned int tx_mask,
                                unsigned int rx_mask, int slots,
                                int slot_width)
@@ -167,8 +245,8 @@ static int sti_uniperiph_dai_create_ctrl(struct snd_soc_dai *dai)
                  * Uniperipheral instance ID
                  */
                 ctrl = &uni->snd_ctrls[i];
-                ctrl->index = uni->info->id;
-                ctrl->device = uni->info->id;
+                ctrl->index = uni->id;
+                ctrl->device = uni->id;
         }
 
         return snd_soc_add_dai_controls(dai, uni->snd_ctrls, uni->num_ctrls);
@@ -186,7 +264,7 @@ int sti_uniperiph_dai_hw_params(struct snd_pcm_substream *substream,
         struct snd_dmaengine_dai_dma_data *dma_data;
         int transfer_size;
 
-        if (uni->info->type == SND_ST_UNIPERIF_TYPE_TDM)
+        if (uni->type == SND_ST_UNIPERIF_TYPE_TDM)
                 /* transfer size = user frame size (in 32-bits FIFO cell) */
                 transfer_size = snd_soc_params_to_frame_size(params) / 32;
         else
@@ -235,7 +313,7 @@ static int sti_uniperiph_dai_resume(struct snd_soc_dai *dai)
         struct uniperif *uni = priv->dai_data.uni;
         int ret;
 
-        if (of_device_is_compatible(dai->dev->of_node, "st,sti-uni-player")) {
+        if (priv->dai_data.stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 ret = uni_player_resume(uni);
                 if (ret)
                         return ret;
@@ -256,7 +334,7 @@ static int sti_uniperiph_dai_probe(struct snd_soc_dai *dai)
         struct sti_uniperiph_dai *dai_data = &priv->dai_data;
 
         /* DMA settings*/
-        if (of_device_is_compatible(dai->dev->of_node, "st,sti-uni-player"))
+        if (priv->dai_data.stream == SNDRV_PCM_STREAM_PLAYBACK)
                 snd_soc_dai_init_dma_data(dai, &dai_data->dma_data, NULL);
         else
                 snd_soc_dai_init_dma_data(dai, NULL, &dai_data->dma_data);
@@ -280,25 +358,32 @@ static const struct snd_soc_component_driver sti_uniperiph_dai_component = {
 static int sti_uniperiph_cpu_dai_of(struct device_node *node,
                                     struct sti_uniperiph_data *priv)
 {
-        const char *str;
-        int ret;
         struct device *dev = &priv->pdev->dev;
         struct sti_uniperiph_dai *dai_data = &priv->dai_data;
         struct snd_soc_dai_driver *dai = priv->dai;
         struct snd_soc_pcm_stream *stream;
         struct uniperif *uni;
+        const struct of_device_id *of_id;
+        const struct sti_uniperiph_dev_data *dev_data;
+        const char *mode;
+
+        /* Populate data structure depending on compatibility */
+        of_id = of_match_node(snd_soc_sti_match, node);
+        if (!of_id->data) {
+                dev_err(dev, "data associated to device is missing");
+                return -EINVAL;
+        }
+        dev_data = (struct sti_uniperiph_dev_data *)of_id->data;
 
         uni = devm_kzalloc(dev, sizeof(*uni), GFP_KERNEL);
         if (!uni)
                 return -ENOMEM;
 
+        uni->id = dev_data->id;
+        uni->ver = dev_data->version;
+
         *dai = sti_uniperiph_dai_template;
-        ret = of_property_read_string(node, "dai-name", &str);
-        if (ret < 0) {
-                dev_err(dev, "%s: dai name missing.\n", __func__);
-                return -EINVAL;
-        }
-        dai->name = str;
+        dai->name = dev_data->dai_names;
 
         /* Get resources */
         uni->mem_region = platform_get_resource(priv->pdev, IORESOURCE_MEM, 0);
@@ -322,9 +407,20 @@ static int sti_uniperiph_cpu_dai_of(struct device_node *node,
                 return -ENXIO;
         }
 
+        uni->type = dev_data->type;
+
+        /* check if player should be configured for tdm */
+        if (dev_data->type & SND_ST_UNIPERIF_TYPE_TDM) {
+                if (!of_property_read_string(node, "st,tdm-mode", &mode))
+                        uni->type = SND_ST_UNIPERIF_TYPE_TDM;
+                else
+                        uni->type = SND_ST_UNIPERIF_TYPE_PCM;
+        }
+
         dai_data->uni = uni;
+        dai_data->stream = dev_data->stream;
 
-        if (of_device_is_compatible(node, "st,sti-uni-player")) {
+        if (priv->dai_data.stream == SNDRV_PCM_STREAM_PLAYBACK) {
                 uni_player_init(priv->pdev, uni);
                 stream = &dai->playback;
         } else {
@@ -376,12 +472,6 @@ static int sti_uniperiph_probe(struct platform_device *pdev)
                                                &dmaengine_pcm_config, 0);
 }
 
-static const struct of_device_id snd_soc_sti_match[] = {
-        { .compatible = "st,sti-uni-player", },
-        { .compatible = "st,sti-uni-reader", },
-        {},
-};
-
 static struct platform_driver sti_uniperiph_driver = {
         .driver = {
                 .name = "sti-uniperiph-dai",
diff --git a/sound/soc/sti/uniperif.h b/sound/soc/sti/uniperif.h
index eb9933c62ad6..1993c655fb79 100644
--- a/sound/soc/sti/uniperif.h
+++ b/sound/soc/sti/uniperif.h
@@ -1220,16 +1220,16 @@
 #define UNIPERIF_FIFO_FRAMES            4  /* FDMA trigger limit in frames */
 
 #define UNIPERIF_TYPE_IS_HDMI(p) \
-        ((p)->info->type == SND_ST_UNIPERIF_TYPE_HDMI)
+        ((p)->type == SND_ST_UNIPERIF_TYPE_HDMI)
 #define UNIPERIF_TYPE_IS_PCM(p) \
-        ((p)->info->type == SND_ST_UNIPERIF_TYPE_PCM)
+        ((p)->type == SND_ST_UNIPERIF_TYPE_PCM)
 #define UNIPERIF_TYPE_IS_SPDIF(p) \
-        ((p)->info->type == SND_ST_UNIPERIF_TYPE_SPDIF)
+        ((p)->type == SND_ST_UNIPERIF_TYPE_SPDIF)
 #define UNIPERIF_TYPE_IS_IEC958(p) \
         (UNIPERIF_TYPE_IS_HDMI(p) || \
                 UNIPERIF_TYPE_IS_SPDIF(p))
 #define UNIPERIF_TYPE_IS_TDM(p) \
-        ((p)->info->type == SND_ST_UNIPERIF_TYPE_TDM)
+        ((p)->type == SND_ST_UNIPERIF_TYPE_TDM)
 
 /*
  * Uniperipheral IP revisions
@@ -1249,11 +1249,11 @@ enum uniperif_version {
 };
 
 enum uniperif_type {
-        SND_ST_UNIPERIF_TYPE_NONE,
-        SND_ST_UNIPERIF_TYPE_HDMI,
-        SND_ST_UNIPERIF_TYPE_PCM,
-        SND_ST_UNIPERIF_TYPE_SPDIF,
-        SND_ST_UNIPERIF_TYPE_TDM
+        SND_ST_UNIPERIF_TYPE_NONE       = 0x00,
+        SND_ST_UNIPERIF_TYPE_HDMI       = 0x01,
+        SND_ST_UNIPERIF_TYPE_PCM        = 0x02,
+        SND_ST_UNIPERIF_TYPE_SPDIF      = 0x04,
+        SND_ST_UNIPERIF_TYPE_TDM        = 0x08
 };
 
 enum uniperif_state {
@@ -1278,12 +1278,6 @@ enum uniperif_word_pos {
         WORD_MAX
 };
 
-struct uniperif_info {
-        int id; /* instance value of the uniperipheral IP */
-        enum uniperif_type type;
-        int underflow_enabled;          /* Underflow recovery mode */
-};
-
 struct uniperif_iec958_settings {
         enum uniperif_iec958_encoding_mode encoding_mode;
         struct snd_aes_iec958 iec958;
@@ -1298,8 +1292,10 @@ struct dai_tdm_slot {
 
 struct uniperif {
         /* System information */
-        struct uniperif_info *info;
+        enum uniperif_type type;
+        int underflow_enabled; /* Underflow recovery mode */
         struct device *dev;
+        int id; /* instance value of the uniperipheral IP */
         int ver; /* IP version, used by register access macros */
         struct regmap_field *clk_sel;
         struct regmap_field *valid_sel;
diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
index 1ac2db205a0d..1bc8ebc2528e 100644
--- a/sound/soc/sti/uniperif_player.c
+++ b/sound/soc/sti/uniperif_player.c
@@ -100,7 +100,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
                 dev_err(player->dev, "FIFO underflow error detected");
 
                 /* Interrupt is just for information when underflow recovery */
-                if (player->info->underflow_enabled) {
+                if (player->underflow_enabled) {
                         /* Update state to underflow */
                         player->state = UNIPERIF_STATE_UNDERFLOW;
 
@@ -134,7 +134,7 @@ static irqreturn_t uni_player_irq_handler(int irq, void *dev_id)
 
         /* Check for underflow recovery done */
         if (unlikely(status & UNIPERIF_ITM_UNDERFLOW_REC_DONE_MASK(player))) {
-                if (!player->info->underflow_enabled) {
+                if (!player->underflow_enabled) {
                         dev_err(player->dev, "unexpected Underflow recovering");
                         return -EPERM;
                 }
@@ -764,7 +764,7 @@ static int uni_player_prepare(struct snd_pcm_substream *substream,
         }
 
         /* Calculate transfer size (in fifo cells and bytes) for frame count */
-        if (player->info->type == SND_ST_UNIPERIF_TYPE_TDM) {
+        if (player->type == SND_ST_UNIPERIF_TYPE_TDM) {
                 /* transfer size = user frame size (in 32 bits FIFO cell) */
                 transfer_size =
                         sti_uniperiph_get_user_frame_size(runtime) / 4;
@@ -794,7 +794,7 @@ static int uni_player_prepare(struct snd_pcm_substream *substream,
         SET_UNIPERIF_CONFIG_DMA_TRIG_LIMIT(player, trigger_limit);
 
         /* Uniperipheral setup depends on player type */
-        switch (player->info->type) {
+        switch (player->type) {
         case SND_ST_UNIPERIF_TYPE_HDMI:
                 ret = uni_player_prepare_iec958(player, runtime);
                 break;
@@ -884,7 +884,7 @@ static int uni_player_start(struct uniperif *player)
         SET_UNIPERIF_ITM_BSET_FIFO_ERROR(player);
 
         /* Enable underflow recovery interrupts */
-        if (player->info->underflow_enabled) {
+        if (player->underflow_enabled) {
                 SET_UNIPERIF_ITM_BSET_UNDERFLOW_REC_DONE(player);
                 SET_UNIPERIF_ITM_BSET_UNDERFLOW_REC_FAILED(player);
         }
@@ -893,8 +893,10 @@ static int uni_player_start(struct uniperif *player)
         SET_UNIPERIF_SOFT_RST_SOFT_RST(player);
 
         ret = reset_player(player);
-        if (ret < 0)
+        if (ret < 0) {
+                clk_disable_unprepare(player->clk);
                 return ret;
+        }
 
         /*
          * Does not use IEC61937 features of the uniperipheral hardware.
@@ -1021,8 +1023,8 @@ static int uni_player_parse_dt_audio_glue(struct platform_device *pdev,
         struct reg_field regfield[2] = {
                 /* PCM_CLK_SEL */
                 REG_FIELD(SYS_CFG_AUDIO_GLUE,
-                          8 + player->info->id,
-                          8 + player->info->id),
+                          8 + player->id,
+                          8 + player->id),
                 /* PCMP_VALID_SEL */
                 REG_FIELD(SYS_CFG_AUDIO_GLUE, 0, 1)
         };
@@ -1040,60 +1042,6 @@ static int uni_player_parse_dt_audio_glue(struct platform_device *pdev,
         return 0;
 }
 
-static int uni_player_parse_dt(struct platform_device *pdev,
-                               struct uniperif *player)
-{
-        struct uniperif_info *info;
-        struct device *dev = &pdev->dev;
-        struct device_node *pnode = pdev->dev.of_node;
-        const char *mode;
-
-        /* Allocate memory for the info structure */
-        info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL);
-        if (!info)
-                return -ENOMEM;
-
-        if (of_property_read_u32(pnode, "st,version", &player->ver) ||
-            player->ver == SND_ST_UNIPERIF_VERSION_UNKNOWN) {
-                dev_err(dev, "Unknown uniperipheral version ");
-                return -EINVAL;
-        }
-        /* Underflow recovery is only supported on later ip revisions */
-        if (player->ver >= SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0)
-                info->underflow_enabled = 1;
-
-        if (of_property_read_u32(pnode, "st,uniperiph-id", &info->id)) {
-                dev_err(dev, "uniperipheral id not defined");
-                return -EINVAL;
-        }
-
-        /* Read the device mode property */
-        if (of_property_read_string(pnode, "st,mode", &mode)) {
-                dev_err(dev, "uniperipheral mode not defined");
-                return -EINVAL;
-        }
-
-        if (strcasecmp(mode, "hdmi") == 0)
-                info->type = SND_ST_UNIPERIF_TYPE_HDMI;
-        else if (strcasecmp(mode, "pcm") == 0)
-                info->type = SND_ST_UNIPERIF_TYPE_PCM;
-        else if (strcasecmp(mode, "spdif") == 0)
-                info->type = SND_ST_UNIPERIF_TYPE_SPDIF;
-        else if (strcasecmp(mode, "tdm") == 0)
-                info->type = SND_ST_UNIPERIF_TYPE_TDM;
-        else
-                info->type = SND_ST_UNIPERIF_TYPE_NONE;
-
-        /* Save the info structure */
-        player->info = info;
-
-        /* Get PCM_CLK_SEL & PCMP_VALID_SEL from audio-glue-ctrl SoC reg */
-        if (uni_player_parse_dt_audio_glue(pdev, player))
-                return -EINVAL;
-
-        return 0;
-}
-
 static const struct snd_soc_dai_ops uni_player_dai_ops = {
                 .startup = uni_player_startup,
                 .shutdown = uni_player_shutdown,
@@ -1114,13 +1062,18 @@ int uni_player_init(struct platform_device *pdev,
         player->state = UNIPERIF_STATE_STOPPED;
         player->dai_ops = &uni_player_dai_ops;
 
-        ret = uni_player_parse_dt(pdev, player);
+        /* Get PCM_CLK_SEL & PCMP_VALID_SEL from audio-glue-ctrl SoC reg */
+        ret = uni_player_parse_dt_audio_glue(pdev, player);
 
         if (ret < 0) {
                 dev_err(player->dev, "Failed to parse DeviceTree");
                 return ret;
         }
 
+        /* Underflow recovery is only supported on later ip revisions */
+        if (player->ver >= SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0)
+                player->underflow_enabled = 1;
+
         if (UNIPERIF_TYPE_IS_TDM(player))
                 player->hw = &uni_tdm_hw;
         else
@@ -1144,8 +1097,8 @@ int uni_player_init(struct platform_device *pdev,
 
         /* connect to I2S/TDM TX bus */
         if (player->valid_sel &&
-            (player->info->id == UNIPERIF_PLAYER_I2S_OUT)) {
-                ret = regmap_field_write(player->valid_sel, player->info->id);
+            (player->id == UNIPERIF_PLAYER_I2S_OUT)) {
+                ret = regmap_field_write(player->valid_sel, player->id);
                 if (ret) {
                         dev_err(player->dev,
                                 "%s: unable to connect to tdm bus", __func__);
diff --git a/sound/soc/sti/uniperif_reader.c b/sound/soc/sti/uniperif_reader.c
index eb74a328c928..0e1c3ee56675 100644
--- a/sound/soc/sti/uniperif_reader.c
+++ b/sound/soc/sti/uniperif_reader.c
@@ -13,6 +13,7 @@
 
 #include "uniperif.h"
 
+#define UNIPERIF_READER_I2S_IN 0 /* reader id connected to I2S/TDM TX bus */
 /*
  * Note: snd_pcm_hardware is linked to DMA controller but is declared here to
  * integrate unireader capability in term of rate and supported channels
@@ -195,7 +196,7 @@ static int uni_reader_prepare(struct snd_pcm_substream *substream,
         }
 
         /* Calculate transfer size (in fifo cells and bytes) for frame count */
-        if (reader->info->type == SND_ST_UNIPERIF_TYPE_TDM) {
+        if (reader->type == SND_ST_UNIPERIF_TYPE_TDM) {
                 /* transfer size = unip frame size (in 32 bits FIFO cell) */
                 transfer_size =
                         sti_uniperiph_get_user_frame_size(runtime) / 4;
@@ -280,7 +281,7 @@ static int uni_reader_prepare(struct snd_pcm_substream *substream,
         SET_UNIPERIF_ITM_BSET_MEM_BLK_READ(reader);
 
         /* Enable underflow recovery interrupts */
-        if (reader->info->underflow_enabled) {
+        if (reader->underflow_enabled) {
                 SET_UNIPERIF_ITM_BSET_UNDERFLOW_REC_DONE(reader);
                 SET_UNIPERIF_ITM_BSET_UNDERFLOW_REC_FAILED(reader);
         }
@@ -394,41 +395,6 @@ static void uni_reader_shutdown(struct snd_pcm_substream *substream,
         }
 }
 
-static int uni_reader_parse_dt(struct platform_device *pdev,
-                               struct uniperif *reader)
-{
-        struct uniperif_info *info;
-        struct device_node *node = pdev->dev.of_node;
-        const char *mode;
-
-        /* Allocate memory for the info structure */
-        info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
-        if (!info)
-                return -ENOMEM;
-
-        if (of_property_read_u32(node, "st,version", &reader->ver) ||
-            reader->ver == SND_ST_UNIPERIF_VERSION_UNKNOWN) {
-                dev_err(&pdev->dev, "Unknown uniperipheral version ");
-                return -EINVAL;
-        }
-
-        /* Read the device mode property */
-        if (of_property_read_string(node, "st,mode", &mode)) {
-                dev_err(&pdev->dev, "uniperipheral mode not defined");
-                return -EINVAL;
-        }
-
-        if (strcasecmp(mode, "tdm") == 0)
-                info->type = SND_ST_UNIPERIF_TYPE_TDM;
-        else
-                info->type = SND_ST_UNIPERIF_TYPE_PCM;
-
-        /* Save the info structure */
-        reader->info = info;
-
-        return 0;
-}
-
 static const struct snd_soc_dai_ops uni_reader_dai_ops = {
                 .startup = uni_reader_startup,
                 .shutdown = uni_reader_shutdown,
@@ -448,12 +414,6 @@ int uni_reader_init(struct platform_device *pdev,
         reader->state = UNIPERIF_STATE_STOPPED;
         reader->dai_ops = &uni_reader_dai_ops;
 
-        ret = uni_reader_parse_dt(pdev, reader);
-        if (ret < 0) {
-                dev_err(reader->dev, "Failed to parse DeviceTree");
-                return ret;
-        }
-
         if (UNIPERIF_TYPE_IS_TDM(reader))
                 reader->hw = &uni_tdm_hw;
         else
diff --git a/sound/soc/sunxi/Kconfig b/sound/soc/sunxi/Kconfig
index 2a954bd01fd8..dd2368297fd3 100644
--- a/sound/soc/sunxi/Kconfig
+++ b/sound/soc/sunxi/Kconfig
@@ -1,4 +1,5 @@
 menu "Allwinner SoC Audio support"
+        depends on ARCH_SUNXI || COMPILE_TEST
 
 config SND_SUN4I_CODEC
         tristate "Allwinner A10 Codec Support"
diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c
index 44f170c73b06..e047ec06d538 100644
--- a/sound/soc/sunxi/sun4i-codec.c
+++ b/sound/soc/sunxi/sun4i-codec.c
@@ -96,8 +96,8 @@
 /* Other various ADC registers */
 #define SUN4I_CODEC_DAC_TXCNT                   (0x30)
 #define SUN4I_CODEC_ADC_RXCNT                   (0x34)
-#define SUN4I_CODEC_AC_SYS_VERI                 (0x38)
-#define SUN4I_CODEC_AC_MIC_PHONE_CAL            (0x3c)
+#define SUN7I_CODEC_AC_DAC_CAL                  (0x38)
+#define SUN7I_CODEC_AC_MIC_PHONE_CAL            (0x3c)
 
 struct sun4i_codec {
         struct device   *dev;
@@ -509,7 +509,7 @@ static const struct snd_kcontrol_new sun4i_codec_pa_mute =
 
 static DECLARE_TLV_DB_SCALE(sun4i_codec_pa_volume_scale, -6300, 100, 1);
 
-static const struct snd_kcontrol_new sun4i_codec_widgets[] = {
+static const struct snd_kcontrol_new sun4i_codec_controls[] = {
         SOC_SINGLE_TLV("Power Amplifier Volume", SUN4I_CODEC_DAC_ACTL,
                        SUN4I_CODEC_DAC_ACTL_PA_VOL, 0x3F, 0,
                        sun4i_codec_pa_volume_scale),
@@ -628,12 +628,14 @@ static const struct snd_soc_dapm_route sun4i_codec_codec_dapm_routes[] = {
 };
 
 static struct snd_soc_codec_driver sun4i_codec_codec = {
-        .controls               = sun4i_codec_widgets,
-        .num_controls           = ARRAY_SIZE(sun4i_codec_widgets),
-        .dapm_widgets           = sun4i_codec_codec_dapm_widgets,
-        .num_dapm_widgets       = ARRAY_SIZE(sun4i_codec_codec_dapm_widgets),
-        .dapm_routes            = sun4i_codec_codec_dapm_routes,
-        .num_dapm_routes        = ARRAY_SIZE(sun4i_codec_codec_dapm_routes),
+        .component_driver = {
+                .controls               = sun4i_codec_controls,
+                .num_controls           = ARRAY_SIZE(sun4i_codec_controls),
+                .dapm_widgets           = sun4i_codec_codec_dapm_widgets,
+                .num_dapm_widgets       = ARRAY_SIZE(sun4i_codec_codec_dapm_widgets),
+                .dapm_routes            = sun4i_codec_codec_dapm_routes,
+                .num_dapm_routes        = ARRAY_SIZE(sun4i_codec_codec_dapm_routes),
+        },
 };
 
 static const struct snd_soc_component_driver sun4i_codec_component = {
@@ -680,12 +682,37 @@ static const struct regmap_config sun4i_codec_regmap_config = {
         .reg_bits       = 32,
         .reg_stride     = 4,
         .val_bits       = 32,
-        .max_register   = SUN4I_CODEC_AC_MIC_PHONE_CAL,
+        .max_register   = SUN4I_CODEC_ADC_RXCNT,
+};
+
+static const struct regmap_config sun7i_codec_regmap_config = {
+        .reg_bits       = 32,
+        .reg_stride     = 4,
+        .val_bits       = 32,
+        .max_register   = SUN7I_CODEC_AC_MIC_PHONE_CAL,
+};
+
+struct sun4i_codec_quirks {
+        const struct regmap_config *regmap_config;
+};
+
+static const struct sun4i_codec_quirks sun4i_codec_quirks = {
+        .regmap_config = &sun4i_codec_regmap_config,
+};
+
+static const struct sun4i_codec_quirks sun7i_codec_quirks = {
+        .regmap_config = &sun7i_codec_regmap_config,
 };
 
 static const struct of_device_id sun4i_codec_of_match[] = {
-        { .compatible = "allwinner,sun4i-a10-codec" },
-        { .compatible = "allwinner,sun7i-a20-codec" },
+        {
+                .compatible = "allwinner,sun4i-a10-codec",
+                .data = &sun4i_codec_quirks,
+        },
+        {
+                .compatible = "allwinner,sun7i-a20-codec",
+                .data = &sun7i_codec_quirks,
+        },
         {}
 };
 MODULE_DEVICE_TABLE(of, sun4i_codec_of_match);
@@ -758,6 +785,7 @@ static int sun4i_codec_probe(struct platform_device *pdev)
 {
         struct snd_soc_card *card;
         struct sun4i_codec *scodec;
+        const struct sun4i_codec_quirks *quirks;
         struct resource *res;
         void __iomem *base;
         int ret;
@@ -775,8 +803,14 @@ static int sun4i_codec_probe(struct platform_device *pdev)
                 return PTR_ERR(base);
         }
 
+        quirks = of_device_get_match_data(&pdev->dev);
+        if (quirks == NULL) {
+                dev_err(&pdev->dev, "Failed to determine the quirks to use\n");
+                return -ENODEV;
+        }
+
         scodec->regmap = devm_regmap_init_mmio(&pdev->dev, base,
-                                             &sun4i_codec_regmap_config);
+                                               quirks->regmap_config);
         if (IS_ERR(scodec->regmap)) {
                 dev_err(&pdev->dev, "Failed to create our regmap\n");
                 return PTR_ERR(scodec->regmap);
diff --git a/sound/soc/sunxi/sun4i-spdif.c b/sound/soc/sunxi/sun4i-spdif.c
index 0b04fb02125c..88fbb3a1e660 100644
--- a/sound/soc/sunxi/sun4i-spdif.c
+++ b/sound/soc/sunxi/sun4i-spdif.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
+#include <linux/reset.h>
 #include <sound/dmaengine_pcm.h>
 #include <sound/pcm_params.h>
 #include <sound/soc.h>
@@ -162,6 +163,7 @@ struct sun4i_spdif_dev {
         struct platform_device *pdev;
         struct clk *spdif_clk;
         struct clk *apb_clk;
+        struct reset_control *rst;
         struct snd_soc_dai_driver cpu_dai_drv;
         struct regmap *regmap;
         struct snd_dmaengine_dai_dma_data dma_params_tx;
@@ -411,6 +413,7 @@ static const struct snd_soc_dapm_route dit_routes[] = {
 
 static const struct of_device_id sun4i_spdif_of_match[] = {
         { .compatible = "allwinner,sun4i-a10-spdif", },
+        { .compatible = "allwinner,sun6i-a31-spdif", },
         { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, sun4i_spdif_of_match);
@@ -482,11 +485,23 @@ static int sun4i_spdif_probe(struct platform_device *pdev)
         }
 
         host->dma_params_tx.addr = res->start + SUN4I_SPDIF_TXFIFO;
-        host->dma_params_tx.maxburst = 4;
+        host->dma_params_tx.maxburst = 8;
         host->dma_params_tx.addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
 
         platform_set_drvdata(pdev, host);
 
+        if (of_device_is_compatible(pdev->dev.of_node,
+                                    "allwinner,sun6i-a31-spdif")) {
+                host->rst = devm_reset_control_get_optional(&pdev->dev, NULL);
+                if (IS_ERR(host->rst) && PTR_ERR(host->rst) == -EPROBE_DEFER) {
+                        ret = -EPROBE_DEFER;
+                        dev_err(&pdev->dev, "Failed to get reset: %d\n", ret);
+                        goto err_disable_apb_clk;
+                }
+                if (!IS_ERR(host->rst))
+                        reset_control_deassert(host->rst);
+        }
+
         ret = devm_snd_soc_register_component(&pdev->dev,
                                 &sun4i_spdif_component, &sun4i_spdif_dai, 1);
         if (ret)
diff --git a/sound/soc/tegra/Kconfig b/sound/soc/tegra/Kconfig
index a6768f832c6f..efbe8d4c019e 100644
--- a/sound/soc/tegra/Kconfig
+++ b/sound/soc/tegra/Kconfig
@@ -138,3 +138,14 @@ config SND_SOC_TEGRA_RT5677
         help
           Say Y or M here if you want to add support for SoC audio on Tegra
           boards using the RT5677 codec, such as Ryu.
+
+config SND_SOC_TEGRA_SGTL5000
+        tristate "SoC Audio support for Tegra boards using a SGTL5000 codec"
+        depends on SND_SOC_TEGRA && I2C && GPIOLIB
+        select SND_SOC_TEGRA20_I2S if ARCH_TEGRA_2x_SOC
+        select SND_SOC_TEGRA30_I2S if ARCH_TEGRA_3x_SOC
+        select SND_SOC_SGTL5000
+        help
+          Say Y or M here if you want to add support for SoC audio on Tegra
+          boards using the SGTL5000 codec, such as Apalis T30, Apalis TK1 or
+          Colibri T30.
diff --git a/sound/soc/tegra/Makefile b/sound/soc/tegra/Makefile
index 9171655ad843..f214a3fd0024 100644
--- a/sound/soc/tegra/Makefile
+++ b/sound/soc/tegra/Makefile
@@ -26,6 +26,7 @@ snd-soc-tegra-wm9712-objs := tegra_wm9712.o
 snd-soc-tegra-trimslice-objs := trimslice.o
 snd-soc-tegra-alc5632-objs := tegra_alc5632.o
 snd-soc-tegra-max98090-objs := tegra_max98090.o
+snd-soc-tegra-sgtl5000-objs := tegra_sgtl5000.o
 
 obj-$(CONFIG_SND_SOC_TEGRA_RT5640) += snd-soc-tegra-rt5640.o
 obj-$(CONFIG_SND_SOC_TEGRA_RT5677) += snd-soc-tegra-rt5677.o
@@ -35,3 +36,4 @@ obj-$(CONFIG_SND_SOC_TEGRA_WM9712) += snd-soc-tegra-wm9712.o
 obj-$(CONFIG_SND_SOC_TEGRA_TRIMSLICE) += snd-soc-tegra-trimslice.o
 obj-$(CONFIG_SND_SOC_TEGRA_ALC5632) += snd-soc-tegra-alc5632.o
 obj-$(CONFIG_SND_SOC_TEGRA_MAX98090) += snd-soc-tegra-max98090.o
+obj-$(CONFIG_SND_SOC_TEGRA_SGTL5000) += snd-soc-tegra-sgtl5000.o
\ No newline at end of file
diff --git a/sound/soc/tegra/tegra_rt5640.c b/sound/soc/tegra/tegra_rt5640.c
index 773daecaa5e8..e5ef4e9c4ac5 100644
--- a/sound/soc/tegra/tegra_rt5640.c
+++ b/sound/soc/tegra/tegra_rt5640.c
@@ -1,5 +1,5 @@
 /*
-* tegra_rt5640.c - Tegra machine ASoC driver for boards using WM8903 codec.
+* tegra_rt5640.c - Tegra machine ASoC driver for boards using RT5640 codec.
  *
  * Copyright (c) 2013, NVIDIA CORPORATION.  All rights reserved.
  *
diff --git a/sound/soc/tegra/tegra_sgtl5000.c b/sound/soc/tegra/tegra_sgtl5000.c
new file mode 100644
index 000000000000..1e76869dd488
--- /dev/null
+++ b/sound/soc/tegra/tegra_sgtl5000.c
@@ -0,0 +1,212 @@
+/*
+ * tegra_sgtl5000.c - Tegra machine ASoC driver for boards using SGTL5000 codec
+ *
+ * Author: Marcel Ziswiler <marcel@ziswiler.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ * Based on code copyright/by:
+ *
+ * Copyright (C) 2010-2012 - NVIDIA, Inc.
+ * (c) 2009, 2010 Nvidia Graphics Pvt. Ltd.
+ * Copyright 2007 Wolfson Microelectronics PLC.
+ */
+
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/gpio.h>
+#include <linux/of_gpio.h>
+
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/soc.h>
+
+#include "../codecs/sgtl5000.h"
+
+#include "tegra_asoc_utils.h"
+
+#define DRV_NAME "tegra-snd-sgtl5000"
+
+struct tegra_sgtl5000 {
+        struct tegra_asoc_utils_data util_data;
+};
+
+static int tegra_sgtl5000_hw_params(struct snd_pcm_substream *substream,
+                                        struct snd_pcm_hw_params *params)
+{
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct snd_soc_dai *codec_dai = rtd->codec_dai;
+        struct snd_soc_card *card = rtd->card;
+        struct tegra_sgtl5000 *machine = snd_soc_card_get_drvdata(card);
+        int srate, mclk;
+        int err;
+
+        srate = params_rate(params);
+        switch (srate) {
+        case 11025:
+        case 22050:
+        case 44100:
+        case 88200:
+                mclk = 11289600;
+                break;
+        default:
+                mclk = 12288000;
+                break;
+        }
+
+        err = tegra_asoc_utils_set_rate(&machine->util_data, srate, mclk);
+        if (err < 0) {
+                dev_err(card->dev, "Can't configure clocks\n");
+                return err;
+        }
+
+        err = snd_soc_dai_set_sysclk(codec_dai, SGTL5000_SYSCLK, mclk,
+                                     SND_SOC_CLOCK_IN);
+        if (err < 0) {
+                dev_err(card->dev, "codec_dai clock not set\n");
+                return err;
+        }
+
+        return 0;
+}
+
+static struct snd_soc_ops tegra_sgtl5000_ops = {
+        .hw_params = tegra_sgtl5000_hw_params,
+};
+
+static const struct snd_soc_dapm_widget tegra_sgtl5000_dapm_widgets[] = {
+        SND_SOC_DAPM_HP("Headphone Jack", NULL),
+        SND_SOC_DAPM_LINE("Line In Jack", NULL),
+        SND_SOC_DAPM_MIC("Mic Jack", NULL),
+};
+
+static struct snd_soc_dai_link tegra_sgtl5000_dai = {
+        .name = "sgtl5000",
+        .stream_name = "HiFi",
+        .codec_dai_name = "sgtl5000",
+        .ops = &tegra_sgtl5000_ops,
+        .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF |
+                        SND_SOC_DAIFMT_CBS_CFS,
+};
+
+static struct snd_soc_card snd_soc_tegra_sgtl5000 = {
+        .name = "tegra-sgtl5000",
+        .owner = THIS_MODULE,
+        .dai_link = &tegra_sgtl5000_dai,
+        .num_links = 1,
+        .dapm_widgets = tegra_sgtl5000_dapm_widgets,
+        .num_dapm_widgets = ARRAY_SIZE(tegra_sgtl5000_dapm_widgets),
+        .fully_routed = true,
+};
+
+static int tegra_sgtl5000_driver_probe(struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        struct snd_soc_card *card = &snd_soc_tegra_sgtl5000;
+        struct tegra_sgtl5000 *machine;
+        int ret;
+
+        machine = devm_kzalloc(&pdev->dev, sizeof(struct tegra_sgtl5000),
+                               GFP_KERNEL);
+        if (!machine) {
+                dev_err(&pdev->dev, "Can't allocate tegra_sgtl5000 struct\n");
+                return -ENOMEM;
+        }
+
+        card->dev = &pdev->dev;
+        platform_set_drvdata(pdev, card);
+        snd_soc_card_set_drvdata(card, machine);
+
+        ret = snd_soc_of_parse_card_name(card, "nvidia,model");
+        if (ret)
+                goto err;
+
+        ret = snd_soc_of_parse_audio_routing(card, "nvidia,audio-routing");
+        if (ret)
+                goto err;
+
+        tegra_sgtl5000_dai.codec_of_node = of_parse_phandle(np,
+                        "nvidia,audio-codec", 0);
+        if (!tegra_sgtl5000_dai.codec_of_node) {
+                dev_err(&pdev->dev,
+                        "Property 'nvidia,audio-codec' missing or invalid\n");
+                ret = -EINVAL;
+                goto err;
+        }
+
+        tegra_sgtl5000_dai.cpu_of_node = of_parse_phandle(np,
+                        "nvidia,i2s-controller", 0);
+        if (!tegra_sgtl5000_dai.cpu_of_node) {
+                dev_err(&pdev->dev,
+                        "Property 'nvidia,i2s-controller' missing/invalid\n");
+                ret = -EINVAL;
+                goto err;
+        }
+
+        tegra_sgtl5000_dai.platform_of_node = tegra_sgtl5000_dai.cpu_of_node;
+
+        ret = tegra_asoc_utils_init(&machine->util_data, &pdev->dev);
+        if (ret)
+                goto err;
+
+        ret = snd_soc_register_card(card);
+        if (ret) {
+                dev_err(&pdev->dev, "snd_soc_register_card failed (%d)\n",
+                        ret);
+                goto err_fini_utils;
+        }
+
+        return 0;
+
+err_fini_utils:
+        tegra_asoc_utils_fini(&machine->util_data);
+err:
+        return ret;
+}
+
+static int tegra_sgtl5000_driver_remove(struct platform_device *pdev)
+{
+        struct snd_soc_card *card = platform_get_drvdata(pdev);
+        struct tegra_sgtl5000 *machine = snd_soc_card_get_drvdata(card);
+        int ret;
+
+        ret = snd_soc_unregister_card(card);
+
+        tegra_asoc_utils_fini(&machine->util_data);
+
+        return ret;
+}
+
+static const struct of_device_id tegra_sgtl5000_of_match[] = {
+        { .compatible = "nvidia,tegra-audio-sgtl5000", },
+        { /* sentinel */ },
+};
+
+static struct platform_driver tegra_sgtl5000_driver = {
+        .driver = {
+                .name = DRV_NAME,
+                .pm = &snd_soc_pm_ops,
+                .of_match_table = tegra_sgtl5000_of_match,
+        },
+        .probe = tegra_sgtl5000_driver_probe,
+        .remove = tegra_sgtl5000_driver_remove,
+};
+module_platform_driver(tegra_sgtl5000_driver);
+
+MODULE_AUTHOR("Marcel Ziswiler <marcel@ziswiler.com>");
+MODULE_DESCRIPTION("Tegra SGTL5000 machine ASoC driver");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:" DRV_NAME);
+MODULE_DEVICE_TABLE(of, tegra_sgtl5000_of_match);
diff --git a/sound/soc/ux500/ux500_msp_dai.c b/sound/soc/ux500/ux500_msp_dai.c
index 6d5698b25bd4..b343efd9be5b 100644
--- a/sound/soc/ux500/ux500_msp_dai.c
+++ b/sound/soc/ux500/ux500_msp_dai.c
@@ -187,7 +187,7 @@ static int setup_clocking(struct snd_soc_dai *dai,
 
         default:
                 dev_err(dai->dev,
-                        "%s: Error: Unsopported inversion (fmt = 0x%x)!\n",
+                        "%s: Error: Unsupported inversion (fmt = 0x%x)!\n",
                         __func__, fmt);
 
                 return -EINVAL;
@@ -218,7 +218,7 @@ static int setup_clocking(struct snd_soc_dai *dai,
                 break;
 
         default:
-                dev_err(dai->dev, "%s: Error: Unsopported master (fmt = 0x%x)!\n",
+                dev_err(dai->dev, "%s: Error: Unsupported master (fmt = 0x%x)!\n",
                         __func__, fmt);
 
                 return -EINVAL;
@@ -374,7 +374,7 @@ static int setup_msp_config(struct snd_pcm_substream *substream,
                 break;
 
         default:
-                dev_err(dai->dev, "%s: Error: Unsopported format (%d)!\n",
+                dev_err(dai->dev, "%s: Error: Unsupported format (%d)!\n",
                         __func__, fmt);
                 return -EINVAL;
         }
diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
index 204cc074adb9..41aa3355e920 100644
--- a/sound/usb/line6/pcm.c
+++ b/sound/usb/line6/pcm.c
@@ -55,7 +55,6 @@ static int snd_line6_impulse_volume_put(struct snd_kcontrol *kcontrol,
                 err = line6_pcm_acquire(line6pcm, LINE6_STREAM_IMPULSE);
                 if (err < 0) {
                         line6pcm->impulse_volume = 0;
-                        line6_pcm_release(line6pcm, LINE6_STREAM_IMPULSE);
                         return err;
                 }
         } else {
@@ -211,7 +210,9 @@ static void line6_stream_stop(struct snd_line6_pcm *line6pcm, int direction,
         spin_lock_irqsave(&pstr->lock, flags);
         clear_bit(type, &pstr->running);
         if (!pstr->running) {
+                spin_unlock_irqrestore(&pstr->lock, flags);
                 line6_unlink_audio_urbs(line6pcm, pstr);
+                spin_lock_irqsave(&pstr->lock, flags);
                 if (direction == SNDRV_PCM_STREAM_CAPTURE) {
                         line6pcm->prev_fbuf = NULL;
                         line6pcm->prev_fsize = 0;
diff --git a/sound/usb/line6/pod.c b/sound/usb/line6/pod.c
index daf81d169a42..45dd34874f43 100644
--- a/sound/usb/line6/pod.c
+++ b/sound/usb/line6/pod.c
@@ -244,8 +244,8 @@ static int pod_set_system_param_int(struct usb_line6_pod *pod, int value,
 static ssize_t serial_number_show(struct device *dev,
                                   struct device_attribute *attr, char *buf)
 {
-        struct usb_interface *interface = to_usb_interface(dev);
-        struct usb_line6_pod *pod = usb_get_intfdata(interface);
+        struct snd_card *card = dev_to_snd_card(dev);
+        struct usb_line6_pod *pod = card->private_data;
 
         return sprintf(buf, "%u\n", pod->serial_number);
 }
@@ -256,8 +256,8 @@ static ssize_t serial_number_show(struct device *dev,
 static ssize_t firmware_version_show(struct device *dev,
                                      struct device_attribute *attr, char *buf)
 {
-        struct usb_interface *interface = to_usb_interface(dev);
-        struct usb_line6_pod *pod = usb_get_intfdata(interface);
+        struct snd_card *card = dev_to_snd_card(dev);
+        struct usb_line6_pod *pod = card->private_data;
 
         return sprintf(buf, "%d.%02d\n", pod->firmware_version / 100,
                        pod->firmware_version % 100);
@@ -269,8 +269,8 @@ static ssize_t firmware_version_show(struct device *dev,
 static ssize_t device_id_show(struct device *dev,
                               struct device_attribute *attr, char *buf)
 {
-        struct usb_interface *interface = to_usb_interface(dev);
-        struct usb_line6_pod *pod = usb_get_intfdata(interface);
+        struct snd_card *card = dev_to_snd_card(dev);
+        struct usb_line6_pod *pod = card->private_data;
 
         return sprintf(buf, "%d\n", pod->device_id);
 }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 6adde457b602..152292e5ee2b 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1128,6 +1128,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
 {
         /* devices which do not support reading the sample rate. */
         switch (chip->usb_id) {
+        case USB_ID(0x041E, 0x4080): /* Creative Live Cam VF0610 */
         case USB_ID(0x045E, 0x075D): /* MS Lifecam Cinema  */
         case USB_ID(0x045E, 0x076D): /* MS Lifecam HD-5000 */
         case USB_ID(0x045E, 0x076E): /* MS Lifecam HD-5001 */
@@ -1138,7 +1139,9 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
         case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
+        case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */
         case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
+        case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */
         case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */
         case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
         case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h
index f209ea151dca..3051f86a9b5f 100644
--- a/tools/arch/arm64/include/uapi/asm/kvm.h
+++ b/tools/arch/arm64/include/uapi/asm/kvm.h
@@ -87,9 +87,11 @@ struct kvm_regs {
 /* Supported VGICv3 address types  */
 #define KVM_VGIC_V3_ADDR_TYPE_DIST      2
 #define KVM_VGIC_V3_ADDR_TYPE_REDIST    3
+#define KVM_VGIC_ITS_ADDR_TYPE          4
 
 #define KVM_VGIC_V3_DIST_SIZE           SZ_64K
 #define KVM_VGIC_V3_REDIST_SIZE         (2 * SZ_64K)
+#define KVM_VGIC_V3_ITS_SIZE            (2 * SZ_64K)
 
 #define KVM_ARM_VCPU_POWER_OFF          0 /* CPU is started in OFF state */
 #define KVM_ARM_VCPU_EL1_32BIT          1 /* CPU running a 32bit VM */
diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h
index 3b8e99ef9d58..a2ffec4139ad 100644
--- a/tools/arch/s390/include/uapi/asm/kvm.h
+++ b/tools/arch/s390/include/uapi/asm/kvm.h
@@ -93,6 +93,47 @@ struct kvm_s390_vm_cpu_machine {
         __u64 fac_list[256];
 };
 
+#define KVM_S390_VM_CPU_PROCESSOR_FEAT  2
+#define KVM_S390_VM_CPU_MACHINE_FEAT    3
+
+#define KVM_S390_VM_CPU_FEAT_NR_BITS    1024
+#define KVM_S390_VM_CPU_FEAT_ESOP       0
+#define KVM_S390_VM_CPU_FEAT_SIEF2      1
+#define KVM_S390_VM_CPU_FEAT_64BSCAO    2
+#define KVM_S390_VM_CPU_FEAT_SIIF       3
+#define KVM_S390_VM_CPU_FEAT_GPERE      4
+#define KVM_S390_VM_CPU_FEAT_GSLS       5
+#define KVM_S390_VM_CPU_FEAT_IB         6
+#define KVM_S390_VM_CPU_FEAT_CEI        7
+#define KVM_S390_VM_CPU_FEAT_IBS        8
+#define KVM_S390_VM_CPU_FEAT_SKEY       9
+#define KVM_S390_VM_CPU_FEAT_CMMA       10
+#define KVM_S390_VM_CPU_FEAT_PFMFI      11
+#define KVM_S390_VM_CPU_FEAT_SIGPIF     12
+struct kvm_s390_vm_cpu_feat {
+        __u64 feat[16];
+};
+
+#define KVM_S390_VM_CPU_PROCESSOR_SUBFUNC       4
+#define KVM_S390_VM_CPU_MACHINE_SUBFUNC         5
+/* for "test bit" instructions MSB 0 bit ordering, for "query" raw blocks */
+struct kvm_s390_vm_cpu_subfunc {
+        __u8 plo[32];           /* always */
+        __u8 ptff[16];          /* with TOD-clock steering */
+        __u8 kmac[16];          /* with MSA */
+        __u8 kmc[16];           /* with MSA */
+        __u8 km[16];            /* with MSA */
+        __u8 kimd[16];          /* with MSA */
+        __u8 klmd[16];          /* with MSA */
+        __u8 pckmo[16];         /* with MSA3 */
+        __u8 kmctr[16];         /* with MSA4 */
+        __u8 kmf[16];           /* with MSA4 */
+        __u8 kmo[16];           /* with MSA4 */
+        __u8 pcc[16];           /* with MSA4 */
+        __u8 ppno[16];          /* with MSA5 */
+        __u8 reserved[1824];
+};
+
 /* kvm attributes for crypto */
 #define KVM_S390_VM_CRYPTO_ENABLE_AES_KW        0
 #define KVM_S390_VM_CRYPTO_ENABLE_DEA_KW        1
diff --git a/tools/arch/s390/include/uapi/asm/sie.h b/tools/arch/s390/include/uapi/asm/sie.h
index 8fb5d4a6dd25..3ac634368939 100644
--- a/tools/arch/s390/include/uapi/asm/sie.h
+++ b/tools/arch/s390/include/uapi/asm/sie.h
@@ -140,6 +140,7 @@
         exit_code_ipa0(0xB2, 0x4c, "TAR"),      \
         exit_code_ipa0(0xB2, 0x50, "CSP"),      \
         exit_code_ipa0(0xB2, 0x54, "MVPG"),     \
+        exit_code_ipa0(0xB2, 0x56, "STHYI"),    \
         exit_code_ipa0(0xB2, 0x58, "BSG"),      \
         exit_code_ipa0(0xB2, 0x5a, "BSA"),      \
         exit_code_ipa0(0xB2, 0x5f, "CHSC"),     \
diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h
index 4a413485f9eb..92a8308b96f6 100644
--- a/tools/arch/x86/include/asm/cpufeatures.h
+++ b/tools/arch/x86/include/asm/cpufeatures.h
@@ -225,7 +225,6 @@
 #define X86_FEATURE_RDSEED      ( 9*32+18) /* The RDSEED instruction */
 #define X86_FEATURE_ADX         ( 9*32+19) /* The ADCX and ADOX instructions */
 #define X86_FEATURE_SMAP        ( 9*32+20) /* Supervisor Mode Access Prevention */
-#define X86_FEATURE_PCOMMIT     ( 9*32+22) /* PCOMMIT instruction */
 #define X86_FEATURE_CLFLUSHOPT  ( 9*32+23) /* CLFLUSHOPT instruction */
 #define X86_FEATURE_CLWB        ( 9*32+24) /* CLWB instruction */
 #define X86_FEATURE_AVX512PF    ( 9*32+26) /* AVX-512 Prefetch */
@@ -301,10 +300,6 @@
 #define X86_BUG_FXSAVE_LEAK     X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */
 #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */
 #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */
-#define X86_BUG_NULL_SEG        X86_BUG(9) /* Nulling a selector preserves the base */
-#define X86_BUG_SWAPGS_FENCE    X86_BUG(10) /* SWAPGS without input dep on GS */
-
-
 #ifdef CONFIG_X86_32
 /*
  * 64-bit kernels don't use X86_BUG_ESPFIX.  Make the define conditional
@@ -312,5 +307,7 @@
  */
 #define X86_BUG_ESPFIX          X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */
 #endif
-
+#define X86_BUG_NULL_SEG        X86_BUG(10) /* Nulling a selector preserves the base */
+#define X86_BUG_SWAPGS_FENCE    X86_BUG(11) /* SWAPGS without input dep on GS */
+#define X86_BUG_MONITOR         X86_BUG(12) /* IPI required to wake up remote CPU */
 #endif /* _ASM_X86_CPUFEATURES_H */
diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h
index 911e9358ceb1..85599ad4d024 100644
--- a/tools/arch/x86/include/asm/disabled-features.h
+++ b/tools/arch/x86/include/asm/disabled-features.h
@@ -56,5 +56,7 @@
 #define DISABLED_MASK14 0
 #define DISABLED_MASK15 0
 #define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE)
+#define DISABLED_MASK17 0
+#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
 #endif /* _ASM_X86_DISABLED_FEATURES_H */
diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h
index 4916144e3c42..fac9a5c0abe9 100644
--- a/tools/arch/x86/include/asm/required-features.h
+++ b/tools/arch/x86/include/asm/required-features.h
@@ -99,5 +99,7 @@
 #define REQUIRED_MASK14 0
 #define REQUIRED_MASK15 0
 #define REQUIRED_MASK16 0
+#define REQUIRED_MASK17 0
+#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18)
 
 #endif /* _ASM_X86_REQUIRED_FEATURES_H */
diff --git a/tools/arch/x86/include/uapi/asm/vmx.h b/tools/arch/x86/include/uapi/asm/vmx.h
index 5b15d94a33f8..37fee272618f 100644
--- a/tools/arch/x86/include/uapi/asm/vmx.h
+++ b/tools/arch/x86/include/uapi/asm/vmx.h
@@ -78,7 +78,6 @@
 #define EXIT_REASON_PML_FULL            62
 #define EXIT_REASON_XSAVES              63
 #define EXIT_REASON_XRSTORS             64
-#define EXIT_REASON_PCOMMIT             65
 
 #define VMX_EXIT_REASONS \
         { EXIT_REASON_EXCEPTION_NMI,         "EXCEPTION_NMI" }, \
@@ -127,8 +126,7 @@
         { EXIT_REASON_INVVPID,               "INVVPID" }, \
         { EXIT_REASON_INVPCID,               "INVPCID" }, \
         { EXIT_REASON_XSAVES,                "XSAVES" }, \
-        { EXIT_REASON_XRSTORS,               "XRSTORS" }, \
-        { EXIT_REASON_PCOMMIT,               "PCOMMIT" }
+        { EXIT_REASON_XRSTORS,               "XRSTORS" }
 
 #define VMX_ABORT_SAVE_GUEST_MSR_FAIL        1
 #define VMX_ABORT_LOAD_HOST_MSR_FAIL         4
diff --git a/tools/gpio/gpio-event-mon.c b/tools/gpio/gpio-event-mon.c
index 448ed96b3b4f..1c14c2595158 100644
--- a/tools/gpio/gpio-event-mon.c
+++ b/tools/gpio/gpio-event-mon.c
@@ -1,5 +1,5 @@
 /*
- * gpio-hammer - example swiss army knife to shake GPIO lines on a system
+ * gpio-event-mon - monitor GPIO line events from userspace
  *
  * Copyright (C) 2016 Linus Walleij
  *
diff --git a/tools/iio/iio_generic_buffer.c b/tools/iio/iio_generic_buffer.c
index 0e8a1f7a292d..f39c0e9c0d5c 100644
--- a/tools/iio/iio_generic_buffer.c
+++ b/tools/iio/iio_generic_buffer.c
@@ -348,7 +348,7 @@ int main(int argc, char **argv)
         int notrigger = 0;
         char *dummy;
 
-        struct iio_channel_info *channels;
+        struct iio_channel_info *channels = NULL;
 
         register_cleanup();
 
@@ -456,7 +456,7 @@ int main(int argc, char **argv)
 
         if (notrigger) {
                 printf("trigger-less mode selected\n");
-        } if (trig_num >= 0) {
+        } else if (trig_num >= 0) {
                 char *trig_dev_name;
                 ret = asprintf(&trig_dev_name, "%strigger%d", iio_dir, trig_num);
                 if (ret < 0) {
diff --git a/tools/include/linux/string.h b/tools/include/linux/string.h
index b96879477311..f436d2420a18 100644
--- a/tools/include/linux/string.h
+++ b/tools/include/linux/string.h
@@ -8,7 +8,11 @@ void *memdup(const void *src, size_t len);
 
 int strtobool(const char *s, bool *res);
 
-#ifdef __GLIBC__
+/*
+ * glibc based builds needs the extern while uClibc doesn't.
+ * However uClibc headers also define __GLIBC__ hence the hack below
+ */
+#if defined(__GLIBC__) && !defined(__UCLIBC__)
 extern size_t strlcpy(char *dest, const char *src, size_t size);
 #endif
 
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 406459b935a2..da218fec6056 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -84,6 +84,7 @@ enum bpf_map_type {
         BPF_MAP_TYPE_PERCPU_HASH,
         BPF_MAP_TYPE_PERCPU_ARRAY,
         BPF_MAP_TYPE_STACK_TRACE,
+        BPF_MAP_TYPE_CGROUP_ARRAY,
 };
 
 enum bpf_prog_type {
@@ -93,6 +94,7 @@ enum bpf_prog_type {
         BPF_PROG_TYPE_SCHED_CLS,
         BPF_PROG_TYPE_SCHED_ACT,
         BPF_PROG_TYPE_TRACEPOINT,
+        BPF_PROG_TYPE_XDP,
 };
 
 #define BPF_PSEUDO_MAP_FD       1
@@ -313,6 +315,66 @@ enum bpf_func_id {
          */
         BPF_FUNC_skb_get_tunnel_opt,
         BPF_FUNC_skb_set_tunnel_opt,
+
+        /**
+         * bpf_skb_change_proto(skb, proto, flags)
+         * Change protocol of the skb. Currently supported is
+         * v4 -> v6, v6 -> v4 transitions. The helper will also
+         * resize the skb. eBPF program is expected to fill the
+         * new headers via skb_store_bytes and lX_csum_replace.
+         * @skb: pointer to skb
+         * @proto: new skb->protocol type
+         * @flags: reserved
+         * Return: 0 on success or negative error
+         */
+        BPF_FUNC_skb_change_proto,
+
+        /**
+         * bpf_skb_change_type(skb, type)
+         * Change packet type of skb.
+         * @skb: pointer to skb
+         * @type: new skb->pkt_type type
+         * Return: 0 on success or negative error
+         */
+        BPF_FUNC_skb_change_type,
+
+        /**
+         * bpf_skb_in_cgroup(skb, map, index) - Check cgroup2 membership of skb
+         * @skb: pointer to skb
+         * @map: pointer to bpf_map in BPF_MAP_TYPE_CGROUP_ARRAY type
+         * @index: index of the cgroup in the bpf_map
+         * Return:
+         *   == 0 skb failed the cgroup2 descendant test
+         *   == 1 skb succeeded the cgroup2 descendant test
+         *    < 0 error
+         */
+        BPF_FUNC_skb_in_cgroup,
+
+        /**
+         * bpf_get_hash_recalc(skb)
+         * Retrieve and possibly recalculate skb->hash.
+         * @skb: pointer to skb
+         * Return: hash
+         */
+        BPF_FUNC_get_hash_recalc,
+
+        /**
+         * u64 bpf_get_current_task(void)
+         * Returns current task_struct
+         * Return: current
+         */
+        BPF_FUNC_get_current_task,
+
+        /**
+         * bpf_probe_write_user(void *dst, void *src, int len)
+         * safely attempt to write to a location
+         * @dst: destination address in userspace
+         * @src: source address on stack
+         * @len: number of bytes to copy
+         * Return: 0 on success or negative error
+         */
+        BPF_FUNC_probe_write_user,
+
         __BPF_FUNC_MAX_ID,
 };
 
@@ -347,9 +409,11 @@ enum bpf_func_id {
 #define BPF_F_ZERO_CSUM_TX              (1ULL << 1)
 #define BPF_F_DONT_FRAGMENT             (1ULL << 2)
 
-/* BPF_FUNC_perf_event_output flags. */
+/* BPF_FUNC_perf_event_output and BPF_FUNC_perf_event_read flags. */
 #define BPF_F_INDEX_MASK                0xffffffffULL
 #define BPF_F_CURRENT_CPU               BPF_F_INDEX_MASK
+/* BPF_FUNC_perf_event_output for sk_buff input context. */
+#define BPF_F_CTXLEN_MASK               (0xfffffULL << 32)
 
 /* user accessible mirror of in-kernel sk_buff.
  * new fields can only be added to the end of this structure
@@ -386,4 +450,24 @@ struct bpf_tunnel_key {
         __u32 tunnel_label;
 };
 
+/* User return codes for XDP prog type.
+ * A valid XDP program must return one of these defined values. All other
+ * return codes are reserved for future use. Unknown return codes will result
+ * in packet drop.
+ */
+enum xdp_action {
+        XDP_ABORTED = 0,
+        XDP_DROP,
+        XDP_PASS,
+        XDP_TX,
+};
+
+/* user accessible metadata for XDP packet hook
+ * new fields must be added to the end of this structure
+ */
+struct xdp_md {
+        __u32 data;
+        __u32 data_end;
+};
+
 #endif /* _UAPI__LINUX_BPF_H__ */
diff --git a/tools/lguest/lguest.c b/tools/lguest/lguest.c
index d9836c5eb694..11c8d9bc762e 100644
--- a/tools/lguest/lguest.c
+++ b/tools/lguest/lguest.c
@@ -3266,6 +3266,9 @@ int main(int argc, char *argv[])
                 }
         }
 
+        /* If we exit via err(), this kills all the threads, restores tty. */
+        atexit(cleanup_devices);
+
         /* We always have a console device, and it's always device 1. */
         setup_console();
 
@@ -3369,9 +3372,6 @@ int main(int argc, char *argv[])
         /* Ensure that we terminate if a device-servicing child dies. */
         signal(SIGCHLD, kill_launcher);
 
-        /* If we exit via err(), this kills all the threads, restores tty. */
-        atexit(cleanup_devices);
-
         /* If requested, chroot to a directory */
         if (chroot_path) {
                 if (chroot(chroot_path) != 0)
diff --git a/tools/perf/Documentation/perf-probe.txt b/tools/perf/Documentation/perf-probe.txt
index 736da44596e4..b303bcdd8ed1 100644
--- a/tools/perf/Documentation/perf-probe.txt
+++ b/tools/perf/Documentation/perf-probe.txt
@@ -176,10 +176,18 @@ Each probe argument follows below syntax.
 
 'NAME' specifies the name of this argument (optional). You can use the name of local variable, local data structure member (e.g. var->field, var.field2), local array with fixed index (e.g. array[1], var->array[0], var->pointer[2]), or kprobe-tracer argument format (e.g. $retval, %ax, etc). Note that the name of this argument will be set as the last member name if you specify a local data structure member (e.g. field2 for 'var->field1.field2'.)
 '$vars' and '$params' special arguments are also available for NAME, '$vars' is expanded to the local variables (including function parameters) which can access at given probe point. '$params' is expanded to only the function parameters.
-'TYPE' casts the type of this argument (optional). If omitted, perf probe automatically set the type based on debuginfo. You can specify 'string' type only for the local variable or structure member which is an array of or a pointer to 'char' or 'unsigned char' type.
+'TYPE' casts the type of this argument (optional). If omitted, perf probe automatically set the type based on debuginfo. Currently, basic types (u8/u16/u32/u64/s8/s16/s32/s64), signedness casting (u/s), "string" and bitfield are supported. (see TYPES for detail)
 
 On x86 systems %REG is always the short form of the register: for example %AX. %RAX or %EAX is not valid.
 
+TYPES
+-----
+Basic types (u8/u16/u32/u64/s8/s16/s32/s64) are integer types. Prefix 's' and 'u' means those types are signed and unsigned respectively. Traced arguments are shown in decimal (signed) or hex (unsigned). You can also use 's' or 'u' to specify only signedness and leave its size auto-detected by perf probe.
+String type is a special type, which fetches a "null-terminated" string from kernel space. This means it will fail and store NULL if the string container has been paged out. You can specify 'string' type only for the local variable or structure member which is an array of or a pointer to 'char' or 'unsigned char' type.
+Bitfield is another special type, which takes 3 parameters, bit-width, bit-offset, and container-size (usually 32). The syntax is;
+
+ b<bit-width>@<bit-offset>/<container-size>
+
 LINE SYNTAX
 -----------
 Line range is described by following syntax.
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index 1f6c70594f0f..053bbbd84ece 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -116,8 +116,8 @@ OPTIONS
 --fields::
         Comma separated list of fields to print. Options are:
         comm, tid, pid, time, cpu, event, trace, ip, sym, dso, addr, symoff,
-        srcline, period, iregs, brstack, brstacksym, flags.
-        Field list can be prepended with the type, trace, sw or hw,
+        srcline, period, iregs, brstack, brstacksym, flags, bpf-output,
+        callindent. Field list can be prepended with the type, trace, sw or hw,
         to indicate to which event type the field list applies.
         e.g., -F sw:comm,tid,time,ip,sym  and -F trace:time,cpu,trace
 
diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c
index c6d0f91731a1..35745a733100 100644
--- a/tools/perf/arch/powerpc/util/sym-handling.c
+++ b/tools/perf/arch/powerpc/util/sym-handling.c
@@ -54,10 +54,6 @@ int arch__compare_symbol_names(const char *namea, const char *nameb)
 #endif
 
 #if defined(_CALL_ELF) && _CALL_ELF == 2
-bool arch__prefers_symtab(void)
-{
-        return true;
-}
 
 #ifdef HAVE_LIBELF_SUPPORT
 void arch__sym_update(struct symbol *s, GElf_Sym *sym)
@@ -100,4 +96,29 @@ void arch__fix_tev_from_maps(struct perf_probe_event *pev,
                         tev->point.offset += lep_offset;
         }
 }
+
+#ifdef HAVE_LIBELF_SUPPORT
+void arch__post_process_probe_trace_events(struct perf_probe_event *pev,
+                                           int ntevs)
+{
+        struct probe_trace_event *tev;
+        struct map *map;
+        struct symbol *sym = NULL;
+        struct rb_node *tmp;
+        int i = 0;
+
+        map = get_target_map(pev->target, pev->uprobes);
+        if (!map || map__load(map, NULL) < 0)
+                return;
+
+        for (i = 0; i < ntevs; i++) {
+                tev = &pev->tevs[i];
+                map__for_each_symbol(map, sym, tmp) {
+                        if (map->unmap_ip(map, sym->start) == tev->point.address)
+                                arch__fix_tev_from_maps(pev, tev, map, sym);
+                }
+        }
+}
+#endif /* HAVE_LIBELF_SUPPORT */
+
 #endif
diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c
index fb51457ba338..a2412e9d883b 100644
--- a/tools/perf/arch/x86/util/intel-pt.c
+++ b/tools/perf/arch/x86/util/intel-pt.c
@@ -501,7 +501,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
         struct intel_pt_recording *ptr =
                         container_of(itr, struct intel_pt_recording, itr);
         struct perf_pmu *intel_pt_pmu = ptr->intel_pt_pmu;
-        bool have_timing_info;
+        bool have_timing_info, need_immediate = false;
         struct perf_evsel *evsel, *intel_pt_evsel = NULL;
         const struct cpu_map *cpus = evlist->cpus;
         bool privileged = geteuid() == 0 || perf_event_paranoid() < 0;
@@ -655,6 +655,7 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
                                 ptr->have_sched_switch = 3;
                         } else {
                                 opts->record_switch_events = true;
+                                need_immediate = true;
                                 if (cpu_wide)
                                         ptr->have_sched_switch = 3;
                                 else
@@ -700,6 +701,9 @@ static int intel_pt_recording_options(struct auxtrace_record *itr,
                 tracking_evsel->attr.freq = 0;
                 tracking_evsel->attr.sample_period = 1;
 
+                if (need_immediate)
+                        tracking_evsel->immediate = true;
+
                 /* In per-cpu case, always need the time of mmap events etc */
                 if (!cpu_map__empty(cpus)) {
                         perf_evsel__set_sample_bit(tracking_evsel, TIME);
diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
index d608a2c9e48c..d1ce29be560e 100644
--- a/tools/perf/builtin-mem.c
+++ b/tools/perf/builtin-mem.c
@@ -88,6 +88,9 @@ static int __cmd_record(int argc, const char **argv, struct perf_mem *mem)
         if (mem->operation & MEM_OPERATION_LOAD)
                 perf_mem_events[PERF_MEM_EVENTS__LOAD].record = true;
 
+        if (mem->operation & MEM_OPERATION_STORE)
+                perf_mem_events[PERF_MEM_EVENTS__STORE].record = true;
+
         if (perf_mem_events[PERF_MEM_EVENTS__LOAD].record)
                 rec_argv[i++] = "-W";
 
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 971ff91b16cb..c859e59dfe3e 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -371,14 +371,16 @@ static int perf_session__check_output_opt(struct perf_session *session)
 
         if (!no_callchain) {
                 bool use_callchain = false;
+                bool not_pipe = false;
 
                 evlist__for_each_entry(session->evlist, evsel) {
+                        not_pipe = true;
                         if (evsel->attr.sample_type & PERF_SAMPLE_CALLCHAIN) {
                                 use_callchain = true;
                                 break;
                         }
                 }
-                if (!use_callchain)
+                if (not_pipe && !use_callchain)
                         symbol_conf.use_callchain = false;
         }
 
@@ -1690,8 +1692,13 @@ static int list_available_scripts(const struct option *opt __maybe_unused,
         snprintf(scripts_path, MAXPATHLEN, "%s/scripts", get_argv_exec_path());
 
         scripts_dir = opendir(scripts_path);
-        if (!scripts_dir)
-                return -1;
+        if (!scripts_dir) {
+                fprintf(stdout,
+                        "open(%s) failed.\n"
+                        "Check \"PERF_EXEC_PATH\" env to set scripts dir.\n",
+                        scripts_path);
+                exit(-1);
+        }
 
         for_each_lang(scripts_path, scripts_dir, lang_dirent) {
                 snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path,
@@ -2116,7 +2123,7 @@ int cmd_script(int argc, const char **argv, const char *prefix __maybe_unused)
                      "Valid types: hw,sw,trace,raw. "
                      "Fields: comm,tid,pid,time,cpu,event,trace,ip,sym,dso,"
                      "addr,symoff,period,iregs,brstack,brstacksym,flags,"
-                     "callindent", parse_output_fields),
+                     "bpf-output,callindent", parse_output_fields),
         OPT_BOOLEAN('a', "all-cpus", &system_wide,
                     "system-wide collection from all CPUs"),
         OPT_STRING('S', "symbols", &symbol_conf.sym_list_str, "symbol[,symbol...]",
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 0c16d20d7e32..3c7452b39f57 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -331,7 +331,7 @@ static int read_counter(struct perf_evsel *counter)
         return 0;
 }
 
-static void read_counters(bool close_counters)
+static void read_counters(void)
 {
         struct perf_evsel *counter;
 
@@ -341,11 +341,6 @@ static void read_counters(bool close_counters)
 
                 if (perf_stat_process_counter(&stat_config, counter))
                         pr_warning("failed to process counter %s\n", counter->name);
-
-                if (close_counters) {
-                        perf_evsel__close_fd(counter, perf_evsel__nr_cpus(counter),
-                                             thread_map__nr(evsel_list->threads));
-                }
         }
 }
 
@@ -353,7 +348,7 @@ static void process_interval(void)
 {
         struct timespec ts, rs;
 
-        read_counters(false);
+        read_counters();
 
         clock_gettime(CLOCK_MONOTONIC, &ts);
         diff_timespec(&rs, &ts, &ref_time);
@@ -380,6 +375,17 @@ static void enable_counters(void)
                 perf_evlist__enable(evsel_list);
 }
 
+static void disable_counters(void)
+{
+        /*
+         * If we don't have tracee (attaching to task or cpu), counters may
+         * still be running. To get accurate group ratios, we must stop groups
+         * from counting before reading their constituent counters.
+         */
+        if (!target__none(&target))
+                perf_evlist__disable(evsel_list);
+}
+
 static volatile int workload_exec_errno;
 
 /*
@@ -657,11 +663,20 @@ try_again:
                 }
         }
 
+        disable_counters();
+
         t1 = rdclock();
 
         update_stats(&walltime_nsecs_stats, t1 - t0);
 
-        read_counters(true);
+        /*
+         * Closing a group leader splits the group, and as we only disable
+         * group leaders, results in remaining events becoming enabled. To
+         * avoid arbitrary skew, we must read all counters before closing any
+         * group leaders.
+         */
+        read_counters();
+        perf_evlist__close(evsel_list);
 
         return WEXITSTATUS(status);
 }
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index d9b80ef881cd..21fd573106ed 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -507,17 +507,17 @@ static int __perf_evsel__hw_cache_name(u64 config, char *bf, size_t size)
         u8 op, result, type = (config >>  0) & 0xff;
         const char *err = "unknown-ext-hardware-cache-type";
 
-        if (type > PERF_COUNT_HW_CACHE_MAX)
+        if (type >= PERF_COUNT_HW_CACHE_MAX)
                 goto out_err;
 
         op = (config >>  8) & 0xff;
         err = "unknown-ext-hardware-cache-op";
-        if (op > PERF_COUNT_HW_CACHE_OP_MAX)
+        if (op >= PERF_COUNT_HW_CACHE_OP_MAX)
                 goto out_err;
 
         result = (config >> 16) & 0xff;
         err = "unknown-ext-hardware-cache-result";
-        if (result > PERF_COUNT_HW_CACHE_RESULT_MAX)
+        if (result >= PERF_COUNT_HW_CACHE_RESULT_MAX)
                 goto out_err;
 
         err = "invalid-cache";
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index 9c8f15da86ce..8ff6c6a61291 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -123,8 +123,6 @@ struct intel_pt_decoder {
         bool have_calc_cyc_to_tsc;
         int exec_mode;
         unsigned int insn_bytes;
-        uint64_t sign_bit;
-        uint64_t sign_bits;
         uint64_t period;
         enum intel_pt_period_type period_type;
         uint64_t tot_insn_cnt;
@@ -191,9 +189,6 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params)
         decoder->data               = params->data;
         decoder->return_compression = params->return_compression;
 
-        decoder->sign_bit           = (uint64_t)1 << 47;
-        decoder->sign_bits          = ~(((uint64_t)1 << 48) - 1);
-
         decoder->period             = params->period;
         decoder->period_type        = params->period_type;
 
@@ -362,21 +357,30 @@ int intel_pt__strerror(int code, char *buf, size_t buflen)
         return 0;
 }
 
-static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder,
-                                 const struct intel_pt_pkt *packet,
+static uint64_t intel_pt_calc_ip(const struct intel_pt_pkt *packet,
                                  uint64_t last_ip)
 {
         uint64_t ip;
 
         switch (packet->count) {
-        case 2:
+        case 1:
                 ip = (last_ip & (uint64_t)0xffffffffffff0000ULL) |
                      packet->payload;
                 break;
-        case 4:
+        case 2:
                 ip = (last_ip & (uint64_t)0xffffffff00000000ULL) |
                      packet->payload;
                 break;
+        case 3:
+                ip = packet->payload;
+                /* Sign-extend 6-byte ip */
+                if (ip & (uint64_t)0x800000000000ULL)
+                        ip |= (uint64_t)0xffff000000000000ULL;
+                break;
+        case 4:
+                ip = (last_ip & (uint64_t)0xffff000000000000ULL) |
+                     packet->payload;
+                break;
         case 6:
                 ip = packet->payload;
                 break;
@@ -384,16 +388,12 @@ static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder,
                 return 0;
         }
 
-        if (ip & decoder->sign_bit)
-                return ip | decoder->sign_bits;
-
         return ip;
 }
 
 static inline void intel_pt_set_last_ip(struct intel_pt_decoder *decoder)
 {
-        decoder->last_ip = intel_pt_calc_ip(decoder, &decoder->packet,
-                                            decoder->last_ip);
+        decoder->last_ip = intel_pt_calc_ip(&decoder->packet, decoder->last_ip);
 }
 
 static inline void intel_pt_set_ip(struct intel_pt_decoder *decoder)
@@ -1657,6 +1657,12 @@ next:
         }
 }
 
+static inline bool intel_pt_have_ip(struct intel_pt_decoder *decoder)
+{
+        return decoder->last_ip || decoder->packet.count == 0 ||
+               decoder->packet.count == 3 || decoder->packet.count == 6;
+}
+
 /* Walk PSB+ packets to get in sync. */
 static int intel_pt_walk_psb(struct intel_pt_decoder *decoder)
 {
@@ -1677,8 +1683,7 @@ static int intel_pt_walk_psb(struct intel_pt_decoder *decoder)
 
                 case INTEL_PT_FUP:
                         decoder->pge = true;
-                        if (decoder->last_ip || decoder->packet.count == 6 ||
-                            decoder->packet.count == 0) {
+                        if (intel_pt_have_ip(decoder)) {
                                 uint64_t current_ip = decoder->ip;
 
                                 intel_pt_set_ip(decoder);
@@ -1767,8 +1772,7 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder)
                 case INTEL_PT_TIP_PGE:
                 case INTEL_PT_TIP:
                         decoder->pge = decoder->packet.type != INTEL_PT_TIP_PGD;
-                        if (decoder->last_ip || decoder->packet.count == 6 ||
-                            decoder->packet.count == 0)
+                        if (intel_pt_have_ip(decoder))
                                 intel_pt_set_ip(decoder);
                         if (decoder->ip)
                                 return 0;
@@ -1776,9 +1780,7 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder)
 
                 case INTEL_PT_FUP:
                         if (decoder->overflow) {
-                                if (decoder->last_ip ||
-                                    decoder->packet.count == 6 ||
-                                    decoder->packet.count == 0)
+                                if (intel_pt_have_ip(decoder))
                                         intel_pt_set_ip(decoder);
                                 if (decoder->ip)
                                         return 0;
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
index b1257c816310..4f7b32020487 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c
@@ -292,36 +292,46 @@ static int intel_pt_get_ip(enum intel_pt_pkt_type type, unsigned int byte,
                            const unsigned char *buf, size_t len,
                            struct intel_pt_pkt *packet)
 {
-        switch (byte >> 5) {
+        int ip_len;
+
+        packet->count = byte >> 5;
+
+        switch (packet->count) {
         case 0:
-                packet->count = 0;
+                ip_len = 0;
                 break;
         case 1:
                 if (len < 3)
                         return INTEL_PT_NEED_MORE_BYTES;
-                packet->count = 2;
+                ip_len = 2;
                 packet->payload = le16_to_cpu(*(uint16_t *)(buf + 1));
                 break;
         case 2:
                 if (len < 5)
                         return INTEL_PT_NEED_MORE_BYTES;
-                packet->count = 4;
+                ip_len = 4;
                 packet->payload = le32_to_cpu(*(uint32_t *)(buf + 1));
                 break;
         case 3:
-        case 6:
+        case 4:
                 if (len < 7)
                         return INTEL_PT_NEED_MORE_BYTES;
-                packet->count = 6;
+                ip_len = 6;
                 memcpy_le64(&packet->payload, buf + 1, 6);
                 break;
+        case 6:
+                if (len < 9)
+                        return INTEL_PT_NEED_MORE_BYTES;
+                ip_len = 8;
+                packet->payload = le64_to_cpu(*(uint64_t *)(buf + 1));
+                break;
         default:
                 return INTEL_PT_BAD_PACKET;
         }
 
         packet->type = type;
 
-        return packet->count + 1;
+        return ip_len + 1;
 }
 
 static int intel_pt_get_mode(const unsigned char *buf, size_t len,
diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
index 9f3305f6b6d5..95f0884aae02 100644
--- a/tools/perf/util/jitdump.c
+++ b/tools/perf/util/jitdump.c
@@ -1,3 +1,4 @@
+#include <sys/sysmacros.h>
 #include <sys/types.h>
 #include <stdio.h>
 #include <stdlib.h>
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 953dc1ab2ed7..28733962cd80 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -170,15 +170,17 @@ static struct map *kernel_get_module_map(const char *module)
                 module = "kernel";
 
         for (pos = maps__first(maps); pos; pos = map__next(pos)) {
+                /* short_name is "[module]" */
                 if (strncmp(pos->dso->short_name + 1, module,
-                            pos->dso->short_name_len - 2) == 0) {
+                            pos->dso->short_name_len - 2) == 0 &&
+                    module[pos->dso->short_name_len - 2] == '\0') {
                         return pos;
                 }
         }
         return NULL;
 }
 
-static struct map *get_target_map(const char *target, bool user)
+struct map *get_target_map(const char *target, bool user)
 {
         /* Init maps of given executable or kernel */
         if (user)
@@ -385,7 +387,7 @@ static int find_alternative_probe_point(struct debuginfo *dinfo,
                 if (uprobes)
                         address = sym->start;
                 else
-                        address = map->unmap_ip(map, sym->start);
+                        address = map->unmap_ip(map, sym->start) - map->reloc;
                 break;
         }
         if (!address) {
@@ -664,22 +666,14 @@ static int add_module_to_probe_trace_events(struct probe_trace_event *tevs,
         return ret;
 }
 
-/* Post processing the probe events */
-static int post_process_probe_trace_events(struct probe_trace_event *tevs,
-                                           int ntevs, const char *module,
-                                           bool uprobe)
+static int
+post_process_kernel_probe_trace_events(struct probe_trace_event *tevs,
+                                       int ntevs)
 {
         struct ref_reloc_sym *reloc_sym;
         char *tmp;
         int i, skipped = 0;
 
-        if (uprobe)
-                return add_exec_to_probe_trace_events(tevs, ntevs, module);
-
-        /* Note that currently ref_reloc_sym based probe is not for drivers */
-        if (module)
-                return add_module_to_probe_trace_events(tevs, ntevs, module);
-
         reloc_sym = kernel_get_ref_reloc_sym();
         if (!reloc_sym) {
                 pr_warning("Relocated base symbol is not found!\n");
@@ -711,6 +705,34 @@ static int post_process_probe_trace_events(struct probe_trace_event *tevs,
         return skipped;
 }
 
+void __weak
+arch__post_process_probe_trace_events(struct perf_probe_event *pev __maybe_unused,
+                                      int ntevs __maybe_unused)
+{
+}
+
+/* Post processing the probe events */
+static int post_process_probe_trace_events(struct perf_probe_event *pev,
+                                           struct probe_trace_event *tevs,
+                                           int ntevs, const char *module,
+                                           bool uprobe)
+{
+        int ret;
+
+        if (uprobe)
+                ret = add_exec_to_probe_trace_events(tevs, ntevs, module);
+        else if (module)
+                /* Currently ref_reloc_sym based probe is not for drivers */
+                ret = add_module_to_probe_trace_events(tevs, ntevs, module);
+        else
+                ret = post_process_kernel_probe_trace_events(tevs, ntevs);
+
+        if (ret >= 0)
+                arch__post_process_probe_trace_events(pev, ntevs);
+
+        return ret;
+}
+
 /* Try to find perf_probe_event with debuginfo */
 static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
                                           struct probe_trace_event **tevs)
@@ -749,7 +771,7 @@ static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
 
         if (ntevs > 0) {        /* Succeeded to find trace events */
                 pr_debug("Found %d probe_trace_events.\n", ntevs);
-                ret = post_process_probe_trace_events(*tevs, ntevs,
+                ret = post_process_probe_trace_events(pev, *tevs, ntevs,
                                                 pev->target, pev->uprobes);
                 if (ret < 0 || ret == ntevs) {
                         clear_probe_trace_events(*tevs, ntevs);
@@ -2936,8 +2958,6 @@ errout:
         return err;
 }
 
-bool __weak arch__prefers_symtab(void) { return false; }
-
 /* Concatinate two arrays */
 static void *memcat(void *a, size_t sz_a, void *b, size_t sz_b)
 {
@@ -3158,12 +3178,6 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
         if (ret > 0 || pev->sdt)        /* SDT can be found only in the cache */
                 return ret == 0 ? -ENOENT : ret; /* Found in probe cache */
 
-        if (arch__prefers_symtab() && !perf_probe_event_need_dwarf(pev)) {
-                ret = find_probe_trace_events_from_map(pev, tevs);
-                if (ret > 0)
-                        return ret; /* Found in symbol table */
-        }
-
         /* Convert perf_probe_event with debuginfo */
         ret = try_to_find_probe_trace_events(pev, tevs);
         if (ret != 0)
diff --git a/tools/perf/util/probe-event.h b/tools/perf/util/probe-event.h
index e18ea9fe6385..f4f45db77c1c 100644
--- a/tools/perf/util/probe-event.h
+++ b/tools/perf/util/probe-event.h
@@ -158,7 +158,6 @@ int show_line_range(struct line_range *lr, const char *module, bool user);
 int show_available_vars(struct perf_probe_event *pevs, int npevs,
                         struct strfilter *filter);
 int show_available_funcs(const char *module, struct strfilter *filter, bool user);
-bool arch__prefers_symtab(void);
 void arch__fix_tev_from_maps(struct perf_probe_event *pev,
                              struct probe_trace_event *tev, struct map *map,
                              struct symbol *sym);
@@ -173,4 +172,9 @@ int e_snprintf(char *str, size_t size, const char *format, ...)
 int copy_to_probe_trace_arg(struct probe_trace_arg *tvar,
                             struct perf_probe_arg *pvar);
 
+struct map *get_target_map(const char *target, bool user);
+
+void arch__post_process_probe_trace_events(struct perf_probe_event *pev,
+                                           int ntevs);
+
 #endif /*_PROBE_EVENT_H */
diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c
index 9aed9c332da6..9c3b9ed5b3c3 100644
--- a/tools/perf/util/probe-file.c
+++ b/tools/perf/util/probe-file.c
@@ -133,7 +133,7 @@ int probe_file__open_both(int *kfd, int *ufd, int flag)
 /* Get raw string list of current kprobe_events  or uprobe_events */
 struct strlist *probe_file__get_rawlist(int fd)
 {
-        int ret, idx;
+        int ret, idx, fddup;
         FILE *fp;
         char buf[MAX_CMDLEN];
         char *p;
@@ -143,8 +143,17 @@ struct strlist *probe_file__get_rawlist(int fd)
                 return NULL;
 
         sl = strlist__new(NULL, NULL);
+        if (sl == NULL)
+                return NULL;
+
+        fddup = dup(fd);
+        if (fddup < 0)
+                goto out_free_sl;
+
+        fp = fdopen(fddup, "r");
+        if (!fp)
+                goto out_close_fddup;
 
-        fp = fdopen(dup(fd), "r");
         while (!feof(fp)) {
                 p = fgets(buf, MAX_CMDLEN, fp);
                 if (!p)
@@ -156,13 +165,21 @@ struct strlist *probe_file__get_rawlist(int fd)
                 ret = strlist__add(sl, buf);
                 if (ret < 0) {
                         pr_debug("strlist__add failed (%d)\n", ret);
-                        strlist__delete(sl);
-                        return NULL;
+                        goto out_close_fp;
                 }
         }
         fclose(fp);
 
         return sl;
+
+out_close_fp:
+        fclose(fp);
+        goto out_free_sl;
+out_close_fddup:
+        close(fddup);
+out_free_sl:
+        strlist__delete(sl);
+        return NULL;
 }
 
 static struct strlist *__probe_file__get_namelist(int fd, bool include_group)
@@ -447,12 +464,17 @@ static int probe_cache__load(struct probe_cache *pcache)
 {
         struct probe_cache_entry *entry = NULL;
         char buf[MAX_CMDLEN], *p;
-        int ret = 0;
+        int ret = 0, fddup;
         FILE *fp;
 
-        fp = fdopen(dup(pcache->fd), "r");
-        if (!fp)
+        fddup = dup(pcache->fd);
+        if (fddup < 0)
+                return -errno;
+        fp = fdopen(fddup, "r");
+        if (!fp) {
+                close(fddup);
                 return -EINVAL;
+        }
 
         while (!feof(fp)) {
                 if (!fgets(buf, MAX_CMDLEN, fp))
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index f2d9ff064e2d..5c290c682afe 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -297,10 +297,13 @@ static int convert_variable_type(Dwarf_Die *vr_die,
         char sbuf[STRERR_BUFSIZE];
         int bsize, boffs, total;
         int ret;
+        char sign;
 
         /* TODO: check all types */
-        if (cast && strcmp(cast, "string") != 0) {
+        if (cast && strcmp(cast, "string") != 0 &&
+            strcmp(cast, "s") != 0 && strcmp(cast, "u") != 0) {
                 /* Non string type is OK */
+                /* and respect signedness cast */
                 tvar->type = strdup(cast);
                 return (tvar->type == NULL) ? -ENOMEM : 0;
         }
@@ -361,6 +364,13 @@ static int convert_variable_type(Dwarf_Die *vr_die,
                 return (tvar->type == NULL) ? -ENOMEM : 0;
         }
 
+        if (cast && (strcmp(cast, "u") == 0))
+                sign = 'u';
+        else if (cast && (strcmp(cast, "s") == 0))
+                sign = 's';
+        else
+                sign = die_is_signed_type(&type) ? 's' : 'u';
+
         ret = dwarf_bytesize(&type);
         if (ret <= 0)
                 /* No size ... try to use default type */
@@ -373,8 +383,7 @@ static int convert_variable_type(Dwarf_Die *vr_die,
                         dwarf_diename(&type), MAX_BASIC_TYPE_BITS);
                 ret = MAX_BASIC_TYPE_BITS;
         }
-        ret = snprintf(buf, 16, "%c%d",
-                       die_is_signed_type(&type) ? 's' : 'u', ret);
+        ret = snprintf(buf, 16, "%c%d", sign, ret);
 
 formatted:
         if (ret < 0 || ret >= 16) {
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 947d21f38398..3d3cb8392c86 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -588,7 +588,11 @@ static char *get_trace_output(struct hist_entry *he)
         } else {
                 pevent_event_info(&seq, evsel->tp_format, &rec);
         }
-        return seq.buffer;
+        /*
+         * Trim the buffer, it starts at 4KB and we're not going to
+         * add anything more to this buffer.
+         */
+        return realloc(seq.buffer, seq.len + 1);
 }
 
 static int64_t
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index a34321e9b44d..a811c13a74d6 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -837,7 +837,8 @@ int dso__load_sym(struct dso *dso, struct map *map,
         sec = syms_ss->symtab;
         shdr = syms_ss->symshdr;
 
-        if (elf_section_by_name(elf, &ehdr, &tshdr, ".text", NULL))
+        if (elf_section_by_name(runtime_ss->elf, &runtime_ss->ehdr, &tshdr,
+                                ".text", NULL))
                 dso->text_offset = tshdr.sh_addr - tshdr.sh_offset;
 
         if (runtime_ss->opdsec)
diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index cf5e250bc78e..783a53fb7a4e 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -66,7 +66,7 @@ static int entry(u64 ip, struct unwind_info *ui)
         if (__report_module(&al, ip, ui))
                 return -1;
 
-        e->ip  = ip;
+        e->ip  = al.addr;
         e->map = al.map;
         e->sym = al.sym;
 
diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c
index 97c0f8fc5561..20c2e5743903 100644
--- a/tools/perf/util/unwind-libunwind-local.c
+++ b/tools/perf/util/unwind-libunwind-local.c
@@ -542,7 +542,7 @@ static int entry(u64 ip, struct thread *thread,
         thread__find_addr_location(thread, PERF_RECORD_MISC_USER,
                                    MAP__FUNCTION, ip, &al);
 
-        e.ip = ip;
+        e.ip = al.addr;
         e.map = al.map;
         e.sym = al.sym;
 
diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c
index 5404efa578a3..dd48f421844c 100644
--- a/tools/testing/nvdimm/test/nfit.c
+++ b/tools/testing/nvdimm/test/nfit.c
@@ -13,6 +13,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
+#include <linux/workqueue.h>
 #include <linux/libnvdimm.h>
 #include <linux/vmalloc.h>
 #include <linux/device.h>
@@ -1474,6 +1475,7 @@ static int nfit_test_probe(struct platform_device *pdev)
         if (nfit_test->setup != nfit_test0_setup)
                 return 0;
 
+        flush_work(&acpi_desc->work);
         nfit_test->setup_hotplug = 1;
         nfit_test->setup(nfit_test);
 
diff --git a/tools/testing/radix-tree/Makefile b/tools/testing/radix-tree/Makefile
index 3b530467148e..9d0919ed52a4 100644
--- a/tools/testing/radix-tree/Makefile
+++ b/tools/testing/radix-tree/Makefile
@@ -1,5 +1,5 @@
 
-CFLAGS += -I. -g -Wall -D_LGPL_SOURCE
+CFLAGS += -I. -g -O2 -Wall -D_LGPL_SOURCE
 LDFLAGS += -lpthread -lurcu
 TARGETS = main
 OFILES = main.o radix-tree.o linux.o test.o tag_check.o find_next_bit.o \
diff --git a/tools/testing/radix-tree/multiorder.c b/tools/testing/radix-tree/multiorder.c
index 39d9b9568fe2..05d7bc488971 100644
--- a/tools/testing/radix-tree/multiorder.c
+++ b/tools/testing/radix-tree/multiorder.c
@@ -124,6 +124,8 @@ static void multiorder_check(unsigned long index, int order)
         unsigned long i;
         unsigned long min = index & ~((1UL << order) - 1);
         unsigned long max = min + (1UL << order);
+        void **slot;
+        struct item *item2 = item_create(min);
         RADIX_TREE(tree, GFP_KERNEL);
 
         printf("Multiorder index %ld, order %d\n", index, order);
@@ -139,13 +141,19 @@ static void multiorder_check(unsigned long index, int order)
                 item_check_absent(&tree, i);
         for (i = max; i < 2*max; i++)
                 item_check_absent(&tree, i);
+        for (i = min; i < max; i++)
+                assert(radix_tree_insert(&tree, i, item2) == -EEXIST);
+
+        slot = radix_tree_lookup_slot(&tree, index);
+        free(*slot);
+        radix_tree_replace_slot(slot, item2);
         for (i = min; i < max; i++) {
-                static void *entry = (void *)
-                                        (0xA0 | RADIX_TREE_EXCEPTIONAL_ENTRY);
-                assert(radix_tree_insert(&tree, i, entry) == -EEXIST);
+                struct item *item = item_lookup(&tree, i);
+                assert(item != 0);
+                assert(item->index == min);
         }
 
-        assert(item_delete(&tree, index) != 0);
+        assert(item_delete(&tree, min) != 0);
 
         for (i = 0; i < 2*max; i++)
                 item_check_absent(&tree, i);
diff --git a/tools/testing/selftests/powerpc/Makefile b/tools/testing/selftests/powerpc/Makefile
index 3c40c9d0e6c7..1cc6d64c39b7 100644
--- a/tools/testing/selftests/powerpc/Makefile
+++ b/tools/testing/selftests/powerpc/Makefile
@@ -8,7 +8,7 @@ ifeq ($(ARCH),powerpc)
 
 GIT_VERSION = $(shell git describe --always --long --dirty || echo "unknown")
 
-CFLAGS := -Wall -O2 -Wall -Werror -DGIT_VERSION='"$(GIT_VERSION)"' -I$(CURDIR) $(CFLAGS)
+CFLAGS := -std=gnu99 -Wall -O2 -Wall -Werror -DGIT_VERSION='"$(GIT_VERSION)"' -I$(CURDIR) $(CFLAGS)
 
 export CFLAGS
 
diff --git a/tools/virtio/linux/dma-mapping.h b/tools/virtio/linux/dma-mapping.h
index 4f93af89ae16..18601f6689b9 100644
--- a/tools/virtio/linux/dma-mapping.h
+++ b/tools/virtio/linux/dma-mapping.h
@@ -14,4 +14,20 @@ enum dma_data_direction {
         DMA_NONE = 3,
 };
 
+#define dma_alloc_coherent(d, s, hp, f) ({ \
+        void *__dma_alloc_coherent_p = kmalloc((s), (f)); \
+        *(hp) = (unsigned long)__dma_alloc_coherent_p; \
+        __dma_alloc_coherent_p; \
+})
+
+#define dma_free_coherent(d, s, p, h) kfree(p)
+
+#define dma_map_page(d, p, o, s, dir) (page_to_phys(p) + (o))
+
+#define dma_map_single(d, p, s, dir) (virt_to_phys(p))
+#define dma_mapping_error(...) (0)
+
+#define dma_unmap_single(...) do { } while (0)
+#define dma_unmap_page(...) do { } while (0)
+
 #endif
diff --git a/tools/virtio/linux/kernel.h b/tools/virtio/linux/kernel.h
index 033849948215..d9554fc3f340 100644
--- a/tools/virtio/linux/kernel.h
+++ b/tools/virtio/linux/kernel.h
@@ -20,7 +20,9 @@
 
 #define PAGE_SIZE getpagesize()
 #define PAGE_MASK (~(PAGE_SIZE-1))
+#define PAGE_ALIGN(x) ((x + PAGE_SIZE - 1) & PAGE_MASK)
 
+typedef unsigned long long phys_addr_t;
 typedef unsigned long long dma_addr_t;
 typedef size_t __kernel_size_t;
 typedef unsigned int __wsum;
@@ -57,6 +59,11 @@ static inline void *kzalloc(size_t s, gfp_t gfp)
         return p;
 }
 
+static inline void *alloc_pages_exact(size_t s, gfp_t gfp)
+{
+        return kmalloc(s, gfp);
+}
+
 static inline void kfree(void *p)
 {
         if (p >= __kfree_ignore_start && p < __kfree_ignore_end)
@@ -64,6 +71,11 @@ static inline void kfree(void *p)
         free(p);
 }
 
+static inline void free_pages_exact(void *p, size_t s)
+{
+        kfree(p);
+}
+
 static inline void *krealloc(void *p, size_t s, gfp_t gfp)
 {
         return realloc(p, s);
@@ -105,6 +117,8 @@ static inline void free_page(unsigned long addr)
 #define dev_err(dev, format, ...) fprintf (stderr, format, ## __VA_ARGS__)
 #define dev_warn(dev, format, ...) fprintf (stderr, format, ## __VA_ARGS__)
 
+#define WARN_ON_ONCE(cond) ((cond) && fprintf (stderr, "WARNING\n"))
+
 #define min(x, y) ({                            \
         typeof(x) _min1 = (x);                  \
         typeof(y) _min2 = (y);                  \
diff --git a/tools/virtio/linux/slab.h b/tools/virtio/linux/slab.h
index 81baeac8ae40..7e1c1197d439 100644
--- a/tools/virtio/linux/slab.h
+++ b/tools/virtio/linux/slab.h
@@ -1,2 +1,6 @@
 #ifndef LINUX_SLAB_H
+#define GFP_KERNEL 0
+#define GFP_ATOMIC 0
+#define __GFP_NOWARN 0
+#define __GFP_ZERO 0
 #endif
diff --git a/tools/virtio/linux/virtio.h b/tools/virtio/linux/virtio.h
index ee125e714053..9377c8b4ac16 100644
--- a/tools/virtio/linux/virtio.h
+++ b/tools/virtio/linux/virtio.h
@@ -3,8 +3,12 @@
 #include <linux/scatterlist.h>
 #include <linux/kernel.h>
 
+struct device {
+        void *parent;
+};
+
 struct virtio_device {
-        void *dev;
+        struct device dev;
         u64 features;
 };
 
diff --git a/tools/virtio/linux/virtio_config.h b/tools/virtio/linux/virtio_config.h
index 57a6964a1e35..9ba11815e0a1 100644
--- a/tools/virtio/linux/virtio_config.h
+++ b/tools/virtio/linux/virtio_config.h
@@ -40,6 +40,19 @@ static inline void __virtio_clear_bit(struct virtio_device *vdev,
 #define virtio_has_feature(dev, feature) \
         (__virtio_test_bit((dev), feature))
 
+/**
+ * virtio_has_iommu_quirk - determine whether this device has the iommu quirk
+ * @vdev: the device
+ */
+static inline bool virtio_has_iommu_quirk(const struct virtio_device *vdev)
+{
+        /*
+         * Note the reverse polarity of the quirk feature (compared to most
+         * other features), this is for compatibility with legacy systems.
+         */
+        return !virtio_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM);
+}
+
 static inline bool virtio_is_little_endian(struct virtio_device *vdev)
 {
         return virtio_has_feature(vdev, VIRTIO_F_VERSION_1) ||
diff --git a/tools/virtio/ringtest/ptr_ring.c b/tools/virtio/ringtest/ptr_ring.c
index 68e4f9f0da3a..bd2ad1d3b7a9 100644
--- a/tools/virtio/ringtest/ptr_ring.c
+++ b/tools/virtio/ringtest/ptr_ring.c
@@ -13,6 +13,7 @@
 #define cache_line_size() SMP_CACHE_BYTES
 #define ____cacheline_aligned_in_smp __attribute__ ((aligned (SMP_CACHE_BYTES)))
 #define unlikely(x)    (__builtin_expect(!!(x), 0))
+#define likely(x)    (__builtin_expect(!!(x), 1))
 #define ALIGN(x, a) (((x) + (a) - 1) / (a) * (a))
 typedef pthread_spinlock_t  spinlock_t;
 
diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
index 4fde8c7dfcfe..77e6ccf14901 100644
--- a/virt/kvm/arm/arch_timer.c
+++ b/virt/kvm/arm/arch_timer.c
@@ -33,6 +33,7 @@
 static struct timecounter *timecounter;
 static struct workqueue_struct *wqueue;
 static unsigned int host_vtimer_irq;
+static u32 host_vtimer_irq_flags;
 
 void kvm_timer_vcpu_put(struct kvm_vcpu *vcpu)
 {
@@ -365,7 +366,7 @@ void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu)
 
 static void kvm_timer_init_interrupt(void *info)
 {
-        enable_percpu_irq(host_vtimer_irq, 0);
+        enable_percpu_irq(host_vtimer_irq, host_vtimer_irq_flags);
 }
 
 int kvm_arm_timer_set_reg(struct kvm_vcpu *vcpu, u64 regid, u64 value)
@@ -432,6 +433,14 @@ int kvm_timer_hyp_init(void)
         }
         host_vtimer_irq = info->virtual_irq;
 
+        host_vtimer_irq_flags = irq_get_trigger_type(host_vtimer_irq);
+        if (host_vtimer_irq_flags != IRQF_TRIGGER_HIGH &&
+            host_vtimer_irq_flags != IRQF_TRIGGER_LOW) {
+                kvm_err("Invalid trigger for IRQ%d, assuming level low\n",
+                        host_vtimer_irq);
+                host_vtimer_irq_flags = IRQF_TRIGGER_LOW;
+        }
+
         err = request_percpu_irq(host_vtimer_irq, kvm_arch_timer_handler,
                                  "kvm guest timer", kvm_get_running_vcpus());
         if (err) {
diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c
index fb4b0a79a950..83777c1cbae0 100644
--- a/virt/kvm/arm/vgic/vgic-init.c
+++ b/virt/kvm/arm/vgic/vgic-init.c
@@ -73,12 +73,8 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
         int i, vcpu_lock_idx = -1, ret;
         struct kvm_vcpu *vcpu;
 
-        mutex_lock(&kvm->lock);
-
-        if (irqchip_in_kernel(kvm)) {
-                ret = -EEXIST;
-                goto out;
-        }
+        if (irqchip_in_kernel(kvm))
+                return -EEXIST;
 
         /*
          * This function is also called by the KVM_CREATE_IRQCHIP handler,
@@ -87,10 +83,8 @@ int kvm_vgic_create(struct kvm *kvm, u32 type)
          * the proper checks already.
          */
         if (type == KVM_DEV_TYPE_ARM_VGIC_V2 &&
-                !kvm_vgic_global_state.can_emulate_gicv2) {
-                ret = -ENODEV;
-                goto out;
-        }
+                !kvm_vgic_global_state.can_emulate_gicv2)
+                return -ENODEV;
 
         /*
          * Any time a vcpu is run, vcpu_load is called which tries to grab the
@@ -138,9 +132,6 @@ out_unlock:
                 vcpu = kvm_get_vcpu(kvm, vcpu_lock_idx);
                 mutex_unlock(&vcpu->mutex);
         }
-
-out:
-        mutex_unlock(&kvm->lock);
         return ret;
 }
 
diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
index 07411cf967b9..4660a7d04eea 100644
--- a/virt/kvm/arm/vgic/vgic-its.c
+++ b/virt/kvm/arm/vgic/vgic-its.c
@@ -51,7 +51,7 @@ static struct vgic_irq *vgic_add_lpi(struct kvm *kvm, u32 intid)
 
         irq = kzalloc(sizeof(struct vgic_irq), GFP_KERNEL);
         if (!irq)
-                return NULL;
+                return ERR_PTR(-ENOMEM);
 
         INIT_LIST_HEAD(&irq->lpi_list);
         INIT_LIST_HEAD(&irq->ap_list);
@@ -441,39 +441,63 @@ static unsigned long vgic_mmio_read_its_idregs(struct kvm *kvm,
  * Find the target VCPU and the LPI number for a given devid/eventid pair
  * and make this IRQ pending, possibly injecting it.
  * Must be called with the its_lock mutex held.
+ * Returns 0 on success, a positive error value for any ITS mapping
+ * related errors and negative error values for generic errors.
  */
-static void vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its,
-                                 u32 devid, u32 eventid)
+static int vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its,
+                                u32 devid, u32 eventid)
 {
+        struct kvm_vcpu *vcpu;
         struct its_itte *itte;
 
         if (!its->enabled)
-                return;
+                return -EBUSY;
 
         itte = find_itte(its, devid, eventid);
-        /* Triggering an unmapped IRQ gets silently dropped. */
-        if (itte && its_is_collection_mapped(itte->collection)) {
-                struct kvm_vcpu *vcpu;
-
-                vcpu = kvm_get_vcpu(kvm, itte->collection->target_addr);
-                if (vcpu && vcpu->arch.vgic_cpu.lpis_enabled) {
-                        spin_lock(&itte->irq->irq_lock);
-                        itte->irq->pending = true;
-                        vgic_queue_irq_unlock(kvm, itte->irq);
-                }
-        }
+        if (!itte || !its_is_collection_mapped(itte->collection))
+                return E_ITS_INT_UNMAPPED_INTERRUPT;
+
+        vcpu = kvm_get_vcpu(kvm, itte->collection->target_addr);
+        if (!vcpu)
+                return E_ITS_INT_UNMAPPED_INTERRUPT;
+
+        if (!vcpu->arch.vgic_cpu.lpis_enabled)
+                return -EBUSY;
+
+        spin_lock(&itte->irq->irq_lock);
+        itte->irq->pending = true;
+        vgic_queue_irq_unlock(kvm, itte->irq);
+
+        return 0;
+}
+
+static struct vgic_io_device *vgic_get_its_iodev(struct kvm_io_device *dev)
+{
+        struct vgic_io_device *iodev;
+
+        if (dev->ops != &kvm_io_gic_ops)
+                return NULL;
+
+        iodev = container_of(dev, struct vgic_io_device, dev);
+
+        if (iodev->iodev_type != IODEV_ITS)
+                return NULL;
+
+        return iodev;
 }
 
 /*
  * Queries the KVM IO bus framework to get the ITS pointer from the given
  * doorbell address.
  * We then call vgic_its_trigger_msi() with the decoded data.
+ * According to the KVM_SIGNAL_MSI API description returns 1 on success.
  */
 int vgic_its_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 {
         u64 address;
         struct kvm_io_device *kvm_io_dev;
         struct vgic_io_device *iodev;
+        int ret;
 
         if (!vgic_has_its(kvm))
                 return -ENODEV;
@@ -485,15 +509,28 @@ int vgic_its_inject_msi(struct kvm *kvm, struct kvm_msi *msi)
 
         kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, address);
         if (!kvm_io_dev)
-                return -ENODEV;
+                return -EINVAL;
 
-        iodev = container_of(kvm_io_dev, struct vgic_io_device, dev);
+        iodev = vgic_get_its_iodev(kvm_io_dev);
+        if (!iodev)
+                return -EINVAL;
 
         mutex_lock(&iodev->its->its_lock);
-        vgic_its_trigger_msi(kvm, iodev->its, msi->devid, msi->data);
+        ret = vgic_its_trigger_msi(kvm, iodev->its, msi->devid, msi->data);
         mutex_unlock(&iodev->its->its_lock);
 
-        return 0;
+        if (ret < 0)
+                return ret;
+
+        /*
+         * KVM_SIGNAL_MSI demands a return value > 0 for success and 0
+         * if the guest has blocked the MSI. So we map any LPI mapping
+         * related error to that.
+         */
+        if (ret)
+                return 0;
+        else
+                return 1;
 }
 
 /* Requires the its_lock to be held. */
@@ -502,7 +539,8 @@ static void its_free_itte(struct kvm *kvm, struct its_itte *itte)
         list_del(&itte->itte_list);
 
         /* This put matches the get in vgic_add_lpi. */
-        vgic_put_irq(kvm, itte->irq);
+        if (itte->irq)
+                vgic_put_irq(kvm, itte->irq);
 
         kfree(itte);
 }
@@ -697,6 +735,7 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
         struct its_device *device;
         struct its_collection *collection, *new_coll = NULL;
         int lpi_nr;
+        struct vgic_irq *irq;
 
         device = find_its_device(its, device_id);
         if (!device)
@@ -710,6 +749,10 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
             lpi_nr >= max_lpis_propbaser(kvm->arch.vgic.propbaser))
                 return E_ITS_MAPTI_PHYSICALID_OOR;
 
+        /* If there is an existing mapping, behavior is UNPREDICTABLE. */
+        if (find_itte(its, device_id, event_id))
+                return 0;
+
         collection = find_collection(its, coll_id);
         if (!collection) {
                 int ret = vgic_its_alloc_collection(its, &collection, coll_id);
@@ -718,22 +761,28 @@ static int vgic_its_cmd_handle_mapi(struct kvm *kvm, struct vgic_its *its,
                 new_coll = collection;
         }
 
-        itte = find_itte(its, device_id, event_id);
+        itte = kzalloc(sizeof(struct its_itte), GFP_KERNEL);
         if (!itte) {
-                itte = kzalloc(sizeof(struct its_itte), GFP_KERNEL);
-                if (!itte) {
-                        if (new_coll)
-                                vgic_its_free_collection(its, coll_id);
-                        return -ENOMEM;
-                }
-
-                itte->event_id  = event_id;
-                list_add_tail(&itte->itte_list, &device->itt_head);
+                if (new_coll)
+                        vgic_its_free_collection(its, coll_id);
+                return -ENOMEM;
         }
 
+        itte->event_id  = event_id;
+        list_add_tail(&itte->itte_list, &device->itt_head);
+
         itte->collection = collection;
         itte->lpi = lpi_nr;
-        itte->irq = vgic_add_lpi(kvm, lpi_nr);
+
+        irq = vgic_add_lpi(kvm, lpi_nr);
+        if (IS_ERR(irq)) {
+                if (new_coll)
+                        vgic_its_free_collection(its, coll_id);
+                its_free_itte(kvm, itte);
+                return PTR_ERR(irq);
+        }
+        itte->irq = irq;
+
         update_affinity_itte(kvm, itte);
 
         /*
@@ -981,9 +1030,7 @@ static int vgic_its_cmd_handle_int(struct kvm *kvm, struct vgic_its *its,
         u32 msi_data = its_cmd_get_id(its_cmd);
         u64 msi_devid = its_cmd_get_deviceid(its_cmd);
 
-        vgic_its_trigger_msi(kvm, its, msi_devid, msi_data);
-
-        return 0;
+        return vgic_its_trigger_msi(kvm, its, msi_devid, msi_data);
 }
 
 /*
@@ -1288,13 +1335,13 @@ void vgic_enable_lpis(struct kvm_vcpu *vcpu)
                 its_sync_lpi_pending_table(vcpu);
 }
 
-static int vgic_its_init_its(struct kvm *kvm, struct vgic_its *its)
+static int vgic_register_its_iodev(struct kvm *kvm, struct vgic_its *its)
 {
         struct vgic_io_device *iodev = &its->iodev;
         int ret;
 
-        if (its->initialized)
-                return 0;
+        if (!its->initialized)
+                return -EBUSY;
 
         if (IS_VGIC_ADDR_UNDEF(its->vgic_its_base))
                 return -ENXIO;
@@ -1311,9 +1358,6 @@ static int vgic_its_init_its(struct kvm *kvm, struct vgic_its *its)
                                       KVM_VGIC_V3_ITS_SIZE, &iodev->dev);
         mutex_unlock(&kvm->slots_lock);
 
-        if (!ret)
-                its->initialized = true;
-
         return ret;
 }
 
@@ -1435,9 +1479,6 @@ static int vgic_its_set_attr(struct kvm_device *dev,
                 if (type != KVM_VGIC_ITS_ADDR_TYPE)
                         return -ENODEV;
 
-                if (its->initialized)
-                        return -EBUSY;
-
                 if (copy_from_user(&addr, uaddr, sizeof(addr)))
                         return -EFAULT;
 
@@ -1453,7 +1494,9 @@ static int vgic_its_set_attr(struct kvm_device *dev,
         case KVM_DEV_ARM_VGIC_GRP_CTRL:
                 switch (attr->attr) {
                 case KVM_DEV_ARM_VGIC_CTRL_INIT:
-                        return vgic_its_init_its(dev->kvm, its);
+                        its->initialized = true;
+
+                        return 0;
                 }
                 break;
         }
@@ -1498,3 +1541,30 @@ int kvm_vgic_register_its_device(void)
         return kvm_register_device_ops(&kvm_arm_vgic_its_ops,
                                        KVM_DEV_TYPE_ARM_VGIC_ITS);
 }
+
+/*
+ * Registers all ITSes with the kvm_io_bus framework.
+ * To follow the existing VGIC initialization sequence, this has to be
+ * done as late as possible, just before the first VCPU runs.
+ */
+int vgic_register_its_iodevs(struct kvm *kvm)
+{
+        struct kvm_device *dev;
+        int ret = 0;
+
+        list_for_each_entry(dev, &kvm->devices, vm_node) {
+                if (dev->ops != &kvm_arm_vgic_its_ops)
+                        continue;
+
+                ret = vgic_register_its_iodev(kvm, dev->private);
+                if (ret)
+                        return ret;
+                /*
+                 * We don't need to care about tearing down previously
+                 * registered ITSes, as the kvm_io_bus framework removes
+                 * them for us if the VM gets destroyed.
+                 */
+        }
+
+        return ret;
+}
diff --git a/virt/kvm/arm/vgic/vgic-mmio-v3.c b/virt/kvm/arm/vgic/vgic-mmio-v3.c
index ff668e0dd586..90d81811fdda 100644
--- a/virt/kvm/arm/vgic/vgic-mmio-v3.c
+++ b/virt/kvm/arm/vgic/vgic-mmio-v3.c
@@ -306,16 +306,19 @@ static void vgic_mmio_write_propbase(struct kvm_vcpu *vcpu,
 {
         struct vgic_dist *dist = &vcpu->kvm->arch.vgic;
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
-        u64 propbaser = dist->propbaser;
+        u64 old_propbaser, propbaser;
 
         /* Storing a value with LPIs already enabled is undefined */
         if (vgic_cpu->lpis_enabled)
                 return;
 
-        propbaser = update_64bit_reg(propbaser, addr & 4, len, val);
-        propbaser = vgic_sanitise_propbaser(propbaser);
-
-        dist->propbaser = propbaser;
+        do {
+                old_propbaser = dist->propbaser;
+                propbaser = old_propbaser;
+                propbaser = update_64bit_reg(propbaser, addr & 4, len, val);
+                propbaser = vgic_sanitise_propbaser(propbaser);
+        } while (cmpxchg64(&dist->propbaser, old_propbaser,
+                           propbaser) != old_propbaser);
 }
 
 static unsigned long vgic_mmio_read_pendbase(struct kvm_vcpu *vcpu,
@@ -331,16 +334,19 @@ static void vgic_mmio_write_pendbase(struct kvm_vcpu *vcpu,
                                      unsigned long val)
 {
         struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
-        u64 pendbaser = vgic_cpu->pendbaser;
+        u64 old_pendbaser, pendbaser;
 
         /* Storing a value with LPIs already enabled is undefined */
         if (vgic_cpu->lpis_enabled)
                 return;
 
-        pendbaser = update_64bit_reg(pendbaser, addr & 4, len, val);
-        pendbaser = vgic_sanitise_pendbaser(pendbaser);
-
-        vgic_cpu->pendbaser = pendbaser;
+        do {
+                old_pendbaser = vgic_cpu->pendbaser;
+                pendbaser = old_pendbaser;
+                pendbaser = update_64bit_reg(pendbaser, addr & 4, len, val);
+                pendbaser = vgic_sanitise_pendbaser(pendbaser);
+        } while (cmpxchg64(&vgic_cpu->pendbaser, old_pendbaser,
+                           pendbaser) != old_pendbaser);
 }
 
 /*
diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c
index 0506543df38a..9f0dae397d9c 100644
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -289,6 +289,14 @@ int vgic_v3_map_resources(struct kvm *kvm)
                 goto out;
         }
 
+        if (vgic_has_its(kvm)) {
+                ret = vgic_register_its_iodevs(kvm);
+                if (ret) {
+                        kvm_err("Unable to register VGIC ITS MMIO regions\n");
+                        goto out;
+                }
+        }
+
         dist->ready = true;
 
 out:
diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
index e7aeac719e09..e83b7fe4baae 100644
--- a/virt/kvm/arm/vgic/vgic.c
+++ b/virt/kvm/arm/vgic/vgic.c
@@ -117,17 +117,17 @@ static void vgic_irq_release(struct kref *ref)
 
 void vgic_put_irq(struct kvm *kvm, struct vgic_irq *irq)
 {
-        struct vgic_dist *dist;
+        struct vgic_dist *dist = &kvm->arch.vgic;
 
         if (irq->intid < VGIC_MIN_LPI)
                 return;
 
-        if (!kref_put(&irq->refcount, vgic_irq_release))
+        spin_lock(&dist->lpi_list_lock);
+        if (!kref_put(&irq->refcount, vgic_irq_release)) {
+                spin_unlock(&dist->lpi_list_lock);
                 return;
+        };
 
-        dist = &kvm->arch.vgic;
-
-        spin_lock(&dist->lpi_list_lock);
         list_del(&irq->lpi_list);
         dist->lpi_list_count--;
         spin_unlock(&dist->lpi_list_lock);
diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h
index 1d8e21d5c13f..6c4625c46368 100644
--- a/virt/kvm/arm/vgic/vgic.h
+++ b/virt/kvm/arm/vgic/vgic.h
@@ -84,6 +84,7 @@ void vgic_v3_enable(struct kvm_vcpu *vcpu);
 int vgic_v3_probe(const struct gic_kvm_info *info);
 int vgic_v3_map_resources(struct kvm *kvm);
 int vgic_register_redist_iodevs(struct kvm *kvm, gpa_t dist_base_address);
+int vgic_register_its_iodevs(struct kvm *kvm);
 bool vgic_has_its(struct kvm *kvm);
 int kvm_vgic_register_its_device(void);
 void vgic_enable_lpis(struct kvm_vcpu *vcpu);
@@ -140,6 +141,11 @@ static inline int vgic_register_redist_iodevs(struct kvm *kvm,
         return -ENODEV;
 }
 
+static inline int vgic_register_its_iodevs(struct kvm *kvm)
+{
+        return -ENODEV;
+}
+
 static inline bool vgic_has_its(struct kvm *kvm)
 {
         return false;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index cc081ccfcaa3..195078225aa5 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -696,6 +696,11 @@ static void kvm_destroy_devices(struct kvm *kvm)
 {
         struct kvm_device *dev, *tmp;
 
+        /*
+         * We do not need to take the kvm->lock here, because nobody else
+         * has a reference to the struct kvm at this point and therefore
+         * cannot access the devices list anyhow.
+         */
         list_for_each_entry_safe(dev, tmp, &kvm->devices, vm_node) {
                 list_del(&dev->vm_node);
                 dev->ops->destroy(dev);
@@ -2832,19 +2837,28 @@ static int kvm_ioctl_create_device(struct kvm *kvm,
         dev->ops = ops;
         dev->kvm = kvm;
 
+        mutex_lock(&kvm->lock);
         ret = ops->create(dev, cd->type);
         if (ret < 0) {
+                mutex_unlock(&kvm->lock);
                 kfree(dev);
                 return ret;
         }
+        list_add(&dev->vm_node, &kvm->devices);
+        mutex_unlock(&kvm->lock);
+
+        if (ops->init)
+                ops->init(dev);
 
         ret = anon_inode_getfd(ops->name, &kvm_device_fops, dev, O_RDWR | O_CLOEXEC);
         if (ret < 0) {
                 ops->destroy(dev);
+                mutex_lock(&kvm->lock);
+                list_del(&dev->vm_node);
+                mutex_unlock(&kvm->lock);
                 return ret;
         }
 
-        list_add(&dev->vm_node, &kvm->devices);
         kvm_get_kvm(kvm);
         cd->fd = ret;
         return 0;